{
    "1678673": [
        {
            "ioc_value": "cirrus.cloudv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 12:37:53",
            "last_seen_utc": "2025-12-14 12:39:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678672": [
        {
            "ioc_value": "6ifg.mistybyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 12:27:37",
            "last_seen_utc": "2025-12-14 12:34:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678671": [
        {
            "ioc_value": "whx.mistybyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 12:17:18",
            "last_seen_utc": "2025-12-14 12:19:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678670": [
        {
            "ioc_value": "tq.mistybyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 12:07:32",
            "last_seen_utc": "2025-12-14 12:09:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678666": [
        {
            "ioc_value": "ekmeowprogram.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-14 12:01:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251214-ns8gpaxpdt",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678665": [
        {
            "ioc_value": "app.castlerocks.za.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-14 12:01:06",
            "last_seen_utc": "2025-12-14 12:01:07",
            "confidence_level": 100,
            "reference": "https://tria.ge/251214-h48nyaslfj",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678659": [
        {
            "ioc_value": "n7xbtfikx.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-14 12:00:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251214-jdjskaslfq",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678658": [
        {
            "ioc_value": "ellu2222-37691.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-14 12:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251214-la1m1sfw6c",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678657": [
        {
            "ioc_value": "S2eeka-62143.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-14 12:00:22",
            "last_seen_utc": "2025-12-14 12:00:24",
            "confidence_level": 100,
            "reference": "https://tria.ge/251214-n1qlvaxqav",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678656": [
        {
            "ioc_value": "rock.mistybyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 11:58:14",
            "last_seen_utc": "2025-12-14 12:04:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678652": [
        {
            "ioc_value": "jq.darkbreeze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 11:47:24",
            "last_seen_utc": "2025-12-14 11:48:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678613": [
        {
            "ioc_value": "castlerocks.za.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-14 11:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.capesandbox.com/analysis/44589/",
            "tags": "AsyncRAT,botnet,c2,Dcrat",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1678651": [
        {
            "ioc_value": "byte.darkbreeze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 11:35:00",
            "last_seen_utc": "2025-12-14 11:42:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678650": [
        {
            "ioc_value": "hog.darkbreeze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 11:26:46",
            "last_seen_utc": "2025-12-14 11:28:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678649": [
        {
            "ioc_value": "4n.darkbreeze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 11:17:02",
            "last_seen_utc": "2025-12-14 11:18:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678642": [
        {
            "ioc_value": "crest.rockstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 11:00:37",
            "last_seen_utc": "2025-12-14 11:02:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678640": [
        {
            "ioc_value": "mist.rockstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 10:57:24",
            "last_seen_utc": "2025-12-14 10:58:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678639": [
        {
            "ioc_value": "5wnc.rockstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 10:47:39",
            "last_seen_utc": "2025-12-14 10:52:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678638": [
        {
            "ioc_value": "delta.rockstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 10:37:23",
            "last_seen_utc": "2025-12-14 10:38:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678637": [
        {
            "ioc_value": "ab.clearl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 10:27:03",
            "last_seen_utc": "2025-12-14 10:32:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678636": [
        {
            "ioc_value": "nexus.clearl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 10:17:10",
            "last_seen_utc": "2025-12-14 10:23:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678635": [
        {
            "ioc_value": "wt.clearl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 10:05:05",
            "last_seen_utc": "2025-12-14 10:10:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678634": [
        {
            "ioc_value": "lj.clearl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 09:57:52",
            "last_seen_utc": "2025-12-14 09:58:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678633": [
        {
            "ioc_value": "po1y8.windst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 09:47:30",
            "last_seen_utc": "2025-12-14 09:48:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678632": [
        {
            "ioc_value": "hfe.windst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 09:37:44",
            "last_seen_utc": "2025-12-14 09:44:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678631": [
        {
            "ioc_value": "556.windst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 09:28:27",
            "last_seen_utc": "2025-12-14 09:30:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678630": [
        {
            "ioc_value": "gc31.windst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 09:17:38",
            "last_seen_utc": "2025-12-14 09:25:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678629": [
        {
            "ioc_value": "field.wild5ky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 09:09:18",
            "last_seen_utc": "2025-12-14 09:10:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678628": [
        {
            "ioc_value": "13rv.wild5ky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 08:57:03",
            "last_seen_utc": "2025-12-14 09:07:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678627": [
        {
            "ioc_value": "63oi.wild5ky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 08:47:09",
            "last_seen_utc": "2025-12-14 08:49:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678625": [
        {
            "ioc_value": "q5.wild5ky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 08:37:56",
            "last_seen_utc": "2025-12-14 08:43:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678624": [
        {
            "ioc_value": "ember.bluef1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 08:28:04",
            "last_seen_utc": "2025-12-14 08:29:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678623": [
        {
            "ioc_value": "trace.bluef1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 08:18:01",
            "last_seen_utc": "2025-12-14 08:19:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678622": [
        {
            "ioc_value": "clear.bluef1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 08:07:29",
            "last_seen_utc": "2025-12-14 08:09:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678614": [
        {
            "ioc_value": "beta.bluef1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 07:57:43",
            "last_seen_utc": "2025-12-14 07:59:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678612": [
        {
            "ioc_value": "mcx.deepcl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 07:47:26",
            "last_seen_utc": "2025-12-14 07:49:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678611": [
        {
            "ioc_value": "w2li.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-14 07:46:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1678600": [
        {
            "ioc_value": "wqu5.deepcl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 07:37:09",
            "last_seen_utc": "2025-12-14 07:38:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678599": [
        {
            "ioc_value": "wind.deepcl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 07:27:23",
            "last_seen_utc": "2025-12-14 07:33:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678598": [
        {
            "ioc_value": "5nr.deepcl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 07:18:55",
            "last_seen_utc": "2025-12-14 07:19:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1678597": [
        {
            "ioc_value": "myrepis.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-14 07:16:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/80809b3c28022cad38c37667c082ed755561f7d5bfd5cf6415cb6bf0211a2e2a/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1678593": [
        {
            "ioc_value": "yminsgdb.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-12-14 07:07:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/00949bc1410a9bd508bfb5fa6723e64292a79557531745247bc9c72359a7d1c1/",
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1678592": [
        {
            "ioc_value": "9q.raincr5st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 07:06:44",
            "last_seen_utc": "2025-12-14 07:10:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678590": [
        {
            "ioc_value": "clothcrib.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-14 07:03:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1678591": [
        {
            "ioc_value": "ricestar.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-14 07:03:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1678588": [
        {
            "ioc_value": "relays.buziopoasbubu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-14 07:01:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/8f19d0c3444439ed0550153d6c8943ca343154706e473cd7f3458f7f82880c7d/",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1678589": [
        {
            "ioc_value": "app.buziopoasbubu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-14 07:01:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/8f19d0c3444439ed0550153d6c8943ca343154706e473cd7f3458f7f82880c7d/",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1678586": [
        {
            "ioc_value": "romeroaktorpalimpsest.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-14 06:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e2754bc0876932908aaeecb3479ee8e8d42a298268e32fc096310c520b0c02ac/",
            "tags": "ClickFix,DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1678585": [
        {
            "ioc_value": "wave.raincr5st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 06:57:54",
            "last_seen_utc": "2025-12-14 07:00:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678584": [
        {
            "ioc_value": "mizh.raincr5st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 06:47:40",
            "last_seen_utc": "2025-12-14 06:48:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678582": [
        {
            "ioc_value": "qtf.raincr5st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 06:37:20",
            "last_seen_utc": "2025-12-14 06:38:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678581": [
        {
            "ioc_value": "wkt.softmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 06:27:31",
            "last_seen_utc": "2025-12-14 06:33:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678580": [
        {
            "ioc_value": "y4uhk.softmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 06:17:16",
            "last_seen_utc": "2025-12-14 06:19:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678578": [
        {
            "ioc_value": "soft.softmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 06:08:00",
            "last_seen_utc": "2025-12-14 06:09:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678577": [
        {
            "ioc_value": "hellober-62592.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-14 06:02:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251214-becfwacm6t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678575": [
        {
            "ioc_value": "4tqikdkjp.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-14 06:00:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251214-anerxscj3w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678574": [
        {
            "ioc_value": "84u.softmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 05:57:13",
            "last_seen_utc": "2025-12-14 05:58:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678573": [
        {
            "ioc_value": "repositorylinux.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-14 05:48:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1678572": [
        {
            "ioc_value": "cloud.stormf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 05:47:56",
            "last_seen_utc": "2025-12-14 05:54:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678571": [
        {
            "ioc_value": "mint.stormf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 05:37:05",
            "last_seen_utc": "2025-12-14 05:39:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678535": [
        {
            "ioc_value": "tvlounge.aw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-14 05:26:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://analytics.dugganusa.com",
            "tags": null,
            "anonymous": "0",
            "reporter": "duggusa"
        }
    ],
    "1678536": [
        {
            "ioc_value": "associacaodejudosi.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-14 05:26:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://analytics.dugganusa.com",
            "tags": null,
            "anonymous": "0",
            "reporter": "duggusa"
        }
    ],
    "1678537": [
        {
            "ioc_value": "asos1.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-14 05:26:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://analytics.dugganusa.com",
            "tags": null,
            "anonymous": "0",
            "reporter": "duggusa"
        }
    ],
    "1678542": [
        {
            "ioc_value": "microsoft.shopmzx.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-14 05:26:07",
            "last_seen_utc": "2025-12-14 06:01:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e36f23a8fa59e0d256c28bb433e5e357fe43b5eb14651bc983ef9c043ed25cc2/",
            "tags": "botnet,c2,DcRAT",
            "anonymous": "1",
            "reporter": "Aumeg"
        }
    ],
    "1678543": [
        {
            "ioc_value": "verify.shopmzx.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-14 05:26:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e36f23a8fa59e0d256c28bb433e5e357fe43b5eb14651bc983ef9c043ed25cc2/",
            "tags": "botnet,c2,DcRAT",
            "anonymous": "1",
            "reporter": "Aumeg"
        }
    ],
    "1678570": [
        {
            "ioc_value": "storm.stormf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 05:22:41",
            "last_seen_utc": "2025-12-14 05:28:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678569": [
        {
            "ioc_value": "ch.stormf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 05:17:23",
            "last_seen_utc": "2025-12-14 05:19:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678567": [
        {
            "ioc_value": "mix.kettle-wisp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 05:07:39",
            "last_seen_utc": "2025-12-14 05:14:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678564": [
        {
            "ioc_value": "fizz.kettle-wisp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 04:58:23",
            "last_seen_utc": "2025-12-14 05:04:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678563": [
        {
            "ioc_value": "odd.kettle-wisp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 04:47:03",
            "last_seen_utc": "2025-12-14 04:47:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678562": [
        {
            "ioc_value": "cask.kettle-wisp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 04:32:08",
            "last_seen_utc": "2025-12-14 04:34:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678561": [
        {
            "ioc_value": "ejt0w.kettlewisp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 04:27:59",
            "last_seen_utc": "2025-12-14 04:29:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678560": [
        {
            "ioc_value": "89pdo.kettlewisp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 04:13:08",
            "last_seen_utc": "2025-12-14 04:13:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678559": [
        {
            "ioc_value": "r2k.kettlewisp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 04:07:51",
            "last_seen_utc": "2025-12-14 04:10:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678549": [
        {
            "ioc_value": "beta.kettlewisp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 03:57:25",
            "last_seen_utc": "2025-12-14 03:59:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678548": [
        {
            "ioc_value": "ajpl.ripple-cask.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 03:46:41",
            "last_seen_utc": "2025-12-14 03:48:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678547": [
        {
            "ioc_value": "glitch.ripple-cask.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 03:37:25",
            "last_seen_utc": "2025-12-14 03:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678546": [
        {
            "ioc_value": "75z.ripple-cask.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 03:27:02",
            "last_seen_utc": "2025-12-14 03:28:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678545": [
        {
            "ioc_value": "d6gu.ripple-cask.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 03:17:19",
            "last_seen_utc": "2025-12-14 03:18:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678544": [
        {
            "ioc_value": "orbit.v0lticrum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 03:07:00",
            "last_seen_utc": "2025-12-14 03:13:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678541": [
        {
            "ioc_value": "vjsjr.v0lticrum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 02:58:11",
            "last_seen_utc": "2025-12-14 03:00:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678540": [
        {
            "ioc_value": "v7rg.v0lticrum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 02:46:48",
            "last_seen_utc": "2025-12-14 02:48:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678539": [
        {
            "ioc_value": "nova.v0lticrum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 02:37:31",
            "last_seen_utc": "2025-12-14 02:40:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678538": [
        {
            "ioc_value": "h4o.snare-plum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 02:27:43",
            "last_seen_utc": "2025-12-14 02:29:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678534": [
        {
            "ioc_value": "qfbmr.snare-plum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 02:17:29",
            "last_seen_utc": "2025-12-14 02:22:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678531": [
        {
            "ioc_value": "paper.snare-plum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 02:07:09",
            "last_seen_utc": "2025-12-14 02:08:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678530": [
        {
            "ioc_value": "trace.snare-plum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 01:55:17",
            "last_seen_utc": "2025-12-14 02:00:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678529": [
        {
            "ioc_value": "fax.gl1tchloam.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 01:48:04",
            "last_seen_utc": "2025-12-14 01:48:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678528": [
        {
            "ioc_value": "sp5.gl1tchloam.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 01:37:23",
            "last_seen_utc": "2025-12-14 01:38:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678527": [
        {
            "ioc_value": "xc2i.gl1tchloam.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 01:27:58",
            "last_seen_utc": "2025-12-14 01:28:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678526": [
        {
            "ioc_value": "pkxq.gl1tchloam.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 01:17:01",
            "last_seen_utc": "2025-12-14 01:23:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678525": [
        {
            "ioc_value": "rfz.snareplum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 01:07:49",
            "last_seen_utc": "2025-12-14 01:09:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678524": [
        {
            "ioc_value": "hth.snareplum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 00:57:27",
            "last_seen_utc": "2025-12-14 00:59:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678523": [
        {
            "ioc_value": "patch.snareplum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 00:47:37",
            "last_seen_utc": "2025-12-14 00:50:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678522": [
        {
            "ioc_value": "vx7.snareplum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 00:37:25",
            "last_seen_utc": "2025-12-14 00:38:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678521": [
        {
            "ioc_value": "bmz0.ripplecask.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 00:27:02",
            "last_seen_utc": "2025-12-14 00:32:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678520": [
        {
            "ioc_value": "omega.ripplecask.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 00:14:08",
            "last_seen_utc": "2025-12-14 00:16:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678519": [
        {
            "ioc_value": "crum.ripplecask.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-14 00:06:58",
            "last_seen_utc": "2025-12-14 00:09:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678512": [
        {
            "ioc_value": "ripple.ripplecask.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 23:57:09",
            "last_seen_utc": "2025-12-13 23:59:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678511": [
        {
            "ioc_value": "33zy.quenchorbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 23:47:49",
            "last_seen_utc": "2025-12-13 23:50:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678510": [
        {
            "ioc_value": "jd.quenchorbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 23:37:32",
            "last_seen_utc": "2025-12-13 23:41:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678509": [
        {
            "ioc_value": "knurl.quenchorbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 23:27:42",
            "last_seen_utc": "2025-12-13 23:33:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678508": [
        {
            "ioc_value": "gamma.quenchorbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 23:17:23",
            "last_seen_utc": "2025-12-13 23:19:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678507": [
        {
            "ioc_value": "3mu0h.paper-knurl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 23:07:06",
            "last_seen_utc": "2025-12-13 23:10:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678468": [
        {
            "ioc_value": "94u4p.paper-knurl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 22:58:18",
            "last_seen_utc": "2025-12-13 22:59:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678467": [
        {
            "ioc_value": "pixel.paper-knurl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 22:43:58",
            "last_seen_utc": "2025-12-13 22:51:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678466": [
        {
            "ioc_value": "shift.paper-knurl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 22:39:45",
            "last_seen_utc": "2025-12-13 22:42:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678465": [
        {
            "ioc_value": "tkn.zigm0scope.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 22:37:09",
            "last_seen_utc": "2025-12-13 22:37:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678464": [
        {
            "ioc_value": "tureq.zigm0scope.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 22:27:49",
            "last_seen_utc": "2025-12-13 22:33:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678463": [
        {
            "ioc_value": "2df.zigm0scope.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 22:11:29",
            "last_seen_utc": "2025-12-13 22:14:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678462": [
        {
            "ioc_value": "le2.zigm0scope.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 22:07:48",
            "last_seen_utc": "2025-12-13 22:09:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678461": [
        {
            "ioc_value": "zig.quench-orbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 21:57:29",
            "last_seen_utc": "2025-12-13 21:59:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678460": [
        {
            "ioc_value": "h7rl1.quench-orbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 21:41:01",
            "last_seen_utc": "2025-12-13 21:42:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678459": [
        {
            "ioc_value": "alpha.quench-orbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 21:37:22",
            "last_seen_utc": "2025-12-13 21:38:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678458": [
        {
            "ioc_value": "delta.quench-orbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 21:28:05",
            "last_seen_utc": "2025-12-13 21:30:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678457": [
        {
            "ioc_value": "volt.m1xthatch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 21:18:23",
            "last_seen_utc": "2025-12-13 21:20:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678456": [
        {
            "ioc_value": "5br.m1xthatch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 21:07:57",
            "last_seen_utc": "2025-12-13 21:10:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678453": [
        {
            "ioc_value": "kettle.m1xthatch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 20:57:44",
            "last_seen_utc": "2025-12-13 20:58:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678452": [
        {
            "ioc_value": "thatch.m1xthatch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 20:47:50",
            "last_seen_utc": "2025-12-13 20:49:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678451": [
        {
            "ioc_value": "psmds.br1stlefax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 20:37:34",
            "last_seen_utc": "2025-12-13 20:44:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678450": [
        {
            "ioc_value": "ped.br1stlefax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 20:27:20",
            "last_seen_utc": "2025-12-13 20:29:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678449": [
        {
            "ioc_value": "plum.br1stlefax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 20:18:36",
            "last_seen_utc": "2025-12-13 20:20:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678448": [
        {
            "ioc_value": "spark.br1stlefax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 20:07:17",
            "last_seen_utc": "2025-12-13 20:09:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678434": [
        {
            "ioc_value": "github.u9myanmar.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-13 20:03:29",
            "last_seen_utc": "2025-12-13 23:01:48",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/170.168.89.225+github.u9myanmar.store",
            "tags": "AS-GLOBALTELEHOST,AS63023,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678430": [
        {
            "ioc_value": "credcoopbeneficios.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-13 20:02:44",
            "last_seen_utc": "2025-12-13 23:01:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.208.159.162+credcoopbeneficios.shop",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678238": [
        {
            "ioc_value": "warp.paperknurl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 19:57:51",
            "last_seen_utc": "2025-12-13 20:00:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678237": [
        {
            "ioc_value": "wisp.paperknurl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 19:48:11",
            "last_seen_utc": "2025-12-13 19:49:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678236": [
        {
            "ioc_value": "4zx.paperknurl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 19:32:51",
            "last_seen_utc": "2025-12-13 19:36:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678235": [
        {
            "ioc_value": "6rr5.paperknurl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 19:25:42",
            "last_seen_utc": "2025-12-13 19:32:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678234": [
        {
            "ioc_value": "silk.ciears0ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 19:13:53",
            "last_seen_utc": "2025-12-13 19:16:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678233": [
        {
            "ioc_value": "hush2.ciears0ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 19:07:42",
            "last_seen_utc": "2025-12-13 19:08:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678232": [
        {
            "ioc_value": "plush.ciears0ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 18:57:21",
            "last_seen_utc": "2025-12-13 19:04:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678230": [
        {
            "ioc_value": "satin.ciears0ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 18:48:29",
            "last_seen_utc": "2025-12-13 18:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678197": [
        {
            "ioc_value": "haze.hiiistorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 18:37:16",
            "last_seen_utc": "2025-12-13 18:39:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678196": [
        {
            "ioc_value": "squall2.hiiistorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 18:26:57",
            "last_seen_utc": "2025-12-13 18:28:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678195": [
        {
            "ioc_value": "thunder.hiiistorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 18:18:09",
            "last_seen_utc": "2025-12-13 18:20:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678194": [
        {
            "ioc_value": "surge.hiiistorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 18:01:40",
            "last_seen_utc": "2025-12-13 18:08:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678184": [
        {
            "ioc_value": "nightmare6732-46415.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-13 18:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251213-qlcgsafz8d",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1678183": [
        {
            "ioc_value": "glare3.m1stycl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 17:58:00",
            "last_seen_utc": "2025-12-13 17:59:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678182": [
        {
            "ioc_value": "zenith.m1stycl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 17:45:27",
            "last_seen_utc": "2025-12-13 17:47:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678179": [
        {
            "ioc_value": "azur.m1stycl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 17:37:29",
            "last_seen_utc": "2025-12-13 17:38:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678178": [
        {
            "ioc_value": "wisp5.m1stycl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 17:27:53",
            "last_seen_utc": "2025-12-13 17:32:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678177": [
        {
            "ioc_value": "mist.m1stycl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 17:17:17",
            "last_seen_utc": "2025-12-13 17:19:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678176": [
        {
            "ioc_value": "rime.fr0stgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 17:07:03",
            "last_seen_utc": "2025-12-13 17:07:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678175": [
        {
            "ioc_value": "hoar2.fr0stgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 16:58:13",
            "last_seen_utc": "2025-12-13 17:04:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678174": [
        {
            "ioc_value": "firn.fr0stgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 16:42:41",
            "last_seen_utc": "2025-12-13 16:44:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678173": [
        {
            "ioc_value": "basin2.rockfieid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 16:38:03",
            "last_seen_utc": "2025-12-13 16:40:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678147": [
        {
            "ioc_value": "quarry.rockfieid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 16:26:53",
            "last_seen_utc": "2025-12-13 16:28:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678146": [
        {
            "ioc_value": "ledge.rockfieid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 16:14:23",
            "last_seen_utc": "2025-12-13 16:20:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678145": [
        {
            "ioc_value": "delta.deepbreeze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 16:07:36",
            "last_seen_utc": "2025-12-13 16:09:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678136": [
        {
            "ioc_value": "fjord1.deepbreeze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 15:57:17",
            "last_seen_utc": "2025-12-13 16:03:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678135": [
        {
            "ioc_value": "zephyr.deepbreeze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 15:47:01",
            "last_seen_utc": "2025-12-13 15:47:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1678134": [
        {
            "ioc_value": "grove.deepbreeze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 15:38:13",
            "last_seen_utc": "2025-12-13 15:38:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677838": [
        {
            "ioc_value": "noct.n1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 15:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677837": [
        {
            "ioc_value": "swell4.n1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 15:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677836": [
        {
            "ioc_value": "crest.n1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 15:07:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677834": [
        {
            "ioc_value": "nimbus3.stormpixei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 14:59:34",
            "last_seen_utc": "2025-12-13 15:00:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677833": [
        {
            "ioc_value": "aurora.stormpixei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 14:51:50",
            "last_seen_utc": "2025-12-13 14:53:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677832": [
        {
            "ioc_value": "drift2.stormpixei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 14:48:10",
            "last_seen_utc": "2025-12-13 14:49:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677831": [
        {
            "ioc_value": "glint.stormpixei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 14:36:18",
            "last_seen_utc": "2025-12-13 14:37:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677829": [
        {
            "ioc_value": "squall.stormpixei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 14:27:31",
            "last_seen_utc": "2025-12-13 14:33:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677828": [
        {
            "ioc_value": "weft.tangleflux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 14:18:41",
            "last_seen_utc": "2025-12-13 14:20:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1677827": [
        {
            "ioc_value": "snarl.tangleflux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 14:07:53",
            "last_seen_utc": "2025-12-13 14:08:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677826": [
        {
            "ioc_value": "eddy.tangleflux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 13:57:06",
            "last_seen_utc": "2025-12-13 13:58:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677825": [
        {
            "ioc_value": "whip.tangleflux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 13:47:49",
            "last_seen_utc": "2025-12-13 13:49:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677823": [
        {
            "ioc_value": "braid.tangleflux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 13:33:57",
            "last_seen_utc": "2025-12-13 13:37:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677822": [
        {
            "ioc_value": "spar.plume-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 13:23:41",
            "last_seen_utc": "2025-12-13 13:26:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677820": [
        {
            "ioc_value": "boom.plume-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 13:17:28",
            "last_seen_utc": "2025-12-13 13:22:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677819": [
        {
            "ioc_value": "rope.plume-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 13:07:34",
            "last_seen_utc": "2025-12-13 13:08:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677818": [
        {
            "ioc_value": "dock.plume-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 12:58:19",
            "last_seen_utc": "2025-12-13 12:59:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677816": [
        {
            "ioc_value": "maw.c1rclefang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 12:46:59",
            "last_seen_utc": "2025-12-13 12:53:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677815": [
        {
            "ioc_value": "prong.c1rclefang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 12:37:12",
            "last_seen_utc": "2025-12-13 12:39:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677814": [
        {
            "ioc_value": "gnash.c1rclefang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 12:27:54",
            "last_seen_utc": "2025-12-13 12:34:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677813": [
        {
            "ioc_value": "orbit.c1rclefang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 12:17:34",
            "last_seen_utc": "2025-12-13 12:20:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677812": [
        {
            "ioc_value": "seal.hollow-zip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 12:07:51",
            "last_seen_utc": "2025-12-13 12:13:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677807": [
        {
            "ioc_value": "minedonate10.waizerfly.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-13 12:01:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251213-ldpd6adz6h",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677806": [
        {
            "ioc_value": "login.10x.co.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-13 12:01:15",
            "last_seen_utc": "2025-12-13 12:01:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/251213-g5mbnads2a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677805": [
        {
            "ioc_value": "version3.spc.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-13 12:01:13",
            "last_seen_utc": "2025-12-13 12:01:14",
            "confidence_level": 100,
            "reference": "https://tria.ge/251213-dj7hxsck5w",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677801": [
        {
            "ioc_value": "atthewr.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-13 12:00:47",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677802": [
        {
            "ioc_value": "injecto.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-13 12:00:47",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677803": [
        {
            "ioc_value": "phytonr.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-13 12:00:47",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677804": [
        {
            "ioc_value": "proselw.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-13 12:00:47",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677800": [
        {
            "ioc_value": "peshmef.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-13 12:00:46",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677799": [
        {
            "ioc_value": "dedefoenumnigga-44957.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-13 12:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251213-h2f6xa1nbp",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677798": [
        {
            "ioc_value": "twine.hollow-zip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 11:58:33",
            "last_seen_utc": "2025-12-13 11:59:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677797": [
        {
            "ioc_value": "vault.hollow-zip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 11:47:14",
            "last_seen_utc": "2025-12-13 11:53:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677796": [
        {
            "ioc_value": "thrust.r0bintorque.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 11:37:26",
            "last_seen_utc": "2025-12-13 11:39:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677795": [
        {
            "ioc_value": "shear.r0bintorque.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 11:27:11",
            "last_seen_utc": "2025-12-13 11:28:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677794": [
        {
            "ioc_value": "axle.r0bintorque.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 11:18:23",
            "last_seen_utc": "2025-12-13 11:20:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677793": [
        {
            "ioc_value": "bind.hollowzip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 11:08:04",
            "last_seen_utc": "2025-12-13 11:09:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677765": [
        {
            "ioc_value": "pouch.hollowzip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 10:57:44",
            "last_seen_utc": "2025-12-13 11:04:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677764": [
        {
            "ioc_value": "wrap.hollowzip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 10:43:48",
            "last_seen_utc": "2025-12-13 10:46:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677763": [
        {
            "ioc_value": "crypt.hollowzip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 10:37:33",
            "last_seen_utc": "2025-12-13 10:43:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677762": [
        {
            "ioc_value": "chain.plumeanchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 10:28:19",
            "last_seen_utc": "2025-12-13 10:29:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1677761": [
        {
            "ioc_value": "reef.plumeanchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 10:11:22",
            "last_seen_utc": "2025-12-13 10:12:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677760": [
        {
            "ioc_value": "moor.plumeanchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 10:06:12",
            "last_seen_utc": "2025-12-13 10:08:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677759": [
        {
            "ioc_value": "port.plumeanchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 10:01:25",
            "last_seen_utc": "2025-12-13 10:02:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677758": [
        {
            "ioc_value": "keel.plumeanchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 09:57:18",
            "last_seen_utc": "2025-12-13 09:59:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677757": [
        {
            "ioc_value": "lid.sn0cklejar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 09:48:16",
            "last_seen_utc": "2025-12-13 09:49:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677756": [
        {
            "ioc_value": "cask.sn0cklejar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 09:38:12",
            "last_seen_utc": "2025-12-13 09:45:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677753": [
        {
            "ioc_value": "pickle.sn0cklejar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 09:28:53",
            "last_seen_utc": "2025-12-13 09:32:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677742": [
        {
            "ioc_value": "snare.sn0cklejar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 09:17:38",
            "last_seen_utc": "2025-12-13 09:28:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677729": [
        {
            "ioc_value": "scrape.gravel-whisk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 09:07:48",
            "last_seen_utc": "2025-12-13 09:08:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677728": [
        {
            "ioc_value": "swirl.gravel-whisk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 08:57:29",
            "last_seen_utc": "2025-12-13 08:58:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677724": [
        {
            "ioc_value": "quarry.gravel-whisk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 08:47:30",
            "last_seen_utc": "2025-12-13 08:48:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677719": [
        {
            "ioc_value": "glow.b1tcascade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 08:44:32",
            "last_seen_utc": "2025-12-13 08:45:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677717": [
        {
            "ioc_value": "rill.b1tcascade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 08:37:13",
            "last_seen_utc": "2025-12-13 08:39:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677716": [
        {
            "ioc_value": "delta.b1tcascade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 08:32:13",
            "last_seen_utc": "2025-12-13 08:35:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677715": [
        {
            "ioc_value": "byte.b1tcascade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 08:28:21",
            "last_seen_utc": "2025-12-13 08:30:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677714": [
        {
            "ioc_value": "lathe.vex-timber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 08:18:44",
            "last_seen_utc": "2025-12-13 08:20:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677713": [
        {
            "ioc_value": "join.vex-timber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 08:07:50",
            "last_seen_utc": "2025-12-13 08:09:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676965": [
        {
            "ioc_value": "ity.keyzsoft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-13 08:03:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/8d9d18fb397ea5ae52f56dc47e7336bb88d781e26b4a109a4ce5cfa728771655/",
            "tags": "c2,domain,vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1676773": [
        {
            "ioc_value": "ace-batiment.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-13 08:00:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1677518": [
        {
            "ioc_value": "renviox.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-13 08:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/72e8e71d1592778c338a9a458a1f35b08e722139dfb59b4f1ba0fd7aa099a6b7/",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1677536": [
        {
            "ioc_value": "instance-p3rfvx-relay.screenconnect.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-13 08:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "FraudulentUse,Screenconnect",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1677537": [
        {
            "ioc_value": "effinghampodiatriclore.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-13 08:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "DeerStealer,DonutLoader,HijackLoader",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1677658": [
        {
            "ioc_value": "www.10x.co.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-13 08:00:40",
            "last_seen_utc": "2025-12-13 12:01:15",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/d3c04371fa3aceeaf08182349f912d1a0265fbed122388391ac4b836fac88cdd",
            "tags": "AsyncRAT,botnet,c2",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1677683": [
        {
            "ioc_value": "pine.vex-timber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 07:57:56",
            "last_seen_utc": "2025-12-13 08:00:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677670": [
        {
            "ioc_value": "stathub.quest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-13 07:48:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/under-the-pure-curtain-from-rat-to-builder-to-coder/",
            "tags": "PureHVNC",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1677671": [
        {
            "ioc_value": "stategiq.quest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-13 07:48:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/under-the-pure-curtain-from-rat-to-builder-to-coder/",
            "tags": "PureHVNC",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1677672": [
        {
            "ioc_value": "mktblend.monster",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-13 07:48:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/under-the-pure-curtain-from-rat-to-builder-to-coder/",
            "tags": "PureHVNC",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1677673": [
        {
            "ioc_value": "dsgnfwd.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-13 07:48:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/under-the-pure-curtain-from-rat-to-builder-to-coder/",
            "tags": "PureHVNC",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1677674": [
        {
            "ioc_value": "dndhub.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-13 07:48:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/under-the-pure-curtain-from-rat-to-builder-to-coder/",
            "tags": "PureHVNC",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1677669": [
        {
            "ioc_value": "axle.vextimber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 07:47:40",
            "last_seen_utc": "2025-12-13 07:55:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677668": [
        {
            "ioc_value": "grain.vextimber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 07:37:48",
            "last_seen_utc": "2025-12-13 07:40:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677667": [
        {
            "ioc_value": "mill.vextimber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 07:27:28",
            "last_seen_utc": "2025-12-13 07:29:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677666": [
        {
            "ioc_value": "bulinco.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-13 07:20:24",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/94e6cf4122215224008285277ee1f4df61a7739c8c85ed569f112d70ce8b998f/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1677665": [
        {
            "ioc_value": "fir.vextimber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 07:17:15",
            "last_seen_utc": "2025-12-13 07:17:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677664": [
        {
            "ioc_value": "rumble.murmurplex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 07:08:26",
            "last_seen_utc": "2025-12-13 07:14:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677663": [
        {
            "ioc_value": "hum.murmurplex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 06:57:14",
            "last_seen_utc": "2025-12-13 06:58:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677662": [
        {
            "ioc_value": "loom.murmurplex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 06:46:54",
            "last_seen_utc": "2025-12-13 06:49:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677661": [
        {
            "ioc_value": "whorl.murmurplex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 06:42:14",
            "last_seen_utc": "2025-12-13 06:46:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677660": [
        {
            "ioc_value": "echo.murmurplex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 06:39:00",
            "last_seen_utc": "2025-12-13 06:39:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677659": [
        {
            "ioc_value": "ridge.gravelwhisk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 06:27:41",
            "last_seen_utc": "2025-12-13 06:29:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677657": [
        {
            "ioc_value": "spur.gravelwhisk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 06:17:52",
            "last_seen_utc": "2025-12-13 06:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677656": [
        {
            "ioc_value": "silt.gravelwhisk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 06:07:36",
            "last_seen_utc": "2025-12-13 06:13:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677655": [
        {
            "ioc_value": "v2.91clubgamez.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-13 06:01:31",
            "last_seen_utc": "2025-12-13 06:01:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251213-bcztdsykcl",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677652": [
        {
            "ioc_value": "harrow.gravelwhisk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 05:57:21",
            "last_seen_utc": "2025-12-13 05:58:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677651": [
        {
            "ioc_value": "2yri.d7mbbmer1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 05:48:34",
            "last_seen_utc": "2025-12-13 05:49:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677650": [
        {
            "ioc_value": "m18.d7mbbmer1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 05:38:10",
            "last_seen_utc": "2025-12-13 05:39:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677649": [
        {
            "ioc_value": "oel6h.d7mbbmer1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 05:26:53",
            "last_seen_utc": "2025-12-13 05:27:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677648": [
        {
            "ioc_value": "mwqkv.d7mbbmer1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 05:18:06",
            "last_seen_utc": "2025-12-13 05:19:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677647": [
        {
            "ioc_value": "gqs5d.ac0rnrepr0d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 05:07:59",
            "last_seen_utc": "2025-12-13 05:10:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677646": [
        {
            "ioc_value": "t1i.ac0rnrepr0d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 04:57:59",
            "last_seen_utc": "2025-12-13 05:00:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677645": [
        {
            "ioc_value": "gamma.ac0rnrepr0d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 04:47:39",
            "last_seen_utc": "2025-12-13 04:48:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677644": [
        {
            "ioc_value": "gwe.ac0rnrepr0d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 04:37:18",
            "last_seen_utc": "2025-12-13 04:38:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677643": [
        {
            "ioc_value": "soft.hi8hmu1berry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 04:27:36",
            "last_seen_utc": "2025-12-13 04:29:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677642": [
        {
            "ioc_value": "a0a.hi8hmu1berry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 04:18:57",
            "last_seen_utc": "2025-12-13 04:19:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677641": [
        {
            "ioc_value": "h819.hi8hmu1berry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 04:08:02",
            "last_seen_utc": "2025-12-13 04:09:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677617": [
        {
            "ioc_value": "nx.hi8hmu1berry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 03:58:09",
            "last_seen_utc": "2025-12-13 04:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677616": [
        {
            "ioc_value": "i5xu.sc2ntrepid2t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 03:42:46",
            "last_seen_utc": "2025-12-13 03:49:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677615": [
        {
            "ioc_value": "flare.sc2ntrepid2t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 03:38:02",
            "last_seen_utc": "2025-12-13 03:40:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677614": [
        {
            "ioc_value": "iyp61.sc2ntrepid2t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 03:28:41",
            "last_seen_utc": "2025-12-13 03:30:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677613": [
        {
            "ioc_value": "deep.sc2ntrepid2t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 03:17:23",
            "last_seen_utc": "2025-12-13 03:19:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677612": [
        {
            "ioc_value": "w10ok.f1ercen1ivin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 03:07:34",
            "last_seen_utc": "2025-12-13 03:12:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677610": [
        {
            "ioc_value": "yxvgh.f1ercen1ivin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 02:57:21",
            "last_seen_utc": "2025-12-13 02:59:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677608": [
        {
            "ioc_value": "champ.f1ercen1ivin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 02:47:03",
            "last_seen_utc": "2025-12-13 02:52:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677607": [
        {
            "ioc_value": "zh8qj.f1ercen1ivin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 02:36:11",
            "last_seen_utc": "2025-12-13 02:39:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677606": [
        {
            "ioc_value": "fh9.f0undst2rve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 02:28:01",
            "last_seen_utc": "2025-12-13 02:28:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677605": [
        {
            "ioc_value": "blood.f0undst2rve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 02:17:40",
            "last_seen_utc": "2025-12-13 02:23:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677604": [
        {
            "ioc_value": "8y.f0undst2rve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 02:07:50",
            "last_seen_utc": "2025-12-13 02:09:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677603": [
        {
            "ioc_value": "dsav5.f0undst2rve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 01:57:37",
            "last_seen_utc": "2025-12-13 02:00:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677602": [
        {
            "ioc_value": "crest.p2rabpr0nos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 01:47:45",
            "last_seen_utc": "2025-12-13 01:49:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677601": [
        {
            "ioc_value": "book.p2rabpr0nos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 01:37:35",
            "last_seen_utc": "2025-12-13 01:43:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677600": [
        {
            "ioc_value": "di.p2rabpr0nos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 01:27:38",
            "last_seen_utc": "2025-12-13 01:33:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677599": [
        {
            "ioc_value": "dz4y1.p2rabpr0nos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 01:17:24",
            "last_seen_utc": "2025-12-13 01:24:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677598": [
        {
            "ioc_value": "lqd.champm2loma1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 01:07:06",
            "last_seen_utc": "2025-12-13 01:08:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677596": [
        {
            "ioc_value": "wy1.champm2loma1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 00:55:44",
            "last_seen_utc": "2025-12-13 00:57:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677595": [
        {
            "ioc_value": "ocean.champm2loma1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 00:48:02",
            "last_seen_utc": "2025-12-13 00:49:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677594": [
        {
            "ioc_value": "shadow.champm2loma1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 00:38:11",
            "last_seen_utc": "2025-12-13 00:39:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677593": [
        {
            "ioc_value": "z6.neur0l5uptn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 00:27:20",
            "last_seen_utc": "2025-12-13 00:28:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677592": [
        {
            "ioc_value": "bridge.neur0l5uptn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 00:17:33",
            "last_seen_utc": "2025-12-13 00:23:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677591": [
        {
            "ioc_value": "light.neur0l5uptn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-13 00:07:20",
            "last_seen_utc": "2025-12-13 00:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677583": [
        {
            "ioc_value": "yzmbi.neur0l5uptn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 23:57:27",
            "last_seen_utc": "2025-12-12 23:58:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677582": [
        {
            "ioc_value": "storm.c0nju8maraf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 23:47:09",
            "last_seen_utc": "2025-12-12 23:49:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677581": [
        {
            "ioc_value": "wild.c0nju8maraf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 23:36:51",
            "last_seen_utc": "2025-12-12 23:40:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677580": [
        {
            "ioc_value": "guard.c0nju8maraf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 23:22:00",
            "last_seen_utc": "2025-12-12 23:25:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677579": [
        {
            "ioc_value": "trace.c0nju8maraf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 23:17:00",
            "last_seen_utc": "2025-12-12 23:21:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677578": [
        {
            "ioc_value": "spark.f1fthudde7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 23:07:47",
            "last_seen_utc": "2025-12-12 23:09:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677542": [
        {
            "ioc_value": "jtp4r.f1fthudde7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 22:57:26",
            "last_seen_utc": "2025-12-12 22:59:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677541": [
        {
            "ioc_value": "ember.f1fthudde7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 22:47:44",
            "last_seen_utc": "2025-12-12 22:49:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677540": [
        {
            "ioc_value": "2ic.f1fthudde7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 22:37:50",
            "last_seen_utc": "2025-12-12 22:40:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677538": [
        {
            "ioc_value": "neuro.b0okca7niv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 22:29:05",
            "last_seen_utc": "2025-12-12 22:31:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677535": [
        {
            "ioc_value": "byte.b0okca7niv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 22:19:11",
            "last_seen_utc": "2025-12-12 22:23:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677534": [
        {
            "ioc_value": "zeq3.b0okca7niv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 22:07:57",
            "last_seen_utc": "2025-12-12 22:09:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677533": [
        {
            "ioc_value": "mint.b0okca7niv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 21:57:40",
            "last_seen_utc": "2025-12-12 22:00:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677532": [
        {
            "ioc_value": "sabr6.b1o0dmanneq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 21:47:52",
            "last_seen_utc": "2025-12-12 21:51:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677531": [
        {
            "ioc_value": "epfe.b1o0dmanneq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 21:44:45",
            "last_seen_utc": "2025-12-12 21:45:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677530": [
        {
            "ioc_value": "p8.b1o0dmanneq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 21:37:31",
            "last_seen_utc": "2025-12-12 21:38:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677528": [
        {
            "ioc_value": "field.b1o0dmanneq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 21:28:39",
            "last_seen_utc": "2025-12-12 21:35:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677527": [
        {
            "ioc_value": "m9dbmhskb.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-12 21:25:25",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/ee28b64d4e17826527e6ee7bdf9ac22f8adb5d2c06ed533e8206f9fceecdcd8c/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1677526": [
        {
            "ioc_value": "q1.interk2ts2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 21:17:21",
            "last_seen_utc": "2025-12-12 21:19:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677524": [
        {
            "ioc_value": "bbpa.interk2ts2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 21:07:31",
            "last_seen_utc": "2025-12-12 21:10:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677522": [
        {
            "ioc_value": "dndhub.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 20:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClickFix,PureHVNC",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677521": [
        {
            "ioc_value": "vdf.interk2ts2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 20:57:17",
            "last_seen_utc": "2025-12-12 20:59:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677520": [
        {
            "ioc_value": "core.interk2ts2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 20:47:00",
            "last_seen_utc": "2025-12-12 20:47:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677519": [
        {
            "ioc_value": "3w.sh0rtwe5ter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 20:38:08",
            "last_seen_utc": "2025-12-12 20:39:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677517": [
        {
            "ioc_value": "z4l.sh0rtwe5ter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 20:27:53",
            "last_seen_utc": "2025-12-12 20:29:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677516": [
        {
            "ioc_value": "lq.sh0rtwe5ter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 20:17:33",
            "last_seen_utc": "2025-12-12 20:19:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677514": [
        {
            "ioc_value": "yl90o.sh0rtwe5ter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 20:07:47",
            "last_seen_utc": "2025-12-12 20:14:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677501": [
        {
            "ioc_value": "fpt.dfp.abdullah-sharif.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-12 20:03:02",
            "last_seen_utc": "2025-12-12 23:01:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.32.154.228+fpt.dfp.abdullah-sharif.com",
            "tags": "AS-VULTR,AS20473,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677499": [
        {
            "ioc_value": "arabsea.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-12 20:03:01",
            "last_seen_utc": "2025-12-12 23:01:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+arabsea.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677500": [
        {
            "ioc_value": "adfs.abdullah-sharif.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-12 20:03:01",
            "last_seen_utc": "2025-12-12 23:01:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.32.154.228+adfs.abdullah-sharif.com",
            "tags": "AS-VULTR,AS20473,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1677480": [
        {
            "ioc_value": "short.n0uvpu7itan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 19:57:28",
            "last_seen_utc": "2025-12-12 20:02:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677478": [
        {
            "ioc_value": "6xy2.n0uvpu7itan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 19:47:50",
            "last_seen_utc": "2025-12-12 19:53:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677477": [
        {
            "ioc_value": "fdvfr.n0uvpu7itan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 19:35:18",
            "last_seen_utc": "2025-12-12 19:41:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677476": [
        {
            "ioc_value": "hill.n0uvpu7itan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 19:27:04",
            "last_seen_utc": "2025-12-12 19:27:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677474": [
        {
            "ioc_value": "dur71.pr2ctsu7v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 19:17:16",
            "last_seen_utc": "2025-12-12 19:19:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677473": [
        {
            "ioc_value": "flame.pr2ctsu7v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 19:07:59",
            "last_seen_utc": "2025-12-12 19:10:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677461": [
        {
            "ioc_value": "beta.pr2ctsu7v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 18:52:35",
            "last_seen_utc": "2025-12-12 19:02:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677459": [
        {
            "ioc_value": "k5i.pr2ctsu7v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 18:46:50",
            "last_seen_utc": "2025-12-12 18:48:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1677009": [
        {
            "ioc_value": "omega.1nju5tred.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 18:38:03",
            "last_seen_utc": "2025-12-12 18:39:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676975": [
        {
            "ioc_value": "6t5.1nju5tred.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 18:27:14",
            "last_seen_utc": "2025-12-12 18:28:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676974": [
        {
            "ioc_value": "river.1nju5tred.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 18:17:26",
            "last_seen_utc": "2025-12-12 18:19:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676973": [
        {
            "ioc_value": "au.1nju5tred.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 18:07:12",
            "last_seen_utc": "2025-12-12 18:09:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676972": [
        {
            "ioc_value": "sodendick-39162.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-12 18:02:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-vd96astldy",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676970": [
        {
            "ioc_value": "1.tcp.clar.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-12 18:02:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-qwd4csdm2w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676969": [
        {
            "ioc_value": "8.tcp.clar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-12 18:02:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-qzd8ja1qbq",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676966": [
        {
            "ioc_value": "entire-so.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-12 18:02:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-wdyypstnaq",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676967": [
        {
            "ioc_value": "dad9idois-44752.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-12 18:02:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-tnvypatjdz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676771": [
        {
            "ioc_value": "xk8.adm1rep1ay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 17:58:28",
            "last_seen_utc": "2025-12-12 17:59:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676770": [
        {
            "ioc_value": "hdbg.adm1rep1ay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 17:48:03",
            "last_seen_utc": "2025-12-12 17:49:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676767": [
        {
            "ioc_value": "sdsu.adm1rep1ay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 17:34:40",
            "last_seen_utc": "2025-12-12 17:35:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676766": [
        {
            "ioc_value": "2vv6.adm1rep1ay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 17:28:01",
            "last_seen_utc": "2025-12-12 17:28:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676763": [
        {
            "ioc_value": "inter.co0perport5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 17:17:44",
            "last_seen_utc": "2025-12-12 17:19:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676762": [
        {
            "ioc_value": "wind.co0perport5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 17:07:26",
            "last_seen_utc": "2025-12-12 17:08:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676761": [
        {
            "ioc_value": "leqdger.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 17:05:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676759": [
        {
            "ioc_value": "8cu.co0perport5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 16:57:48",
            "last_seen_utc": "2025-12-12 17:04:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676757": [
        {
            "ioc_value": "9vq0tzgx64793.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-12 16:52:46",
            "last_seen_utc": "2025-12-14 11:48:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1676756": [
        {
            "ioc_value": "i6.co0perport5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 16:47:23",
            "last_seen_utc": "2025-12-12 16:49:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676754": [
        {
            "ioc_value": "1tza.starl1tewave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 16:38:05",
            "last_seen_utc": "2025-12-12 16:39:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676742": [
        {
            "ioc_value": "mouc.starl1tewave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 16:27:15",
            "last_seen_utc": "2025-12-12 16:32:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676702": [
        {
            "ioc_value": "intercttp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 16:24:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/ffd46048b8ead14d5bd8c05d340fe00b6695093dac18ad55eda6d74457fe29ae/",
            "tags": "c2",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1676706": [
        {
            "ioc_value": "italy-divine.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-12 16:24:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1676721": [
        {
            "ioc_value": "content-v2-verisoiu.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-12-12 16:24:05",
            "last_seen_utc": "2025-12-14 11:00:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "stealc",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1676722": [
        {
            "ioc_value": "joyeriatauro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-12-12 16:24:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "stealc",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1676737": [
        {
            "ioc_value": "alpha.starl1tewave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 16:18:01",
            "last_seen_utc": "2025-12-12 16:20:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676736": [
        {
            "ioc_value": "z9s.starl1tewave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 16:07:45",
            "last_seen_utc": "2025-12-12 16:09:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676723": [
        {
            "ioc_value": "peak.nightl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 15:58:18",
            "last_seen_utc": "2025-12-12 16:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676717": [
        {
            "ioc_value": "zj3m0.nightl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 15:48:26",
            "last_seen_utc": "2025-12-12 15:48:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676707": [
        {
            "ioc_value": "branch.nightl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 15:37:49",
            "last_seen_utc": "2025-12-12 15:39:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676704": [
        {
            "ioc_value": "uqdz.nightl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 15:28:28",
            "last_seen_utc": "2025-12-12 15:29:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1676703": [
        {
            "ioc_value": "clear.brightgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 15:21:25",
            "last_seen_utc": "2025-12-12 15:22:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676701": [
        {
            "ioc_value": "t84g.brightgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 15:11:54",
            "last_seen_utc": "2025-12-12 15:14:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676697": [
        {
            "ioc_value": "i3o.brightgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 15:08:17",
            "last_seen_utc": "2025-12-12 15:10:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1676689": [
        {
            "ioc_value": "oput.brightgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 14:57:28",
            "last_seen_utc": "2025-12-12 14:58:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676678": [
        {
            "ioc_value": "hcg.cloudreach.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 14:41:10",
            "last_seen_utc": "2025-12-12 14:51:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676677": [
        {
            "ioc_value": "ihokolkasdiemh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-12 14:37:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.53.88",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676676": [
        {
            "ioc_value": "aniradodokloiure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-12 14:36:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1673816/",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676675": [
        {
            "ioc_value": "jiontrusdergaseol.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-12 14:34:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.164",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676674": [
        {
            "ioc_value": "gastroikoliojauiol.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-12 14:34:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.173",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676641": [
        {
            "ioc_value": "kevincheat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-12 14:29:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f4d788440fe7232667ab1c1062ee6521001c93f4f3f7dc32feb303cf420b64fe/",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1676645": [
        {
            "ioc_value": "buradakimvar.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-12 14:29:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/buradakimvar.xyz/relations",
            "tags": "c2,stealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1676650": [
        {
            "ioc_value": "s9ps.cloudreach.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 14:08:47",
            "last_seen_utc": "2025-12-12 14:10:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676649": [
        {
            "ioc_value": "tp.cloudreach.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 13:57:23",
            "last_seen_utc": "2025-12-12 14:18:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676648": [
        {
            "ioc_value": "cwci.oceandrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 13:50:13",
            "last_seen_utc": "2025-12-12 13:51:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676647": [
        {
            "ioc_value": "ic7y.oceandrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 13:46:01",
            "last_seen_utc": "2025-12-12 13:47:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676646": [
        {
            "ioc_value": "gsv54.oceandrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 13:37:16",
            "last_seen_utc": "2025-12-12 13:38:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676644": [
        {
            "ioc_value": "gamma.oceandrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 13:28:00",
            "last_seen_utc": "2025-12-12 13:34:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676643": [
        {
            "ioc_value": "7yyu6.snowcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 13:17:41",
            "last_seen_utc": "2025-12-12 13:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676640": [
        {
            "ioc_value": "zwo.snowcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 13:08:06",
            "last_seen_utc": "2025-12-12 13:09:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1676637": [
        {
            "ioc_value": "vz.snowcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 12:57:37",
            "last_seen_utc": "2025-12-12 13:04:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676636": [
        {
            "ioc_value": "cacodsq.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-12 12:55:45",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676631": [
        {
            "ioc_value": "raisinc.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-12 12:53:48",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676632": [
        {
            "ioc_value": "genustt.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-12 12:53:48",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676633": [
        {
            "ioc_value": "servilg.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-12 12:53:48",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676634": [
        {
            "ioc_value": "fixedwr.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-12 12:53:48",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676635": [
        {
            "ioc_value": "dhulhxu.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-12 12:53:48",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676628": [
        {
            "ioc_value": "night.snowcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 12:47:57",
            "last_seen_utc": "2025-12-12 12:48:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1676622": [
        {
            "ioc_value": "wind.mounta1npath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 12:37:32",
            "last_seen_utc": "2025-12-12 12:40:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676620": [
        {
            "ioc_value": "nh60c.mounta1npath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 12:27:17",
            "last_seen_utc": "2025-12-12 12:28:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676619": [
        {
            "ioc_value": "asirojointofucks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-12 12:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.166",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676618": [
        {
            "ioc_value": "neurolattice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.matanbuchus",
            "malware_alias": null,
            "malware_printable": "Matanbuchus",
            "first_seen_utc": "2025-12-12 12:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/92a2e2a124a106af33993828fb0d4cdffd9dac8790169774d672c30747769455",
            "tags": "c2,domain,Matanbuchus,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676617": [
        {
            "ioc_value": "core.mounta1npath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 12:18:26",
            "last_seen_utc": "2025-12-12 12:20:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676616": [
        {
            "ioc_value": "s9i01.mounta1npath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 12:07:11",
            "last_seen_utc": "2025-12-12 12:08:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676605": [
        {
            "ioc_value": "register.spc.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-12 12:02:17",
            "last_seen_utc": "2025-12-12 12:02:20",
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-lnw7razlak",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676602": [
        {
            "ioc_value": "k38.deepbreez3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 11:57:50",
            "last_seen_utc": "2025-12-12 11:58:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676566": [
        {
            "ioc_value": "baritale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.matanbuchus",
            "malware_alias": null,
            "malware_printable": "Matanbuchus",
            "first_seen_utc": "2025-12-12 11:50:54",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "plebourhis"
        }
    ],
    "1676601": [
        {
            "ioc_value": "8wp1.deepbreez3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 11:47:02",
            "last_seen_utc": "2025-12-12 11:48:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676600": [
        {
            "ioc_value": "stone.deepbreez3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 11:30:35",
            "last_seen_utc": "2025-12-12 11:33:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676599": [
        {
            "ioc_value": "field.deepbreez3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 11:28:11",
            "last_seen_utc": "2025-12-12 11:28:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676598": [
        {
            "ioc_value": "z24rf.mistyshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 11:17:38",
            "last_seen_utc": "2025-12-12 11:19:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676597": [
        {
            "ioc_value": "q71t.mistyshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 11:07:24",
            "last_seen_utc": "2025-12-12 11:09:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676565": [
        {
            "ioc_value": "ue.mistyshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 10:57:30",
            "last_seen_utc": "2025-12-12 10:59:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676564": [
        {
            "ioc_value": "shore.mistyshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 10:47:13",
            "last_seen_utc": "2025-12-12 10:49:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676563": [
        {
            "ioc_value": "fox.clears0ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 10:37:57",
            "last_seen_utc": "2025-12-12 10:38:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676562": [
        {
            "ioc_value": "jt77.clears0ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 10:28:04",
            "last_seen_utc": "2025-12-12 10:30:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676561": [
        {
            "ioc_value": "3e.clears0ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 10:18:51",
            "last_seen_utc": "2025-12-12 10:23:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676560": [
        {
            "ioc_value": "drift.clears0ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 10:07:26",
            "last_seen_utc": "2025-12-12 10:08:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676558": [
        {
            "ioc_value": "zgeg.forestcl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 09:57:42",
            "last_seen_utc": "2025-12-12 10:03:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676557": [
        {
            "ioc_value": "e08z3.forestcl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 09:46:21",
            "last_seen_utc": "2025-12-12 09:50:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676556": [
        {
            "ioc_value": "host.forestcl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 09:38:38",
            "last_seen_utc": "2025-12-12 09:45:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676555": [
        {
            "ioc_value": "3gky.forestcl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 09:34:28",
            "last_seen_utc": "2025-12-12 09:38:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676554": [
        {
            "ioc_value": "jjt.f0xwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 09:32:20",
            "last_seen_utc": "2025-12-12 09:33:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676553": [
        {
            "ioc_value": "mist.f0xwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 09:27:10",
            "last_seen_utc": "2025-12-12 09:29:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676552": [
        {
            "ioc_value": "554r5.f0xwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 09:17:18",
            "last_seen_utc": "2025-12-12 09:19:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676551": [
        {
            "ioc_value": "kp3uw.f0xwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 09:06:56",
            "last_seen_utc": "2025-12-12 09:15:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676548": [
        {
            "ioc_value": "forest.clearh0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 08:58:15",
            "last_seen_utc": "2025-12-12 09:00:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676547": [
        {
            "ioc_value": "mint.clearh0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 08:48:57",
            "last_seen_utc": "2025-12-12 08:50:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676544": [
        {
            "ioc_value": "river.clearh0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 08:40:41",
            "last_seen_utc": "2025-12-12 08:42:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676543": [
        {
            "ioc_value": "8l8gr.clearh0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 08:31:56",
            "last_seen_utc": "2025-12-12 08:34:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676540": [
        {
            "ioc_value": "crest.m1stleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 08:27:45",
            "last_seen_utc": "2025-12-12 08:29:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676539": [
        {
            "ioc_value": "cwt.m1stleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 08:18:03",
            "last_seen_utc": "2025-12-12 08:19:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676534": [
        {
            "ioc_value": "qo1u.m1stleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 08:05:34",
            "last_seen_utc": "2025-12-12 08:07:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676480": [
        {
            "ioc_value": "yljy.m1stleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 07:57:40",
            "last_seen_utc": "2025-12-12 08:04:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676479": [
        {
            "ioc_value": "0s.frostbranch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 07:42:55",
            "last_seen_utc": "2025-12-12 07:44:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676478": [
        {
            "ioc_value": "d5.frostbranch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 07:38:14",
            "last_seen_utc": "2025-12-12 07:39:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676477": [
        {
            "ioc_value": "ffmg.frostbranch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 07:25:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1676475": [
        {
            "ioc_value": "sky.frostbranch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 07:18:03",
            "last_seen_utc": "2025-12-12 07:20:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676466": [
        {
            "ioc_value": "nova.cleardawn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 07:07:54",
            "last_seen_utc": "2025-12-12 07:09:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676464": [
        {
            "ioc_value": "bamboopaw2021.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-12 07:07:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/9dcfd6ad92ba2a0b05036cec9696abd6b8ff922c8694723aa07790f08ae50495/",
            "tags": "MaskGramStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1676463": [
        {
            "ioc_value": "e5w.cleardawn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 06:58:11",
            "last_seen_utc": "2025-12-12 06:59:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676461": [
        {
            "ioc_value": "60sek.cleardawn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 06:47:38",
            "last_seen_utc": "2025-12-12 06:53:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676460": [
        {
            "ioc_value": "bridge.cleardawn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 06:37:20",
            "last_seen_utc": "2025-12-12 06:39:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676459": [
        {
            "ioc_value": "brands.khaitara.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:36:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676455": [
        {
            "ioc_value": "api.qtss.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:35:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,PeerBlight",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676456": [
        {
            "ioc_value": "vps-zap812595-1.zap-srv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:35:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,PeerBlight",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676457": [
        {
            "ioc_value": "help.093214.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:35:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,PeerBlight",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676458": [
        {
            "ioc_value": "keep.camdvr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:35:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,PeerBlight",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676454": [
        {
            "ioc_value": "app.enzirt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-12 06:34:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Gholoader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676453": [
        {
            "ioc_value": "api.htscefh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-12 06:34:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Gholoader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676252": [
        {
            "ioc_value": "microservice-update-s1-bucket.cc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.amatera",
            "malware_alias": null,
            "malware_printable": "Amatera",
            "first_seen_utc": "2025-12-12 06:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69a221fe8833624d52031f5c6243745ea901b5622231de26bd52023ff667a71c/",
            "tags": "amatera,payload",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1676255": [
        {
            "ioc_value": "microservice-update-s2-bucket.cc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.amatera",
            "malware_alias": null,
            "malware_printable": "Amatera",
            "first_seen_utc": "2025-12-12 06:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "amaterastealer,payload",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1676259": [
        {
            "ioc_value": "api-w11c.onrender.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-12 06:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6659f6e7120e112b2d1e5bdd469ed4935c5a11144575950c6e14173a49c1bff9/",
            "tags": "c2,SilentStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1676366": [
        {
            "ioc_value": "nkpoor.sa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-12 06:34:39",
            "last_seen_utc": "2025-12-12 06:27:31",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/9c19c389e49db92049126a213f3b1dcebe17781919517df6c7c028f44e4c0787",
            "tags": "AsyncRAT,botnet,c2",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1676367": [
        {
            "ioc_value": "download.nkpoor.sa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-12 06:34:38",
            "last_seen_utc": "2025-12-12 06:27:31",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/9c19c389e49db92049126a213f3b1dcebe17781919517df6c7c028f44e4c0787",
            "tags": "AsyncRAT,botnet,c2",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1676446": [
        {
            "ioc_value": "totalservices.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:34:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ShadowAgent,TA396",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676447": [
        {
            "ioc_value": "broughservice.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:34:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ShadowAgent,TA396",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676448": [
        {
            "ioc_value": "theoyservices.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:34:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ShadowAgent,TA396",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676449": [
        {
            "ioc_value": "excesswintex.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:34:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ShadowAgent,TA396",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676450": [
        {
            "ioc_value": "brityservice.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:34:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ShadowAgent,TA396",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676451": [
        {
            "ioc_value": "bijoyshare.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:34:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ShadowAgent,TA396",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676452": [
        {
            "ioc_value": "sharetobijoy.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-12 06:34:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ShadowAgent,TA396",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675842": [
        {
            "ioc_value": "gov.hanel.work",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-12 06:34:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/13fc514b39ed0c2a5dffd9baeb74a0ef77e1935e7de65adcc220a03ab2d44d66/",
            "tags": "c2,domain,vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1676445": [
        {
            "ioc_value": "wwexp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-12-12 06:33:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "LandUpdate808",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676442": [
        {
            "ioc_value": "country-tex.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-12 06:30:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676433": [
        {
            "ioc_value": "gugugulol.kenkejai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-12 06:29:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676431": [
        {
            "ioc_value": "google.motchilltv.red",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-12 06:29:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676429": [
        {
            "ioc_value": "sarefy07.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-12-12 06:29:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676430": [
        {
            "ioc_value": "sarjeb09.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-12-12 06:29:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676428": [
        {
            "ioc_value": "damysa10.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-12-12 06:29:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1676418": [
        {
            "ioc_value": "eia.dr1ftshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 06:26:58",
            "last_seen_utc": "2025-12-12 06:28:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1676417": [
        {
            "ioc_value": "ebsk.dr1ftshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 06:18:09",
            "last_seen_utc": "2025-12-12 06:18:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676416": [
        {
            "ioc_value": "range.dr1ftshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 06:07:52",
            "last_seen_utc": "2025-12-12 06:09:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676415": [
        {
            "ioc_value": "malware.quality.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-12 06:03:06",
            "last_seen_utc": "2025-12-12 06:03:07",
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-c1yrnszrcv",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676414": [
        {
            "ioc_value": "quality.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-12 06:03:05",
            "last_seen_utc": "2025-12-12 06:03:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-c1yrnszrcv",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676413": [
        {
            "ioc_value": "malware.medcom.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-12 06:02:56",
            "last_seen_utc": "2025-12-12 06:02:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-bqc7jshz8a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676412": [
        {
            "ioc_value": "medcom.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-12 06:02:54",
            "last_seen_utc": "2025-12-12 06:02:56",
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-bqc7jshz8a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676411": [
        {
            "ioc_value": "mariajose12.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-12 06:02:16",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-egqm3a1ket",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676408": [
        {
            "ioc_value": "halahtyb-45632.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-12 06:02:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-c2l49swqgp",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676409": [
        {
            "ioc_value": "halahtyb-41206.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-12 06:02:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251212-cfe4tszpaz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676407": [
        {
            "ioc_value": "xew2z.dr1ftshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 05:55:05",
            "last_seen_utc": "2025-12-12 06:00:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676406": [
        {
            "ioc_value": "wave.skyf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 05:41:45",
            "last_seen_utc": "2025-12-12 05:43:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676405": [
        {
            "ioc_value": "x93.skyf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 05:36:32",
            "last_seen_utc": "2025-12-12 05:37:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676404": [
        {
            "ioc_value": "6rpmj.skyf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 05:27:52",
            "last_seen_utc": "2025-12-12 05:29:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676403": [
        {
            "ioc_value": "beta.skyf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 05:19:24",
            "last_seen_utc": "2025-12-12 05:26:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676402": [
        {
            "ioc_value": "r8x.l1ghtshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 05:17:15",
            "last_seen_utc": "2025-12-12 05:18:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1676401": [
        {
            "ioc_value": "omega.l1ghtshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 05:07:35",
            "last_seen_utc": "2025-12-12 05:08:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676400": [
        {
            "ioc_value": "cr.l1ghtshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 04:57:11",
            "last_seen_utc": "2025-12-12 04:58:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676398": [
        {
            "ioc_value": "p1fb9.l1ghtshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 04:48:37",
            "last_seen_utc": "2025-12-12 04:53:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676397": [
        {
            "ioc_value": "sun.s0ftcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 04:31:01",
            "last_seen_utc": "2025-12-12 04:32:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676396": [
        {
            "ioc_value": "storm.s0ftcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 04:27:55",
            "last_seen_utc": "2025-12-12 04:29:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676395": [
        {
            "ioc_value": "dh28.s0ftcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 04:18:02",
            "last_seen_utc": "2025-12-12 04:18:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676394": [
        {
            "ioc_value": "hill.s0ftcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 04:07:52",
            "last_seen_utc": "2025-12-12 04:14:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676387": [
        {
            "ioc_value": "testcuncr.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-12 04:02:52",
            "last_seen_utc": "2025-12-12 11:01:40",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+testcuncr.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676375": [
        {
            "ioc_value": "cwscj.stonec0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 03:57:27",
            "last_seen_utc": "2025-12-12 03:58:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676374": [
        {
            "ioc_value": "69z.stonec0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 03:47:07",
            "last_seen_utc": "2025-12-12 03:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676373": [
        {
            "ioc_value": "ocean.stonec0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 03:38:19",
            "last_seen_utc": "2025-12-12 03:38:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676372": [
        {
            "ioc_value": "tur.stonec0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 03:27:06",
            "last_seen_utc": "2025-12-12 03:28:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676371": [
        {
            "ioc_value": "breeze.br1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 03:17:20",
            "last_seen_utc": "2025-12-12 03:23:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676370": [
        {
            "ioc_value": "k1v5q.br1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 03:07:58",
            "last_seen_utc": "2025-12-12 03:11:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676365": [
        {
            "ioc_value": "a72o.br1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 02:57:40",
            "last_seen_utc": "2025-12-12 02:59:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676360": [
        {
            "ioc_value": "up.mcprotocol.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-12 02:48:29",
            "last_seen_utc": "2025-12-14 11:48:17",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1676359": [
        {
            "ioc_value": "c2.tiktok-js.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-12 02:48:15",
            "last_seen_utc": "2025-12-14 11:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1676358": [
        {
            "ioc_value": "snow.br1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 02:47:55",
            "last_seen_utc": "2025-12-12 02:50:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676357": [
        {
            "ioc_value": "4b.cloudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 02:37:48",
            "last_seen_utc": "2025-12-12 02:43:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676356": [
        {
            "ioc_value": "7iwp.cloudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 02:27:32",
            "last_seen_utc": "2025-12-12 02:33:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676355": [
        {
            "ioc_value": "bright.cloudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 02:17:13",
            "last_seen_utc": "2025-12-12 02:23:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676354": [
        {
            "ioc_value": "qk8q.cloudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 02:07:28",
            "last_seen_utc": "2025-12-12 02:08:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676353": [
        {
            "ioc_value": "ukd0.saffron-dent.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 01:57:11",
            "last_seen_utc": "2025-12-12 01:59:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676352": [
        {
            "ioc_value": "jitter.saffron-dent.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 01:48:11",
            "last_seen_utc": "2025-12-12 01:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676351": [
        {
            "ioc_value": "cobble.saffron-dent.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 01:38:09",
            "last_seen_utc": "2025-12-12 01:40:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676350": [
        {
            "ioc_value": "2njv.saffron-dent.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 01:27:44",
            "last_seen_utc": "2025-12-12 01:29:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676349": [
        {
            "ioc_value": "d8iw.saffrondent.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 01:17:27",
            "last_seen_utc": "2025-12-12 01:19:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676348": [
        {
            "ioc_value": "sn7.saffrondent.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 01:07:42",
            "last_seen_utc": "2025-12-12 01:09:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676347": [
        {
            "ioc_value": "pq.saffrondent.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 01:03:25",
            "last_seen_utc": "2025-12-12 01:06:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676346": [
        {
            "ioc_value": "qmolq.saffrondent.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 00:57:47",
            "last_seen_utc": "2025-12-12 00:58:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676345": [
        {
            "ioc_value": "i4o3.twig-mantle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 00:47:22",
            "last_seen_utc": "2025-12-12 00:49:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676344": [
        {
            "ioc_value": "bf1.twig-mantle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 00:37:06",
            "last_seen_utc": "2025-12-12 00:39:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676343": [
        {
            "ioc_value": "dlnd.twig-mantle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 00:21:11",
            "last_seen_utc": "2025-12-12 00:23:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676342": [
        {
            "ioc_value": "shackle.twig-mantle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 00:17:01",
            "last_seen_utc": "2025-12-12 00:19:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676339": [
        {
            "ioc_value": "qwg6.orbshackle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-12 00:07:41",
            "last_seen_utc": "2025-12-12 00:09:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676335": [
        {
            "ioc_value": "g1gq.orbshackle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 23:57:50",
            "last_seen_utc": "2025-12-12 00:03:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676334": [
        {
            "ioc_value": "loom.orbshackle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 23:47:34",
            "last_seen_utc": "2025-12-11 23:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676331": [
        {
            "ioc_value": "vex.orbshackle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 23:37:21",
            "last_seen_utc": "2025-12-11 23:38:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676330": [
        {
            "ioc_value": "alpha.orb-shackle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 23:27:30",
            "last_seen_utc": "2025-12-11 23:33:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676329": [
        {
            "ioc_value": "v8.orb-shackle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 23:17:11",
            "last_seen_utc": "2025-12-11 23:23:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676325": [
        {
            "ioc_value": "cc.orb-shackle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 23:08:20",
            "last_seen_utc": "2025-12-11 23:14:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676307": [
        {
            "ioc_value": "lab.w42o.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-11 23:01:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/54.169.194.248+lab.w42o.online",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1676269": [
        {
            "ioc_value": "clink.orb-shackle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 22:58:08",
            "last_seen_utc": "2025-12-11 23:00:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676268": [
        {
            "ioc_value": "2v.cl1nkbarge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 22:47:50",
            "last_seen_utc": "2025-12-11 22:48:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676267": [
        {
            "ioc_value": "ijct.cl1nkbarge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 22:38:02",
            "last_seen_utc": "2025-12-11 22:43:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676266": [
        {
            "ioc_value": "x7xh.cl1nkbarge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 22:27:42",
            "last_seen_utc": "2025-12-11 22:28:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676265": [
        {
            "ioc_value": "wztbj.cl1nkbarge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 22:17:26",
            "last_seen_utc": "2025-12-11 22:22:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676264": [
        {
            "ioc_value": "mantle.pr0wlmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 22:07:36",
            "last_seen_utc": "2025-12-11 22:09:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676262": [
        {
            "ioc_value": "dxd.pr0wlmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 21:59:19",
            "last_seen_utc": "2025-12-11 22:02:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676261": [
        {
            "ioc_value": "delta.pr0wlmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 21:48:25",
            "last_seen_utc": "2025-12-11 21:49:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676258": [
        {
            "ioc_value": "twig.pr0wlmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 21:38:09",
            "last_seen_utc": "2025-12-11 21:43:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676257": [
        {
            "ioc_value": "pincer.twigmantle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 21:27:53",
            "last_seen_utc": "2025-12-11 21:29:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676256": [
        {
            "ioc_value": "dent.twigmantle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 21:18:08",
            "last_seen_utc": "2025-12-11 21:20:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676253": [
        {
            "ioc_value": "1jd.twigmantle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 21:07:44",
            "last_seen_utc": "2025-12-11 21:08:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676249": [
        {
            "ioc_value": "fla.twigmantle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 21:02:35",
            "last_seen_utc": "2025-12-11 21:02:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676247": [
        {
            "ioc_value": "uz.cobble-yard.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 20:57:30",
            "last_seen_utc": "2025-12-11 20:59:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676246": [
        {
            "ioc_value": "xxqr.cobble-yard.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 20:50:52",
            "last_seen_utc": "2025-12-11 20:52:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676245": [
        {
            "ioc_value": "malware.motchilltv.red",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-11 20:50:20",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/de723092b9584c66b9191b62d3b25b76bbf3e149ae8bf245d2be81ffa87bcf54/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1676244": [
        {
            "ioc_value": "em.cobble-yard.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 20:47:34",
            "last_seen_utc": "2025-12-11 20:48:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676243": [
        {
            "ioc_value": "5fa4.cobble-yard.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 20:37:12",
            "last_seen_utc": "2025-12-11 20:44:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676241": [
        {
            "ioc_value": "00w1g.j1ttersnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 20:28:26",
            "last_seen_utc": "2025-12-11 20:30:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676240": [
        {
            "ioc_value": "hu9.j1ttersnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 20:17:05",
            "last_seen_utc": "2025-12-11 20:19:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676239": [
        {
            "ioc_value": "prowl.j1ttersnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 20:08:29",
            "last_seen_utc": "2025-12-11 20:15:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676233": [
        {
            "ioc_value": "cdn.sentihey.dedyn.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-11 20:04:39",
            "last_seen_utc": "2025-12-11 23:01:35",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/212.132.68.79+cdn.sentihey.dedyn.io",
            "tags": "AS8560,C2,censys,Havoc,IONOS-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1676085": [
        {
            "ioc_value": "snap.j1ttersnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 19:57:58",
            "last_seen_utc": "2025-12-11 20:00:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676084": [
        {
            "ioc_value": "gamma.muddle-oak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 19:47:43",
            "last_seen_utc": "2025-12-11 19:51:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676082": [
        {
            "ioc_value": "ub.muddle-oak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 19:37:54",
            "last_seen_utc": "2025-12-11 19:39:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1676079": [
        {
            "ioc_value": "wooddecor.com.br.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676080": [
        {
            "ioc_value": "watabaran.se",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:29",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676081": [
        {
            "ioc_value": "ysetechnologies.com.appniacs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676069": [
        {
            "ioc_value": "vegasvalleycommercial.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676070": [
        {
            "ioc_value": "webdisk.shiningstarschildcare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676071": [
        {
            "ioc_value": "webdisk.kasatnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676072": [
        {
            "ioc_value": "vitaricca-1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": "2025-12-12 18:01:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676073": [
        {
            "ioc_value": "wordt-ontwikkeldbe.site.tb-hosting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676074": [
        {
            "ioc_value": "wooddecor.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676075": [
        {
            "ioc_value": "yellowbird.siulyn.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676076": [
        {
            "ioc_value": "verresel.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676077": [
        {
            "ioc_value": "whm.tamiltotamil.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676078": [
        {
            "ioc_value": "whm.umeedshiksharath.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676061": [
        {
            "ioc_value": "study.bisabarengoby.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676062": [
        {
            "ioc_value": "teenpattijawaan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:27",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676063": [
        {
            "ioc_value": "tes-totaleng.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:27",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676064": [
        {
            "ioc_value": "urbiagua.pt",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676065": [
        {
            "ioc_value": "vendamaiscomthiago.ads360imob.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:27",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676066": [
        {
            "ioc_value": "webmail.giracoin.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676067": [
        {
            "ioc_value": "webmail.mega77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676068": [
        {
            "ioc_value": "webfolddns.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676051": [
        {
            "ioc_value": "shiprbx.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676052": [
        {
            "ioc_value": "stavby.sk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676053": [
        {
            "ioc_value": "suzuya-basketball-dog-house.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676054": [
        {
            "ioc_value": "staging.trytebox.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676055": [
        {
            "ioc_value": "stazio54.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676056": [
        {
            "ioc_value": "supvitalfree.verslo.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676057": [
        {
            "ioc_value": "tanakazu1977.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": "2025-12-12 18:01:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676058": [
        {
            "ioc_value": "tehahfandbtrading.com.nexus-my.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676059": [
        {
            "ioc_value": "syuchan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676060": [
        {
            "ioc_value": "teresina.oligoflora.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676046": [
        {
            "ioc_value": "sebastiancafe.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676047": [
        {
            "ioc_value": "singlevendor.ninetysix.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676048": [
        {
            "ioc_value": "skincare123tokyo.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676049": [
        {
            "ioc_value": "shop.net-gazet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:25",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676050": [
        {
            "ioc_value": "shareyourstory-org-zm.tizambia.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676034": [
        {
            "ioc_value": "portaldesigngrafico.com.br.agenciadelivearte.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676035": [
        {
            "ioc_value": "psicologowil.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": "2025-12-12 18:01:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676036": [
        {
            "ioc_value": "quabala-quabala.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": "2025-12-12 18:01:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676037": [
        {
            "ioc_value": "qka.poy.temporary.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676038": [
        {
            "ioc_value": "roumanie.sandierrot.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676039": [
        {
            "ioc_value": "rummagewi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676040": [
        {
            "ioc_value": "rummagewi.drcs-solutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676041": [
        {
            "ioc_value": "quamecheng.co.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676042": [
        {
            "ioc_value": "sageproductions.tv",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676043": [
        {
            "ioc_value": "red-eyesecurity.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676044": [
        {
            "ioc_value": "schluesselringe.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676045": [
        {
            "ioc_value": "roku.jnishop.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676025": [
        {
            "ioc_value": "pickterra.mx.pickterra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676026": [
        {
            "ioc_value": "perfectorder.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676027": [
        {
            "ioc_value": "pickterra.com.mx",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676028": [
        {
            "ioc_value": "pmmblognoot.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676029": [
        {
            "ioc_value": "patologiamoderna.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:23",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676030": [
        {
            "ioc_value": "nt4sc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676031": [
        {
            "ioc_value": "psicogenealogia.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676032": [
        {
            "ioc_value": "pleiades-capite.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:23",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676033": [
        {
            "ioc_value": "raessler.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676018": [
        {
            "ioc_value": "novasoftbd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676019": [
        {
            "ioc_value": "pauloeduardodemelo1744295722000.2410142.meusitehostgator.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676020": [
        {
            "ioc_value": "pauloeduardodemelo1744294643000.2410142.meusitehostgator.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676021": [
        {
            "ioc_value": "peroccoalimentos.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676022": [
        {
            "ioc_value": "paypan.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:22",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676023": [
        {
            "ioc_value": "ontheoutside.cliffsurfcamp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676024": [
        {
            "ioc_value": "paixetjoie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676011": [
        {
            "ioc_value": "mail.sabihfinancials.pk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676012": [
        {
            "ioc_value": "merchandise.risemyrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676013": [
        {
            "ioc_value": "minato-inc.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:21",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676014": [
        {
            "ioc_value": "new.parsoa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676015": [
        {
            "ioc_value": "nicolekoettstorfer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676016": [
        {
            "ioc_value": "newmobicard.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676017": [
        {
            "ioc_value": "old.nicholastuck.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676000": [
        {
            "ioc_value": "mail.retena.ec",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": "2025-12-12 18:00:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676001": [
        {
            "ioc_value": "mail.quimicaelda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676002": [
        {
            "ioc_value": "mail.kenandlindy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676003": [
        {
            "ioc_value": "mail.kakmekakedemi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676004": [
        {
            "ioc_value": "mail.imobiliariadevalor.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676005": [
        {
            "ioc_value": "mail.guardianpayment.systems",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676006": [
        {
            "ioc_value": "mail.purposehousepublishing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676007": [
        {
            "ioc_value": "marmorariaserrana.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676008": [
        {
            "ioc_value": "manual.xxxx88.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676009": [
        {
            "ioc_value": "mochi69.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1676010": [
        {
            "ioc_value": "matsuura3.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675989": [
        {
            "ioc_value": "mail.dbnet.com.vc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675990": [
        {
            "ioc_value": "lycon.co.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675991": [
        {
            "ioc_value": "mail.ipacarai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675992": [
        {
            "ioc_value": "mail.landtransparency.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675993": [
        {
            "ioc_value": "mail.opticlimb.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675994": [
        {
            "ioc_value": "mail.eventocontaduriafce.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675995": [
        {
            "ioc_value": "mail.pontualcascavel.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675996": [
        {
            "ioc_value": "mail.ihs.yin.mybluehost.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675997": [
        {
            "ioc_value": "mail.digital-keys.com.sa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675998": [
        {
            "ioc_value": "mail.renaceconcarino.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675999": [
        {
            "ioc_value": "lineconnect-v4.0.0.marketplace-exam.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675982": [
        {
            "ioc_value": "mail.aimbotcheat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675983": [
        {
            "ioc_value": "lomaka-tree.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675984": [
        {
            "ioc_value": "legacy.sushymns.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:18",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675985": [
        {
            "ioc_value": "mail.akoyahair.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:18",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675986": [
        {
            "ioc_value": "licon.com.ar",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675987": [
        {
            "ioc_value": "mail.authentiekeparfumerienl.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675988": [
        {
            "ioc_value": "mail.excavatingindustriesltd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675976": [
        {
            "ioc_value": "landtransparency-org-zm.tizambia.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:17",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675977": [
        {
            "ioc_value": "kinderweather.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675978": [
        {
            "ioc_value": "lecolinequintet.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675979": [
        {
            "ioc_value": "kichijyoji-syodo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675980": [
        {
            "ioc_value": "ljbeautynailssupply.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675981": [
        {
            "ioc_value": "landscapearchitectural.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675968": [
        {
            "ioc_value": "gutti.pe",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675969": [
        {
            "ioc_value": "innovatewith.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:16",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675970": [
        {
            "ioc_value": "innovative4x.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675971": [
        {
            "ioc_value": "kenandlindy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:16",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675972": [
        {
            "ioc_value": "ilexis.net.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675973": [
        {
            "ioc_value": "jelas4d.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675974": [
        {
            "ioc_value": "iriasu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675975": [
        {
            "ioc_value": "iyana.co.za.rocketrobs.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675957": [
        {
            "ioc_value": "habanero77.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675958": [
        {
            "ioc_value": "grubzskincare.zambosur.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675959": [
        {
            "ioc_value": "heathrowdevelopment.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675960": [
        {
            "ioc_value": "happydeliveryllc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675961": [
        {
            "ioc_value": "hihotelsgroup.imperialsunnybeach.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675962": [
        {
            "ioc_value": "hasimja.pristine-tech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675963": [
        {
            "ioc_value": "ifan-hebron.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675964": [
        {
            "ioc_value": "imobiliariadevalor.com.br.victorabrao.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675965": [
        {
            "ioc_value": "harry.staging.xrf.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675966": [
        {
            "ioc_value": "honoriscoin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675967": [
        {
            "ioc_value": "heda-project.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675945": [
        {
            "ioc_value": "eyelens.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675946": [
        {
            "ioc_value": "floridatextil.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675947": [
        {
            "ioc_value": "emm.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675948": [
        {
            "ioc_value": "ftp.lupolab.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675949": [
        {
            "ioc_value": "ftp.beittur.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675950": [
        {
            "ioc_value": "ftp.strivexventures.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675951": [
        {
            "ioc_value": "g42p2t-thewigdoctorshopcom-6261.site.tb-hosting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675952": [
        {
            "ioc_value": "floradatextil.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675953": [
        {
            "ioc_value": "eqvola.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675954": [
        {
            "ioc_value": "ftp.giracoin.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675955": [
        {
            "ioc_value": "ftp.strivex.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675956": [
        {
            "ioc_value": "fastsolution.asia",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675935": [
        {
            "ioc_value": "ead.universidadedaguerra.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675936": [
        {
            "ioc_value": "dev.theinstituteofreo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675937": [
        {
            "ioc_value": "dranabellagonzalez.crearhosting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675938": [
        {
            "ioc_value": "dmgthailand.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": "2025-12-12 18:00:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675939": [
        {
            "ioc_value": "ekattor.bhadracity.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675940": [
        {
            "ioc_value": "expansao.oligoflora.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675941": [
        {
            "ioc_value": "ertepehh.ikantoman.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675942": [
        {
            "ioc_value": "doblamet.grintic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675943": [
        {
            "ioc_value": "engenhariadetecidos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675944": [
        {
            "ioc_value": "eni24.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675922": [
        {
            "ioc_value": "chestnut-park-apartments.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675923": [
        {
            "ioc_value": "chebsajexport.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675924": [
        {
            "ioc_value": "cpanel.joss77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675925": [
        {
            "ioc_value": "dev.camidstudios.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675926": [
        {
            "ioc_value": "cpanel.originalsvensktkrkort.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675927": [
        {
            "ioc_value": "dancework-agency.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675928": [
        {
            "ioc_value": "dagelan88.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675929": [
        {
            "ioc_value": "dr-foerschner.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675930": [
        {
            "ioc_value": "ebpp-i.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675931": [
        {
            "ioc_value": "cube-a.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675932": [
        {
            "ioc_value": "cread-inc.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675933": [
        {
            "ioc_value": "economywise.coupons",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675934": [
        {
            "ioc_value": "demo88.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:12",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675909": [
        {
            "ioc_value": "cbdcannalife.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675910": [
        {
            "ioc_value": "cds-i.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675911": [
        {
            "ioc_value": "bitrix24support.adm-center.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675912": [
        {
            "ioc_value": "btcom.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675913": [
        {
            "ioc_value": "catchsongmaker.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675914": [
        {
            "ioc_value": "coachingcall.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675915": [
        {
            "ioc_value": "coachevanroth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675916": [
        {
            "ioc_value": "cpcontacts.chinabandy.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675917": [
        {
            "ioc_value": "cpcontacts.kasatnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675918": [
        {
            "ioc_value": "cpcontacts.moro-mie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675919": [
        {
            "ioc_value": "chrisopek.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675920": [
        {
            "ioc_value": "chehabci.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675921": [
        {
            "ioc_value": "cognorvia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675903": [
        {
            "ioc_value": "autoblogai.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675904": [
        {
            "ioc_value": "b.pendantkart.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675905": [
        {
            "ioc_value": "bca88.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:10",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675906": [
        {
            "ioc_value": "bellapenfold.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675907": [
        {
            "ioc_value": "botaniqlife.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:10",
            "last_seen_utc": "2025-12-13 15:28:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675908": [
        {
            "ioc_value": "breezibeauti.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675893": [
        {
            "ioc_value": "alleyglamour.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675894": [
        {
            "ioc_value": "aipros.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675895": [
        {
            "ioc_value": "arbitr-urist.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675896": [
        {
            "ioc_value": "autoconfig.uranium-news.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675897": [
        {
            "ioc_value": "autodiscover.blancosettlement.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675898": [
        {
            "ioc_value": "authentiekeparfumerie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675899": [
        {
            "ioc_value": "autosmartmechanic.com.workwithastara.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675900": [
        {
            "ioc_value": "autodiscover.maritimnews.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675901": [
        {
            "ioc_value": "armazenebox.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675902": [
        {
            "ioc_value": "authentiekeparfumerienl.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675887": [
        {
            "ioc_value": "abs88.fit",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675888": [
        {
            "ioc_value": "acirurgica.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675889": [
        {
            "ioc_value": "affairstv.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675890": [
        {
            "ioc_value": "agenasia88slot.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:08",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675891": [
        {
            "ioc_value": "alejandro.websiteplay.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675892": [
        {
            "ioc_value": "alineesteves.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-11 19:29:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1675886": [
        {
            "ioc_value": "saffron.muddle-oak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 19:27:39",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675885": [
        {
            "ioc_value": "malware.nangtamlonto.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-11 19:20:20",
            "last_seen_utc": "2025-12-12 06:03:01",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/a0e52c62b620f7c7318fd87ec6d4d4a6e1141fab03e8f88e02cea45e2689fe95/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1675884": [
        {
            "ioc_value": "fuzz.muddle-oak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 19:17:18",
            "last_seen_utc": "2025-12-11 19:19:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675882": [
        {
            "ioc_value": "trill.v0xletrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 19:08:48",
            "last_seen_utc": "2025-12-11 19:09:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675881": [
        {
            "ioc_value": "t2.v0xletrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 18:58:14",
            "last_seen_utc": "2025-12-11 19:00:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675876": [
        {
            "ioc_value": "9yd.v0xletrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 18:47:55",
            "last_seen_utc": "2025-12-11 18:49:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675873": [
        {
            "ioc_value": "brisk.v0xletrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 18:37:08",
            "last_seen_utc": "2025-12-11 18:43:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675872": [
        {
            "ioc_value": "barge.pincer-loom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 18:27:48",
            "last_seen_utc": "2025-12-11 18:29:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675871": [
        {
            "ioc_value": "nova.pincer-loom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 18:17:57",
            "last_seen_utc": "2025-12-11 18:18:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675870": [
        {
            "ioc_value": "omega.pincer-loom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 18:07:40",
            "last_seen_utc": "2025-12-11 18:14:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675868": [
        {
            "ioc_value": "monocastro0612.1cooldns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-11 18:02:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251211-gtht4aaq5x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1675867": [
        {
            "ioc_value": "water-included.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 18:02:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251211-rjxwdadr5t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1675866": [
        {
            "ioc_value": "S2lender-59991.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 18:02:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251211-wafmysey2b",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1675864": [
        {
            "ioc_value": "oak.pincer-loom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 17:57:26",
            "last_seen_utc": "2025-12-11 17:58:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675860": [
        {
            "ioc_value": "djno.cobbleyard.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 17:47:40",
            "last_seen_utc": "2025-12-11 17:49:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675859": [
        {
            "ioc_value": "nib.cobbleyard.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 17:31:16",
            "last_seen_utc": "2025-12-11 17:43:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675857": [
        {
            "ioc_value": "3cz39.cobbleyard.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 17:28:05",
            "last_seen_utc": "2025-12-11 17:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675856": [
        {
            "ioc_value": "nhg.cobbleyard.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 17:18:15",
            "last_seen_utc": "2025-12-11 17:24:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675850": [
        {
            "ioc_value": "opbz.pincerloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 17:08:11",
            "last_seen_utc": "2025-12-11 17:08:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675849": [
        {
            "ioc_value": "mint.pincerloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 16:57:42",
            "last_seen_utc": "2025-12-11 16:58:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675847": [
        {
            "ioc_value": "tangle.pincerloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 16:47:53",
            "last_seen_utc": "2025-12-11 16:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675846": [
        {
            "ioc_value": "yard.pincerloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 16:37:34",
            "last_seen_utc": "2025-12-11 16:38:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675845": [
        {
            "ioc_value": "orb.muddleoak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 16:21:39",
            "last_seen_utc": "2025-12-11 16:22:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675844": [
        {
            "ioc_value": "uslrd.muddleoak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 16:16:28",
            "last_seen_utc": "2025-12-11 16:18:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675841": [
        {
            "ioc_value": "grain.muddleoak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 16:08:35",
            "last_seen_utc": "2025-12-11 16:10:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675838": [
        {
            "ioc_value": "msft.sts.abdullah-sharif.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-11 16:03:46",
            "last_seen_utc": "2025-12-11 23:01:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.32.154.228+msft.sts.abdullah-sharif.com",
            "tags": "AS-VULTR,AS20473,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1675828": [
        {
            "ioc_value": "7ch1.muddleoak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 15:55:25",
            "last_seen_utc": "2025-12-11 15:56:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675827": [
        {
            "ioc_value": "uvfo2.fire1n5ulat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 15:48:09",
            "last_seen_utc": "2025-12-11 15:51:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675826": [
        {
            "ioc_value": "s3.fire1n5ulat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 15:39:45",
            "last_seen_utc": "2025-12-11 15:43:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675825": [
        {
            "ioc_value": "1zqb.fire1n5ulat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 15:27:48",
            "last_seen_utc": "2025-12-11 15:28:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675602": [
        {
            "ioc_value": "iffrooypwm.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-11 15:13:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675597": [
        {
            "ioc_value": "harshnz.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-11 15:13:42",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675598": [
        {
            "ioc_value": "downind.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-11 15:13:42",
            "last_seen_utc": "2025-12-13 12:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675599": [
        {
            "ioc_value": "huddles.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-11 15:13:42",
            "last_seen_utc": "2025-12-13 12:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675600": [
        {
            "ioc_value": "product.360academybd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-11 15:13:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675601": [
        {
            "ioc_value": "deoxyrq.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-11 15:13:42",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675596": [
        {
            "ioc_value": "uye.fire1n5ulat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 15:11:19",
            "last_seen_utc": "2025-12-11 15:13:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675595": [
        {
            "ioc_value": "orx5.par2ch0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 15:08:14",
            "last_seen_utc": "2025-12-11 15:09:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675581": [
        {
            "ioc_value": "quick.par2ch0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 14:57:27",
            "last_seen_utc": "2025-12-11 14:59:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675580": [
        {
            "ioc_value": "ustg1.par2ch0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 14:46:09",
            "last_seen_utc": "2025-12-11 14:51:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675579": [
        {
            "ioc_value": "u11v.par2ch0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 14:31:15",
            "last_seen_utc": "2025-12-11 14:33:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675577": [
        {
            "ioc_value": "dxl08.ch2rmsan1nst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 14:20:55",
            "last_seen_utc": "2025-12-11 14:26:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675576": [
        {
            "ioc_value": "qxn.ch2rmsan1nst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 14:12:11",
            "last_seen_utc": "2025-12-11 14:13:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675570": [
        {
            "ioc_value": "mint.ch2rmsan1nst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 14:07:57",
            "last_seen_utc": "2025-12-11 14:08:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675569": [
        {
            "ioc_value": "5r.ch2rmsan1nst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 13:57:39",
            "last_seen_utc": "2025-12-11 13:59:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675568": [
        {
            "ioc_value": "charm.ist0mpi1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 13:49:15",
            "last_seen_utc": "2025-12-11 13:49:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675564": [
        {
            "ioc_value": "ult.wraithbot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-11 13:44:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5da36b89427b237eaf57d03e7f9a4bbcf3fb34f60efcca9dabf8c20bcf7633e9/",
            "tags": "dropped-by-amadey,WraithBot,WraithNet",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1675565": [
        {
            "ioc_value": "ultbu2.wraithbot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-11 13:44:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5da36b89427b237eaf57d03e7f9a4bbcf3fb34f60efcca9dabf8c20bcf7633e9/",
            "tags": "dropped-by-amadey,WraithBot,WraithNet",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1675566": [
        {
            "ioc_value": "ultbu1.wraithbot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-11 13:44:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5da36b89427b237eaf57d03e7f9a4bbcf3fb34f60efcca9dabf8c20bcf7633e9/",
            "tags": "dropped-by-amadey,WraithBot,WraithNet",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1675562": [
        {
            "ioc_value": "5b.ist0mpi1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 13:37:34",
            "last_seen_utc": "2025-12-11 13:39:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675561": [
        {
            "ioc_value": "wrenobservation.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-11 13:32:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1675558": [
        {
            "ioc_value": "sparkle.ist0mpi1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 13:27:14",
            "last_seen_utc": "2025-12-11 13:28:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675529": [
        {
            "ioc_value": "lalanikas-49138.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675530": [
        {
            "ioc_value": "unsigned-49011.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675531": [
        {
            "ioc_value": "thread-television.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675532": [
        {
            "ioc_value": "anti-prairie.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675533": [
        {
            "ioc_value": "pop-progressive.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675534": [
        {
            "ioc_value": "prior-myspace.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675535": [
        {
            "ioc_value": "secretstorage.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675536": [
        {
            "ioc_value": "experience-while.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675537": [
        {
            "ioc_value": "pre-manga.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675538": [
        {
            "ioc_value": "group-texts.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675539": [
        {
            "ioc_value": "activities-strict.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675540": [
        {
            "ioc_value": "Nitxwet4-32679.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675541": [
        {
            "ioc_value": "toasterbread-51386.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": "2025-12-11 13:23:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675542": [
        {
            "ioc_value": "parent-44871.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675543": [
        {
            "ioc_value": "koid-49965.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:55",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675513": [
        {
            "ioc_value": "heart-nous.with.playit.plus",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675514": [
        {
            "ioc_value": "reahall1-64014.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675515": [
        {
            "ioc_value": "16.tcp.cpolar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675516": [
        {
            "ioc_value": "leake798-58959.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675517": [
        {
            "ioc_value": "updates-pottery.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675518": [
        {
            "ioc_value": "windowslonghorn-39122.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675519": [
        {
            "ioc_value": "renziiiii-31544.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675520": [
        {
            "ioc_value": "kwizygmd-60694.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675521": [
        {
            "ioc_value": "places-booty.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675522": [
        {
            "ioc_value": "dfhh783-35596.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675523": [
        {
            "ioc_value": "miwee2-49793.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675524": [
        {
            "ioc_value": "sun-mining.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675525": [
        {
            "ioc_value": "22.tcp.vip.cpolar.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675526": [
        {
            "ioc_value": "entertainment-pirates.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675527": [
        {
            "ioc_value": "senior-form.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675528": [
        {
            "ioc_value": "dufgdwgfy7f-64720.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675508": [
        {
            "ioc_value": "17.tcp.cpolar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675509": [
        {
            "ioc_value": "killnetj231-48499.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675510": [
        {
            "ioc_value": "ayham123-31460.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675511": [
        {
            "ioc_value": "leake798-38723.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675512": [
        {
            "ioc_value": "fully-springfield.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:23:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675507": [
        {
            "ioc_value": "wild.ist0mpi1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 13:17:26",
            "last_seen_utc": "2025-12-11 13:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675480": [
        {
            "ioc_value": "luicer-52197.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675481": [
        {
            "ioc_value": "svchost1.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675482": [
        {
            "ioc_value": "5421hjvugfvuk.myftp.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675483": [
        {
            "ioc_value": "ssasdasd34-63321.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675484": [
        {
            "ioc_value": "pearful-47873.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675485": [
        {
            "ioc_value": "envio2-12.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675486": [
        {
            "ioc_value": "yuseef-30448.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675487": [
        {
            "ioc_value": "draxo-57366.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675488": [
        {
            "ioc_value": "method-facing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675489": [
        {
            "ioc_value": "request-painting.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675490": [
        {
            "ioc_value": "sdfsefesc-42790.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675491": [
        {
            "ioc_value": "sdfsefesc-61327.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675492": [
        {
            "ioc_value": "gdgfgded3-45458.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675493": [
        {
            "ioc_value": "gsad-53763.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675494": [
        {
            "ioc_value": "ercc-36107.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675495": [
        {
            "ioc_value": "dec-smooth.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675496": [
        {
            "ioc_value": "simpler-44964.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:03",
            "last_seen_utc": "2025-12-11 13:23:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675497": [
        {
            "ioc_value": "forThePeople-58907.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675498": [
        {
            "ioc_value": "crucio-57843.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 13:12:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1675356": [
        {
            "ioc_value": "dktourandtaxi.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-11 13:11:56",
            "last_seen_utc": "2025-12-11 08:30:58",
            "confidence_level": 50,
            "reference": "https://bazaar.abuse.ch/browse/",
            "tags": "Js,RAT,RemcosRAT",
            "anonymous": "1",
            "reporter": "OkV"
        }
    ],
    "1675357": [
        {
            "ioc_value": "malware.dktourandtaxi.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-11 13:11:55",
            "last_seen_utc": "2025-12-11 08:30:58",
            "confidence_level": 50,
            "reference": "https://bazaar.abuse.ch/browse/",
            "tags": "Js,RAT,RemcosRAT",
            "anonymous": "1",
            "reporter": "OkV"
        }
    ],
    "1675504": [
        {
            "ioc_value": "soft.ha1fakos0l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 13:08:12",
            "last_seen_utc": "2025-12-11 13:09:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675479": [
        {
            "ioc_value": "joke.ha1fakos0l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 12:55:19",
            "last_seen_utc": "2025-12-11 13:01:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675477": [
        {
            "ioc_value": "syriatelsy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-11 12:50:12",
            "last_seen_utc": "2025-12-14 11:48:17",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1675476": [
        {
            "ioc_value": "ely.ha1fakos0l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 12:48:27",
            "last_seen_utc": "2025-12-11 12:49:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675475": [
        {
            "ioc_value": "cyberknull.publicvm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.coinminer",
            "malware_alias": null,
            "malware_printable": "Coinminer",
            "first_seen_utc": "2025-12-11 12:38:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "CoinMiner",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1675474": [
        {
            "ioc_value": "core.ha1fakos0l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 12:37:45",
            "last_seen_utc": "2025-12-11 12:39:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675473": [
        {
            "ioc_value": "ocean.f1ippme7re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 12:28:01",
            "last_seen_utc": "2025-12-11 12:29:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675472": [
        {
            "ioc_value": "lxp1.f1ippme7re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 12:21:39",
            "last_seen_utc": "2025-12-11 12:24:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675471": [
        {
            "ioc_value": "flip.f1ippme7re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 12:15:29",
            "last_seen_utc": "2025-12-11 12:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675470": [
        {
            "ioc_value": "field.f1ippme7re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 12:12:45",
            "last_seen_utc": "2025-12-11 12:13:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675469": [
        {
            "ioc_value": "i1.bra9lupt5ev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 12:07:36",
            "last_seen_utc": "2025-12-11 12:09:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675448": [
        {
            "ioc_value": "fbk.bra9lupt5ev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 11:57:12",
            "last_seen_utc": "2025-12-11 11:59:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675447": [
        {
            "ioc_value": "tqe.bra9lupt5ev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 11:50:35",
            "last_seen_utc": "2025-12-11 11:53:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675446": [
        {
            "ioc_value": "f0.bra9lupt5ev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 11:47:22",
            "last_seen_utc": "2025-12-11 11:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675445": [
        {
            "ioc_value": "648.r0cketf2rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 11:38:07",
            "last_seen_utc": "2025-12-11 11:44:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675444": [
        {
            "ioc_value": "cdr.r0cketf2rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 11:30:55",
            "last_seen_utc": "2025-12-11 11:32:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675443": [
        {
            "ioc_value": "delta.r0cketf2rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 11:28:14",
            "last_seen_utc": "2025-12-11 11:28:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675442": [
        {
            "ioc_value": "letter.r0cketf2rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 11:17:56",
            "last_seen_utc": "2025-12-11 11:24:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675441": [
        {
            "ioc_value": "pixel.f1ukomki5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 11:05:38",
            "last_seen_utc": "2025-12-11 11:09:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675385": [
        {
            "ioc_value": "mist.f1ukomki5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 10:57:51",
            "last_seen_utc": "2025-12-11 11:00:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675384": [
        {
            "ioc_value": "wza.f1ukomki5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 10:52:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675383": [
        {
            "ioc_value": "bgmb.f1ukomki5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 10:47:27",
            "last_seen_utc": "2025-12-11 10:50:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675382": [
        {
            "ioc_value": "5oj6.effu5rep7eh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 10:44:43",
            "last_seen_utc": "2025-12-11 10:46:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675381": [
        {
            "ioc_value": "flame.effu5rep7eh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 10:37:30",
            "last_seen_utc": "2025-12-11 10:42:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675379": [
        {
            "ioc_value": "byte.effu5rep7eh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 10:27:29",
            "last_seen_utc": "2025-12-11 10:34:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675378": [
        {
            "ioc_value": "v8r7.effu5rep7eh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 10:18:22",
            "last_seen_utc": "2025-12-11 10:23:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675377": [
        {
            "ioc_value": "omega.chel0be7upt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 10:02:57",
            "last_seen_utc": "2025-12-11 10:06:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675376": [
        {
            "ioc_value": "rocket.chel0be7upt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 09:58:18",
            "last_seen_utc": "2025-12-11 09:59:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675375": [
        {
            "ioc_value": "nzhr.chel0be7upt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 09:43:54",
            "last_seen_utc": "2025-12-11 09:48:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675374": [
        {
            "ioc_value": "46.chel0be7upt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 09:37:42",
            "last_seen_utc": "2025-12-11 09:43:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675373": [
        {
            "ioc_value": "gate.po5tr2diat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 09:28:00",
            "last_seen_utc": "2025-12-11 09:30:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675372": [
        {
            "ioc_value": "fusion.po5tr2diat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 09:20:40",
            "last_seen_utc": "2025-12-11 09:23:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675371": [
        {
            "ioc_value": "3i.po5tr2diat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 09:17:29",
            "last_seen_utc": "2025-12-11 09:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675370": [
        {
            "ioc_value": "xk.po5tr2diat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 09:05:35",
            "last_seen_utc": "2025-12-11 09:10:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675368": [
        {
            "ioc_value": "9pt.bu1gep2lest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 08:54:19",
            "last_seen_utc": "2025-12-11 08:57:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675364": [
        {
            "ioc_value": "trace.bu1gep2lest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 08:47:05",
            "last_seen_utc": "2025-12-11 08:54:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675361": [
        {
            "ioc_value": "boost.bu1gep2lest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 08:34:11",
            "last_seen_utc": "2025-12-11 08:41:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675358": [
        {
            "ioc_value": "cxks9.bu1gep2lest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 08:27:23",
            "last_seen_utc": "2025-12-11 08:27:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675355": [
        {
            "ioc_value": "5idt.c0rres5cour.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 08:17:41",
            "last_seen_utc": "2025-12-11 08:18:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675354": [
        {
            "ioc_value": "njs.c0rres5cour.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 08:08:17",
            "last_seen_utc": "2025-12-11 08:10:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675335": [
        {
            "ioc_value": "1f3.c0rres5cour.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 07:52:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675334": [
        {
            "ioc_value": "clear.c0rres5cour.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 07:48:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675333": [
        {
            "ioc_value": "zo.p2rtics2nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 07:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675330": [
        {
            "ioc_value": "h27g.p2rtics2nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 07:28:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675329": [
        {
            "ioc_value": "crest.p2rtics2nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 07:25:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1675328": [
        {
            "ioc_value": "friday-barbados.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-11 07:15:24",
            "last_seen_utc": "2025-12-11 13:04:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675326": [
        {
            "ioc_value": "godblessuswithmoney385.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-11 07:14:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675325": [
        {
            "ioc_value": "ssofhoseuegsgrfnuy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675305": [
        {
            "ioc_value": "slpsrgpsrhojifdijy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675306": [
        {
            "ioc_value": "srndndubsbsifurfd.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675307": [
        {
            "ioc_value": "srndndubsbsifurfd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675308": [
        {
            "ioc_value": "srndndubsbsifurfd.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675309": [
        {
            "ioc_value": "srndndubsbsifurfd.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675310": [
        {
            "ioc_value": "srndndubsbsifurfda.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675311": [
        {
            "ioc_value": "srndndubsbsifurfdf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675312": [
        {
            "ioc_value": "srndndubsbsifurfdi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675313": [
        {
            "ioc_value": "srndndubsbsifurfdo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675314": [
        {
            "ioc_value": "srndndubsbsifurfdt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675315": [
        {
            "ioc_value": "srndndubsbsifurfdy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675316": [
        {
            "ioc_value": "ssofhoseuegsgrfnj.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675317": [
        {
            "ioc_value": "ssofhoseuegsgrfnja.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675318": [
        {
            "ioc_value": "ssofhoseuegsgrfnji.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675319": [
        {
            "ioc_value": "ssofhoseuegsgrfnjo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675320": [
        {
            "ioc_value": "ssofhoseuegsgrfnjt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675321": [
        {
            "ioc_value": "ssofhoseuegsgrfnu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675322": [
        {
            "ioc_value": "ssofhoseuegsgrfnu.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675323": [
        {
            "ioc_value": "ssofhoseuegsgrfnu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675324": [
        {
            "ioc_value": "ssofhoseuegsgrfnuf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675286": [
        {
            "ioc_value": "sfiusihuisisifgmr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675287": [
        {
            "ioc_value": "sfiusihuisisifgmr.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675288": [
        {
            "ioc_value": "sfiusihuisisifgmr.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675289": [
        {
            "ioc_value": "sfiusihuisisifgmr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675290": [
        {
            "ioc_value": "sfiusihuisisifgmr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675291": [
        {
            "ioc_value": "sfiusihuisisifgmr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675292": [
        {
            "ioc_value": "sfiusihuisisifgmrf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675293": [
        {
            "ioc_value": "sfiusihuisisifgmri.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675294": [
        {
            "ioc_value": "sfiusihuisisifgmro.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675295": [
        {
            "ioc_value": "sfiusihuisisifgmrt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675296": [
        {
            "ioc_value": "sfiusihuisisifgmry.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675297": [
        {
            "ioc_value": "slpsrgpsrhojifdij.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675298": [
        {
            "ioc_value": "slpsrgpsrhojifdij.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675299": [
        {
            "ioc_value": "slpsrgpsrhojifdij.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675300": [
        {
            "ioc_value": "slpsrgpsrhojifdija.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675301": [
        {
            "ioc_value": "slpsrgpsrhojifdijf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675302": [
        {
            "ioc_value": "slpsrgpsrhojifdiji.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675303": [
        {
            "ioc_value": "slpsrgpsrhojifdijo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675304": [
        {
            "ioc_value": "slpsrgpsrhojifdijt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675268": [
        {
            "ioc_value": "nousiieiffgogogooi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675269": [
        {
            "ioc_value": "nousiieiffgogogooo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675270": [
        {
            "ioc_value": "nousiieiffgogogoot.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675271": [
        {
            "ioc_value": "nousiieiffgogogooy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675272": [
        {
            "ioc_value": "seusiiusuiuifiuui.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675273": [
        {
            "ioc_value": "seusiiusuiuifiuui.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675274": [
        {
            "ioc_value": "seusiiusuiuifiuui.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675275": [
        {
            "ioc_value": "seusiiusuiuifiuui.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675276": [
        {
            "ioc_value": "seusiiusuiuifiuui.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675277": [
        {
            "ioc_value": "seusiiusuiuifiuui.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675278": [
        {
            "ioc_value": "seusiiusuiuifiuui.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675279": [
        {
            "ioc_value": "seusiiusuiuifiuuia.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675280": [
        {
            "ioc_value": "seusiiusuiuifiuuif.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675281": [
        {
            "ioc_value": "seusiiusuiuifiuuii.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675282": [
        {
            "ioc_value": "seusiiusuiuifiuuio.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675283": [
        {
            "ioc_value": "seusiiusuiuifiuuit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675284": [
        {
            "ioc_value": "seusiiusuiuifiuuiy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675285": [
        {
            "ioc_value": "sfiusihuisisifgmr.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675248": [
        {
            "ioc_value": "nnososoosjfeuhueua.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675249": [
        {
            "ioc_value": "nnososoosjfeuhueuf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675250": [
        {
            "ioc_value": "nnososoosjfeuhueui.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675251": [
        {
            "ioc_value": "nnososoosjfeuhueuo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675252": [
        {
            "ioc_value": "nnososoosjfeuhueut.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675253": [
        {
            "ioc_value": "nnososoosjfeuhueuy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675254": [
        {
            "ioc_value": "noeuaoenriusfiruu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675255": [
        {
            "ioc_value": "noeuaoenriusfiruu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675256": [
        {
            "ioc_value": "noeuaoenriusfiruu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675257": [
        {
            "ioc_value": "noeuaoenriusfiruua.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675258": [
        {
            "ioc_value": "noeuaoenriusfiruuf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675259": [
        {
            "ioc_value": "noeuaoenriusfiruui.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675260": [
        {
            "ioc_value": "noeuaoenriusfiruuo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675261": [
        {
            "ioc_value": "noeuaoenriusfiruut.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675262": [
        {
            "ioc_value": "noeuaoenriusfiruuy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675263": [
        {
            "ioc_value": "nousiieiffgogogoo.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675264": [
        {
            "ioc_value": "nousiieiffgogogoo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675265": [
        {
            "ioc_value": "nousiieiffgogogoo.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675266": [
        {
            "ioc_value": "nousiieiffgogogooa.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675267": [
        {
            "ioc_value": "nousiieiffgogogoof.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675229": [
        {
            "ioc_value": "fuihaihueifnnnvndf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675230": [
        {
            "ioc_value": "fuihaihueifnnnvndi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675231": [
        {
            "ioc_value": "fuihaihueifnnnvndo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675232": [
        {
            "ioc_value": "fuihaihueifnnnvndt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675233": [
        {
            "ioc_value": "fuihaihueifnnnvndy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675234": [
        {
            "ioc_value": "iuirshriuisruruuf.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675235": [
        {
            "ioc_value": "iuirshriuisruruuf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675236": [
        {
            "ioc_value": "iuirshriuisruruuf.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675237": [
        {
            "ioc_value": "iuirshriuisruruuf.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675238": [
        {
            "ioc_value": "iuirshriuisruruufa.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675239": [
        {
            "ioc_value": "iuirshriuisruruuff.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675240": [
        {
            "ioc_value": "iuirshriuisruruufi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675241": [
        {
            "ioc_value": "iuirshriuisruruufo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675242": [
        {
            "ioc_value": "iuirshriuisruruuft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675243": [
        {
            "ioc_value": "iuirshriuisruruufy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675244": [
        {
            "ioc_value": "nnososoosjfeuhueu.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675245": [
        {
            "ioc_value": "nnososoosjfeuhueu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675246": [
        {
            "ioc_value": "nnososoosjfeuhueu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675247": [
        {
            "ioc_value": "nnososoosjfeuhueu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675210": [
        {
            "ioc_value": "fiiauediehduefuget.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675211": [
        {
            "ioc_value": "fiiauediehduefugey.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675212": [
        {
            "ioc_value": "fuaiuebndieufeufu.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675213": [
        {
            "ioc_value": "fuaiuebndieufeufu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675214": [
        {
            "ioc_value": "fuaiuebndieufeufu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675215": [
        {
            "ioc_value": "fuaiuebndieufeufua.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675216": [
        {
            "ioc_value": "fuaiuebndieufeufuf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675217": [
        {
            "ioc_value": "fuaiuebndieufeufui.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675218": [
        {
            "ioc_value": "fuaiuebndieufeufuo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675219": [
        {
            "ioc_value": "fuaiuebndieufeufut.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675220": [
        {
            "ioc_value": "fuaiuebndieufeufuy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675221": [
        {
            "ioc_value": "fuihaihueifnnnvnd.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675222": [
        {
            "ioc_value": "fuihaihueifnnnvnd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675223": [
        {
            "ioc_value": "fuihaihueifnnnvnd.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675224": [
        {
            "ioc_value": "fuihaihueifnnnvnd.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675225": [
        {
            "ioc_value": "fuihaihueifnnnvnd.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675226": [
        {
            "ioc_value": "fuihaihueifnnnvnd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675227": [
        {
            "ioc_value": "fuihaihueifnnnvnd.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675228": [
        {
            "ioc_value": "fuihaihueifnnnvnda.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675190": [
        {
            "ioc_value": "fihsifuiiusuiuduf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675191": [
        {
            "ioc_value": "fihsifuiiusuiuduf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675192": [
        {
            "ioc_value": "fihsifuiiusuiuduf.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675193": [
        {
            "ioc_value": "fihsifuiiusuiuduf.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675194": [
        {
            "ioc_value": "fihsifuiiusuiuduf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675195": [
        {
            "ioc_value": "fihsifuiiusuiuduf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675196": [
        {
            "ioc_value": "fihsifuiiusuiudufa.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675197": [
        {
            "ioc_value": "fihsifuiiusuiuduff.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675198": [
        {
            "ioc_value": "fihsifuiiusuiudufi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675199": [
        {
            "ioc_value": "fihsifuiiusuiudufo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675200": [
        {
            "ioc_value": "fihsifuiiusuiuduft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675201": [
        {
            "ioc_value": "fihsifuiiusuiudufy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675202": [
        {
            "ioc_value": "fiiauediehduefuge.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675203": [
        {
            "ioc_value": "fiiauediehduefuge.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675204": [
        {
            "ioc_value": "fiiauediehduefuge.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675205": [
        {
            "ioc_value": "fiiauediehduefuge.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675206": [
        {
            "ioc_value": "fiiauediehduefugea.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675207": [
        {
            "ioc_value": "fiiauediehduefugef.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675208": [
        {
            "ioc_value": "fiiauediehduefugei.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675209": [
        {
            "ioc_value": "fiiauediehduefugeo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675172": [
        {
            "ioc_value": "fieieienfsnirgrni.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675173": [
        {
            "ioc_value": "fieieienfsnirgrni.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675174": [
        {
            "ioc_value": "fieieienfsnirgrni.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675175": [
        {
            "ioc_value": "fieieienfsnirgrni.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675176": [
        {
            "ioc_value": "fieieienfsnirgrnia.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675177": [
        {
            "ioc_value": "fieieienfsnirgrnif.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675178": [
        {
            "ioc_value": "fieieienfsnirgrnii.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675179": [
        {
            "ioc_value": "fieieienfsnirgrnio.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675180": [
        {
            "ioc_value": "fieieienfsnirgrnit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675181": [
        {
            "ioc_value": "fieieienfsnirgrniy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675182": [
        {
            "ioc_value": "fifiehsueuufidhfi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675183": [
        {
            "ioc_value": "fifiehsueuufidhfi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675184": [
        {
            "ioc_value": "fifiehsueuufidhfia.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675185": [
        {
            "ioc_value": "fifiehsueuufidhfii.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675186": [
        {
            "ioc_value": "fifiehsueuufidhfio.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675187": [
        {
            "ioc_value": "fifiehsueuufidhfit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675188": [
        {
            "ioc_value": "fifiehsueuufidhfiy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675189": [
        {
            "ioc_value": "fihsifuiiusuiuduf.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675155": [
        {
            "ioc_value": "eoroooskfogihisrg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675156": [
        {
            "ioc_value": "eoroooskfogihisrg.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675157": [
        {
            "ioc_value": "eoroooskfogihisrg.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675158": [
        {
            "ioc_value": "eoroooskfogihisrga.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675159": [
        {
            "ioc_value": "eoroooskfogihisrgf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675160": [
        {
            "ioc_value": "eoroooskfogihisrgi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675161": [
        {
            "ioc_value": "eoroooskfogihisrgo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675162": [
        {
            "ioc_value": "eoroooskfogihisrgt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675163": [
        {
            "ioc_value": "eoroooskfogihisrgy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675164": [
        {
            "ioc_value": "eseusiiusuiuifiuui.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675165": [
        {
            "ioc_value": "esfiusihuisisifgmr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675166": [
        {
            "ioc_value": "eslpsrgpsrhojifdij.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675167": [
        {
            "ioc_value": "esrndndubsbsifurfd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675168": [
        {
            "ioc_value": "essofhoseuegsgrfnu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675169": [
        {
            "ioc_value": "fieieienfsnirgrni.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675170": [
        {
            "ioc_value": "fieieienfsnirgrni.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675171": [
        {
            "ioc_value": "fieieienfsnirgrni.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675137": [
        {
            "ioc_value": "eiifngjfksisiufjfi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675138": [
        {
            "ioc_value": "eiifngjfksisiufjfo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675139": [
        {
            "ioc_value": "eiifngjfksisiufjft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675140": [
        {
            "ioc_value": "eiifngjfksisiufjfy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675141": [
        {
            "ioc_value": "eiuirshriuisruruuf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675142": [
        {
            "ioc_value": "ennososoosjfeuhueu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675143": [
        {
            "ioc_value": "enoeuaoenriusfiruu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675144": [
        {
            "ioc_value": "enousiieiffgogogoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675145": [
        {
            "ioc_value": "eofihsishihiursgu.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675146": [
        {
            "ioc_value": "eofihsishihiursgu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675147": [
        {
            "ioc_value": "eofihsishihiursgu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675148": [
        {
            "ioc_value": "eofihsishihiursgua.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675149": [
        {
            "ioc_value": "eofihsishihiursguf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675150": [
        {
            "ioc_value": "eofihsishihiursgui.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675151": [
        {
            "ioc_value": "eofihsishihiursguo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675152": [
        {
            "ioc_value": "eofihsishihiursgut.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675153": [
        {
            "ioc_value": "eofihsishihiursguy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675154": [
        {
            "ioc_value": "eoroooskfogihisrg.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675120": [
        {
            "ioc_value": "aiiaiafrzrueuedury.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675121": [
        {
            "ioc_value": "eafeifieuuufufufuf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675122": [
        {
            "ioc_value": "eaiiaiafrzrueuedur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675123": [
        {
            "ioc_value": "eeiifngjfksisiufjf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675124": [
        {
            "ioc_value": "eeofihsishihiursgu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675125": [
        {
            "ioc_value": "eeoroooskfogihisrg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675126": [
        {
            "ioc_value": "efieieienfsnirgrni.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675127": [
        {
            "ioc_value": "efifiehsueuufidhfi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675128": [
        {
            "ioc_value": "efihsifuiiusuiuduf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675129": [
        {
            "ioc_value": "efiiauediehduefuge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675130": [
        {
            "ioc_value": "efuaiuebndieufeufu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675131": [
        {
            "ioc_value": "efuihaihueifnnnvnd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675132": [
        {
            "ioc_value": "eiifngjfksisiufjf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675133": [
        {
            "ioc_value": "eiifngjfksisiufjf.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675134": [
        {
            "ioc_value": "eiifngjfksisiufjf.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675135": [
        {
            "ioc_value": "eiifngjfksisiufjfa.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675136": [
        {
            "ioc_value": "eiifngjfksisiufjff.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675101": [
        {
            "ioc_value": "afeifieuuufufufuf.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675102": [
        {
            "ioc_value": "afeifieuuufufufuf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675103": [
        {
            "ioc_value": "afeifieuuufufufuf.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675104": [
        {
            "ioc_value": "afeifieuuufufufuf.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675105": [
        {
            "ioc_value": "afeifieuuufufufufa.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675106": [
        {
            "ioc_value": "afeifieuuufufufuff.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675107": [
        {
            "ioc_value": "afeifieuuufufufufi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675108": [
        {
            "ioc_value": "afeifieuuufufufufo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675109": [
        {
            "ioc_value": "afeifieuuufufufuft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675110": [
        {
            "ioc_value": "afeifieuuufufufufy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675111": [
        {
            "ioc_value": "aiiaiafrzrueuedur.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675112": [
        {
            "ioc_value": "aiiaiafrzrueuedur.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675113": [
        {
            "ioc_value": "aiiaiafrzrueuedur.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675114": [
        {
            "ioc_value": "aiiaiafrzrueuedur.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675115": [
        {
            "ioc_value": "aiiaiafrzrueuedura.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675116": [
        {
            "ioc_value": "aiiaiafrzrueuedurf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675117": [
        {
            "ioc_value": "aiiaiafrzrueueduri.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675118": [
        {
            "ioc_value": "aiiaiafrzrueueduro.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1675119": [
        {
            "ioc_value": "aiiaiafrzrueuedurt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-11 07:14:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674864": [
        {
            "ioc_value": "bounty.p2rtics2nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 07:13:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674856": [
        {
            "ioc_value": "6hmcw0.sa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-11 07:13:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674857": [
        {
            "ioc_value": "dxyiz.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-11 07:13:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674858": [
        {
            "ioc_value": "e2bet-link.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-11 07:13:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674859": [
        {
            "ioc_value": "malware.6hmcw0.sa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-11 07:13:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674860": [
        {
            "ioc_value": "malware.dxyiz.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-11 07:13:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674861": [
        {
            "ioc_value": "malware.e2bet-link.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-11 07:13:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674862": [
        {
            "ioc_value": "phising.dxyiz.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-11 07:13:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674863": [
        {
            "ioc_value": "sex.6hmcw0.sa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-11 07:13:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674849": [
        {
            "ioc_value": "kissyou.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-11 07:12:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674850": [
        {
            "ioc_value": "syperzina52-35743.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-11 07:12:09",
            "last_seen_utc": "2025-12-11 13:04:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674845": [
        {
            "ioc_value": "v4x.impa5sj0ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 07:09:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674836": [
        {
            "ioc_value": "jtt.impa5sj0ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 07:01:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674751": [
        {
            "ioc_value": "ma.impa5sj0ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 06:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674733": [
        {
            "ioc_value": "yessigmaurlahhahahfunnytypeshi67.wiped-protected.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-11 06:51:54",
            "last_seen_utc": "2025-12-11 13:04:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/3677cb257e0a44363a98879ab3570f48114f35cc10e340a861aae098dac34df3/",
            "tags": "QuasarRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1674732": [
        {
            "ioc_value": "bqiy0.impa5sj0ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 06:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674729": [
        {
            "ioc_value": "microservice-update-s2-bucket.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-11 06:47:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1674730": [
        {
            "ioc_value": "microservice-update-s1-bucket.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-11 06:47:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1674731": [
        {
            "ioc_value": "s3-updatehub.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-11 06:47:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1674728": [
        {
            "ioc_value": "bright.bwenina.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 06:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674727": [
        {
            "ioc_value": "sky.bwenina.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 06:29:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674726": [
        {
            "ioc_value": "river.bwenina.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 06:26:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674725": [
        {
            "ioc_value": "repositorylinux.publicvm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-11 06:23:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "CVE-2025-55182,Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1674724": [
        {
            "ioc_value": "ember.bwenina.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 06:17:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674723": [
        {
            "ioc_value": "gamma.ep1che2ded.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 06:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674704": [
        {
            "ioc_value": "lora.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-11 06:02:05",
            "last_seen_utc": "2025-12-11 07:14:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251211-c8k6jsgr9w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674703": [
        {
            "ioc_value": "y5jyv.ep1che2ded.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 05:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674702": [
        {
            "ioc_value": "stone.ep1che2ded.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 05:52:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674358": [
        {
            "ioc_value": "malware.91clubgamez.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-11 05:51:55",
            "last_seen_utc": "2025-12-11 07:13:07",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/7107a5aff83a129d0a58e09a5338be703a9ded881cd7d750cbccb2e255898a34/detection",
            "tags": "asyncrat,marte,msil,rat",
            "anonymous": "0",
            "reporter": "cagoldhydra1701"
        }
    ],
    "1674357": [
        {
            "ioc_value": "91clubgamez.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-11 05:51:52",
            "last_seen_utc": "2025-12-11 07:13:07",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/7107a5aff83a129d0a58e09a5338be703a9ded881cd7d750cbccb2e255898a34/detection",
            "tags": "asyncrat,marte,msil,rat",
            "anonymous": "0",
            "reporter": "cagoldhydra1701"
        }
    ],
    "1674328": [
        {
            "ioc_value": "members.affiliateincomecoach.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-12-11 05:51:44",
            "last_seen_utc": "2025-12-12 06:33:55",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115696684549518809",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1674649": [
        {
            "ioc_value": "xvideox.za.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-11 05:51:18",
            "last_seen_utc": "2025-12-11 07:13:07",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/8943c75d3f974d35e552c914bc64df0bbce1eabab18b0ffda945665e7ba37691",
            "tags": "asyncRAT,botnet,c2",
            "anonymous": "1",
            "reporter": "Amethyste"
        }
    ],
    "1674650": [
        {
            "ioc_value": "support.xvideox.za.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-11 05:51:17",
            "last_seen_utc": "2025-12-11 07:13:07",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/8943c75d3f974d35e552c914bc64df0bbce1eabab18b0ffda945665e7ba37691",
            "tags": "asyncRAT,botnet,c2",
            "anonymous": "1",
            "reporter": "Amethyste"
        }
    ],
    "1674651": [
        {
            "ioc_value": "login.pureeats.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-11 05:51:17",
            "last_seen_utc": "2025-12-11 07:13:07",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/295cadd97ce5703753e88626dbb01faaf10e46f5b0bb91bd9ff16c7c1de6aeb1/relations",
            "tags": "botnet,c2,DcRAT",
            "anonymous": "1",
            "reporter": "Amethyste"
        }
    ],
    "1674699": [
        {
            "ioc_value": "light.ep1che2ded.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 05:46:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674697": [
        {
            "ioc_value": "wind.i5ch3mref.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 05:38:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674691": [
        {
            "ioc_value": "nova.i5ch3mref.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 05:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674690": [
        {
            "ioc_value": "il3j.i5ch3mref.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 05:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674688": [
        {
            "ioc_value": "wj.i5ch3mref.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 05:07:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674682": [
        {
            "ioc_value": "8t.b0untf1ush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 04:54:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674681": [
        {
            "ioc_value": "parcel.b0untf1ush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 04:46:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674680": [
        {
            "ioc_value": "forest.b0untf1ush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 04:37:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674679": [
        {
            "ioc_value": "p4k.b0untf1ush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 04:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674678": [
        {
            "ioc_value": "x0k.snibblecap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 04:14:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674663": [
        {
            "ioc_value": "n7bz1.snibblecap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 04:03:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674656": [
        {
            "ioc_value": "51p.snibblecap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 03:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674655": [
        {
            "ioc_value": "me52.snibblecap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 03:47:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674654": [
        {
            "ioc_value": "unr.draft-snip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 03:33:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674653": [
        {
            "ioc_value": "fizz.draft-snip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 03:27:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674652": [
        {
            "ioc_value": "quick.draft-snip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 03:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674648": [
        {
            "ioc_value": "43.draft-snip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 03:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674640": [
        {
            "ioc_value": "trace.m0tivecrib.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 02:47:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674639": [
        {
            "ioc_value": "hfhi.m0tivecrib.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 02:36:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674637": [
        {
            "ioc_value": "velvet.m0tivecrib.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 02:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674636": [
        {
            "ioc_value": "jc2s.m0tivecrib.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 02:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674634": [
        {
            "ioc_value": "95.quartz-kip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 02:07:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674633": [
        {
            "ioc_value": "snip.quartz-kip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 01:57:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674632": [
        {
            "ioc_value": "etalon.quartz-kip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 01:47:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674631": [
        {
            "ioc_value": "weird.quartz-kip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 01:37:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674630": [
        {
            "ioc_value": "spark.st1ltwarp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 01:26:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674629": [
        {
            "ioc_value": "1qt.st1ltwarp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 01:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674628": [
        {
            "ioc_value": "crank.st1ltwarp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 01:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674627": [
        {
            "ioc_value": "z9.st1ltwarp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 00:57:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674626": [
        {
            "ioc_value": "nova.quartzkip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 00:43:53",
            "last_seen_utc": "2025-12-11 00:59:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674625": [
        {
            "ioc_value": "zu.quartzkip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 00:37:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674624": [
        {
            "ioc_value": "patch.quartzkip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 00:27:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674622": [
        {
            "ioc_value": "omega.quartzkip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 00:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674621": [
        {
            "ioc_value": "z6yg.draftsnip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-11 00:08:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674603": [
        {
            "ioc_value": "pip.draftsnip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 23:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674594": [
        {
            "ioc_value": "v6bet.fan",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674595": [
        {
            "ioc_value": "wp.ttqm.com.sg",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:13",
            "last_seen_utc": "2025-12-11 19:29:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674596": [
        {
            "ioc_value": "yuk89slot.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674597": [
        {
            "ioc_value": "yzempire.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674598": [
        {
            "ioc_value": "yukkou2.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674599": [
        {
            "ioc_value": "zbhnozatrading.com.nexus-my.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674600": [
        {
            "ioc_value": "yumewokanaeru365.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674601": [
        {
            "ioc_value": "whm.chinabandy.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674602": [
        {
            "ioc_value": "ystar.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674585": [
        {
            "ioc_value": "topone-fc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674586": [
        {
            "ioc_value": "webdisk.super77a.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:12",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674587": [
        {
            "ioc_value": "webdisk.dinsosjombang.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674588": [
        {
            "ioc_value": "twessy.tasawk.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674589": [
        {
            "ioc_value": "website-e4b7844b.joyfulsouthernmama.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:12",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674590": [
        {
            "ioc_value": "webdisk.umeedshiksharath.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674591": [
        {
            "ioc_value": "wiseconsolidation.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674592": [
        {
            "ioc_value": "web-ocean.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:12",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674593": [
        {
            "ioc_value": "wp-proplus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:12",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674577": [
        {
            "ioc_value": "terecon.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674578": [
        {
            "ioc_value": "toiler.wesix.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674579": [
        {
            "ioc_value": "transportadoraguacu.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:11",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674580": [
        {
            "ioc_value": "travelpass.zambosur.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674581": [
        {
            "ioc_value": "triplobby.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674582": [
        {
            "ioc_value": "valorcomunica.agenciadelivearte.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674583": [
        {
            "ioc_value": "tsuchiya-miso.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:11",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674584": [
        {
            "ioc_value": "vanpopubs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674570": [
        {
            "ioc_value": "soulcirclewellness.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674571": [
        {
            "ioc_value": "staging.wastedisposalsolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674572": [
        {
            "ioc_value": "sto.ttc-auto.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:10",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674573": [
        {
            "ioc_value": "signature.seaskyservices.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:10",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674574": [
        {
            "ioc_value": "taxi-saranda-shehaj.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:10",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674575": [
        {
            "ioc_value": "tenmaru7hikiyose.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674576": [
        {
            "ioc_value": "southwoodnigeria.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674554": [
        {
            "ioc_value": "shinworks4.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674555": [
        {
            "ioc_value": "simulatedpeople.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674556": [
        {
            "ioc_value": "seminariodiocesedejanauba.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674557": [
        {
            "ioc_value": "sitebh.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674558": [
        {
            "ioc_value": "sbludwig.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674559": [
        {
            "ioc_value": "seiken-naisoushiage.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674560": [
        {
            "ioc_value": "smtp.fixmystrings.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674561": [
        {
            "ioc_value": "shophomevn.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": "2025-12-12 18:01:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674562": [
        {
            "ioc_value": "smtp.he-connect.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674563": [
        {
            "ioc_value": "seribijutsu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674564": [
        {
            "ioc_value": "soda89.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674565": [
        {
            "ioc_value": "smtp.laminetjes.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674566": [
        {
            "ioc_value": "skjsb.my.nexus-my.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674567": [
        {
            "ioc_value": "southbaybythegulfdestin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674568": [
        {
            "ioc_value": "socialsecurityprimer.southernsummits.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674569": [
        {
            "ioc_value": "soloecommerce.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:09",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674548": [
        {
            "ioc_value": "potiontp30.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:08",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674549": [
        {
            "ioc_value": "pyxmsoft.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674550": [
        {
            "ioc_value": "roundcounter.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674551": [
        {
            "ioc_value": "ruudho.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674552": [
        {
            "ioc_value": "pppnf2928.chiba-ip.dti.ne.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674553": [
        {
            "ioc_value": "rotoplast.com.br.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:08",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674542": [
        {
            "ioc_value": "pousadaestacaokaphe.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:07",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674543": [
        {
            "ioc_value": "portaldospocos.agenciadelivearte.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:07",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674544": [
        {
            "ioc_value": "ppicdcmontessori.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674545": [
        {
            "ioc_value": "pk07game.download",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:07",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674546": [
        {
            "ioc_value": "puzzle-app.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:07",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674547": [
        {
            "ioc_value": "pjspaulfoundation.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674536": [
        {
            "ioc_value": "ocd-angola.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674537": [
        {
            "ioc_value": "nyheder.fusiondigest.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674538": [
        {
            "ioc_value": "ns1.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674539": [
        {
            "ioc_value": "ouiftapp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674540": [
        {
            "ioc_value": "odd-nichinan-4485.lolipopmc.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:06",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674541": [
        {
            "ioc_value": "opticlimb.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674530": [
        {
            "ioc_value": "morita-consul.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:05",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674531": [
        {
            "ioc_value": "msw.staging.xrf.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674532": [
        {
            "ioc_value": "mx.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674533": [
        {
            "ioc_value": "masindo88.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674534": [
        {
            "ioc_value": "ns1.schoolofhealthcare.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:05",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674535": [
        {
            "ioc_value": "mgfoundations.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674517": [
        {
            "ioc_value": "macarraoperocco.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674518": [
        {
            "ioc_value": "mail.suavidaadois.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674519": [
        {
            "ioc_value": "mail.qal.wyj.mybluehost.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674520": [
        {
            "ioc_value": "mail.umeedshiksharath.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674521": [
        {
            "ioc_value": "mail.vidaedinheiro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674522": [
        {
            "ioc_value": "mail.raessler.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674523": [
        {
            "ioc_value": "mail.unitesolutions.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": "2025-12-12 18:00:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674524": [
        {
            "ioc_value": "mail.uranium-news.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674525": [
        {
            "ioc_value": "mail.themelayuhealing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674526": [
        {
            "ioc_value": "mail.thelosttransition.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674527": [
        {
            "ioc_value": "mail.tumainischoolstanzaniafoundation.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674528": [
        {
            "ioc_value": "mail.savvyconversions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674529": [
        {
            "ioc_value": "mail.mpo77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:04",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674509": [
        {
            "ioc_value": "mail.enlightenproject.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:03",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674510": [
        {
            "ioc_value": "mail.bigwealthglobal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674511": [
        {
            "ioc_value": "mail.escape2cashflow.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674512": [
        {
            "ioc_value": "mail.newzmedia.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674513": [
        {
            "ioc_value": "mail.rami.blog",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674514": [
        {
            "ioc_value": "mail.pasnicenko.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674515": [
        {
            "ioc_value": "lazerepilasyonfiyatlar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:03",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674516": [
        {
            "ioc_value": "mail.qccqatar.qa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674505": [
        {
            "ioc_value": "machibito-c.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:02",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674506": [
        {
            "ioc_value": "mail.authentiekeparfumerienl.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674507": [
        {
            "ioc_value": "mail.creditlifebd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:02",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674508": [
        {
            "ioc_value": "mail.giracoin.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674502": [
        {
            "ioc_value": "link.ikantoman.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:01",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674503": [
        {
            "ioc_value": "lumis.lt",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:01",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674504": [
        {
            "ioc_value": "mail.bayshorecommunication.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:01",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674491": [
        {
            "ioc_value": "kingsauto-glass.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674492": [
        {
            "ioc_value": "jumpstart.lumori.africa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674493": [
        {
            "ioc_value": "knee360.in.brandstapler.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674494": [
        {
            "ioc_value": "ksp-s.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674495": [
        {
            "ioc_value": "ladamajutrading.com.nexus-my.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674496": [
        {
            "ioc_value": "lh-familyhub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674497": [
        {
            "ioc_value": "lexmates.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674498": [
        {
            "ioc_value": "lowcountrygrapevines.com.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674499": [
        {
            "ioc_value": "lp.disalvoteam.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674500": [
        {
            "ioc_value": "letnan777.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674501": [
        {
            "ioc_value": "kakmekakedemi.nexus-my.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:57:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674478": [
        {
            "ioc_value": "inefabledesfile.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674479": [
        {
            "ioc_value": "jamesrreed.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674480": [
        {
            "ioc_value": "jamiejames.localgrapevines.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674481": [
        {
            "ioc_value": "janbaskdemo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674482": [
        {
            "ioc_value": "jellry.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674483": [
        {
            "ioc_value": "jdsa.asia",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674484": [
        {
            "ioc_value": "honobono-pharmacy.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674485": [
        {
            "ioc_value": "kaphestore.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674486": [
        {
            "ioc_value": "jakouan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674487": [
        {
            "ioc_value": "jma-architecture.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674488": [
        {
            "ioc_value": "juken-web.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674489": [
        {
            "ioc_value": "hibitech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674490": [
        {
            "ioc_value": "khalibra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:59",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674473": [
        {
            "ioc_value": "ftp.airlockersp.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674474": [
        {
            "ioc_value": "ftp.schoolofbeauticians.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:58",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674475": [
        {
            "ioc_value": "hihotelsgroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674476": [
        {
            "ioc_value": "grupodivical.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:58",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674477": [
        {
            "ioc_value": "hamayori.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:58",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674463": [
        {
            "ioc_value": "fleuraison.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674464": [
        {
            "ioc_value": "evanderupdate.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674465": [
        {
            "ioc_value": "freecosmeticos.amosca.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674466": [
        {
            "ioc_value": "ftp.marciomedradophotography.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674467": [
        {
            "ioc_value": "gemis.mt-org.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674468": [
        {
            "ioc_value": "gds-solution.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674469": [
        {
            "ioc_value": "feria.fundacionmarialuisa.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674470": [
        {
            "ioc_value": "geogoods.com.br.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674471": [
        {
            "ioc_value": "gestiatalaia.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674472": [
        {
            "ioc_value": "fieldsign.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674454": [
        {
            "ioc_value": "duduk88.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674455": [
        {
            "ioc_value": "egota-map.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:56",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674456": [
        {
            "ioc_value": "efan.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674457": [
        {
            "ioc_value": "embratonhost.com.br.slojas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674458": [
        {
            "ioc_value": "evolvenow.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:56",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674459": [
        {
            "ioc_value": "fact-company.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:56",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674460": [
        {
            "ioc_value": "fofbookgroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674461": [
        {
            "ioc_value": "demo-tracking.predictive.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674462": [
        {
            "ioc_value": "ftp.moro-mie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:56",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674442": [
        {
            "ioc_value": "dabinichplatt.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674443": [
        {
            "ioc_value": "chisaka-dc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674444": [
        {
            "ioc_value": "dementiepas.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674445": [
        {
            "ioc_value": "cookiz.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674446": [
        {
            "ioc_value": "diabezill.com.br.estiloefeito.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674447": [
        {
            "ioc_value": "dpenergy.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674448": [
        {
            "ioc_value": "developer.promowebsites.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674449": [
        {
            "ioc_value": "dumpsterpod.com.workwithastara.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674450": [
        {
            "ioc_value": "dolls-f.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": "2025-12-11 19:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674451": [
        {
            "ioc_value": "directmail-drive.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674452": [
        {
            "ioc_value": "clinicapele.agenciadelivearte.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674453": [
        {
            "ioc_value": "droneschool.kanagawa.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:55",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674433": [
        {
            "ioc_value": "consengautomacao.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674434": [
        {
            "ioc_value": "cm-initiative.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674435": [
        {
            "ioc_value": "cpanel.chinabandy.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674436": [
        {
            "ioc_value": "chekker-team.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674437": [
        {
            "ioc_value": "cpcalendars.uranium-news.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674438": [
        {
            "ioc_value": "cocorita.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:54",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674439": [
        {
            "ioc_value": "cptcaldas.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:54",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674440": [
        {
            "ioc_value": "cpcontacts.science-ing.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674441": [
        {
            "ioc_value": "cloudcard.3squared360.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674423": [
        {
            "ioc_value": "autodiscover.mikon.ink",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674424": [
        {
            "ioc_value": "bo.dizeo-agency.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674425": [
        {
            "ioc_value": "bodycareensenada.com.66-29-156-11.cpanel.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674426": [
        {
            "ioc_value": "bp.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674427": [
        {
            "ioc_value": "bouffemobile.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674428": [
        {
            "ioc_value": "bien-etre-en-forme.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674429": [
        {
            "ioc_value": "bmconsultoriaetreinamentos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674430": [
        {
            "ioc_value": "botaniqlife.leearaujo.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674431": [
        {
            "ioc_value": "carrozzeria-magic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674432": [
        {
            "ioc_value": "businessthrust.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674420": [
        {
            "ioc_value": "autoconfig.giracoin.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:52",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674421": [
        {
            "ioc_value": "amasaka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:52",
            "last_seen_utc": "2025-12-11 19:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674422": [
        {
            "ioc_value": "ayuniterusmaju.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674411": [
        {
            "ioc_value": "a-gain.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674412": [
        {
            "ioc_value": "abo99.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:51",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674413": [
        {
            "ioc_value": "abltda.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674414": [
        {
            "ioc_value": "advokatsubbotin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674415": [
        {
            "ioc_value": "alessandroruoso.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674416": [
        {
            "ioc_value": "amazon.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674417": [
        {
            "ioc_value": "alasan123.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:51",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674418": [
        {
            "ioc_value": "aptsd.kbral.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674419": [
        {
            "ioc_value": "apply.loanroad.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674409": [
        {
            "ioc_value": "596f205362.nxcli.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674410": [
        {
            "ioc_value": "633bd53942.nxcli.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 23:56:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix,reCAPTCHA,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1674408": [
        {
            "ioc_value": "warp.draftsnip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 23:47:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674406": [
        {
            "ioc_value": "w91a.draftsnip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 23:38:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674405": [
        {
            "ioc_value": "cap.pipetalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 23:27:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674404": [
        {
            "ioc_value": "5v72.pipetalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 23:12:23",
            "last_seen_utc": "2025-12-10 23:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674403": [
        {
            "ioc_value": "motive.pipetalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 23:08:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674402": [
        {
            "ioc_value": "5nq6s.pipetalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 23:05:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674384": [
        {
            "ioc_value": "suprevile.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-10 23:00:33",
            "last_seen_utc": "2025-12-11 00:03:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.208.159.162+suprevile.shop",
            "tags": "AS42624,C2,censys,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1674382": [
        {
            "ioc_value": "outlook.sentihey.dedyn.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-10 23:00:32",
            "last_seen_utc": "2025-12-11 00:03:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/212.132.68.79+outlook.sentihey.dedyn.io",
            "tags": "AS8560,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1674383": [
        {
            "ioc_value": "galicaonline.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-10 23:00:32",
            "last_seen_utc": "2025-12-11 00:03:25",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.208.159.162+galicaonline.shop",
            "tags": "AS42624,C2,censys,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1674371": [
        {
            "ioc_value": "yvrp.crank-muddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 22:57:34",
            "last_seen_utc": "2025-12-10 22:58:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674370": [
        {
            "ioc_value": "cluster.crank-muddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 22:47:13",
            "last_seen_utc": "2025-12-10 22:55:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674369": [
        {
            "ioc_value": "odd.crank-muddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 22:38:26",
            "last_seen_utc": "2025-12-10 22:39:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674368": [
        {
            "ioc_value": "set.crank-muddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 22:24:05",
            "last_seen_utc": "2025-12-10 22:28:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674367": [
        {
            "ioc_value": "a4.velvetecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 22:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674366": [
        {
            "ioc_value": "nexus.velvetecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 22:08:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674365": [
        {
            "ioc_value": "m727.velvetecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 21:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674364": [
        {
            "ioc_value": "muddle.velvetecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 21:49:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674362": [
        {
            "ioc_value": "rv.pip-etalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 21:37:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674361": [
        {
            "ioc_value": "alpha.pip-etalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 21:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674360": [
        {
            "ioc_value": "draft.pip-etalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 21:17:06",
            "last_seen_utc": "2025-12-10 21:17:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674356": [
        {
            "ioc_value": "mu.pip-etalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 21:07:20",
            "last_seen_utc": "2025-12-10 21:14:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674355": [
        {
            "ioc_value": "snibble.gl1mmerset.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 20:58:03",
            "last_seen_utc": "2025-12-10 21:03:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674354": [
        {
            "ioc_value": "shift.gl1mmerset.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 20:47:43",
            "last_seen_utc": "2025-12-10 20:52:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674353": [
        {
            "ioc_value": "echo.gl1mmerset.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 20:37:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674349": [
        {
            "ioc_value": "qmmj.gl1mmerset.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 20:23:34",
            "last_seen_utc": "2025-12-10 20:32:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674348": [
        {
            "ioc_value": "1rr.s0apcluster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 20:12:44",
            "last_seen_utc": "2025-12-10 20:16:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674347": [
        {
            "ioc_value": "gamma.s0apcluster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 20:07:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674344": [
        {
            "ioc_value": "aiwcp.s0apcluster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 19:57:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674341": [
        {
            "ioc_value": "t8.s0apcluster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 19:43:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674339": [
        {
            "ioc_value": "ku.crankmuddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 19:34:04",
            "last_seen_utc": "2025-12-10 19:36:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674338": [
        {
            "ioc_value": "soap.crankmuddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 19:27:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674336": [
        {
            "ioc_value": "beta.crankmuddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 19:18:03",
            "last_seen_utc": "2025-12-10 19:19:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674335": [
        {
            "ioc_value": "quartz.crankmuddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 19:12:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674334": [
        {
            "ioc_value": "enj.fu5spurch2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 19:08:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674333": [
        {
            "ioc_value": "ad1u.fu5spurch2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 18:55:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674332": [
        {
            "ioc_value": "i2.fu5spurch2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 18:49:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674329": [
        {
            "ioc_value": "pd.fu5spurch2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 18:33:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674327": [
        {
            "ioc_value": "cee.fe2rsos5is.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 18:27:26",
            "last_seen_utc": "2025-12-10 18:29:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674326": [
        {
            "ioc_value": "light.fe2rsos5is.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 18:17:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674324": [
        {
            "ioc_value": "dle5u.fe2rsos5is.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 18:08:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674323": [
        {
            "ioc_value": "y6k8.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-12-10 18:06:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-v52m8svlax",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674322": [
        {
            "ioc_value": "druwwtsas.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 18:02:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-tqd3ysbq8v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674320": [
        {
            "ioc_value": "xxblessingsinabundance.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-10 18:02:04",
            "last_seen_utc": "2025-12-10 18:02:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-tzbzystrbt",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674321": [
        {
            "ioc_value": "xxblessingsinabundant.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-10 18:02:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-tzbzystrbt",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674319": [
        {
            "ioc_value": "cumasinavillageherdinauwangbedekanyiwelu.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-10 18:02:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-td4g3sey4a",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674317": [
        {
            "ioc_value": "1haldmdpz.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-10 18:01:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-vkchlsvjhz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674318": [
        {
            "ioc_value": "xxpeszmtf.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-10 18:01:57",
            "last_seen_utc": "2025-12-11 13:04:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-vhmksszkck",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674316": [
        {
            "ioc_value": "vertex-optimizing.with.playit.plus",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-10 18:01:56",
            "last_seen_utc": "2025-12-11 13:04:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-vsx5aavkct",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674315": [
        {
            "ioc_value": "57r.fe2rsos5is.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 17:59:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674314": [
        {
            "ioc_value": "dbry.bel1etin7eg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 17:46:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674313": [
        {
            "ioc_value": "kcwx.bel1etin7eg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 17:37:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674312": [
        {
            "ioc_value": "i62yv.bel1etin7eg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 17:24:32",
            "last_seen_utc": "2025-12-10 17:26:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674310": [
        {
            "ioc_value": "nen.bel1etin7eg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 17:15:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674309": [
        {
            "ioc_value": "1t.ma5cotw2ter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 17:07:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674301": [
        {
            "ioc_value": "oipolfield.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-10 17:06:45",
            "last_seen_utc": "2025-12-10 16:42:54",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115696258096631144",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1674307": [
        {
            "ioc_value": "jer.demisemarzban.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-10 17:06:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1674308": [
        {
            "ioc_value": "jer.firsttech-llc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-10 17:06:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1674304": [
        {
            "ioc_value": "ex6.ma5cotw2ter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 16:58:18",
            "last_seen_utc": "2025-12-10 17:03:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674303": [
        {
            "ioc_value": "ef.ma5cotw2ter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 16:46:58",
            "last_seen_utc": "2025-12-10 16:55:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674295": [
        {
            "ioc_value": "yqz.ma5cotw2ter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 16:37:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674293": [
        {
            "ioc_value": "wa1s.b1asfi7ty.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 16:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674292": [
        {
            "ioc_value": "9r5b.b1asfi7ty.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 16:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674291": [
        {
            "ioc_value": "beta.b1asfi7ty.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 16:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674285": [
        {
            "ioc_value": "greenmosaic.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-10 16:02:35",
            "last_seen_utc": "2025-12-10 23:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+greenmosaic.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674280": [
        {
            "ioc_value": "spark.b1asfi7ty.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 15:56:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674279": [
        {
            "ioc_value": "river.h0bbittr0ts.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 15:47:41",
            "last_seen_utc": "2025-12-10 15:55:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674277": [
        {
            "ioc_value": "ssh.nobbos-team-lol.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.pumabot",
            "malware_alias": null,
            "malware_printable": "PumaBot",
            "first_seen_utc": "2025-12-10 15:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/3c60a39b3b69ca2466cab0908bc644b8f0c0e166802f19386829b250c78a6537/",
            "tags": "PumaBot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1674276": [
        {
            "ioc_value": "vector.h0bbittr0ts.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 15:37:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674275": [
        {
            "ioc_value": "CHECK.OFFICE365-UPDATE.COM",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.rekoobe",
            "malware_alias": null,
            "malware_printable": "Rekoobe",
            "first_seen_utc": "2025-12-10 15:32:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/82335954bec84cbdd019cfa474f20f4274310a1477e03e34af7c62d15096fe0d/",
            "tags": "Rekoobe",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1674273": [
        {
            "ioc_value": "bridge.h0bbittr0ts.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 15:27:05",
            "last_seen_utc": "2025-12-10 15:33:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674272": [
        {
            "ioc_value": "forest.h0bbittr0ts.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 15:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674271": [
        {
            "ioc_value": "ep8.lett5p0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 15:08:02",
            "last_seen_utc": "2025-12-10 15:13:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674269": [
        {
            "ioc_value": "q7q.lett5p0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 14:57:46",
            "last_seen_utc": "2025-12-10 14:58:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674268": [
        {
            "ioc_value": "pixel.lett5p0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 14:47:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674267": [
        {
            "ioc_value": "gamma.lett5p0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 14:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674266": [
        {
            "ioc_value": "37haj.adm1tdebu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 14:28:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674265": [
        {
            "ioc_value": "ix2s.adm1tdebu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 14:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674264": [
        {
            "ioc_value": "te9d.adm1tdebu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 14:07:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674263": [
        {
            "ioc_value": "7n5st.adm1tdebu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 13:57:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674262": [
        {
            "ioc_value": "ee3.gu1enme5ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 13:47:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674261": [
        {
            "ioc_value": "ad6.gu1enme5ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 13:37:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674260": [
        {
            "ioc_value": "8p.gu1enme5ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 13:26:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674259": [
        {
            "ioc_value": "account-captcha.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 13:15:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674258": [
        {
            "ioc_value": "kiraww.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 13:15:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674257": [
        {
            "ioc_value": "tom.demisemarzban.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-10 13:13:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1674254": [
        {
            "ioc_value": "cqwrb.gu1enme5ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 13:11:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674253": [
        {
            "ioc_value": "mint.b0uncerco1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 13:07:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674252": [
        {
            "ioc_value": "sky.b0uncerco1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 12:57:35",
            "last_seen_utc": "2025-12-10 13:01:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674250": [
        {
            "ioc_value": "tom.firsttech-llc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-10 12:54:08",
            "last_seen_utc": "2025-12-10 13:13:08",
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1673651/",
            "tags": "c2,domain,vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1674248": [
        {
            "ioc_value": "umv.b0uncerco1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 12:47:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674247": [
        {
            "ioc_value": "l0eq.b0uncerco1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 12:37:29",
            "last_seen_utc": "2025-12-10 12:42:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674244": [
        {
            "ioc_value": "ynge.lab0urun1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 12:27:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674242": [
        {
            "ioc_value": "lzcea.lab0urun1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 12:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674241": [
        {
            "ioc_value": "5vs.lab0urun1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 12:08:16",
            "last_seen_utc": "2025-12-10 12:09:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674239": [
        {
            "ioc_value": "luvic1de.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 12:02:16",
            "last_seen_utc": "2025-12-10 12:02:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-n4tgxazjhy",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674237": [
        {
            "ioc_value": "sw0ar.lab0urun1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 11:57:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674236": [
        {
            "ioc_value": "ai5.bene1i8ht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 11:48:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674235": [
        {
            "ioc_value": "1tz1u.bene1i8ht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 11:37:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674234": [
        {
            "ioc_value": "2pao.bene1i8ht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 11:27:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674233": [
        {
            "ioc_value": "tenergymanagement.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-10 11:27:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/199.38.100.9",
            "tags": "censys,clickfix,domain,first-stage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1674210": [
        {
            "ioc_value": "8b0ng.bene1i8ht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 11:18:03",
            "last_seen_utc": "2025-12-10 11:23:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674209": [
        {
            "ioc_value": "9j9y4.c2prrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 11:14:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674208": [
        {
            "ioc_value": "bright.c2prrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 11:08:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674207": [
        {
            "ioc_value": "clear.c2prrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 11:05:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674196": [
        {
            "ioc_value": "zbci.c2prrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 10:57:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674195": [
        {
            "ioc_value": "f9.m2kebo1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 10:54:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674194": [
        {
            "ioc_value": "yhsi2.m2kebo1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 10:47:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674193": [
        {
            "ioc_value": "night.m2kebo1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 10:38:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674192": [
        {
            "ioc_value": "storm.m2kebo1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 10:28:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674191": [
        {
            "ioc_value": "lw.dia1ecgoo5e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 10:22:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674190": [
        {
            "ioc_value": "alpha.dia1ecgoo5e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 10:16:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674189": [
        {
            "ioc_value": "35kd.dia1ecgoo5e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 10:07:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674185": [
        {
            "ioc_value": "6q03g.dia1ecgoo5e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 09:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674184": [
        {
            "ioc_value": "5ktt.band5tair5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 09:47:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674183": [
        {
            "ioc_value": "fqz.band5tair5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 09:35:21",
            "last_seen_utc": "2025-12-10 09:41:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674182": [
        {
            "ioc_value": "8l.band5tair5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 09:28:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674181": [
        {
            "ioc_value": "femboy.fuckphillipthegerman.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-10 09:25:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1674180": [
        {
            "ioc_value": "04c.band5tair5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 09:21:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674179": [
        {
            "ioc_value": "flame.na5optwe7ty.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 09:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674178": [
        {
            "ioc_value": "cloud.na5optwe7ty.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 09:08:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674176": [
        {
            "ioc_value": "c8kci.na5optwe7ty.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 08:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674175": [
        {
            "ioc_value": "l4dd.na5optwe7ty.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 08:47:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674172": [
        {
            "ioc_value": "bt6.intrl2bi1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 08:39:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674171": [
        {
            "ioc_value": "delta.intrl2bi1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 08:33:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674170": [
        {
            "ioc_value": "guard.intrl2bi1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 08:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674166": [
        {
            "ioc_value": "hto.demisemarzban.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-10 08:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1674167": [
        {
            "ioc_value": "hto.ejmali.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-10 08:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1674162": [
        {
            "ioc_value": "range.intrl2bi1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 08:17:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674161": [
        {
            "ioc_value": "js.c2shst0sing.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 08:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674143": [
        {
            "ioc_value": "uag.c2shst0sing.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 07:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674142": [
        {
            "ioc_value": "5y3m.c2shst0sing.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 07:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674139": [
        {
            "ioc_value": "z216.c2shst0sing.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 07:37:02",
            "last_seen_utc": "2025-12-10 07:40:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674138": [
        {
            "ioc_value": "hj9.ge7kom0ley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 07:27:48",
            "last_seen_utc": "2025-12-10 07:35:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674137": [
        {
            "ioc_value": "byte.ge7kom0ley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 07:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674136": [
        {
            "ioc_value": "4b.ge7kom0ley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 07:07:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1674135": [
        {
            "ioc_value": "Karated-49398.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-10 07:04:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674133": [
        {
            "ioc_value": "kimberlygeswein.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-10 07:03:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,shortloader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674126": [
        {
            "ioc_value": "ojezulu.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-10 07:02:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674127": [
        {
            "ioc_value": "ojezulu1.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-10 07:02:48",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674128": [
        {
            "ioc_value": "wealthybillionaire2025.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-10 07:02:48",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674129": [
        {
            "ioc_value": "wealthyblessman.minhaempresa.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-10 07:02:48",
            "last_seen_utc": "2025-12-11 13:23:54",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674123": [
        {
            "ioc_value": "monacurzanamoacuza.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-10 07:02:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674124": [
        {
            "ioc_value": "okoaiaznjbwuzudhuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-10 07:02:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674125": [
        {
            "ioc_value": "ytardwtaufzafzgzfe.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-10 07:02:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674120": [
        {
            "ioc_value": "aizgegizgefzaihfud.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-10 07:02:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674121": [
        {
            "ioc_value": "iageufgizaegzgzegd.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-10 07:02:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674122": [
        {
            "ioc_value": "ieuruidijwhwueifik.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-10 07:02:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674115": [
        {
            "ioc_value": "sex.55clubx.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-10 07:01:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674116": [
        {
            "ioc_value": "sex.servicecenters.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-10 07:01:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674117": [
        {
            "ioc_value": "v2.fun88kyc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-10 07:01:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674118": [
        {
            "ioc_value": "v3.fun88kyc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-10 07:01:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674112": [
        {
            "ioc_value": "55clubx.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-10 07:01:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674113": [
        {
            "ioc_value": "google.munafa.co.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-10 07:01:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674114": [
        {
            "ioc_value": "malware.servicecenters.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-10 07:01:51",
            "last_seen_utc": "2025-12-10 07:01:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674099": [
        {
            "ioc_value": "gatex.theplasterhouse.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674100": [
        {
            "ioc_value": "gatex.treasuresofeuropetours.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674101": [
        {
            "ioc_value": "gatex.ulrichstavern.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674102": [
        {
            "ioc_value": "gatex.vaults.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674103": [
        {
            "ioc_value": "gatex.verticalscratchers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674104": [
        {
            "ioc_value": "gatex.viktre.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674105": [
        {
            "ioc_value": "gatex.vintagerpm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674106": [
        {
            "ioc_value": "gatex.weismuseum.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674107": [
        {
            "ioc_value": "gatex.wsf2008.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674108": [
        {
            "ioc_value": "gatex.x3wiki.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674109": [
        {
            "ioc_value": "gatex.yesonpropk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674110": [
        {
            "ioc_value": "gatex.zevitasmarcus.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674111": [
        {
            "ioc_value": "hzmvgdypl.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674080": [
        {
            "ioc_value": "gatex.museumregister.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674081": [
        {
            "ioc_value": "gatex.nativeworkscsc.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674082": [
        {
            "ioc_value": "gatex.nepaaudubon.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674083": [
        {
            "ioc_value": "gatex.nimr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674084": [
        {
            "ioc_value": "gatex.observatoriocriticocuba.or",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674085": [
        {
            "ioc_value": "gatex.omotenashi-movie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674086": [
        {
            "ioc_value": "gatex.ondanet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674087": [
        {
            "ioc_value": "gatex.orlandohistoricinn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674088": [
        {
            "ioc_value": "gatex.pidamazonia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674089": [
        {
            "ioc_value": "gatex.richardstjohn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674090": [
        {
            "ioc_value": "gatex.savethetrident.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674091": [
        {
            "ioc_value": "gatex.seal-of-excellence.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674092": [
        {
            "ioc_value": "gatex.shanebauer.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674093": [
        {
            "ioc_value": "gatex.shericandler.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674094": [
        {
            "ioc_value": "gatex.spaessentials.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674095": [
        {
            "ioc_value": "gatex.springhousepress.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674096": [
        {
            "ioc_value": "gatex.stleonards.london",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674097": [
        {
            "ioc_value": "gatex.suramericapress.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674098": [
        {
            "ioc_value": "gatex.thatsonchaudoc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674060": [
        {
            "ioc_value": "gatex.hogsandhopsbbq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674061": [
        {
            "ioc_value": "gatex.iamerinbrown.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674062": [
        {
            "ioc_value": "gatex.icaird.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674063": [
        {
            "ioc_value": "gatex.inceptionradionetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674064": [
        {
            "ioc_value": "gatex.indigenascovid19.red",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674065": [
        {
            "ioc_value": "gatex.insidestlaudio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674066": [
        {
            "ioc_value": "gatex.jerrysdogs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674067": [
        {
            "ioc_value": "gatex.kgf-movie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674068": [
        {
            "ioc_value": "gatex.lautrec.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674069": [
        {
            "ioc_value": "gatex.lawtofact.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674070": [
        {
            "ioc_value": "gatex.livecleveland.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674071": [
        {
            "ioc_value": "gatex.logocravings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674072": [
        {
            "ioc_value": "gatex.mannalifefood.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674073": [
        {
            "ioc_value": "gatex.martonmogyorosy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674074": [
        {
            "ioc_value": "gatex.mayorlovelywarren.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674075": [
        {
            "ioc_value": "gatex.microcapitalmonitor.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674076": [
        {
            "ioc_value": "gatex.mikewieringo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674077": [
        {
            "ioc_value": "gatex.mipatriaecuador.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674078": [
        {
            "ioc_value": "gatex.monitorduty.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674079": [
        {
            "ioc_value": "gatex.montanea.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674041": [
        {
            "ioc_value": "gatex.cakhiatvu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674042": [
        {
            "ioc_value": "gatex.cakhiatvw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674043": [
        {
            "ioc_value": "gatex.cokelead.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674044": [
        {
            "ioc_value": "gatex.computeagainstcancer.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674045": [
        {
            "ioc_value": "gatex.culturas.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674046": [
        {
            "ioc_value": "gatex.cwejman.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674047": [
        {
            "ioc_value": "gatex.dillingermuseum.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674048": [
        {
            "ioc_value": "gatex.dpvhs.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674049": [
        {
            "ioc_value": "gatex.edmdroid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674050": [
        {
            "ioc_value": "gatex.edwinvieira.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674051": [
        {
            "ioc_value": "gatex.everybodyeveryone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674052": [
        {
            "ioc_value": "gatex.fakewalls.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674053": [
        {
            "ioc_value": "gatex.franksndawgs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674054": [
        {
            "ioc_value": "gatex.fred-london.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674055": [
        {
            "ioc_value": "gatex.goldevestuario.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674056": [
        {
            "ioc_value": "gatex.harmonymurphygallery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674057": [
        {
            "ioc_value": "gatex.herraduraranch.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674058": [
        {
            "ioc_value": "gatex.hogsandhops.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674059": [
        {
            "ioc_value": "gatex.hogsandhopsatlanta.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674020": [
        {
            "ioc_value": "gatex.cakhiatv.is",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674021": [
        {
            "ioc_value": "gatex.cakhiatv.media",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674022": [
        {
            "ioc_value": "gatex.cakhiatv.mx",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674023": [
        {
            "ioc_value": "gatex.cakhiatv.studio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674024": [
        {
            "ioc_value": "gatex.cakhiatv.team",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674025": [
        {
            "ioc_value": "gatex.cakhiatv.tube",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674026": [
        {
            "ioc_value": "gatex.cakhiatv.vc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674027": [
        {
            "ioc_value": "gatex.cakhiatva.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674028": [
        {
            "ioc_value": "gatex.cakhiatvc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674029": [
        {
            "ioc_value": "gatex.cakhiatve.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674030": [
        {
            "ioc_value": "gatex.cakhiatvf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674031": [
        {
            "ioc_value": "gatex.cakhiatvg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674032": [
        {
            "ioc_value": "gatex.cakhiatvh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674033": [
        {
            "ioc_value": "gatex.cakhiatvi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674034": [
        {
            "ioc_value": "gatex.cakhiatvj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674035": [
        {
            "ioc_value": "gatex.cakhiatvk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674036": [
        {
            "ioc_value": "gatex.cakhiatvm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674037": [
        {
            "ioc_value": "gatex.cakhiatvo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674038": [
        {
            "ioc_value": "gatex.cakhiatvp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674039": [
        {
            "ioc_value": "gatex.cakhiatvq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674040": [
        {
            "ioc_value": "gatex.cakhiatvr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674003": [
        {
            "ioc_value": "gatex.70leonardst.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674004": [
        {
            "ioc_value": "gatex.70leonardstreet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674005": [
        {
            "ioc_value": "gatex.8secretsofsuccess.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674006": [
        {
            "ioc_value": "gatex.accadandkoka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674007": [
        {
            "ioc_value": "gatex.artkuwait.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674008": [
        {
            "ioc_value": "gatex.astralpublishing.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674009": [
        {
            "ioc_value": "gatex.atlbbqfest.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674010": [
        {
            "ioc_value": "gatex.bambooorgan.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674011": [
        {
            "ioc_value": "gatex.boulangeriejocteur.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674012": [
        {
            "ioc_value": "gatex.buccaneersgab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674013": [
        {
            "ioc_value": "gatex.butchvoices.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674014": [
        {
            "ioc_value": "gatex.c3style.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674015": [
        {
            "ioc_value": "gatex.cakhiatv.ai",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674016": [
        {
            "ioc_value": "gatex.cakhiatv.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674017": [
        {
            "ioc_value": "gatex.cakhiatv.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674018": [
        {
            "ioc_value": "gatex.cakhiatv.futbol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1674019": [
        {
            "ioc_value": "gatex.cakhiatv.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 07:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673996": [
        {
            "ioc_value": "gate.ge7kom0ley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 06:57:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673994": [
        {
            "ioc_value": "wild.indi5t0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 06:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673993": [
        {
            "ioc_value": "new88.markhancock.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-10 06:41:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/d0609ecac184940c000201c8af3cdf5f4b6bdc6fbab9b5c33ed91495323c9982",
            "tags": "botnet,c2,DcRAT",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1673992": [
        {
            "ioc_value": "audmy.indi5t0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 06:37:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673991": [
        {
            "ioc_value": "mist.indi5t0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 06:34:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673990": [
        {
            "ioc_value": "core.indi5t0st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 06:27:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673989": [
        {
            "ioc_value": "silent.chi1ob5cene.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 06:13:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673988": [
        {
            "ioc_value": "ember.chi1ob5cene.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 06:04:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673983": [
        {
            "ioc_value": "v2.slot123.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-10 06:02:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-dgg59asqgv",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673984": [
        {
            "ioc_value": "v3.slot123.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-10 06:02:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-dgg59asqgv",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673985": [
        {
            "ioc_value": "elearning.hust.health",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-10 06:02:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251210-c6zk6avldn",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673981": [
        {
            "ioc_value": "omega.chi1ob5cene.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 06:00:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673980": [
        {
            "ioc_value": "mjus.chi1ob5cene.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 05:54:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673979": [
        {
            "ioc_value": "crest.c5ech0ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 05:47:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673978": [
        {
            "ioc_value": "hill.c5ech0ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 05:35:42",
            "last_seen_utc": "2025-12-10 05:39:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673977": [
        {
            "ioc_value": "fi4xl.c5ech0ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 05:27:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673976": [
        {
            "ioc_value": "rdfycare.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-10 05:21:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673975": [
        {
            "ioc_value": "dark.c5ech0ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 05:17:05",
            "last_seen_utc": "2025-12-10 05:19:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673970": [
        {
            "ioc_value": "twirl.hexwander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 05:05:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673969": [
        {
            "ioc_value": "hx.hexwander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 04:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673968": [
        {
            "ioc_value": "vortex.hexwander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 04:47:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673962": [
        {
            "ioc_value": "effeminate.fuckphillipthegerman.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-10 04:41:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/ee2fe11a7f43aba14f37897b7c69e2c4b26eef20a8854a838353b59866ee4861/",
            "tags": "CVE-2025-55182,Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673963": [
        {
            "ioc_value": "trap.fuckphillipthegerman.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-10 04:41:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/ee2fe11a7f43aba14f37897b7c69e2c4b26eef20a8854a838353b59866ee4861/",
            "tags": "CVE-2025-55182,Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673964": [
        {
            "ioc_value": "tranny.fuckphillipthegerman.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-10 04:41:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/ee2fe11a7f43aba14f37897b7c69e2c4b26eef20a8854a838353b59866ee4861/",
            "tags": "CVE-2025-55182,Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673961": [
        {
            "ioc_value": "tinker.hexwander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 04:37:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673954": [
        {
            "ioc_value": "repositorylinux.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-10 04:33:07",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://react2025cve-analysis.pages.dev/",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673955": [
        {
            "ioc_value": "gfxnick.emerald.usbx.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-10 04:33:07",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://react2025cve-analysis.pages.dev/",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673956": [
        {
            "ioc_value": "merahmerona.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-10 04:33:07",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://react2025cve-analysis.pages.dev/",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673957": [
        {
            "ioc_value": "meomeoli.mooo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-10 04:33:07",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://react2025cve-analysis.pages.dev/",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673958": [
        {
            "ioc_value": "pub-dc84e32afcfa417fa04d36454032549b.r2.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-10 04:33:07",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://react2025cve-analysis.pages.dev/",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673959": [
        {
            "ioc_value": "f003.backblazeb2.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-10 04:33:07",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://react2025cve-analysis.pages.dev/",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673960": [
        {
            "ioc_value": "ojqgoengwrbeepixspmsu9zuomvrpzdy5.oast.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-10 04:33:07",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://react2025cve-analysis.pages.dev/",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673953": [
        {
            "ioc_value": "6y504.hex-wander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 04:27:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673951": [
        {
            "ioc_value": "trace.hex-wander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 04:17:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673949": [
        {
            "ioc_value": "pattern.hex-wander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 04:07:38",
            "last_seen_utc": "2025-12-10 04:13:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673947": [
        {
            "ioc_value": "test.download1818.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-10 04:05:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/207ca7b4d95732a92aa9fd34185084b127bc5e3fcfcd2061874d452f76290dc5/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673933": [
        {
            "ioc_value": "shift.hex-wander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 03:58:22",
            "last_seen_utc": "2025-12-10 03:59:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673932": [
        {
            "ioc_value": "draft22.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-10 03:52:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5db3a4be1c6eb9039ca4fcc8bec385f51f6cd4c3b752d3d13d175449f85e1dd5/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673931": [
        {
            "ioc_value": "gamma.patterjack.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 03:48:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673930": [
        {
            "ioc_value": "r15u.patterjack.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 03:39:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673929": [
        {
            "ioc_value": "b3xts.patterjack.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 03:26:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673856": [
        {
            "ioc_value": "api-logs-b794.onrender.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 03:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0f529e424b18e942540829a675f38b35c5bf190dcae224b8b92383d401e9824e/",
            "tags": "c2,SilentStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1673878": [
        {
            "ioc_value": "duedilligence.com.au",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-10 03:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/67.219.100.49+duedilligence.com.au",
            "tags": "AS-VULTR,AS20473,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1673881": [
        {
            "ioc_value": "ifg.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-10 03:20:23",
            "last_seen_utc": "2025-12-10 00:02:49",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+ifg.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1673882": [
        {
            "ioc_value": "analytics.sentihey.dedyn.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-10 03:20:21",
            "last_seen_utc": "2025-12-10 00:02:51",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/212.132.68.79+analytics.sentihey.dedyn.io",
            "tags": "AS8560,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1673883": [
        {
            "ioc_value": "infozzle.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-10 03:20:21",
            "last_seen_utc": "2025-12-10 00:02:52",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+infozzle.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1673911": [
        {
            "ioc_value": "motphimchilli.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 03:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/b5ebd46e76d9f04e186654ab23e0e29cf72267f667bb7f54d91a532edb6ffb14",
            "tags": "asyncrat,botnet,c2",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1673914": [
        {
            "ioc_value": "motphimr.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-10 03:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/b45af1db52c1ff1b5c5529c05113971880d8799e82f1d42606acf2f7ffa69b46",
            "tags": "botnet,c2,QuasarRAT",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1673918": [
        {
            "ioc_value": "kuban.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 03:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/bf9c08ee1c58899f4734654f212c88f884006b4cb72f1fc959beee10613980a7/relations",
            "tags": "asyncrat,botnet,c2",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1673919": [
        {
            "ioc_value": "login.kuban.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-10 03:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/bf9c08ee1c58899f4734654f212c88f884006b4cb72f1fc959beee10613980a7/relations",
            "tags": "asyncrat,botnet,c2",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1673842": [
        {
            "ioc_value": "possibleresc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-10 03:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115691428170163449",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1673928": [
        {
            "ioc_value": "duu.patterjack.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 03:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673926": [
        {
            "ioc_value": "xydizainten.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-10 03:14:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/263f1db1c1eafd6757f7ca97bd9eef9c4df026777d1d5db133c4482e9e70251b/",
            "tags": "Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673925": [
        {
            "ioc_value": "n1.fr-1-zzlepit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 03:07:51",
            "last_seen_utc": "2025-12-10 03:15:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673923": [
        {
            "ioc_value": "nova.fr-1-zzlepit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 02:57:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673922": [
        {
            "ioc_value": "q9x.fr-1-zzlepit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 02:48:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673921": [
        {
            "ioc_value": "mkst8.fr-1-zzlepit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 02:33:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673920": [
        {
            "ioc_value": "hj2c.fr1zzlepit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 02:28:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673917": [
        {
            "ioc_value": "u5x.fr1zzlepit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 02:17:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673916": [
        {
            "ioc_value": "xr.fr1zzlepit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 02:08:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673915": [
        {
            "ioc_value": "27.fr1zzlepit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 01:57:47",
            "last_seen_utc": "2025-12-10 02:04:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673913": [
        {
            "ioc_value": "3s.g0bcrumb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 01:47:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673912": [
        {
            "ioc_value": "7a0xj.g0bcrumb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 01:37:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673910": [
        {
            "ioc_value": "jumble.g0bcrumb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 01:27:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673909": [
        {
            "ioc_value": "7dbj.g0bcrumb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 01:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673908": [
        {
            "ioc_value": "hex.twirlpane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 01:07:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673907": [
        {
            "ioc_value": "wander.twirlpane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 00:57:25",
            "last_seen_utc": "2025-12-10 00:59:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673906": [
        {
            "ioc_value": "1euk.twirlpane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 00:47:07",
            "last_seen_utc": "2025-12-10 00:51:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673905": [
        {
            "ioc_value": "beta.twirlpane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 00:36:50",
            "last_seen_utc": "2025-12-10 00:46:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673904": [
        {
            "ioc_value": "weird.twirl-pane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 00:28:03",
            "last_seen_utc": "2025-12-10 00:30:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673903": [
        {
            "ioc_value": "pixel.twirl-pane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 00:16:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673902": [
        {
            "ioc_value": "bit.twirl-pane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-10 00:07:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673900": [
        {
            "ioc_value": "myaccount.sentihey.dedyn.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-10 00:02:50",
            "last_seen_utc": "2025-12-10 11:01:01",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/212.132.68.79+myaccount.sentihey.dedyn.io",
            "tags": "AS8560,C2,censys,Havoc,IONOS-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673894": [
        {
            "ioc_value": "jt5.twirl-pane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 23:57:39",
            "last_seen_utc": "2025-12-10 00:07:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673893": [
        {
            "ioc_value": "v5.quirkpaste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 23:47:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673892": [
        {
            "ioc_value": "dizzy.quirkpaste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 23:32:17",
            "last_seen_utc": "2025-12-09 23:42:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673891": [
        {
            "ioc_value": "o27y.quirkpaste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 23:28:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673890": [
        {
            "ioc_value": "crumb.quirkpaste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 23:16:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673889": [
        {
            "ioc_value": "glitch.quirk-paste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 23:07:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673868": [
        {
            "ioc_value": "97dz.quirk-paste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 22:57:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673867": [
        {
            "ioc_value": "jack.quirk-paste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 22:47:34",
            "last_seen_utc": "2025-12-09 22:56:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673865": [
        {
            "ioc_value": "bv.quirk-paste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 22:37:46",
            "last_seen_utc": "2025-12-09 22:44:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673864": [
        {
            "ioc_value": "0gays.siickhorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 22:26:30",
            "last_seen_utc": "2025-12-09 22:30:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673863": [
        {
            "ioc_value": "warp.siickhorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 22:17:14",
            "last_seen_utc": "2025-12-09 22:21:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673862": [
        {
            "ioc_value": "mw.siickhorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 22:08:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673861": [
        {
            "ioc_value": "frizzle.siickhorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 21:56:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673860": [
        {
            "ioc_value": "7is1.bl0bspinner.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 21:54:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673857": [
        {
            "ioc_value": "blob.bl0bspinner.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 21:44:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673855": [
        {
            "ioc_value": "dog.bl0bspinner.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 21:34:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673854": [
        {
            "ioc_value": "loop.bl0bspinner.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 21:22:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673853": [
        {
            "ioc_value": "4o6i.mashvortex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 21:19:00",
            "last_seen_utc": "2025-12-09 21:19:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1673849": [
        {
            "ioc_value": "alpha.mashvortex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 21:07:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673848": [
        {
            "ioc_value": "37s.mashvortex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 20:57:47",
            "last_seen_utc": "2025-12-09 21:06:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673847": [
        {
            "ioc_value": "spark.mashvortex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 20:47:26",
            "last_seen_utc": "2025-12-09 20:50:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673846": [
        {
            "ioc_value": "t4z.tinkerstep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 20:31:17",
            "last_seen_utc": "2025-12-09 20:33:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673844": [
        {
            "ioc_value": "nexus.tinkerstep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 20:25:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673843": [
        {
            "ioc_value": "kn6m.tinkerstep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 20:16:01",
            "last_seen_utc": "2025-12-09 20:21:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673838": [
        {
            "ioc_value": "spinner.tinkerstep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 20:07:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673814": [
        {
            "ioc_value": "qelrin.wildstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673813": [
        {
            "ioc_value": "nurvak.wildstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 19:46:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673811": [
        {
            "ioc_value": "drax1m.wildstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 19:32:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673810": [
        {
            "ioc_value": "stremy.wildstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 19:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673809": [
        {
            "ioc_value": "wildor.wildstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 19:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673807": [
        {
            "ioc_value": "tarvel.starl1ght.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 19:08:30",
            "last_seen_utc": "2025-12-09 19:09:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1673806": [
        {
            "ioc_value": "radian.starl1ght.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 19:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673805": [
        {
            "ioc_value": "lum1st.starl1ght.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 18:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673803": [
        {
            "ioc_value": "glaron.starl1ght.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 18:47:13",
            "last_seen_utc": "2025-12-09 18:53:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673802": [
        {
            "ioc_value": "stelyx.starl1ght.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 18:44:04",
            "last_seen_utc": "2025-12-09 18:44:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673801": [
        {
            "ioc_value": "velcro.nightf0rest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 18:32:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673800": [
        {
            "ioc_value": "murnet.nightf0rest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 18:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673799": [
        {
            "ioc_value": "thrn1x.nightf0rest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 18:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673791": [
        {
            "ioc_value": "safevpnconnection.anondns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-12-09 18:10:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-sa6mlaykbt",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673789": [
        {
            "ioc_value": "forenx.nightf0rest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 18:07:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673786": [
        {
            "ioc_value": "malware.apsom.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 18:03:02",
            "last_seen_utc": "2025-12-11 16:57:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-vp1q1abm8v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673785": [
        {
            "ioc_value": "apsom.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 18:02:50",
            "last_seen_utc": "2025-12-11 16:57:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-vp1q1abm8v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673784": [
        {
            "ioc_value": "11243debestreeeemcoxxxx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-09 18:02:03",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-txbleaypcs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673780": [
        {
            "ioc_value": "wow.khalidalshawwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-09 18:01:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-tazdysgx6g",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673778": [
        {
            "ioc_value": "nighal.nightf0rest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 18:01:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673776": [
        {
            "ioc_value": "strivo.brightw1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 17:57:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673775": [
        {
            "ioc_value": "glaven.brightw1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 17:47:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673774": [
        {
            "ioc_value": "flar1n.brightw1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 17:38:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673773": [
        {
            "ioc_value": "wingor.brightw1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 17:27:15",
            "last_seen_utc": "2025-12-09 17:31:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673772": [
        {
            "ioc_value": "brilax.brightw1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 17:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673769": [
        {
            "ioc_value": "sevrin.oceanpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 17:00:55",
            "last_seen_utc": "2025-12-09 17:05:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673768": [
        {
            "ioc_value": "tidalo.oceanpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 16:55:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673767": [
        {
            "ioc_value": "marq1n.oceanpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 16:47:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673765": [
        {
            "ioc_value": "wavren.oceanpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 16:31:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673762": [
        {
            "ioc_value": "oceryl.oceanpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 16:27:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673760": [
        {
            "ioc_value": "merqil.bl0omgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 16:13:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673759": [
        {
            "ioc_value": "teldan.bl0omgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 16:08:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673736": [
        {
            "ioc_value": "heronwater1337.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-09 16:03:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1829600/1/html#domains",
            "tags": "c2",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1673753": [
        {
            "ioc_value": "adani.ddnsgeek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-09 16:02:34",
            "last_seen_utc": "2025-12-09 23:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/194.182.64.104+adani.ddnsgeek.com",
            "tags": "AS24806,C2,censys,Havoc,INTERNET-CZ",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673742": [
        {
            "ioc_value": "brik0n.bl0omgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 15:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673735": [
        {
            "ioc_value": "vlooma.bl0omgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 15:42:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673734": [
        {
            "ioc_value": "garmet.bl0omgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 15:37:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673729": [
        {
            "ioc_value": "durnel.sunshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 15:27:37",
            "last_seen_utc": "2025-12-09 15:30:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673728": [
        {
            "ioc_value": "mechiraz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.matanbuchus",
            "malware_alias": null,
            "malware_printable": "Matanbuchus",
            "first_seen_utc": "2025-12-09 15:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/77a53dc757fdf381d3906ab256b74ad3cdb7628261c58a62bcc9c6ca605307ba/",
            "tags": "Matanbuchus",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673727": [
        {
            "ioc_value": "krasil.sunshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 15:13:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673726": [
        {
            "ioc_value": "soliq1.sunshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 15:08:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673670": [
        {
            "ioc_value": "halvyn.sunshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 14:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673669": [
        {
            "ioc_value": "sunwex.sunshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 14:54:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673668": [
        {
            "ioc_value": "trivol.clears0ul.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 14:48:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673667": [
        {
            "ioc_value": "serqen.clears0ul.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 14:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673663": [
        {
            "ioc_value": "lum0ra.clears0ul.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 14:27:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673661": [
        {
            "ioc_value": "aersin.clears0ul.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 14:13:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673660": [
        {
            "ioc_value": "clemnor.clears0ul.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 14:06:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673658": [
        {
            "ioc_value": "perliq.rivercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 13:57:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673657": [
        {
            "ioc_value": "droven.rivercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 13:46:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673654": [
        {
            "ioc_value": "lov.demisemarzban.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-09 13:40:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1673655": [
        {
            "ioc_value": "lov.ejmali.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-09 13:40:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1673649": [
        {
            "ioc_value": "valky2.rivercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 13:39:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673643": [
        {
            "ioc_value": "widenews.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:29",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673644": [
        {
            "ioc_value": "web12.alliancepaytest.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673645": [
        {
            "ioc_value": "webdisk.sushymns.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673646": [
        {
            "ioc_value": "womenworkingtogether.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673647": [
        {
            "ioc_value": "webmail.umeedshiksharath.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:29",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673648": [
        {
            "ioc_value": "wewheel.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:29",
            "last_seen_utc": "2025-12-12 18:01:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673635": [
        {
            "ioc_value": "webdisk.tamiltotamil.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:28",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673636": [
        {
            "ioc_value": "webmail.uranium-news.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:28",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673637": [
        {
            "ioc_value": "vidaedinheiro.com.agenciadelivearte.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:28",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673638": [
        {
            "ioc_value": "whm.sindangkasihnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673639": [
        {
            "ioc_value": "website-9988a09b.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:28",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673640": [
        {
            "ioc_value": "whm.giracoin.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673641": [
        {
            "ioc_value": "website.studiocaravan.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673642": [
        {
            "ioc_value": "wishlist.miarcus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:28",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673627": [
        {
            "ioc_value": "urzone.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673628": [
        {
            "ioc_value": "uilfpl.bz.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:27",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673629": [
        {
            "ioc_value": "vietorigin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:27",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673630": [
        {
            "ioc_value": "webdisk.giracoin.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:27",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673631": [
        {
            "ioc_value": "webdisk.moro-mie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673632": [
        {
            "ioc_value": "webmail.kasatnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:27",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673633": [
        {
            "ioc_value": "wanchai-cleaning.com.63944387-4-20190715204404.webstarterz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:27",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673634": [
        {
            "ioc_value": "vafglobal.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:27",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673449": [
        {
            "ioc_value": "acebirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:26",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673451": [
        {
            "ioc_value": "adrianadecastrojewelry.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:26",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673621": [
        {
            "ioc_value": "taskageniusalamin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673622": [
        {
            "ioc_value": "tongdaixeghepyenlinh.io.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673623": [
        {
            "ioc_value": "trustedservicez.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:26",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673624": [
        {
            "ioc_value": "tradesunjapan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:26",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673625": [
        {
            "ioc_value": "ulwaza.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673626": [
        {
            "ioc_value": "truongminhduc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673450": [
        {
            "ioc_value": "abeno-snake.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673614": [
        {
            "ioc_value": "souzaeferro.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673615": [
        {
            "ioc_value": "taias.lt",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673616": [
        {
            "ioc_value": "taqrisenterprise.com.nexus-my.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:25",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673617": [
        {
            "ioc_value": "skyxin.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673618": [
        {
            "ioc_value": "svenmoelleken.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:25",
            "last_seen_utc": "2025-12-12 18:01:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673619": [
        {
            "ioc_value": "tehahfandbtrading.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:25",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673620": [
        {
            "ioc_value": "sp0t.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673447": [
        {
            "ioc_value": "250julie.nohassle.website",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673448": [
        {
            "ioc_value": "abac-kompresszor.hu.technorollshop.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673604": [
        {
            "ioc_value": "shatalarabgroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673605": [
        {
            "ioc_value": "simanys.yln.mfs.temporary.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673606": [
        {
            "ioc_value": "saturnfoundation.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673607": [
        {
            "ioc_value": "shop.jlct.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673608": [
        {
            "ioc_value": "simz2.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673609": [
        {
            "ioc_value": "soulcirclewellness.rocketrobs.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": "2025-12-10 23:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673610": [
        {
            "ioc_value": "sl-baker.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673611": [
        {
            "ioc_value": "sonatindustries.com.weendugroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673612": [
        {
            "ioc_value": "sinq-biyou.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673613": [
        {
            "ioc_value": "stockexchangejournal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673596": [
        {
            "ioc_value": "resume.nicholastuck.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673597": [
        {
            "ioc_value": "retrorecycler.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673598": [
        {
            "ioc_value": "roxsolidbookkeeping.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:23",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673599": [
        {
            "ioc_value": "rochaesantos.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673600": [
        {
            "ioc_value": "rubycell-fukuoka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673601": [
        {
            "ioc_value": "satwikskincare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673602": [
        {
            "ioc_value": "sahacom.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:23",
            "last_seen_utc": "2025-12-10 23:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673603": [
        {
            "ioc_value": "raillinesyr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673591": [
        {
            "ioc_value": "plaisir-kobe.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673592": [
        {
            "ioc_value": "puriru.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:22",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673594": [
        {
            "ioc_value": "ramoseandrade.com.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673595": [
        {
            "ioc_value": "renaceconcarino.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673588": [
        {
            "ioc_value": "online.fundacaoiluminar.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:21",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673589": [
        {
            "ioc_value": "persianprime.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673590": [
        {
            "ioc_value": "orthodontist-time2smile.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673581": [
        {
            "ioc_value": "mobicard.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673582": [
        {
            "ioc_value": "marinavarro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673583": [
        {
            "ioc_value": "new.sushymns.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673584": [
        {
            "ioc_value": "navaship.com.sg",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:20",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673585": [
        {
            "ioc_value": "nicktuck.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:20",
            "last_seen_utc": "2025-12-11 19:29:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673586": [
        {
            "ioc_value": "nailsalon-tete.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:20",
            "last_seen_utc": "2025-12-11 19:29:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673587": [
        {
            "ioc_value": "nutraforyou.shop.suavidaadois.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:20",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673574": [
        {
            "ioc_value": "marceloleiteadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673575": [
        {
            "ioc_value": "mehraz.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673576": [
        {
            "ioc_value": "mail.makeyoursite.cyou",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673577": [
        {
            "ioc_value": "mms-cds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:19",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673578": [
        {
            "ioc_value": "min-kbys.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:19",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673579": [
        {
            "ioc_value": "misadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673580": [
        {
            "ioc_value": "mp-drone.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673561": [
        {
            "ioc_value": "mail.technorollshop.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673562": [
        {
            "ioc_value": "mail.fastpasstijuana.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673563": [
        {
            "ioc_value": "mail.integratedproperties.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673564": [
        {
            "ioc_value": "mail.gconfisur.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673565": [
        {
            "ioc_value": "mail.vascoinsurance.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673566": [
        {
            "ioc_value": "mail.2connect-eg.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673567": [
        {
            "ioc_value": "mail.website-planet.gr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673568": [
        {
            "ioc_value": "mail.remembrance.love",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673569": [
        {
            "ioc_value": "makeyoursite.cyou",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673570": [
        {
            "ioc_value": "mail.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673571": [
        {
            "ioc_value": "mail.wanchai-cleaning.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673572": [
        {
            "ioc_value": "mail.universalguvenlik.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673573": [
        {
            "ioc_value": "marketwizardspro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:18",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673552": [
        {
            "ioc_value": "mail.atibinhos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673553": [
        {
            "ioc_value": "lp.jezreelacademy.edu.ec",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:17",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673554": [
        {
            "ioc_value": "koreyan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:17",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673555": [
        {
            "ioc_value": "mail.anyamanaska.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673556": [
        {
            "ioc_value": "leading-career-support.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:17",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673557": [
        {
            "ioc_value": "lacouleurs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:17",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673558": [
        {
            "ioc_value": "mail.concavomotorcars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673559": [
        {
            "ioc_value": "mail.iyana.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:17",
            "last_seen_utc": "2025-12-10 23:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673560": [
        {
            "ioc_value": "mail.deeptechcentre.ug",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673542": [
        {
            "ioc_value": "lesleyprosko.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673543": [
        {
            "ioc_value": "lembu777.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673544": [
        {
            "ioc_value": "lopesevinicius.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673545": [
        {
            "ioc_value": "landtransparency.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673546": [
        {
            "ioc_value": "lstlandfillexpansion.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673547": [
        {
            "ioc_value": "lupstyle.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": "2025-12-10 23:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673548": [
        {
            "ioc_value": "lupolab.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673549": [
        {
            "ioc_value": "mail.bluedemo.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673550": [
        {
            "ioc_value": "mail.atxsa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673551": [
        {
            "ioc_value": "mail.charlaentreamigos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673533": [
        {
            "ioc_value": "kamicia-kobe.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:15",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673534": [
        {
            "ioc_value": "jagerkaffee.dev.metasoft.sk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673535": [
        {
            "ioc_value": "karlacontract.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673536": [
        {
            "ioc_value": "kokoslotlogin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:15",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673537": [
        {
            "ioc_value": "krcloset.com.br.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673538": [
        {
            "ioc_value": "laermschutz-leversen.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673539": [
        {
            "ioc_value": "kmadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673540": [
        {
            "ioc_value": "landingwm.develop-app.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673541": [
        {
            "ioc_value": "legalads.adv.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673523": [
        {
            "ioc_value": "homesofpalmbeachcounty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673524": [
        {
            "ioc_value": "hakogashi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673525": [
        {
            "ioc_value": "jaymeadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673526": [
        {
            "ioc_value": "joselicaadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673527": [
        {
            "ioc_value": "int.tumainischoolstanzaniafoundation.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673528": [
        {
            "ioc_value": "junkcarpatrol.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673529": [
        {
            "ioc_value": "ipacarai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673530": [
        {
            "ioc_value": "hobidir.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673531": [
        {
            "ioc_value": "jinentai.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673532": [
        {
            "ioc_value": "karenfernandesadv.com.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673516": [
        {
            "ioc_value": "hako-kobe.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:13",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673517": [
        {
            "ioc_value": "harashima-cpta.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673518": [
        {
            "ioc_value": "hasenbergl.umzug-milbertshofen.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673519": [
        {
            "ioc_value": "greengarden-gs.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673520": [
        {
            "ioc_value": "indian--express.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673521": [
        {
            "ioc_value": "immo.wordt-ontwikkeld.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:13",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673522": [
        {
            "ioc_value": "hundertvier.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:13",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673509": [
        {
            "ioc_value": "gloriousinventory.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673510": [
        {
            "ioc_value": "ftp.educatorshub.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:12",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673511": [
        {
            "ioc_value": "grunaumetals.pairsite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673512": [
        {
            "ioc_value": "greglo-kk-com.check-xserver.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673513": [
        {
            "ioc_value": "guerreiroadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673514": [
        {
            "ioc_value": "gld.wisedesignlab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:12",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673515": [
        {
            "ioc_value": "h-i-c.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:12",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673498": [
        {
            "ioc_value": "foodi-edge.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673499": [
        {
            "ioc_value": "fressiahealthcare.com.digitaljaydeep.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673500": [
        {
            "ioc_value": "francizaimobiliara.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673501": [
        {
            "ioc_value": "ftp.hotelthilanka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673502": [
        {
            "ioc_value": "fromlink.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673503": [
        {
            "ioc_value": "fishmeaqua.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673504": [
        {
            "ioc_value": "ftp.hermanngmeinerscz.edu.bo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673505": [
        {
            "ioc_value": "exchange.southafricanza.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673506": [
        {
            "ioc_value": "fieb.salvador.br.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": "2025-12-10 23:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673507": [
        {
            "ioc_value": "gabinet-cormed.com.pl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673508": [
        {
            "ioc_value": "ftp.sindangkasihnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673489": [
        {
            "ioc_value": "dr-carind.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:10",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673490": [
        {
            "ioc_value": "directapi.insidebnb.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673491": [
        {
            "ioc_value": "ejthr.citur-tourismresearch.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:10",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673492": [
        {
            "ioc_value": "faltbuecher.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673493": [
        {
            "ioc_value": "eso.fwf.temporary.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:10",
            "last_seen_utc": "2025-12-12 18:00:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673494": [
        {
            "ioc_value": "ferreirarezende.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673495": [
        {
            "ioc_value": "extra-company-dev.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:10",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673496": [
        {
            "ioc_value": "fanaco-lab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:10",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673497": [
        {
            "ioc_value": "eclubjp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673480": [
        {
            "ioc_value": "cpanel.parashaktisolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:09",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673481": [
        {
            "ioc_value": "cpcontacts.shouryapuram.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673482": [
        {
            "ioc_value": "davisbrothersconstructionllc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673483": [
        {
            "ioc_value": "combinedscience2.acktechnologies.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673484": [
        {
            "ioc_value": "cpanel.sindangkasihnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:09",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673485": [
        {
            "ioc_value": "dev.itecor.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:09",
            "last_seen_utc": "2025-12-10 23:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673486": [
        {
            "ioc_value": "developmentsite1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673487": [
        {
            "ioc_value": "dakarplaquiste.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:09",
            "last_seen_utc": "2025-12-11 19:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673488": [
        {
            "ioc_value": "dosanjosadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673473": [
        {
            "ioc_value": "cash4lifepowerball.com.araiexpress.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673474": [
        {
            "ioc_value": "chirin-chirin.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673475": [
        {
            "ioc_value": "cmbf.yaakka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673476": [
        {
            "ioc_value": "comunalaprende.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:08",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673477": [
        {
            "ioc_value": "cds.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673478": [
        {
            "ioc_value": "cpanel.blancosettlement.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:08",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673479": [
        {
            "ioc_value": "cpanel.firingpinjournal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:08",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673470": [
        {
            "ioc_value": "autodiscover.kasatnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:07",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673471": [
        {
            "ioc_value": "bhargavahospital.in.adskonic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673472": [
        {
            "ioc_value": "bylinkyzdomova.cz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673461": [
        {
            "ioc_value": "awzelboya.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673462": [
        {
            "ioc_value": "avanteoficina.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:06",
            "last_seen_utc": "2025-12-11 19:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673463": [
        {
            "ioc_value": "autodiscover.joss77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673464": [
        {
            "ioc_value": "autodiscover.uranium-news.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673465": [
        {
            "ioc_value": "artyexplains.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:06",
            "last_seen_utc": "2025-12-11 19:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673466": [
        {
            "ioc_value": "bachiko.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673467": [
        {
            "ioc_value": "bio.samtiagoadv.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:06",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673468": [
        {
            "ioc_value": "bee-viral.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:06",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673469": [
        {
            "ioc_value": "bihaku77.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:06",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673454": [
        {
            "ioc_value": "aki-office.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:05",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673455": [
        {
            "ioc_value": "accurite.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:05",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673456": [
        {
            "ioc_value": "apnaudhyog.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673457": [
        {
            "ioc_value": "apnaudhyog.com.digitaljaydeep.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673458": [
        {
            "ioc_value": "akusoft.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:05",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673459": [
        {
            "ioc_value": "appl.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:05",
            "last_seen_utc": "2025-12-10 23:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673460": [
        {
            "ioc_value": "aegeandestincondos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673452": [
        {
            "ioc_value": "academiaamar.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:04",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673453": [
        {
            "ioc_value": "admin.ttqm.com.sg",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-09 13:35:04",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1673446": [
        {
            "ioc_value": "cedran.rivercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 13:34:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673445": [
        {
            "ioc_value": "rivmox.rivercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 13:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673444": [
        {
            "ioc_value": "skunyo.cloudrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 13:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673443": [
        {
            "ioc_value": "tavrel.cloudrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 13:14:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673442": [
        {
            "ioc_value": "morz1n.cloudrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 13:08:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673437": [
        {
            "ioc_value": "claryn.cloudrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 13:02:58",
            "last_seen_utc": "2025-12-09 13:06:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673435": [
        {
            "ioc_value": "vexlun.cloudrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673434": [
        {
            "ioc_value": "flame.dia1re5pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:55:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673432": [
        {
            "ioc_value": "627.dia1re5pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:47:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673431": [
        {
            "ioc_value": "eayxz.dia1re5pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:42:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673430": [
        {
            "ioc_value": "mist.dia1re5pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:37:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673369": [
        {
            "ioc_value": "slot123.jp.net",
            "ioc_type": "domain",
            "threat_type": "cc_skimming",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 12:36:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/291eefee3ed2adfb9d285db81ffb60e8799e76ebce556813f621d424f0f62786/detection",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1673387": [
        {
            "ioc_value": "www.imcoin.fish",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-09 12:36:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.30.77.154+www.imcoin.fish",
            "tags": "AS932,C2,censys,XNNET",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1673429": [
        {
            "ioc_value": "jqqice.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:35:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673428": [
        {
            "ioc_value": "account-extracaptcha.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:35:04",
            "last_seen_utc": "2025-12-11 07:50:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673427": [
        {
            "ioc_value": "ember.con8ratgr2de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:27:35",
            "last_seen_utc": "2025-12-09 12:37:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673426": [
        {
            "ioc_value": "b2q.con8ratgr2de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:17:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673423": [
        {
            "ioc_value": "light.con8ratgr2de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 12:07:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673422": [
        {
            "ioc_value": "iceiiskeng.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-12-09 12:06:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-lap7aawndq",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673421": [
        {
            "ioc_value": "kycb.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-12-09 12:06:10",
            "last_seen_utc": "2025-12-12 18:39:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-hkrw3svkh1",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673414": [
        {
            "ioc_value": "kali.hackcom.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-09 12:02:13",
            "last_seen_utc": "2025-12-12 18:39:52",
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-njyk5ady7h",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673413": [
        {
            "ioc_value": "mal.hackcom.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-09 12:02:11",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-njyk5ady7h",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673409": [
        {
            "ioc_value": "hqo7.con8ratgr2de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 11:59:11",
            "last_seen_utc": "2025-12-09 12:02:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673408": [
        {
            "ioc_value": "trace.ine7tinve7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 11:53:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673407": [
        {
            "ioc_value": "spark.ine7tinve7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 11:48:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673406": [
        {
            "ioc_value": "hvpri.ine7tinve7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 11:43:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673405": [
        {
            "ioc_value": "vector.ine7tinve7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 11:37:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673404": [
        {
            "ioc_value": "gate.akmei5mh0t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 11:28:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673403": [
        {
            "ioc_value": "ng.akmei5mh0t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 11:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673402": [
        {
            "ioc_value": "clear.akmei5mh0t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 11:07:53",
            "last_seen_utc": "2025-12-09 11:12:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673386": [
        {
            "ioc_value": "xi4l.akmei5mh0t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 10:57:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673385": [
        {
            "ioc_value": "beta.in5istle5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 10:47:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673384": [
        {
            "ioc_value": "delta.in5istle5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 10:38:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673383": [
        {
            "ioc_value": "deep.in5istle5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 10:32:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673382": [
        {
            "ioc_value": "dark.in5istle5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 10:26:29",
            "last_seen_utc": "2025-12-09 10:31:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673381": [
        {
            "ioc_value": "3azj.c0nfirmlo0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 10:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673380": [
        {
            "ioc_value": "54gbp.c0nfirmlo0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 10:07:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673375": [
        {
            "ioc_value": "nova.c0nfirmlo0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 09:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673374": [
        {
            "ioc_value": "sky.c0nfirmlo0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 09:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673373": [
        {
            "ioc_value": "j9.mcr0phnuc1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 09:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673372": [
        {
            "ioc_value": "697yp.mcr0phnuc1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 09:28:40",
            "last_seen_utc": "2025-12-09 09:30:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673371": [
        {
            "ioc_value": "slot123.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-09 09:25:20",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/fc10f366564e61290add3a2002142b7a6f24c5a434ed1201d671b32d8ef9f84b/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673370": [
        {
            "ioc_value": "5kn.mcr0phnuc1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 09:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673366": [
        {
            "ioc_value": "guard.mcr0phnuc1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 09:08:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673365": [
        {
            "ioc_value": "6gh.izn5ty1ize.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 08:57:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673363": [
        {
            "ioc_value": "river.izn5ty1ize.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 08:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673361": [
        {
            "ioc_value": "ko48.izn5ty1ize.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 08:39:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673359": [
        {
            "ioc_value": "9r1ca.izn5ty1ize.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 08:24:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673358": [
        {
            "ioc_value": "pixel.li1mi8rat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 08:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673357": [
        {
            "ioc_value": "j1o0.li1mi8rat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 08:07:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673347": [
        {
            "ioc_value": "pre.automanpk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-09 08:06:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1673348": [
        {
            "ioc_value": "pre.dirayat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-09 08:06:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1673332": [
        {
            "ioc_value": "yf9.li1mi8rat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 07:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673331": [
        {
            "ioc_value": "7hv.li1mi8rat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 07:47:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673330": [
        {
            "ioc_value": "jhuy.into1erma5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 07:38:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673326": [
        {
            "ioc_value": "9o.into1erma5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 07:22:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673325": [
        {
            "ioc_value": "ex.into1erma5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 07:11:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673324": [
        {
            "ioc_value": "mist.into1erma5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 07:05:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673323": [
        {
            "ioc_value": "garfieldjubilee.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-09 07:03:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-htqelsvqhj/",
            "tags": "c2,clickfix,domain,first-stage,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673322": [
        {
            "ioc_value": "vmx.b0rtnge5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 07:01:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673310": [
        {
            "ioc_value": "su.b0rtnge5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 06:50:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673308": [
        {
            "ioc_value": "dauphca.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-09 06:50:20",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673309": [
        {
            "ioc_value": "acclafc.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-09 06:50:20",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673307": [
        {
            "ioc_value": "www.neggpay.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-09 06:46:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-hhz5nsvkg1",
            "tags": "clickfix,domain,first-stage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1673306": [
        {
            "ioc_value": "wormspark.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-09 06:43:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1673305": [
        {
            "ioc_value": "dapper.b0rtnge5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 06:37:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1673298": [
        {
            "ioc_value": "rutuneuenfuhusg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673299": [
        {
            "ioc_value": "sogounfsungunrg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673300": [
        {
            "ioc_value": "ubanedanigmimig.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673301": [
        {
            "ioc_value": "ueinaieugnusfig.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673302": [
        {
            "ioc_value": "uhiueaaubgbuadg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673303": [
        {
            "ioc_value": "uniunieubfiubgg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673304": [
        {
            "ioc_value": "uririneinigning.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673286": [
        {
            "ioc_value": "niemfoefomsegig.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673287": [
        {
            "ioc_value": "nifaneieugunuug.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673288": [
        {
            "ioc_value": "nniaendiandiihg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673289": [
        {
            "ioc_value": "oaoeuoouegandsg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673290": [
        {
            "ioc_value": "ploaiedueaigzefag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673291": [
        {
            "ioc_value": "ploaiedueaigzefeg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673292": [
        {
            "ioc_value": "ploaiedueaigzefg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673293": [
        {
            "ioc_value": "ploaiedueaigzefk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673294": [
        {
            "ioc_value": "ploaiedueaigzefmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673295": [
        {
            "ioc_value": "ploaiedueaigzefp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673296": [
        {
            "ioc_value": "ploaiedueaigzefrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673297": [
        {
            "ioc_value": "pojoieaohauubfg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673270": [
        {
            "ioc_value": "ieanubfiuagugng.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673271": [
        {
            "ioc_value": "iinnfuaeidaighg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673272": [
        {
            "ioc_value": "isohgohrusurgdg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673273": [
        {
            "ioc_value": "iuauebfeufuuasg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673274": [
        {
            "ioc_value": "iuebfiueifuitog.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673275": [
        {
            "ioc_value": "iuehuhaethhtudg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673276": [
        {
            "ioc_value": "iuhuefibuibgbsg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673277": [
        {
            "ioc_value": "lpekfoaefhiehug.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673278": [
        {
            "ioc_value": "nbmbnmbembfaeurag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673279": [
        {
            "ioc_value": "nbmbnmbembfaeureg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673280": [
        {
            "ioc_value": "nbmbnmbembfaeurg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673281": [
        {
            "ioc_value": "nbmbnmbembfaeurk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673282": [
        {
            "ioc_value": "nbmbnmbembfaeurmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673283": [
        {
            "ioc_value": "nbmbnmbembfaeurp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673284": [
        {
            "ioc_value": "nbmbnmbembfaeurrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673285": [
        {
            "ioc_value": "ngsiososusdiifi.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673257": [
        {
            "ioc_value": "fauibdbebdbburueg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673258": [
        {
            "ioc_value": "fauibdbebdbburug.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673259": [
        {
            "ioc_value": "fauibdbebdbburuk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673260": [
        {
            "ioc_value": "fauibdbebdbburumg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673261": [
        {
            "ioc_value": "fauibdbebdbburup.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673262": [
        {
            "ioc_value": "fauibdbebdbbururg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673263": [
        {
            "ioc_value": "gaieufhaefuefhg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673264": [
        {
            "ioc_value": "gaubaduebdubegu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673265": [
        {
            "ioc_value": "giaigduaedhhush.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673266": [
        {
            "ioc_value": "hioeppaepgoaneg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673267": [
        {
            "ioc_value": "hisrfsosrughudh.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673268": [
        {
            "ioc_value": "ibbgursuiuedeeg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673269": [
        {
            "ioc_value": "ibieibfiubefudg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673241": [
        {
            "ioc_value": "eueuqundnndnsudeg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673242": [
        {
            "ioc_value": "eueuqundnndnsudg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673243": [
        {
            "ioc_value": "eueuqundnndnsudk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673244": [
        {
            "ioc_value": "eueuqundnndnsudmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673245": [
        {
            "ioc_value": "eueuqundnndnsudp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673246": [
        {
            "ioc_value": "eueuqundnndnsudrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673247": [
        {
            "ioc_value": "eunuegnuaebuang.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673248": [
        {
            "ioc_value": "euuauudduufuuguag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673249": [
        {
            "ioc_value": "euuauudduufuugueg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673250": [
        {
            "ioc_value": "euuauudduufuugug.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673251": [
        {
            "ioc_value": "euuauudduufuuguk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673252": [
        {
            "ioc_value": "euuauudduufuugumg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673253": [
        {
            "ioc_value": "euuauudduufuugup.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673254": [
        {
            "ioc_value": "euuauudduufuugurg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673255": [
        {
            "ioc_value": "ezeiafzbgzabzdg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673256": [
        {
            "ioc_value": "fauibdbebdbburuag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673226": [
        {
            "ioc_value": "eooeoeoririusfrag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673227": [
        {
            "ioc_value": "eooeoeoririusfreg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673228": [
        {
            "ioc_value": "eooeoeoririusfrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673229": [
        {
            "ioc_value": "eooeoeoririusfrk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673230": [
        {
            "ioc_value": "eooeoeoririusfrmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673231": [
        {
            "ioc_value": "eooeoeoririusfrp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673232": [
        {
            "ioc_value": "eooeoeoririusfrrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673233": [
        {
            "ioc_value": "euauueuueuruudgag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673234": [
        {
            "ioc_value": "euauueuueuruudgeg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673235": [
        {
            "ioc_value": "euauueuueuruudgg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673236": [
        {
            "ioc_value": "euauueuueuruudgk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673237": [
        {
            "ioc_value": "euauueuueuruudgmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673238": [
        {
            "ioc_value": "euauueuueuruudgp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673239": [
        {
            "ioc_value": "euauueuueuruudgrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673240": [
        {
            "ioc_value": "eueuqundnndnsudag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673211": [
        {
            "ioc_value": "azezezbdndnnnsnmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673212": [
        {
            "ioc_value": "azezezbdndnnnsnp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673213": [
        {
            "ioc_value": "azezezbdndnnnsnrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673214": [
        {
            "ioc_value": "babiuedunefbbgg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673215": [
        {
            "ioc_value": "badaeduahedhhuaag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673216": [
        {
            "ioc_value": "badaeduahedhhuaeg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673217": [
        {
            "ioc_value": "badaeduahedhhuag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673218": [
        {
            "ioc_value": "badaeduahedhhuak.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673219": [
        {
            "ioc_value": "badaeduahedhhuamg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673220": [
        {
            "ioc_value": "badaeduahedhhuap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673221": [
        {
            "ioc_value": "badaeduahedhhuarg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673222": [
        {
            "ioc_value": "bidjcceaiidjieg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673223": [
        {
            "ioc_value": "eaeunauenuangdg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673224": [
        {
            "ioc_value": "eahaiuhuirsuhfg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673225": [
        {
            "ioc_value": "eiugaidihehuhfs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673199": [
        {
            "ioc_value": "awduhawduhuhhagag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673200": [
        {
            "ioc_value": "awduhawduhuhhageg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673201": [
        {
            "ioc_value": "awduhawduhuhhagg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673202": [
        {
            "ioc_value": "awduhawduhuhhagk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673203": [
        {
            "ioc_value": "awduhawduhuhhagmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673204": [
        {
            "ioc_value": "awduhawduhuhhagp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673205": [
        {
            "ioc_value": "awduhawduhuhhagrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673206": [
        {
            "ioc_value": "azbdezaeugnungg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673207": [
        {
            "ioc_value": "azezezbdndnnnsnag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673208": [
        {
            "ioc_value": "azezezbdndnnnsneg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673209": [
        {
            "ioc_value": "azezezbdndnnnsng.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673210": [
        {
            "ioc_value": "azezezbdndnnnsnk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673184": [
        {
            "ioc_value": "afieifaieudhhudeg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673185": [
        {
            "ioc_value": "afieifaieudhhudg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673186": [
        {
            "ioc_value": "afieifaieudhhudk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673187": [
        {
            "ioc_value": "afieifaieudhhudmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673188": [
        {
            "ioc_value": "afieifaieudhhudp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673189": [
        {
            "ioc_value": "afieifaieudhhudrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673190": [
        {
            "ioc_value": "ahefihaehiuguus.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673191": [
        {
            "ioc_value": "ahoouhrghsudmfg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673192": [
        {
            "ioc_value": "awbnmnmammmamnrag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673193": [
        {
            "ioc_value": "awbnmnmammmamnreg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673194": [
        {
            "ioc_value": "awbnmnmammmamnrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673195": [
        {
            "ioc_value": "awbnmnmammmamnrk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673196": [
        {
            "ioc_value": "awbnmnmammmamnrmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673197": [
        {
            "ioc_value": "awbnmnmammmamnrp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673198": [
        {
            "ioc_value": "awbnmnmammmamnrrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673169": [
        {
            "ioc_value": "aegieuueueuuruieg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673170": [
        {
            "ioc_value": "aegieuueueuuruig.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673171": [
        {
            "ioc_value": "aegieuueueuuruik.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673172": [
        {
            "ioc_value": "aegieuueueuuruimg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673173": [
        {
            "ioc_value": "aegieuueueuuruip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673174": [
        {
            "ioc_value": "aegieuueueuuruirg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673175": [
        {
            "ioc_value": "aeigeibfabidbgu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673176": [
        {
            "ioc_value": "aeufoeahfouefhgag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673177": [
        {
            "ioc_value": "aeufoeahfouefhgeg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673178": [
        {
            "ioc_value": "aeufoeahfouefhgg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673179": [
        {
            "ioc_value": "aeufoeahfouefhgk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673180": [
        {
            "ioc_value": "aeufoeahfouefhgmg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673181": [
        {
            "ioc_value": "aeufoeahfouefhgp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673182": [
        {
            "ioc_value": "aeufoeahfouefhgrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673183": [
        {
            "ioc_value": "afieifaieudhhudag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673159": [
        {
            "ioc_value": "aaeuauaueieiier.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673160": [
        {
            "ioc_value": "aeaunengieisiag.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673161": [
        {
            "ioc_value": "aefuaeufhueuufuag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673162": [
        {
            "ioc_value": "aefuaeufhueuufueg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673163": [
        {
            "ioc_value": "aefuaeufhueuufug.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673164": [
        {
            "ioc_value": "aefuaeufhueuufuk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673165": [
        {
            "ioc_value": "aefuaeufhueuufumg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673166": [
        {
            "ioc_value": "aefuaeufhueuufup.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673167": [
        {
            "ioc_value": "aefuaeufhueuufurg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673168": [
        {
            "ioc_value": "aegieuueueuuruiag.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-09 06:36:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673012": [
        {
            "ioc_value": "johen.windy.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-09 06:35:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673006": [
        {
            "ioc_value": "xoilaczk.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:30",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673007": [
        {
            "ioc_value": "xoilaczl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:30",
            "last_seen_utc": "2025-12-12 18:38:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673008": [
        {
            "ioc_value": "xoilaczq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:30",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673009": [
        {
            "ioc_value": "xoilaczq.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:30",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673010": [
        {
            "ioc_value": "xoilaczxzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:30",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673011": [
        {
            "ioc_value": "xoilaczz.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:30",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672991": [
        {
            "ioc_value": "xoilacvi.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672992": [
        {
            "ioc_value": "xoilacvii.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672993": [
        {
            "ioc_value": "xoilacviii.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:38:23",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672994": [
        {
            "ioc_value": "xoilacwzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672995": [
        {
            "ioc_value": "xoilacxq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672996": [
        {
            "ioc_value": "xoilacz1.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672997": [
        {
            "ioc_value": "xoilacz3.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672998": [
        {
            "ioc_value": "xoilacz4.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672999": [
        {
            "ioc_value": "xoilacz5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673000": [
        {
            "ioc_value": "xoilacza.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673001": [
        {
            "ioc_value": "xoilaczb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673002": [
        {
            "ioc_value": "xoilaczf.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673003": [
        {
            "ioc_value": "xoilaczg.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673004": [
        {
            "ioc_value": "xoilaczizz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1673005": [
        {
            "ioc_value": "xoilaczk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:29",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672977": [
        {
            "ioc_value": "xoilacnzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672978": [
        {
            "ioc_value": "xoilacpp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672979": [
        {
            "ioc_value": "xoilacpt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672980": [
        {
            "ioc_value": "xoilacstz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672981": [
        {
            "ioc_value": "xoilacszt.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672982": [
        {
            "ioc_value": "xoilacth.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672983": [
        {
            "ioc_value": "xoilactt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672984": [
        {
            "ioc_value": "xoilactv.bid",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672985": [
        {
            "ioc_value": "xoilactv.fan",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672986": [
        {
            "ioc_value": "xoilactvnn.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672987": [
        {
            "ioc_value": "xoilactvqq.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672988": [
        {
            "ioc_value": "xoilactzx.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672989": [
        {
            "ioc_value": "xoilacvg.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672990": [
        {
            "ioc_value": "xoilacvi.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:28",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672965": [
        {
            "ioc_value": "xemlaibongda.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672966": [
        {
            "ioc_value": "xoilac-tv.bio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672967": [
        {
            "ioc_value": "xoilac-tv.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672968": [
        {
            "ioc_value": "xoilac37.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672969": [
        {
            "ioc_value": "xoilac49.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672970": [
        {
            "ioc_value": "xoilac66.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672971": [
        {
            "ioc_value": "xoilac66.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:23",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672972": [
        {
            "ioc_value": "xoilacbanhkhuc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672973": [
        {
            "ioc_value": "xoilacchamtv.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672974": [
        {
            "ioc_value": "xoilacd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672975": [
        {
            "ioc_value": "xoilacjzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:38:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672976": [
        {
            "ioc_value": "xoilacm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:27",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672954": [
        {
            "ioc_value": "v3.youandx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672955": [
        {
            "ioc_value": "v3.youandx.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672956": [
        {
            "ioc_value": "v3.youandx.dk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672957": [
        {
            "ioc_value": "v3.youandx.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672958": [
        {
            "ioc_value": "v3.youandx.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672959": [
        {
            "ioc_value": "v3.youandx.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672960": [
        {
            "ioc_value": "v3.youandx.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672961": [
        {
            "ioc_value": "v3.youandx.se",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672962": [
        {
            "ioc_value": "v3.youandx.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672963": [
        {
            "ioc_value": "v3.zentasrobots.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672964": [
        {
            "ioc_value": "visionprize.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:26",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672938": [
        {
            "ioc_value": "v3.xoilactv8386t.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672939": [
        {
            "ioc_value": "v3.xoilactv8386x.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672940": [
        {
            "ioc_value": "v3.xoilactv8386y.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672941": [
        {
            "ioc_value": "v3.xoilactv8386z.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672942": [
        {
            "ioc_value": "v3.xoilactvi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672943": [
        {
            "ioc_value": "v3.xoilactvl1.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672944": [
        {
            "ioc_value": "v3.xoilactvl3.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672945": [
        {
            "ioc_value": "v3.xoilactvw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672946": [
        {
            "ioc_value": "v3.xoilacx.ai",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672947": [
        {
            "ioc_value": "v3.xoilacx.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672948": [
        {
            "ioc_value": "v3.xoilacxb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672949": [
        {
            "ioc_value": "v3.xoilacxx.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672950": [
        {
            "ioc_value": "v3.xoilacxz.ai",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672951": [
        {
            "ioc_value": "v3.xoilacxz.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672952": [
        {
            "ioc_value": "v3.yesonpropk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672953": [
        {
            "ioc_value": "v3.youandx.ch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:25",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672924": [
        {
            "ioc_value": "v3.xoilacmw.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672925": [
        {
            "ioc_value": "v3.xoilacnb.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672926": [
        {
            "ioc_value": "v3.xoilacnd.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672927": [
        {
            "ioc_value": "v3.xoilacnf.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672928": [
        {
            "ioc_value": "v3.xoilacni.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672929": [
        {
            "ioc_value": "v3.xoilactv8386.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672930": [
        {
            "ioc_value": "v3.xoilactv8386a.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672931": [
        {
            "ioc_value": "v3.xoilactv8386f.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672932": [
        {
            "ioc_value": "v3.xoilactv8386g.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672933": [
        {
            "ioc_value": "v3.xoilactv8386i.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672934": [
        {
            "ioc_value": "v3.xoilactv8386k.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672935": [
        {
            "ioc_value": "v3.xoilactv8386m.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672936": [
        {
            "ioc_value": "v3.xoilactv8386o.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672937": [
        {
            "ioc_value": "v3.xoilactv8386p.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:24",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672909": [
        {
            "ioc_value": "v3.walkingtoursmanhattan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672910": [
        {
            "ioc_value": "v3.wapdaonlinebill.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672911": [
        {
            "ioc_value": "v3.wbnews.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672912": [
        {
            "ioc_value": "v3.weismuseum.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672913": [
        {
            "ioc_value": "v3.wigwamvillage.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672914": [
        {
            "ioc_value": "v3.womensoundoff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672915": [
        {
            "ioc_value": "v3.wsf2008.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672916": [
        {
            "ioc_value": "v3.x3wiki.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:54",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672917": [
        {
            "ioc_value": "v3.xoilac.sh",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672918": [
        {
            "ioc_value": "v3.xoilacg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672919": [
        {
            "ioc_value": "v3.xoilacm.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672920": [
        {
            "ioc_value": "v3.xoilacmn.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672921": [
        {
            "ioc_value": "v3.xoilacmr.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672922": [
        {
            "ioc_value": "v3.xoilacmt.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672923": [
        {
            "ioc_value": "v3.xoilacmu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:23",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672892": [
        {
            "ioc_value": "v3.thegioiapple.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672893": [
        {
            "ioc_value": "v3.theplasterhouse.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672894": [
        {
            "ioc_value": "v3.tickettannoy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672895": [
        {
            "ioc_value": "v3.tinhnguyeng9.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672896": [
        {
            "ioc_value": "v3.tmsmall.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672897": [
        {
            "ioc_value": "v3.transbay.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672898": [
        {
            "ioc_value": "v3.treasuresofeuropetours.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672899": [
        {
            "ioc_value": "v3.uka-p.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672900": [
        {
            "ioc_value": "v3.ulrichstavern.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672901": [
        {
            "ioc_value": "v3.umdpc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672902": [
        {
            "ioc_value": "v3.vaults.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672903": [
        {
            "ioc_value": "v3.verticalscratchers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672904": [
        {
            "ioc_value": "v3.vietnambrides.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672905": [
        {
            "ioc_value": "v3.viewfromthefridge.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672906": [
        {
            "ioc_value": "v3.viktre.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672907": [
        {
            "ioc_value": "v3.vintagerpm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672908": [
        {
            "ioc_value": "v3.visionlossconnections.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:22",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672877": [
        {
            "ioc_value": "v3.spaessentials.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672878": [
        {
            "ioc_value": "v3.spatang.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672879": [
        {
            "ioc_value": "v3.springhousepress.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672880": [
        {
            "ioc_value": "v3.statsheep.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672881": [
        {
            "ioc_value": "v3.stleonards.london",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672882": [
        {
            "ioc_value": "v3.studioretail.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672883": [
        {
            "ioc_value": "v3.suramericapress.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672884": [
        {
            "ioc_value": "v3.tactile3d.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672885": [
        {
            "ioc_value": "v3.taramillernutrition.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672886": [
        {
            "ioc_value": "v3.thatsonchaudoc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672887": [
        {
            "ioc_value": "v3.the1905.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672888": [
        {
            "ioc_value": "v3.theatre-fonte.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672889": [
        {
            "ioc_value": "v3.thebutcheryltd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672890": [
        {
            "ioc_value": "v3.thecuriouscreamery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672891": [
        {
            "ioc_value": "v3.thefocuspull.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:21",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672863": [
        {
            "ioc_value": "v3.redherringlou.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672864": [
        {
            "ioc_value": "v3.remodubai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672865": [
        {
            "ioc_value": "v3.richardstjohn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672866": [
        {
            "ioc_value": "v3.salutebistro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672867": [
        {
            "ioc_value": "v3.savethetrident.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672868": [
        {
            "ioc_value": "v3.savingbletchleypark.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672869": [
        {
            "ioc_value": "v3.sccombank.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672870": [
        {
            "ioc_value": "v3.seal-of-excellence.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:38:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672871": [
        {
            "ioc_value": "v3.secretlifeofmuslims.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672872": [
        {
            "ioc_value": "v3.shanebauer.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672873": [
        {
            "ioc_value": "v3.slpsmagnetschools.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672874": [
        {
            "ioc_value": "v3.snowparknz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672875": [
        {
            "ioc_value": "v3.socgeo.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672876": [
        {
            "ioc_value": "v3.sosmap.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:20",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672849": [
        {
            "ioc_value": "v3.ondanet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672850": [
        {
            "ioc_value": "v3.onusida-latina.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672851": [
        {
            "ioc_value": "v3.orlandohistoricinn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672852": [
        {
            "ioc_value": "v3.osaka-ferry.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672853": [
        {
            "ioc_value": "v3.owlle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672854": [
        {
            "ioc_value": "v3.pacificpie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:39:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672855": [
        {
            "ioc_value": "v3.pascalbiosciences.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672856": [
        {
            "ioc_value": "v3.percyjacksonthemovie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672857": [
        {
            "ioc_value": "v3.peteralanlloyd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672858": [
        {
            "ioc_value": "v3.pidamazonia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672859": [
        {
            "ioc_value": "v3.pimentowood.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:39:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672860": [
        {
            "ioc_value": "v3.pkaffairs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672861": [
        {
            "ioc_value": "v3.primapastacafe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672862": [
        {
            "ioc_value": "v3.recetasdecomidamexicana.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:19",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672834": [
        {
            "ioc_value": "v3.moviemusereviews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672835": [
        {
            "ioc_value": "v3.multnomahhistorical.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672836": [
        {
            "ioc_value": "v3.museumregister.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672837": [
        {
            "ioc_value": "v3.naacptheatreawards.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672838": [
        {
            "ioc_value": "v3.nancyvn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672839": [
        {
            "ioc_value": "v3.nandinayanyc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672840": [
        {
            "ioc_value": "v3.nativeworkscsc.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672841": [
        {
            "ioc_value": "v3.naukatehnika.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672842": [
        {
            "ioc_value": "v3.nepaaudubon.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672843": [
        {
            "ioc_value": "v3.nghenhac.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672844": [
        {
            "ioc_value": "v3.nightmarerecords.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672845": [
        {
            "ioc_value": "v3.nimr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672846": [
        {
            "ioc_value": "v3.nouvelanbelge.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672847": [
        {
            "ioc_value": "v3.observatoriocriticocuba.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672848": [
        {
            "ioc_value": "v3.omotenashi-movie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:18",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672819": [
        {
            "ioc_value": "v3.martonmogyorosy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672820": [
        {
            "ioc_value": "v3.masstortnexus.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672821": [
        {
            "ioc_value": "v3.mayorlovelywarren.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672822": [
        {
            "ioc_value": "v3.meditationsociety.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672823": [
        {
            "ioc_value": "v3.melissablogs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672824": [
        {
            "ioc_value": "v3.microcapitalmonitor.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672825": [
        {
            "ioc_value": "v3.mikesorganicdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672826": [
        {
            "ioc_value": "v3.mikewieringo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672827": [
        {
            "ioc_value": "v3.milanfashionweeklive.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672828": [
        {
            "ioc_value": "v3.mintatl.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672829": [
        {
            "ioc_value": "v3.mireproductivefreedom.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672830": [
        {
            "ioc_value": "v3.mollysmovement.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672831": [
        {
            "ioc_value": "v3.moneywithfriendspodcast.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672832": [
        {
            "ioc_value": "v3.monitorduty.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672833": [
        {
            "ioc_value": "v3.montanea.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:17",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672799": [
        {
            "ioc_value": "v3.italiantuorism.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672800": [
        {
            "ioc_value": "v3.jammu-kashmir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672801": [
        {
            "ioc_value": "v3.jerrysdogs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672802": [
        {
            "ioc_value": "v3.kcriverfest.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672803": [
        {
            "ioc_value": "v3.kinglaksa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672804": [
        {
            "ioc_value": "v3.klbistro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672805": [
        {
            "ioc_value": "v3.ladyvalorfilm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672806": [
        {
            "ioc_value": "v3.lautrec.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672807": [
        {
            "ioc_value": "v3.lawtofact.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672808": [
        {
            "ioc_value": "v3.learnplasma.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672809": [
        {
            "ioc_value": "v3.lemmetweetthatforyou.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672810": [
        {
            "ioc_value": "v3.lemongrassthai.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672811": [
        {
            "ioc_value": "v3.lexiwalker.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672812": [
        {
            "ioc_value": "v3.lisabettany.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672813": [
        {
            "ioc_value": "v3.livecleveland.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672814": [
        {
            "ioc_value": "v3.logocravings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672815": [
        {
            "ioc_value": "v3.lolali.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672816": [
        {
            "ioc_value": "v3.magicflightstudio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672817": [
        {
            "ioc_value": "v3.magrack.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672818": [
        {
            "ioc_value": "v3.mannalifefood.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:16",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672778": [
        {
            "ioc_value": "v3.everybodyeveryone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672779": [
        {
            "ioc_value": "v3.fakewalls.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672780": [
        {
            "ioc_value": "v3.finchpark.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672781": [
        {
            "ioc_value": "v3.foodsafeschools.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672782": [
        {
            "ioc_value": "v3.footballmarketingmagazine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672783": [
        {
            "ioc_value": "v3.foxandrobin.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672784": [
        {
            "ioc_value": "v3.gabaysoutlet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672785": [
        {
            "ioc_value": "v3.gettermusic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672786": [
        {
            "ioc_value": "v3.getterofficial.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672787": [
        {
            "ioc_value": "v3.graffitinyc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672788": [
        {
            "ioc_value": "v3.grnba.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672789": [
        {
            "ioc_value": "v3.hanabentoparis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672790": [
        {
            "ioc_value": "v3.harmonymurphygallery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672791": [
        {
            "ioc_value": "v3.herraduraranch.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672792": [
        {
            "ioc_value": "v3.hogsandhops.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672793": [
        {
            "ioc_value": "v3.hogsandhopsbbq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672794": [
        {
            "ioc_value": "v3.iamerinbrown.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672795": [
        {
            "ioc_value": "v3.icaird.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672796": [
        {
            "ioc_value": "v3.inceptionradionetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672797": [
        {
            "ioc_value": "v3.indigenascovid19.red",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672798": [
        {
            "ioc_value": "v3.insidestlaudio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:15",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672758": [
        {
            "ioc_value": "v3.comicsthegathering.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672759": [
        {
            "ioc_value": "v3.copenhagenclimatecouncil.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672760": [
        {
            "ioc_value": "v3.counter-inaugural.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672761": [
        {
            "ioc_value": "v3.covencle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672762": [
        {
            "ioc_value": "v3.crookedskyfarms.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672763": [
        {
            "ioc_value": "v3.crusadersoflight.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672764": [
        {
            "ioc_value": "v3.culturas.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672765": [
        {
            "ioc_value": "v3.daventryutc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672766": [
        {
            "ioc_value": "v3.defusie.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672767": [
        {
            "ioc_value": "v3.diasporaenligne.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672768": [
        {
            "ioc_value": "v3.dillingermuseum.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672769": [
        {
            "ioc_value": "v3.disclaimermag.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672770": [
        {
            "ioc_value": "v3.discoveryofatlantis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672771": [
        {
            "ioc_value": "v3.dpvhs.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672772": [
        {
            "ioc_value": "v3.duplexsecure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672773": [
        {
            "ioc_value": "v3.dynamicsyntax.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672774": [
        {
            "ioc_value": "v3.edmdroid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672775": [
        {
            "ioc_value": "v3.elgcf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672776": [
        {
            "ioc_value": "v3.espoirdasile.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672777": [
        {
            "ioc_value": "v3.eufmd.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:14",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672737": [
        {
            "ioc_value": "v3.cakhiatve.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672738": [
        {
            "ioc_value": "v3.cakhiatvf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672739": [
        {
            "ioc_value": "v3.cakhiatvg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672740": [
        {
            "ioc_value": "v3.cakhiatvh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672741": [
        {
            "ioc_value": "v3.cakhiatvi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672742": [
        {
            "ioc_value": "v3.cakhiatvk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:39:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672743": [
        {
            "ioc_value": "v3.cakhiatvl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672744": [
        {
            "ioc_value": "v3.cakhiatvm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672745": [
        {
            "ioc_value": "v3.cakhiatvo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672746": [
        {
            "ioc_value": "v3.cakhiatvp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672747": [
        {
            "ioc_value": "v3.cakhiatvq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672748": [
        {
            "ioc_value": "v3.cakhiatvr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672749": [
        {
            "ioc_value": "v3.cakhiatvt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672750": [
        {
            "ioc_value": "v3.cakhiatvu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672751": [
        {
            "ioc_value": "v3.cakhiatvw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672752": [
        {
            "ioc_value": "v3.cakhiatvx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672753": [
        {
            "ioc_value": "v3.cakhiatvy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672754": [
        {
            "ioc_value": "v3.carbopro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672755": [
        {
            "ioc_value": "v3.chambaragame.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672756": [
        {
            "ioc_value": "v3.claire-sansgluten.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672757": [
        {
            "ioc_value": "v3.cokelead.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:13",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672716": [
        {
            "ioc_value": "v3.burntlumpiablog.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672717": [
        {
            "ioc_value": "v3.butchvoices.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672718": [
        {
            "ioc_value": "v3.butterboycomedy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672719": [
        {
            "ioc_value": "v3.c3style.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672720": [
        {
            "ioc_value": "v3.cakhiatv.ai",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672721": [
        {
            "ioc_value": "v3.cakhiatv.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672722": [
        {
            "ioc_value": "v3.cakhiatv.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672723": [
        {
            "ioc_value": "v3.cakhiatv.futbol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672724": [
        {
            "ioc_value": "v3.cakhiatv.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672725": [
        {
            "ioc_value": "v3.cakhiatv.is",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672726": [
        {
            "ioc_value": "v3.cakhiatv.media",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672727": [
        {
            "ioc_value": "v3.cakhiatv.mx",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672728": [
        {
            "ioc_value": "v3.cakhiatv.team",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672729": [
        {
            "ioc_value": "v3.cakhiatv.tube",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:39:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672730": [
        {
            "ioc_value": "v3.cakhiatv.vc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672731": [
        {
            "ioc_value": "v3.cakhiatv.video",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672732": [
        {
            "ioc_value": "v3.cakhiatv.watch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672733": [
        {
            "ioc_value": "v3.cakhiatva.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672734": [
        {
            "ioc_value": "v3.cakhiatvb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672735": [
        {
            "ioc_value": "v3.cakhiatvc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672736": [
        {
            "ioc_value": "v3.cakhiatvd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:12",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672697": [
        {
            "ioc_value": "v3.androidgadget.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672698": [
        {
            "ioc_value": "v3.aniellodesiderio.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672699": [
        {
            "ioc_value": "v3.antarcticbiennale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672700": [
        {
            "ioc_value": "v3.artkuwait.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672701": [
        {
            "ioc_value": "v3.asianartmall.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672702": [
        {
            "ioc_value": "v3.astralpublishing.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672703": [
        {
            "ioc_value": "v3.atlbbqfest.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672704": [
        {
            "ioc_value": "v3.australasianzookeeping.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672705": [
        {
            "ioc_value": "v3.avocadorecipes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672706": [
        {
            "ioc_value": "v3.bambooorgan.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672707": [
        {
            "ioc_value": "v3.beckhamhouse.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672708": [
        {
            "ioc_value": "v3.birdylashes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672709": [
        {
            "ioc_value": "v3.bittersbar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672710": [
        {
            "ioc_value": "v3.blindaroundthesound.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672711": [
        {
            "ioc_value": "v3.bohohome.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672712": [
        {
            "ioc_value": "v3.boulangeriejocteur.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672713": [
        {
            "ioc_value": "v3.bowie1983book.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672714": [
        {
            "ioc_value": "v3.brownandgraymusic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672715": [
        {
            "ioc_value": "v3.buccaneersgab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:11",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672677": [
        {
            "ioc_value": "v2.youandx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672678": [
        {
            "ioc_value": "v2.youandx.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672679": [
        {
            "ioc_value": "v2.youandx.dk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672680": [
        {
            "ioc_value": "v2.youandx.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672681": [
        {
            "ioc_value": "v2.youandx.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672682": [
        {
            "ioc_value": "v2.youandx.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672683": [
        {
            "ioc_value": "v2.youandx.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672684": [
        {
            "ioc_value": "v2.youandx.se",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672685": [
        {
            "ioc_value": "v2.youandx.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672686": [
        {
            "ioc_value": "v2.zevitasmarcus.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672687": [
        {
            "ioc_value": "v2.zilingotrade.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672688": [
        {
            "ioc_value": "v3.1phuttietkiemtrieuniemvui.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672689": [
        {
            "ioc_value": "v3.5bfilm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672690": [
        {
            "ioc_value": "v3.70leonardstreet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672691": [
        {
            "ioc_value": "v3.8secretsofsuccess.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672692": [
        {
            "ioc_value": "v3.aballerinastale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672693": [
        {
            "ioc_value": "v3.accadandkoka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672694": [
        {
            "ioc_value": "v3.airliquide-expertisecenter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672695": [
        {
            "ioc_value": "v3.americanrescuecoalition.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672696": [
        {
            "ioc_value": "v3.amwenglish.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:10",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672657": [
        {
            "ioc_value": "v2.xoilactvl3.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672658": [
        {
            "ioc_value": "v2.xoilactvw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672659": [
        {
            "ioc_value": "v2.xoilacvzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672660": [
        {
            "ioc_value": "v2.xoilacx.ai",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672661": [
        {
            "ioc_value": "v2.xoilacx.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672662": [
        {
            "ioc_value": "v2.xoilacxa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672663": [
        {
            "ioc_value": "v2.xoilacxc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672664": [
        {
            "ioc_value": "v2.xoilacxkz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672665": [
        {
            "ioc_value": "v2.xoilacxx.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672666": [
        {
            "ioc_value": "v2.xoilacxz.ai",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672667": [
        {
            "ioc_value": "v2.xoilacxz.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672668": [
        {
            "ioc_value": "v2.xoilacxzt.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672669": [
        {
            "ioc_value": "v2.xoilacza.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672670": [
        {
            "ioc_value": "v2.xoilaczhzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672671": [
        {
            "ioc_value": "v2.xoilaczq.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672672": [
        {
            "ioc_value": "v2.xoilaczs.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672673": [
        {
            "ioc_value": "v2.xoilaczsx.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672674": [
        {
            "ioc_value": "v2.xoilaczzzbz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672675": [
        {
            "ioc_value": "v2.yesonpropk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672676": [
        {
            "ioc_value": "v2.youandx.ch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:09",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672637": [
        {
            "ioc_value": "v2.xoilacql.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672638": [
        {
            "ioc_value": "v2.xoilacqzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672639": [
        {
            "ioc_value": "v2.xoilactv.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672640": [
        {
            "ioc_value": "v2.xoilactv.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672641": [
        {
            "ioc_value": "v2.xoilactv8386.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672642": [
        {
            "ioc_value": "v2.xoilactv8386a.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672643": [
        {
            "ioc_value": "v2.xoilactv8386f.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672644": [
        {
            "ioc_value": "v2.xoilactv8386g.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672645": [
        {
            "ioc_value": "v2.xoilactv8386i.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672646": [
        {
            "ioc_value": "v2.xoilactv8386k.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672647": [
        {
            "ioc_value": "v2.xoilactv8386m.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672648": [
        {
            "ioc_value": "v2.xoilactv8386o.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672649": [
        {
            "ioc_value": "v2.xoilactv8386p.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672650": [
        {
            "ioc_value": "v2.xoilactv8386t.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672651": [
        {
            "ioc_value": "v2.xoilactv8386x.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672652": [
        {
            "ioc_value": "v2.xoilactv8386y.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672653": [
        {
            "ioc_value": "v2.xoilactv8386z.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672654": [
        {
            "ioc_value": "v2.xoilactvi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672655": [
        {
            "ioc_value": "v2.xoilactvl1.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672656": [
        {
            "ioc_value": "v2.xoilactvl2.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:08",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672622": [
        {
            "ioc_value": "v2.xoilac.sh",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672623": [
        {
            "ioc_value": "v2.xoilacbzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672624": [
        {
            "ioc_value": "v2.xoilacezzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672625": [
        {
            "ioc_value": "v2.xoilacgzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672626": [
        {
            "ioc_value": "v2.xoilaclv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672627": [
        {
            "ioc_value": "v2.xoilacm.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672628": [
        {
            "ioc_value": "v2.xoilacmn.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672629": [
        {
            "ioc_value": "v2.xoilacmr.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672630": [
        {
            "ioc_value": "v2.xoilacmt.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672631": [
        {
            "ioc_value": "v2.xoilacmu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672632": [
        {
            "ioc_value": "v2.xoilacmw.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672633": [
        {
            "ioc_value": "v2.xoilacnb.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672634": [
        {
            "ioc_value": "v2.xoilacnd.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672635": [
        {
            "ioc_value": "v2.xoilacnf.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672636": [
        {
            "ioc_value": "v2.xoilacni.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:07",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672602": [
        {
            "ioc_value": "v2.treasuresofeuropetours.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672603": [
        {
            "ioc_value": "v2.uka-p.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672604": [
        {
            "ioc_value": "v2.ulrichstavern.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672605": [
        {
            "ioc_value": "v2.umdpc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672606": [
        {
            "ioc_value": "v2.universalcreditsuffer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672607": [
        {
            "ioc_value": "v2.uwff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672608": [
        {
            "ioc_value": "v2.vaults.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672609": [
        {
            "ioc_value": "v2.verticalscratchers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672610": [
        {
            "ioc_value": "v2.viktre.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672611": [
        {
            "ioc_value": "v2.vintagerpm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:23",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672612": [
        {
            "ioc_value": "v2.visionlossconnections.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672613": [
        {
            "ioc_value": "v2.vrafoundation.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672614": [
        {
            "ioc_value": "v2.wapdaonlinebill.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672615": [
        {
            "ioc_value": "v2.wbnews.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672616": [
        {
            "ioc_value": "v2.weismuseum.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672617": [
        {
            "ioc_value": "v2.wigwamvillage.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672618": [
        {
            "ioc_value": "v2.womensoundoff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672619": [
        {
            "ioc_value": "v2.wsf2008.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672620": [
        {
            "ioc_value": "v2.x3wiki.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672621": [
        {
            "ioc_value": "v2.xembd.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:06",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672583": [
        {
            "ioc_value": "v2.squash2020.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672584": [
        {
            "ioc_value": "v2.statsheep.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672585": [
        {
            "ioc_value": "v2.steven-franco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672586": [
        {
            "ioc_value": "v2.stleonards.london",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672587": [
        {
            "ioc_value": "v2.studioretail.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672588": [
        {
            "ioc_value": "v2.suramericapress.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672589": [
        {
            "ioc_value": "v2.tactile3d.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672590": [
        {
            "ioc_value": "v2.taramillernutrition.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672591": [
        {
            "ioc_value": "v2.thatsonchaudoc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672592": [
        {
            "ioc_value": "v2.the1905.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672593": [
        {
            "ioc_value": "v2.thebutcheryltd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672594": [
        {
            "ioc_value": "v2.thecuriouscreamery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672595": [
        {
            "ioc_value": "v2.thefocuspull.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672596": [
        {
            "ioc_value": "v2.theplasterhouse.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672597": [
        {
            "ioc_value": "v2.tickettannoy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672598": [
        {
            "ioc_value": "v2.timewiththea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672599": [
        {
            "ioc_value": "v2.tinhnguyeng9.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672600": [
        {
            "ioc_value": "v2.tmsmall.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672601": [
        {
            "ioc_value": "v2.transbay.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:05",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672565": [
        {
            "ioc_value": "v2.remodubai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672566": [
        {
            "ioc_value": "v2.richardstjohn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672567": [
        {
            "ioc_value": "v2.salutebistro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672568": [
        {
            "ioc_value": "v2.savethetrident.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672569": [
        {
            "ioc_value": "v2.savingbletchleypark.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672570": [
        {
            "ioc_value": "v2.sccombank.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672571": [
        {
            "ioc_value": "v2.seal-of-excellence.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672572": [
        {
            "ioc_value": "v2.secretlifeofmuslims.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672573": [
        {
            "ioc_value": "v2.shanebauer.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672574": [
        {
            "ioc_value": "v2.shericandler.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672575": [
        {
            "ioc_value": "v2.slpsmagnetschools.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672576": [
        {
            "ioc_value": "v2.snowparknz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672577": [
        {
            "ioc_value": "v2.socgeo.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672578": [
        {
            "ioc_value": "v2.sosmap.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672579": [
        {
            "ioc_value": "v2.spaessentials.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672580": [
        {
            "ioc_value": "v2.sparkinglife.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672581": [
        {
            "ioc_value": "v2.spatang.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672582": [
        {
            "ioc_value": "v2.springhousepress.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:04",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672551": [
        {
            "ioc_value": "v2.onusida-latina.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672552": [
        {
            "ioc_value": "v2.orlandohistoricinn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672553": [
        {
            "ioc_value": "v2.osaka-ferry.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672554": [
        {
            "ioc_value": "v2.owlle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672555": [
        {
            "ioc_value": "v2.pacificpie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672556": [
        {
            "ioc_value": "v2.pandajogosgratis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672557": [
        {
            "ioc_value": "v2.pascalbiosciences.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672558": [
        {
            "ioc_value": "v2.percyjacksonthemovie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672559": [
        {
            "ioc_value": "v2.perdre-la-raison.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672560": [
        {
            "ioc_value": "v2.peteralanlloyd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672561": [
        {
            "ioc_value": "v2.phuonghoangtv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672562": [
        {
            "ioc_value": "v2.pidamazonia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672563": [
        {
            "ioc_value": "v2.pimentowood.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672564": [
        {
            "ioc_value": "v2.primapastacafe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:03",
            "last_seen_utc": "2025-12-12 18:38:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672550": [
        {
            "ioc_value": "v2.ondanet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:02",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672540": [
        {
            "ioc_value": "v2.naacptheatreawards.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672541": [
        {
            "ioc_value": "v2.nancyvn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672542": [
        {
            "ioc_value": "v2.nandinayanyc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672543": [
        {
            "ioc_value": "v2.nativeworkscsc.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672544": [
        {
            "ioc_value": "v2.nepaaudubon.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672545": [
        {
            "ioc_value": "v2.nghenhac.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672546": [
        {
            "ioc_value": "v2.nightmarerecords.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672547": [
        {
            "ioc_value": "v2.nimr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672548": [
        {
            "ioc_value": "v2.observatoriocriticocuba.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672549": [
        {
            "ioc_value": "v2.omotenashi-movie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:01",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672526": [
        {
            "ioc_value": "v2.mikesorganicdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672527": [
        {
            "ioc_value": "v2.mikewieringo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672528": [
        {
            "ioc_value": "v2.milanfashionweeklive.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672529": [
        {
            "ioc_value": "v2.mintatl.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672530": [
        {
            "ioc_value": "v2.mipatriaecuador.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672531": [
        {
            "ioc_value": "v2.mireproductivefreedom.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672532": [
        {
            "ioc_value": "v2.mitvcconference.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672533": [
        {
            "ioc_value": "v2.mollysmovement.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672534": [
        {
            "ioc_value": "v2.moneywithfriendspodcast.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:39:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672535": [
        {
            "ioc_value": "v2.monitorduty.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672536": [
        {
            "ioc_value": "v2.montanea.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672537": [
        {
            "ioc_value": "v2.moviemusereviews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672538": [
        {
            "ioc_value": "v2.multnomahhistorical.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672539": [
        {
            "ioc_value": "v2.museumregister.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:34:00",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672508": [
        {
            "ioc_value": "v2.lawtofact.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672509": [
        {
            "ioc_value": "v2.learnplasma.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672510": [
        {
            "ioc_value": "v2.lemmetweetthatforyou.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:39:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672511": [
        {
            "ioc_value": "v2.lemongrassthai.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672512": [
        {
            "ioc_value": "v2.lexiwalker.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672513": [
        {
            "ioc_value": "v2.lingerie-indiscrete.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672514": [
        {
            "ioc_value": "v2.lisabettany.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672515": [
        {
            "ioc_value": "v2.literarymanhattan.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672516": [
        {
            "ioc_value": "v2.lolali.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672517": [
        {
            "ioc_value": "v2.magicflightstudio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672518": [
        {
            "ioc_value": "v2.magrack.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672519": [
        {
            "ioc_value": "v2.mannalifefood.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672520": [
        {
            "ioc_value": "v2.martonmogyorosy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672521": [
        {
            "ioc_value": "v2.masstortnexus.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672522": [
        {
            "ioc_value": "v2.mayorlovelywarren.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672523": [
        {
            "ioc_value": "v2.meditationsociety.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672524": [
        {
            "ioc_value": "v2.melissablogs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672525": [
        {
            "ioc_value": "v2.microcapitalmonitor.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:59",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672491": [
        {
            "ioc_value": "v2.hogsandhopsbbq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672492": [
        {
            "ioc_value": "v2.icaird.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672493": [
        {
            "ioc_value": "v2.iellousa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672494": [
        {
            "ioc_value": "v2.inceptionradionetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672495": [
        {
            "ioc_value": "v2.indigenascovid19.red",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672496": [
        {
            "ioc_value": "v2.insidestlaudio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672497": [
        {
            "ioc_value": "v2.italiantuorism.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672498": [
        {
            "ioc_value": "v2.itselirose.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672499": [
        {
            "ioc_value": "v2.jammu-kashmir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672500": [
        {
            "ioc_value": "v2.jasmyneacannick.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672501": [
        {
            "ioc_value": "v2.jerrysdogs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672502": [
        {
            "ioc_value": "v2.journeyblackhome.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672503": [
        {
            "ioc_value": "v2.kcriverfest.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672504": [
        {
            "ioc_value": "v2.kgf-movie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672505": [
        {
            "ioc_value": "v2.kickshawproductions.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672506": [
        {
            "ioc_value": "v2.ladyvalorfilm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672507": [
        {
            "ioc_value": "v2.lautrec.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:58",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672473": [
        {
            "ioc_value": "v2.eufmd.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672474": [
        {
            "ioc_value": "v2.everybodyeveryone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672475": [
        {
            "ioc_value": "v2.fakewalls.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672476": [
        {
            "ioc_value": "v2.finchpark.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672477": [
        {
            "ioc_value": "v2.foodsafeschools.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672478": [
        {
            "ioc_value": "v2.footballmarketingmagazine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672479": [
        {
            "ioc_value": "v2.foxandrobin.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672480": [
        {
            "ioc_value": "v2.franksndawgs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672481": [
        {
            "ioc_value": "v2.fred-london.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672482": [
        {
            "ioc_value": "v2.gabaysoutlet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672483": [
        {
            "ioc_value": "v2.gettermusic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672484": [
        {
            "ioc_value": "v2.getterofficial.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672485": [
        {
            "ioc_value": "v2.goldevestuario.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672486": [
        {
            "ioc_value": "v2.grnba.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672487": [
        {
            "ioc_value": "v2.hanabentoparis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672488": [
        {
            "ioc_value": "v2.harmonymurphygallery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672489": [
        {
            "ioc_value": "v2.herraduraranch.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672490": [
        {
            "ioc_value": "v2.hogsandhops.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:57",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672454": [
        {
            "ioc_value": "v2.computeagainstcancer.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672455": [
        {
            "ioc_value": "v2.copenhagenclimatecouncil.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672456": [
        {
            "ioc_value": "v2.counter-inaugural.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672457": [
        {
            "ioc_value": "v2.covencle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672458": [
        {
            "ioc_value": "v2.craft-n-vinyl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:54",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672459": [
        {
            "ioc_value": "v2.crookedskyfarms.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672460": [
        {
            "ioc_value": "v2.crusadersoflight.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672461": [
        {
            "ioc_value": "v2.culturas.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672462": [
        {
            "ioc_value": "v2.cwejman.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672463": [
        {
            "ioc_value": "v2.daventryutc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672464": [
        {
            "ioc_value": "v2.diasporaenligne.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672465": [
        {
            "ioc_value": "v2.dillingermuseum.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672466": [
        {
            "ioc_value": "v2.disclaimermag.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672467": [
        {
            "ioc_value": "v2.dlfcybercity.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672468": [
        {
            "ioc_value": "v2.dynamicsyntax.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672469": [
        {
            "ioc_value": "v2.edmdroid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672470": [
        {
            "ioc_value": "v2.edwinvieira.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672471": [
        {
            "ioc_value": "v2.elementalbeverage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672472": [
        {
            "ioc_value": "v2.espoirdasile.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:56",
            "last_seen_utc": "2025-12-12 18:38:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672436": [
        {
            "ioc_value": "v2.cakhiatvj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672437": [
        {
            "ioc_value": "v2.cakhiatvk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672438": [
        {
            "ioc_value": "v2.cakhiatvl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672439": [
        {
            "ioc_value": "v2.cakhiatvm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672440": [
        {
            "ioc_value": "v2.cakhiatvo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672441": [
        {
            "ioc_value": "v2.cakhiatvp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672442": [
        {
            "ioc_value": "v2.cakhiatvq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672443": [
        {
            "ioc_value": "v2.cakhiatvr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672444": [
        {
            "ioc_value": "v2.cakhiatvt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672445": [
        {
            "ioc_value": "v2.cakhiatvu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672446": [
        {
            "ioc_value": "v2.cakhiatvw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672447": [
        {
            "ioc_value": "v2.cakhiatvx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672448": [
        {
            "ioc_value": "v2.cakhiatvy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672449": [
        {
            "ioc_value": "v2.carbopro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672450": [
        {
            "ioc_value": "v2.chambaragame.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672451": [
        {
            "ioc_value": "v2.claire-sansgluten.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672452": [
        {
            "ioc_value": "v2.cokelead.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672453": [
        {
            "ioc_value": "v2.comicsthegathering.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:55",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672420": [
        {
            "ioc_value": "v2.cakhiatv.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672421": [
        {
            "ioc_value": "v2.cakhiatv.is",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672422": [
        {
            "ioc_value": "v2.cakhiatv.media",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672423": [
        {
            "ioc_value": "v2.cakhiatv.mx",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672424": [
        {
            "ioc_value": "v2.cakhiatv.studio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672425": [
        {
            "ioc_value": "v2.cakhiatv.team",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672426": [
        {
            "ioc_value": "v2.cakhiatv.tube",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672427": [
        {
            "ioc_value": "v2.cakhiatv.vc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672428": [
        {
            "ioc_value": "v2.cakhiatva.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672429": [
        {
            "ioc_value": "v2.cakhiatvb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672430": [
        {
            "ioc_value": "v2.cakhiatvc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672431": [
        {
            "ioc_value": "v2.cakhiatvd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672432": [
        {
            "ioc_value": "v2.cakhiatvf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672433": [
        {
            "ioc_value": "v2.cakhiatvg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672434": [
        {
            "ioc_value": "v2.cakhiatvh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672435": [
        {
            "ioc_value": "v2.cakhiatvi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:54",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672403": [
        {
            "ioc_value": "v2.avocadorecipes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672404": [
        {
            "ioc_value": "v2.bambooorgan.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672405": [
        {
            "ioc_value": "v2.beckhamhouse.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672406": [
        {
            "ioc_value": "v2.billphillipsnews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672407": [
        {
            "ioc_value": "v2.birdylashes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672408": [
        {
            "ioc_value": "v2.bittersbar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672409": [
        {
            "ioc_value": "v2.blindaroundthesound.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672410": [
        {
            "ioc_value": "v2.bohohome.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672411": [
        {
            "ioc_value": "v2.bowie1983book.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672412": [
        {
            "ioc_value": "v2.brainspinesurgery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672413": [
        {
            "ioc_value": "v2.brownandgraymusic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672414": [
        {
            "ioc_value": "v2.burntlumpiablog.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672415": [
        {
            "ioc_value": "v2.butterboycomedy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672416": [
        {
            "ioc_value": "v2.c3style.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672417": [
        {
            "ioc_value": "v2.cakhiatv.ai",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672418": [
        {
            "ioc_value": "v2.cakhiatv.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672419": [
        {
            "ioc_value": "v2.cakhiatv.futbol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:53",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672385": [
        {
            "ioc_value": "v2.50thirdand3rd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672386": [
        {
            "ioc_value": "v2.5bfilm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672387": [
        {
            "ioc_value": "v2.70leonardst.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:54",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672388": [
        {
            "ioc_value": "v2.70leonardstreet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672389": [
        {
            "ioc_value": "v2.8secretsofsuccess.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672390": [
        {
            "ioc_value": "v2.aballerinastale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672391": [
        {
            "ioc_value": "v2.aboutlocalmagazine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672392": [
        {
            "ioc_value": "v2.accadandkoka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672393": [
        {
            "ioc_value": "v2.airliquide-expertisecenter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672394": [
        {
            "ioc_value": "v2.americanrescuecoalition.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672395": [
        {
            "ioc_value": "v2.androidgadget.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672396": [
        {
            "ioc_value": "v2.aniellodesiderio.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672397": [
        {
            "ioc_value": "v2.antarcticbiennale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672398": [
        {
            "ioc_value": "v2.artkuwait.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672399": [
        {
            "ioc_value": "v2.assistedsuicide.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672400": [
        {
            "ioc_value": "v2.atlbbqfest.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672401": [
        {
            "ioc_value": "v2.australasianzookeeping.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672402": [
        {
            "ioc_value": "v2.authorandrewsmith.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:52",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672368": [
        {
            "ioc_value": "thaistudents.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672369": [
        {
            "ioc_value": "the1905.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672370": [
        {
            "ioc_value": "theatre-fonte.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672371": [
        {
            "ioc_value": "thebutcheryltd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672372": [
        {
            "ioc_value": "thecuriouscreamery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672373": [
        {
            "ioc_value": "themexicansuitcase.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672374": [
        {
            "ioc_value": "therealmadridfan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672375": [
        {
            "ioc_value": "thetaoteching.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672376": [
        {
            "ioc_value": "thriceholy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672377": [
        {
            "ioc_value": "tickettannoy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672378": [
        {
            "ioc_value": "timewiththea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672379": [
        {
            "ioc_value": "torontobrigantine.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672380": [
        {
            "ioc_value": "trams-in-france.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672381": [
        {
            "ioc_value": "uka-p.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672382": [
        {
            "ioc_value": "universalcreditsuffer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672383": [
        {
            "ioc_value": "v2.101wilsonbar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672384": [
        {
            "ioc_value": "v2.1phuttietkiemtrieuniemvui.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:51",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672355": [
        {
            "ioc_value": "residuall.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672356": [
        {
            "ioc_value": "roblechman.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672357": [
        {
            "ioc_value": "rolloheart.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672358": [
        {
            "ioc_value": "salutebistro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672359": [
        {
            "ioc_value": "sex.slotpresiden.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672360": [
        {
            "ioc_value": "sistemademierda123.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672361": [
        {
            "ioc_value": "slegalosubito.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672362": [
        {
            "ioc_value": "slpsmagnetschools.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672363": [
        {
            "ioc_value": "smokeythepurringcat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672364": [
        {
            "ioc_value": "sonusantiqva.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672365": [
        {
            "ioc_value": "spatang.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672366": [
        {
            "ioc_value": "steven-franco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672367": [
        {
            "ioc_value": "test-pill.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:50",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672342": [
        {
            "ioc_value": "netfreedom.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672343": [
        {
            "ioc_value": "omotenashi-movie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672344": [
        {
            "ioc_value": "onusida-latina.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672345": [
        {
            "ioc_value": "oralfixationshow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672346": [
        {
            "ioc_value": "owlle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672347": [
        {
            "ioc_value": "pacificpie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672348": [
        {
            "ioc_value": "phuonghoangtv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672349": [
        {
            "ioc_value": "pimentowood.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672350": [
        {
            "ioc_value": "pkaffairs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672351": [
        {
            "ioc_value": "portlandinterviewmagazine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672352": [
        {
            "ioc_value": "primapastacafe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672353": [
        {
            "ioc_value": "redherringlou.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672354": [
        {
            "ioc_value": "residuall.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:49",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672327": [
        {
            "ioc_value": "knowledgetap.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672328": [
        {
            "ioc_value": "ktelegram.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672329": [
        {
            "ioc_value": "lemmetweetthatforyou.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672330": [
        {
            "ioc_value": "lermanet.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672331": [
        {
            "ioc_value": "lingerie-indiscrete.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672332": [
        {
            "ioc_value": "lisa-evans.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672333": [
        {
            "ioc_value": "lolali.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672334": [
        {
            "ioc_value": "lookoutmountaintn.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672335": [
        {
            "ioc_value": "magicflightstudio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672336": [
        {
            "ioc_value": "malware.slotpresiden.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672337": [
        {
            "ioc_value": "masstortnexus.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672338": [
        {
            "ioc_value": "mayorlovelywarren.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672339": [
        {
            "ioc_value": "mireproductivefreedom.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672340": [
        {
            "ioc_value": "mitvcconference.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672341": [
        {
            "ioc_value": "multnomahhistorical.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672310": [
        {
            "ioc_value": "greenboxny.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672311": [
        {
            "ioc_value": "grnba.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672312": [
        {
            "ioc_value": "hackinghabitat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672313": [
        {
            "ioc_value": "hanabentoparis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672314": [
        {
            "ioc_value": "hogsandhopsatlanta.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672315": [
        {
            "ioc_value": "iellousa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672316": [
        {
            "ioc_value": "ilv-bibliotheca.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672317": [
        {
            "ioc_value": "itselirose.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:39:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672318": [
        {
            "ioc_value": "japanserve.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672319": [
        {
            "ioc_value": "jasmyneacannick.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672320": [
        {
            "ioc_value": "jcrmrg.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672321": [
        {
            "ioc_value": "journeyblackhome.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672322": [
        {
            "ioc_value": "journeyblackhome.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672323": [
        {
            "ioc_value": "kickshawproductions.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672324": [
        {
            "ioc_value": "kinglaksa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672325": [
        {
            "ioc_value": "klbistro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672326": [
        {
            "ioc_value": "knowledgetap.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:47",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672293": [
        {
            "ioc_value": "diasporaenligne.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672294": [
        {
            "ioc_value": "discoveryofatlantis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672295": [
        {
            "ioc_value": "dlfcybercity.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672296": [
        {
            "ioc_value": "druillet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672297": [
        {
            "ioc_value": "elementalbeverage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672298": [
        {
            "ioc_value": "elgcf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672299": [
        {
            "ioc_value": "emilywillinghamphd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672300": [
        {
            "ioc_value": "emmanuelmoire.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672301": [
        {
            "ioc_value": "evtushenko.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672302": [
        {
            "ioc_value": "explorelocalmag.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672303": [
        {
            "ioc_value": "explorelocalmagazine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672304": [
        {
            "ioc_value": "fey.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672305": [
        {
            "ioc_value": "foodsafeschools.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672306": [
        {
            "ioc_value": "foroinnovacionuniversitaria.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672307": [
        {
            "ioc_value": "gabaysoutlet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672308": [
        {
            "ioc_value": "getterofficial.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672309": [
        {
            "ioc_value": "gmroth.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:46",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672284": [
        {
            "ioc_value": "bowie1983book.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672285": [
        {
            "ioc_value": "boymeetsgirlmovie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:45",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672286": [
        {
            "ioc_value": "cirruslegacy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:45",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672287": [
        {
            "ioc_value": "claire-sansgluten.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:45",
            "last_seen_utc": "2025-12-12 18:38:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672288": [
        {
            "ioc_value": "clubtavern.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:45",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672289": [
        {
            "ioc_value": "covencle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:45",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672290": [
        {
            "ioc_value": "crookedskyfarms.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:45",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672291": [
        {
            "ioc_value": "crusadersoflight.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672292": [
        {
            "ioc_value": "defusie.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:45",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672266": [
        {
            "ioc_value": "aboutlocalmagazine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672267": [
        {
            "ioc_value": "advancesagainstaspergillosis.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672268": [
        {
            "ioc_value": "air-lr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672269": [
        {
            "ioc_value": "airliquide-expertisecenter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672270": [
        {
            "ioc_value": "all-about-india.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672271": [
        {
            "ioc_value": "amwenglish.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672272": [
        {
            "ioc_value": "anactoflovefilm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672273": [
        {
            "ioc_value": "androidgadget.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672274": [
        {
            "ioc_value": "aniellodesiderio.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672275": [
        {
            "ioc_value": "antarcticbiennale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672276": [
        {
            "ioc_value": "appalachiarising.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672277": [
        {
            "ioc_value": "ariboo.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672278": [
        {
            "ioc_value": "asianartmall.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672279": [
        {
            "ioc_value": "autoredistrict.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672280": [
        {
            "ioc_value": "benetgames.cat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672281": [
        {
            "ioc_value": "bettyblueeyesthemusical.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672282": [
        {
            "ioc_value": "billphillipsnews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672283": [
        {
            "ioc_value": "bohohome.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672259": [
        {
            "ioc_value": "2.xoilacxa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:43",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672260": [
        {
            "ioc_value": "70leonardst.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:43",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672261": [
        {
            "ioc_value": "9813980.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:43",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672262": [
        {
            "ioc_value": "aballerinastale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672263": [
        {
            "ioc_value": "aboutfacemag.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:43",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672264": [
        {
            "ioc_value": "aboutfacemagazine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:43",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672265": [
        {
            "ioc_value": "aboutlocalmag.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-09 06:33:43",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672258": [
        {
            "ioc_value": "contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.conti",
            "malware_alias": null,
            "malware_printable": "Conti",
            "first_seen_utc": "2025-12-09 06:32:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,conti",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672256": [
        {
            "ioc_value": "login.mrsburch.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-09 06:32:16",
            "last_seen_utc": "2025-12-09 06:32:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672257": [
        {
            "ioc_value": "sso.mrsburch.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-09 06:32:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672254": [
        {
            "ioc_value": "zevitasmarcus.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:43",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672237": [
        {
            "ioc_value": "viktre.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-09 06:34:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672238": [
        {
            "ioc_value": "visionlossconnections.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672239": [
        {
            "ioc_value": "wapdaonlinebill.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672240": [
        {
            "ioc_value": "wbnews.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672241": [
        {
            "ioc_value": "weismuseum.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-09 06:34:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672242": [
        {
            "ioc_value": "wsf2008.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672243": [
        {
            "ioc_value": "x3wiki.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-09 06:34:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672244": [
        {
            "ioc_value": "xoilacm.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672245": [
        {
            "ioc_value": "xoilacnd.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-09 06:34:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672246": [
        {
            "ioc_value": "xoilacnf.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672247": [
        {
            "ioc_value": "xoilacni.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672248": [
        {
            "ioc_value": "xoilactv8386a.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672249": [
        {
            "ioc_value": "xoilactv8386o.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672250": [
        {
            "ioc_value": "xoilactv8386p.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672251": [
        {
            "ioc_value": "xoilactvi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672252": [
        {
            "ioc_value": "xoilactvw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672253": [
        {
            "ioc_value": "yesonpropk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:42",
            "last_seen_utc": "2025-12-09 06:34:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672222": [
        {
            "ioc_value": "secretlifeofmuslims.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672223": [
        {
            "ioc_value": "sendtofucs.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672224": [
        {
            "ioc_value": "shanebauer.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-09 06:33:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672225": [
        {
            "ioc_value": "shericandler.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672226": [
        {
            "ioc_value": "spaessentials.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-09 06:33:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672227": [
        {
            "ioc_value": "squash2020.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672228": [
        {
            "ioc_value": "stleonards.london",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-09 06:33:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672229": [
        {
            "ioc_value": "suramericapress.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-09 06:33:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672230": [
        {
            "ioc_value": "taramillernutrition.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672231": [
        {
            "ioc_value": "thatsonchaudoc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-09 06:33:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672232": [
        {
            "ioc_value": "tinhnguyeng9.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672233": [
        {
            "ioc_value": "tmsmall.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672234": [
        {
            "ioc_value": "treasuresofeuropetours.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-09 06:33:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672235": [
        {
            "ioc_value": "ulrichstavern.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-09 06:33:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672236": [
        {
            "ioc_value": "verticalscratchers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:41",
            "last_seen_utc": "2025-12-09 06:34:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672208": [
        {
            "ioc_value": "museumregister.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-09 06:33:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672209": [
        {
            "ioc_value": "nancyvn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672210": [
        {
            "ioc_value": "nandinayanyc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672211": [
        {
            "ioc_value": "nativeworkscsc.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-09 06:33:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672212": [
        {
            "ioc_value": "nepaaudubon.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-09 06:33:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672213": [
        {
            "ioc_value": "nimr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-09 06:33:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672214": [
        {
            "ioc_value": "observatoriocriticocuba.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672215": [
        {
            "ioc_value": "ondanet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672216": [
        {
            "ioc_value": "orlandohistoricinn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-09 06:33:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672217": [
        {
            "ioc_value": "pascalbiosciences.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672218": [
        {
            "ioc_value": "pidamazonia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-09 06:33:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672219": [
        {
            "ioc_value": "savethetrident.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-09 06:33:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672220": [
        {
            "ioc_value": "savingbletchleypark.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672221": [
        {
            "ioc_value": "seal-of-excellence.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:40",
            "last_seen_utc": "2025-12-09 06:33:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672193": [
        {
            "ioc_value": "kgf-movie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:38:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672194": [
        {
            "ioc_value": "lawtofact.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-09 06:33:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672195": [
        {
            "ioc_value": "lexiwalker.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672196": [
        {
            "ioc_value": "livecleveland.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:38:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672197": [
        {
            "ioc_value": "magrack.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672198": [
        {
            "ioc_value": "mannalifefood.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672199": [
        {
            "ioc_value": "martonmogyorosy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-09 06:33:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672200": [
        {
            "ioc_value": "meditationsociety.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672201": [
        {
            "ioc_value": "melissablogs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672202": [
        {
            "ioc_value": "microcapitalmonitor.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672203": [
        {
            "ioc_value": "mikesorganicdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672204": [
        {
            "ioc_value": "mikewieringo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-09 06:33:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672205": [
        {
            "ioc_value": "milanfashionweeklive.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672206": [
        {
            "ioc_value": "motphimr.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672207": [
        {
            "ioc_value": "moviemusereviews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:39",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672177": [
        {
            "ioc_value": "dillingermuseum.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672178": [
        {
            "ioc_value": "disclaimermag.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672179": [
        {
            "ioc_value": "dpvhs.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672180": [
        {
            "ioc_value": "edwinvieira.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672181": [
        {
            "ioc_value": "fakewalls.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672182": [
        {
            "ioc_value": "footballmarketingmagazine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672183": [
        {
            "ioc_value": "fred-london.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672184": [
        {
            "ioc_value": "goldevestuario.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672185": [
        {
            "ioc_value": "harmonymurphygallery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-09 06:33:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672186": [
        {
            "ioc_value": "herraduraranch.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-09 06:33:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672187": [
        {
            "ioc_value": "hogsandhops.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-09 06:33:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672188": [
        {
            "ioc_value": "hogsandhopsbbq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-09 06:33:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672189": [
        {
            "ioc_value": "icaird.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-09 06:33:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672190": [
        {
            "ioc_value": "inceptionradionetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-09 06:33:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672191": [
        {
            "ioc_value": "insidestlaudio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-09 06:33:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672192": [
        {
            "ioc_value": "italiantuorism.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:38",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672160": [
        {
            "ioc_value": "cakhiatv.mx",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672161": [
        {
            "ioc_value": "cakhiatv.studio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672162": [
        {
            "ioc_value": "cakhiatv.team",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672163": [
        {
            "ioc_value": "cakhiatv.tube",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672164": [
        {
            "ioc_value": "cakhiatv.vc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672165": [
        {
            "ioc_value": "cakhiatva.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672166": [
        {
            "ioc_value": "cakhiatvc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672167": [
        {
            "ioc_value": "cakhiatvf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672168": [
        {
            "ioc_value": "cakhiatvk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672169": [
        {
            "ioc_value": "cakhiatvp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672170": [
        {
            "ioc_value": "cakhiatvq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672171": [
        {
            "ioc_value": "cakhiatvw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672172": [
        {
            "ioc_value": "carbopro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672173": [
        {
            "ioc_value": "comicsthegathering.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672174": [
        {
            "ioc_value": "computeagainstcancer.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-12 18:39:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672175": [
        {
            "ioc_value": "counter-inaugural.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672176": [
        {
            "ioc_value": "daventryutc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:37",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672143": [
        {
            "ioc_value": "70leonardstreet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672144": [
        {
            "ioc_value": "8secretsofsuccess.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672145": [
        {
            "ioc_value": "accadandkoka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672146": [
        {
            "ioc_value": "astralpublishing.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672147": [
        {
            "ioc_value": "avocadorecipes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672148": [
        {
            "ioc_value": "bambooorgan.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672149": [
        {
            "ioc_value": "blindaroundthesound.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-12 18:39:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672150": [
        {
            "ioc_value": "boulangeriejocteur.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-12 18:38:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672151": [
        {
            "ioc_value": "buccaneersgab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672152": [
        {
            "ioc_value": "butterboycomedy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672153": [
        {
            "ioc_value": "c3style.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672154": [
        {
            "ioc_value": "cakhiatv.ai",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672155": [
        {
            "ioc_value": "cakhiatv.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672156": [
        {
            "ioc_value": "cakhiatv.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-12 18:39:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672157": [
        {
            "ioc_value": "cakhiatv.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672158": [
        {
            "ioc_value": "cakhiatv.is",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672159": [
        {
            "ioc_value": "cakhiatv.media",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:36",
            "last_seen_utc": "2025-12-09 06:33:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672142": [
        {
            "ioc_value": "1phuttietkiemtrieuniemvui.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:31:35",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1672139": [
        {
            "ioc_value": "wv.b0rtnge5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 06:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671887": [
        {
            "ioc_value": "clearskyspark.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-09 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.secrss.com/articles/85868",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1671888": [
        {
            "ioc_value": "deepcloudspark.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-09 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.secrss.com/articles/85868",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1671889": [
        {
            "ioc_value": "greenhillmatrix.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-09 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.secrss.com/articles/85868",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1671890": [
        {
            "ioc_value": "silentmountcode.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-09 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.secrss.com/articles/85868",
            "tags": "CVE-2025-55182",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1671799": [
        {
            "ioc_value": "google.vn168.casa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/238e565defbe5839c1fb66f0bf65892b21cda9214abeeb7b08e134397c3dae61/detection",
            "tags": "AsyncRAT,c2,exe,rat",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1671800": [
        {
            "ioc_value": "googlecom.vn168.casa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:17:50",
            "last_seen_utc": "2025-12-12 18:38:36",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/238e565defbe5839c1fb66f0bf65892b21cda9214abeeb7b08e134397c3dae61/detection",
            "tags": "AsyncRAT,c2,exe,rat",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1671801": [
        {
            "ioc_value": "phising.vn168.casa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/238e565defbe5839c1fb66f0bf65892b21cda9214abeeb7b08e134397c3dae61/detection",
            "tags": "AsyncRAT,c2,exe,rat",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1671802": [
        {
            "ioc_value": "virus.vn168.casa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/238e565defbe5839c1fb66f0bf65892b21cda9214abeeb7b08e134397c3dae61/detection",
            "tags": "AsyncRAT,c2,exe,rat",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1672138": [
        {
            "ioc_value": "nsigl.amy8ep1thet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 06:17:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672137": [
        {
            "ioc_value": "ii.amy8ep1thet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 06:07:26",
            "last_seen_utc": "2025-12-09 06:15:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672132": [
        {
            "ioc_value": "koyogotit.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-09 06:02:50",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-b4ktjstmgn",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1672127": [
        {
            "ioc_value": "westxw.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-09 06:01:45",
            "last_seen_utc": "2025-12-09 06:36:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251209-fht8batpbx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1672126": [
        {
            "ioc_value": "byte.amy8ep1thet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 05:58:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672125": [
        {
            "ioc_value": "6n.amy8ep1thet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 05:46:47",
            "last_seen_utc": "2025-12-09 05:48:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672124": [
        {
            "ioc_value": "6eys.col1ectfre5h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 05:38:00",
            "last_seen_utc": "2025-12-09 05:40:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672123": [
        {
            "ioc_value": "vector.col1ectfre5h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 05:27:46",
            "last_seen_utc": "2025-12-09 05:34:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672122": [
        {
            "ioc_value": "9j6.col1ectfre5h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 05:17:46",
            "last_seen_utc": "2025-12-09 05:23:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672121": [
        {
            "ioc_value": "n7rwr.col1ectfre5h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 05:07:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672119": [
        {
            "ioc_value": "jz.ank1elickin8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 04:57:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672118": [
        {
            "ioc_value": "0dbws.ank1elickin8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 04:47:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672117": [
        {
            "ioc_value": "iz.ank1elickin8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 04:31:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672116": [
        {
            "ioc_value": "79hc.ank1elickin8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 04:26:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672115": [
        {
            "ioc_value": "zh9.di5orientr0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 04:13:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672114": [
        {
            "ioc_value": "3vg76.di5orientr0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 04:07:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672097": [
        {
            "ioc_value": "trace.di5orientr0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 03:57:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672096": [
        {
            "ioc_value": "fresh.di5orientr0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 03:47:44",
            "last_seen_utc": "2025-12-09 03:49:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672095": [
        {
            "ioc_value": "oh.ref1nemsei7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 03:37:27",
            "last_seen_utc": "2025-12-09 03:42:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672094": [
        {
            "ioc_value": "tkf8.ref1nemsei7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 03:27:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672093": [
        {
            "ioc_value": "orct1.ref1nemsei7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 03:15:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672092": [
        {
            "ioc_value": "crate.ref1nemsei7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 03:10:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672089": [
        {
            "ioc_value": "bright.p1acetit1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 02:56:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1672088": [
        {
            "ioc_value": "johnsmith77770444.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-09 02:50:24",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1672087": [
        {
            "ioc_value": "dc.p1acetit1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 02:50:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671878": [
        {
            "ioc_value": "ecq0.p1acetit1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 02:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671877": [
        {
            "ioc_value": "v8gqo.p1acetit1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 02:26:50",
            "last_seen_utc": "2025-12-09 02:29:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671876": [
        {
            "ioc_value": "jl.chee5eg1ider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 02:16:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671874": [
        {
            "ioc_value": "kg.chee5eg1ider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 02:07:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671872": [
        {
            "ioc_value": "ygg.chee5eg1ider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 01:57:34",
            "last_seen_utc": "2025-12-09 02:02:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671871": [
        {
            "ioc_value": "oxzka.chee5eg1ider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 01:47:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671870": [
        {
            "ioc_value": "9fm.hire5t1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 01:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671868": [
        {
            "ioc_value": "eb.hire5t1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 01:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671867": [
        {
            "ioc_value": "yi.hire5t1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 01:16:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671866": [
        {
            "ioc_value": "ebkkh.hire5t1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 01:07:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671865": [
        {
            "ioc_value": "shift.pe7fectp7oc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 00:57:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671864": [
        {
            "ioc_value": "l5qal.pe7fectp7oc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 00:48:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671863": [
        {
            "ioc_value": "yfx.pe7fectp7oc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 00:38:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671862": [
        {
            "ioc_value": "fyed6.pe7fectp7oc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 00:27:59",
            "last_seen_utc": "2025-12-09 00:28:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671861": [
        {
            "ioc_value": "yje.vexdapper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 00:17:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671860": [
        {
            "ioc_value": "wild.vexdapper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-09 00:08:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671853": [
        {
            "ioc_value": "cherokeemech.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-12-09 00:04:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.217.251+cherokeemech.net",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Gafgyt,open-dir",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671842": [
        {
            "ioc_value": "sn7.vexdapper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 23:58:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671841": [
        {
            "ioc_value": "stone.vexdapper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 23:47:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671840": [
        {
            "ioc_value": "9rt5b.dexlotion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 23:37:53",
            "last_seen_utc": "2025-12-08 23:47:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671839": [
        {
            "ioc_value": "m7d6.dexlotion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 23:29:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671838": [
        {
            "ioc_value": "4m.dexlotion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 23:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671836": [
        {
            "ioc_value": "glint.dexlotion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 23:07:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671823": [
        {
            "ioc_value": "corticox.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-08 23:01:15",
            "last_seen_utc": "2025-12-09 00:03:12",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+corticox.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1671816": [
        {
            "ioc_value": "5c.gl1ntip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 22:58:08",
            "last_seen_utc": "2025-12-08 23:06:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671815": [
        {
            "ioc_value": "hill.gl1ntip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 22:42:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671814": [
        {
            "ioc_value": "mint.gl1ntip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 22:38:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671811": [
        {
            "ioc_value": "pixel.gl1ntip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 22:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671810": [
        {
            "ioc_value": "1iz.rangepip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 22:11:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671809": [
        {
            "ioc_value": "shadow.rangepip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 22:04:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671806": [
        {
            "ioc_value": "sky.rangepip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 21:53:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671805": [
        {
            "ioc_value": "light.rangepip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 21:47:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671804": [
        {
            "ioc_value": "jr.minglecrate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 21:38:21",
            "last_seen_utc": "2025-12-08 21:45:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671758": [
        {
            "ioc_value": "wy3.minglecrate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 21:28:30",
            "last_seen_utc": "2025-12-08 21:29:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671753": [
        {
            "ioc_value": "storm.minglecrate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 21:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671750": [
        {
            "ioc_value": "www.msupdate.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-08 21:12:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/malwrhunterteam/status/1998127612326260966",
            "tags": "c2,cobaltstrike,cs-watermark-987654321,domain",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671749": [
        {
            "ioc_value": "np.minglecrate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 21:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671746": [
        {
            "ioc_value": "xal.f-1-sslehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 20:51:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671745": [
        {
            "ioc_value": "sun.f-1-sslehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 20:47:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671744": [
        {
            "ioc_value": "ocean.f-1-sslehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 20:40:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671743": [
        {
            "ioc_value": "silent.f-1-sslehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 20:31:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671742": [
        {
            "ioc_value": "8oc.sprintmold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 20:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671741": [
        {
            "ioc_value": "i2p.sprintmold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 20:23:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671739": [
        {
            "ioc_value": "forest.sprintmold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 20:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671712": [
        {
            "ioc_value": "ksfldfklskdmbxcvb.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 20:07:47",
            "last_seen_utc": "2025-12-08 19:59:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1671738": [
        {
            "ioc_value": "8dp4.sprintmold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 20:07:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671720": [
        {
            "ioc_value": "ksdkgsdkgkgmgm.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 19:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671719": [
        {
            "ioc_value": "ern.qu0rkline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 19:57:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671718": [
        {
            "ioc_value": "river.qu0rkline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 19:47:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671716": [
        {
            "ioc_value": "0ut.qu0rkline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 19:37:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671715": [
        {
            "ioc_value": "wvcqn.qu0rkline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 19:27:40",
            "last_seen_utc": "2025-12-08 19:32:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671711": [
        {
            "ioc_value": "vex.f1sslehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 19:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671710": [
        {
            "ioc_value": "perfect.f1sslehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 19:07:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671697": [
        {
            "ioc_value": "wp.postanidostavljac.rs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671698": [
        {
            "ioc_value": "wp.zyratalk.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671699": [
        {
            "ioc_value": "xbox.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671700": [
        {
            "ioc_value": "xinnomix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671701": [
        {
            "ioc_value": "xn--vck8crc320vuua.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": "2025-12-12 18:01:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671702": [
        {
            "ioc_value": "yarapon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": "2025-12-09 13:35:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671703": [
        {
            "ioc_value": "youanditrips.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": "2025-12-11 19:29:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671704": [
        {
            "ioc_value": "youngdesignerscollective.idconsults.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671705": [
        {
            "ioc_value": "yoursny.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": "2025-12-09 13:35:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671706": [
        {
            "ioc_value": "ys.onaritest-1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671707": [
        {
            "ioc_value": "yukkou555.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": "2025-12-09 13:35:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671708": [
        {
            "ioc_value": "yumekanaumade.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": "2025-12-11 19:29:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671709": [
        {
            "ioc_value": "zoom.tecnosimbra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671685": [
        {
            "ioc_value": "vayna.in.digitaljaydeep.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671686": [
        {
            "ioc_value": "velvetyield.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671687": [
        {
            "ioc_value": "victorlopes.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671688": [
        {
            "ioc_value": "vigor-14.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671689": [
        {
            "ioc_value": "vipbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671690": [
        {
            "ioc_value": "vitralweb.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": "2025-12-11 19:29:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671691": [
        {
            "ioc_value": "volokno.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671692": [
        {
            "ioc_value": "website-planet.gr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": "2025-12-09 13:35:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671693": [
        {
            "ioc_value": "winwinexpert.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": "2025-12-11 19:29:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671694": [
        {
            "ioc_value": "wisemerchantservices.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671695": [
        {
            "ioc_value": "wo.cementah.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671696": [
        {
            "ioc_value": "worldvacationtour.adskonic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:50",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671671": [
        {
            "ioc_value": "trybirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671672": [
        {
            "ioc_value": "trybirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671673": [
        {
            "ioc_value": "turkey-company.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671674": [
        {
            "ioc_value": "tv.ldiiriau.or.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671675": [
        {
            "ioc_value": "umami.eu.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-09 13:35:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671676": [
        {
            "ioc_value": "unf.alt-ruist.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671677": [
        {
            "ioc_value": "upbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-12 18:01:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671678": [
        {
            "ioc_value": "usbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671679": [
        {
            "ioc_value": "v1.yhelwah.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671680": [
        {
            "ioc_value": "v6bet.boo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671681": [
        {
            "ioc_value": "va.jvrjobs.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671682": [
        {
            "ioc_value": "vasco.media",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-09 13:35:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671683": [
        {
            "ioc_value": "vasco.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-08 19:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671684": [
        {
            "ioc_value": "vascoinsurance.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:49",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671661": [
        {
            "ioc_value": "tessajemile.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671662": [
        {
            "ioc_value": "testdata.bel-technology.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671663": [
        {
            "ioc_value": "testeproducao.kinghost.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671664": [
        {
            "ioc_value": "thebirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671665": [
        {
            "ioc_value": "thecatflix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671666": [
        {
            "ioc_value": "thietbidiencongnghiep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671667": [
        {
            "ioc_value": "tifarahbemestar.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671668": [
        {
            "ioc_value": "track.truckporter.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671669": [
        {
            "ioc_value": "travelfork.highheelsplace.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671670": [
        {
            "ioc_value": "tresna.bel-technology.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671648": [
        {
            "ioc_value": "sysbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671649": [
        {
            "ioc_value": "sysbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671650": [
        {
            "ioc_value": "t2.apps.zestforai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671651": [
        {
            "ioc_value": "talents.tasawk.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671652": [
        {
            "ioc_value": "talentwoods.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671653": [
        {
            "ioc_value": "tampilkan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": "2025-12-09 13:35:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671654": [
        {
            "ioc_value": "tapbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671655": [
        {
            "ioc_value": "techa.or.th",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671656": [
        {
            "ioc_value": "techvirtus.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": "2025-12-12 18:01:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671657": [
        {
            "ioc_value": "tecnotour360.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": "2025-12-12 18:01:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671658": [
        {
            "ioc_value": "tecvirtus.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671659": [
        {
            "ioc_value": "teixeiraadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671660": [
        {
            "ioc_value": "teo-global.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671635": [
        {
            "ioc_value": "spreeacker.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671636": [
        {
            "ioc_value": "srisriacademy.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": "2025-12-12 18:01:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671637": [
        {
            "ioc_value": "srv1133832.hstgr.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671638": [
        {
            "ioc_value": "standscancun.mx",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671639": [
        {
            "ioc_value": "staw.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671640": [
        {
            "ioc_value": "stelaconvites.kevbarroz.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671641": [
        {
            "ioc_value": "suavidaadois.com.suavidaadois.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671642": [
        {
            "ioc_value": "suellensoares.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671643": [
        {
            "ioc_value": "suomikuva.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671644": [
        {
            "ioc_value": "suporte.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": "2025-12-12 18:01:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671645": [
        {
            "ioc_value": "support.lmtr.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671646": [
        {
            "ioc_value": "suwalake.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671647": [
        {
            "ioc_value": "swat3.welfaretaiwan.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671621": [
        {
            "ioc_value": "sgst.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671622": [
        {
            "ioc_value": "shiroutojapan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": "2025-12-12 18:01:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671623": [
        {
            "ioc_value": "shockingpoint.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671624": [
        {
            "ioc_value": "shop.biprolex.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671625": [
        {
            "ioc_value": "shop.rst.ge",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671626": [
        {
            "ioc_value": "shoushin.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": "2025-12-10 23:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671627": [
        {
            "ioc_value": "sikousakugo.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671628": [
        {
            "ioc_value": "site.fontesolutions.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671629": [
        {
            "ioc_value": "smartmanagernew.bel-technology.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671630": [
        {
            "ioc_value": "smtp.caodangyduoctphcm.com.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671631": [
        {
            "ioc_value": "smtp.journalultv.edu.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671632": [
        {
            "ioc_value": "smtp11.cp8nl.hyperhost.ua",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671633": [
        {
            "ioc_value": "somnathguesthouse.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671634": [
        {
            "ioc_value": "sousaedomingos.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:45",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671606": [
        {
            "ioc_value": "sample.toramameblog.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671607": [
        {
            "ioc_value": "sanxiashe.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671608": [
        {
            "ioc_value": "saraaraenterprise.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671609": [
        {
            "ioc_value": "savvyconversions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671610": [
        {
            "ioc_value": "schnaidepincelli.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671611": [
        {
            "ioc_value": "schuldenscout24.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671612": [
        {
            "ioc_value": "scorenotopo.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671613": [
        {
            "ioc_value": "securenetapp-site.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671614": [
        {
            "ioc_value": "securepaymasters.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671615": [
        {
            "ioc_value": "seo.bayshorecommunication.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671616": [
        {
            "ioc_value": "server.grupovirtualizate.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671617": [
        {
            "ioc_value": "server.schoolofhealthcare.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671618": [
        {
            "ioc_value": "servisoft.al",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671619": [
        {
            "ioc_value": "servizio-clienti.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": "2025-12-10 23:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671620": [
        {
            "ioc_value": "seseragisato.xsrv.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:44",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671593": [
        {
            "ioc_value": "revuedepresse.caci.dz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671594": [
        {
            "ioc_value": "rewardsplus.phm-hotels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671595": [
        {
            "ioc_value": "ribeiraopreto.oligoflora.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": "2025-12-12 18:01:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671596": [
        {
            "ioc_value": "rising-s.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671597": [
        {
            "ioc_value": "rl-soc-siem.mori.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671598": [
        {
            "ioc_value": "rmpadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671599": [
        {
            "ioc_value": "robobotics.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": "2025-12-10 23:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671600": [
        {
            "ioc_value": "ronymax.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671601": [
        {
            "ioc_value": "s-aroma.tokyo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671602": [
        {
            "ioc_value": "s.onaritest-1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671603": [
        {
            "ioc_value": "sabihfinancials.pk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671604": [
        {
            "ioc_value": "sachiyaari.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671605": [
        {
            "ioc_value": "saintmichaelsdenver.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:43",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671578": [
        {
            "ioc_value": "racismbasics.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671579": [
        {
            "ioc_value": "radiofan88fm.ro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-12 18:01:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671580": [
        {
            "ioc_value": "radiosandiegomantilla.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671581": [
        {
            "ioc_value": "radovich-net.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671582": [
        {
            "ioc_value": "rafaelcataldiadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671583": [
        {
            "ioc_value": "railanpaiva.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671584": [
        {
            "ioc_value": "rcbharatpur.org.np",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-10 23:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671585": [
        {
            "ioc_value": "rd3.3squaredco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671586": [
        {
            "ioc_value": "reachbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671587": [
        {
            "ioc_value": "rebatesoft.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-12 18:01:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671588": [
        {
            "ioc_value": "rebelhousewife.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-09 13:35:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671589": [
        {
            "ioc_value": "receita-fazenda.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671590": [
        {
            "ioc_value": "reform.skworks.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671591": [
        {
            "ioc_value": "reido.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671592": [
        {
            "ioc_value": "revenueempirehub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:42",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671562": [
        {
            "ioc_value": "polpaeva.ind.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671563": [
        {
            "ioc_value": "pop.caodangyduoctphcm.com.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671564": [
        {
            "ioc_value": "pop.journalultv.edu.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671565": [
        {
            "ioc_value": "popo.party",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671566": [
        {
            "ioc_value": "portalvaledojiquirica.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671567": [
        {
            "ioc_value": "portoidee.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671568": [
        {
            "ioc_value": "pos.realautogroup.co.ke",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671569": [
        {
            "ioc_value": "pospi.mt-org.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671570": [
        {
            "ioc_value": "ppg.ldiiriau.or.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671571": [
        {
            "ioc_value": "premiumtapete.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671572": [
        {
            "ioc_value": "probirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671573": [
        {
            "ioc_value": "proteggereseg.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671574": [
        {
            "ioc_value": "proves2tn.2tono.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671575": [
        {
            "ioc_value": "pti-br.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671576": [
        {
            "ioc_value": "pti.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671577": [
        {
            "ioc_value": "qalab.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:41",
            "last_seen_utc": "2025-12-09 13:35:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671549": [
        {
            "ioc_value": "outbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": "2025-12-10 23:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671550": [
        {
            "ioc_value": "overionconsulting.com.victorabrao.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671551": [
        {
            "ioc_value": "paint.stejdzing.pl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671552": [
        {
            "ioc_value": "patriciamattos.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671553": [
        {
            "ioc_value": "pauloferreira.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671554": [
        {
            "ioc_value": "pay.propel.co.ke",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671555": [
        {
            "ioc_value": "pcinuask.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671556": [
        {
            "ioc_value": "personalfinesse.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": "2025-12-10 23:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671557": [
        {
            "ioc_value": "phcolo.ph",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671558": [
        {
            "ioc_value": "pi.draftus.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671559": [
        {
            "ioc_value": "piresesousa.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671560": [
        {
            "ioc_value": "pk-pro.iqhs.pl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": "2025-12-09 13:35:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671561": [
        {
            "ioc_value": "planavi1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:40",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671537": [
        {
            "ioc_value": "nx3engenharia.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671538": [
        {
            "ioc_value": "obrigada.uniaeditora.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671539": [
        {
            "ioc_value": "olaia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671540": [
        {
            "ioc_value": "old.vascoinsurance.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671541": [
        {
            "ioc_value": "oliveiraealves.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671542": [
        {
            "ioc_value": "omailoang.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671543": [
        {
            "ioc_value": "oncallsolutions.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": "2025-12-11 19:29:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671544": [
        {
            "ioc_value": "onecommunities.com.wegaplas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671545": [
        {
            "ioc_value": "online.asesoriaprof.com.mx",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671546": [
        {
            "ioc_value": "optbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671547": [
        {
            "ioc_value": "os.mpcservicos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671548": [
        {
            "ioc_value": "ospm.mpcservicos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671525": [
        {
            "ioc_value": "myrtleturtlesavingscard.com.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671526": [
        {
            "ioc_value": "nashikoariel.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671527": [
        {
            "ioc_value": "ndpparticipacoes.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671528": [
        {
            "ioc_value": "neggpay.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671529": [
        {
            "ioc_value": "new.localgrapevines.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": "2025-12-09 13:35:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671530": [
        {
            "ioc_value": "newage-tv.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671531": [
        {
            "ioc_value": "newlowerplan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671532": [
        {
            "ioc_value": "nextwarren.mt-org.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671533": [
        {
            "ioc_value": "nicsnest.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671534": [
        {
            "ioc_value": "nicsnest.rocketrobs.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": "2025-12-09 13:35:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671535": [
        {
            "ioc_value": "nurturewallet.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671536": [
        {
            "ioc_value": "nutricell.tunegocioreal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:38",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671513": [
        {
            "ioc_value": "monette.sumulong.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671514": [
        {
            "ioc_value": "moneycolony.workwithastara.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671515": [
        {
            "ioc_value": "montirid.azurewebsites.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671516": [
        {
            "ioc_value": "moreiraeaquino.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671517": [
        {
            "ioc_value": "mortgage.loanroad.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": "2025-12-11 19:29:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671518": [
        {
            "ioc_value": "mpfadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671519": [
        {
            "ioc_value": "ms810.tokyo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671520": [
        {
            "ioc_value": "msroffice.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671521": [
        {
            "ioc_value": "musubi-emu.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671522": [
        {
            "ioc_value": "mybirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671523": [
        {
            "ioc_value": "mybirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671524": [
        {
            "ioc_value": "mymail.lkhoster.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:37",
            "last_seen_utc": "2025-12-11 19:29:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671500": [
        {
            "ioc_value": "mcastroecastro.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671501": [
        {
            "ioc_value": "mcnd.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671502": [
        {
            "ioc_value": "medihai.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671503": [
        {
            "ioc_value": "megas.leadtech.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671504": [
        {
            "ioc_value": "melktandjiespreschool.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671505": [
        {
            "ioc_value": "members.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671506": [
        {
            "ioc_value": "mikrofasertuch24.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671507": [
        {
            "ioc_value": "milagrosmiraclesolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671508": [
        {
            "ioc_value": "ministrycanvapro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671509": [
        {
            "ioc_value": "missenterpriseafrica.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671510": [
        {
            "ioc_value": "mixy.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": "2025-12-11 19:29:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671511": [
        {
            "ioc_value": "ml.k2x.tech",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671512": [
        {
            "ioc_value": "mockup540.leanq.com.np",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671486": [
        {
            "ioc_value": "mail.xoxnelson.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671487": [
        {
            "ioc_value": "maitanesarralde.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671488": [
        {
            "ioc_value": "makesense.pp.ua",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671489": [
        {
            "ioc_value": "manriqueadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671490": [
        {
            "ioc_value": "mapa.dtopublicidade.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671491": [
        {
            "ioc_value": "marcelohenriquemartins.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": "2025-12-09 13:35:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671492": [
        {
            "ioc_value": "marcomiranda.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671493": [
        {
            "ioc_value": "market.aasabie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671494": [
        {
            "ioc_value": "marusho-factory.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671495": [
        {
            "ioc_value": "massans7.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671496": [
        {
            "ioc_value": "matheusbaldan.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671497": [
        {
            "ioc_value": "matheusribeiro.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671498": [
        {
            "ioc_value": "matheusvieiraribeiro.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671499": [
        {
            "ioc_value": "maxbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:35",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671469": [
        {
            "ioc_value": "mail.rubic3.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671470": [
        {
            "ioc_value": "mail.sanchezgroups.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671471": [
        {
            "ioc_value": "mail.sandlefordparade.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671472": [
        {
            "ioc_value": "mail.semfronteirasmarcas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671473": [
        {
            "ioc_value": "mail.shahzadmovers.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671474": [
        {
            "ioc_value": "mail.smcompressores.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-12 18:00:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671475": [
        {
            "ioc_value": "mail.southernsummits.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671476": [
        {
            "ioc_value": "mail.suavidaadois.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-10 23:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671477": [
        {
            "ioc_value": "mail.subasanat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671478": [
        {
            "ioc_value": "mail.tapensa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671479": [
        {
            "ioc_value": "mail.tiltdesigns.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671480": [
        {
            "ioc_value": "mail.tophygiene.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671481": [
        {
            "ioc_value": "mail.vascofinancial.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671482": [
        {
            "ioc_value": "mail.vidyaniketanpublicschools.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-08 19:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671483": [
        {
            "ioc_value": "mail.webpeco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671484": [
        {
            "ioc_value": "mail.winnipeglandscapingpros.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671485": [
        {
            "ioc_value": "mail.worldvacationtour.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:34",
            "last_seen_utc": "2025-12-10 23:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671452": [
        {
            "ioc_value": "mail.oneononefriendship.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671453": [
        {
            "ioc_value": "mail.orebits.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-09 13:35:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671454": [
        {
            "ioc_value": "mail.orebits.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671455": [
        {
            "ioc_value": "mail.pdtutahalphaevents.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671456": [
        {
            "ioc_value": "mail.personalfinesse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-10 23:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671457": [
        {
            "ioc_value": "mail.pinnaclecompanies.us",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-12 18:00:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671458": [
        {
            "ioc_value": "mail.planetaalfabetizado.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671459": [
        {
            "ioc_value": "mail.poloidesign.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671460": [
        {
            "ioc_value": "mail.positivaautopecas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671461": [
        {
            "ioc_value": "mail.printzone.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671462": [
        {
            "ioc_value": "mail.prolifemobilization.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671463": [
        {
            "ioc_value": "mail.proseiec.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-12 18:00:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671464": [
        {
            "ioc_value": "mail.raessler.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671465": [
        {
            "ioc_value": "mail.raessler.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671466": [
        {
            "ioc_value": "mail.redlandsclearautobra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671467": [
        {
            "ioc_value": "mail.redlandsclearbra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671468": [
        {
            "ioc_value": "mail.riseword.risedev.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:33",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671435": [
        {
            "ioc_value": "mail.jozelletech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671436": [
        {
            "ioc_value": "mail.kc5jmj.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671437": [
        {
            "ioc_value": "mail.kemeticbeauti.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671438": [
        {
            "ioc_value": "mail.kesieuthihatinh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671439": [
        {
            "ioc_value": "mail.landman.africa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671440": [
        {
            "ioc_value": "mail.lepetitjardinier.sn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671441": [
        {
            "ioc_value": "mail.maikamakes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671442": [
        {
            "ioc_value": "mail.maritimnews.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671443": [
        {
            "ioc_value": "mail.meeting-point.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": "2025-12-12 18:00:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671444": [
        {
            "ioc_value": "mail.mikovtraining.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671445": [
        {
            "ioc_value": "mail.mirzadev.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671446": [
        {
            "ioc_value": "mail.mojtabaabbasi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671447": [
        {
            "ioc_value": "mail.moudperfume.dev3.prodevr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671448": [
        {
            "ioc_value": "mail.mpcservicos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": "2025-12-12 18:00:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671449": [
        {
            "ioc_value": "mail.mrleeprojects.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671450": [
        {
            "ioc_value": "mail.mylabmed.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": "2025-12-12 18:00:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671451": [
        {
            "ioc_value": "mail.nathanhowe.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:32",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671419": [
        {
            "ioc_value": "mail.emailbiz.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671420": [
        {
            "ioc_value": "mail.emaragogi.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671421": [
        {
            "ioc_value": "mail.estefanys.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671422": [
        {
            "ioc_value": "mail.estefanystours.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": "2025-12-10 23:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671423": [
        {
            "ioc_value": "mail.euromoc.co.mz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671424": [
        {
            "ioc_value": "mail.explonortespa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": "2025-12-12 18:00:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671425": [
        {
            "ioc_value": "mail.garrygolden.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671426": [
        {
            "ioc_value": "mail.geraldomartins.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671427": [
        {
            "ioc_value": "mail.getbrandauthority.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671428": [
        {
            "ioc_value": "mail.gold-silver-investment.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671429": [
        {
            "ioc_value": "mail.gopanoptica.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671430": [
        {
            "ioc_value": "mail.hartvoorregelen.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": "2025-12-09 13:35:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671431": [
        {
            "ioc_value": "mail.hautehealth.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671432": [
        {
            "ioc_value": "mail.heartofthepiedmont.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671433": [
        {
            "ioc_value": "mail.hotelthilanka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671434": [
        {
            "ioc_value": "mail.itotecsistemas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671405": [
        {
            "ioc_value": "mail.cherisseebanks.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671406": [
        {
            "ioc_value": "mail.chovgroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": "2025-12-09 13:35:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671407": [
        {
            "ioc_value": "mail.clickuhome.com.hk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671408": [
        {
            "ioc_value": "mail.client24.shared.atcihosting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671409": [
        {
            "ioc_value": "mail.copizzas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": "2025-12-10 23:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671410": [
        {
            "ioc_value": "mail.cornerstoneindonesia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671411": [
        {
            "ioc_value": "mail.covidautorelief.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671412": [
        {
            "ioc_value": "mail.cymage-media.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": "2025-12-10 23:57:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671413": [
        {
            "ioc_value": "mail.diabezill.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671414": [
        {
            "ioc_value": "mail.dinsosjombang.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": "2025-12-09 13:35:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671415": [
        {
            "ioc_value": "mail.dioseschido.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671416": [
        {
            "ioc_value": "mail.drpaulocatalao.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671417": [
        {
            "ioc_value": "mail.e-media.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": "2025-12-09 13:35:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671418": [
        {
            "ioc_value": "mail.educationhmo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671389": [
        {
            "ioc_value": "mail.247p4ng.uptozion.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671390": [
        {
            "ioc_value": "mail.3squaredco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671391": [
        {
            "ioc_value": "mail.adbsurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671392": [
        {
            "ioc_value": "mail.adsys-iq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-12 18:00:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671393": [
        {
            "ioc_value": "mail.agragamipucollege.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671394": [
        {
            "ioc_value": "mail.alldecor.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671395": [
        {
            "ioc_value": "mail.anupammills.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671396": [
        {
            "ioc_value": "mail.artwix.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-10 23:57:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671397": [
        {
            "ioc_value": "mail.asesoriaprof.com.mx",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671398": [
        {
            "ioc_value": "mail.assertivacriativa.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671399": [
        {
            "ioc_value": "mail.asunflowersmindset.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671400": [
        {
            "ioc_value": "mail.avciauto.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671401": [
        {
            "ioc_value": "mail.bebejan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-12 18:00:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671402": [
        {
            "ioc_value": "mail.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671403": [
        {
            "ioc_value": "mail.buevents.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671404": [
        {
            "ioc_value": "mail.bustaff.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:29",
            "last_seen_utc": "2025-12-10 23:57:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671373": [
        {
            "ioc_value": "loans.loanroad.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671374": [
        {
            "ioc_value": "lojajoias.seomidia.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671375": [
        {
            "ioc_value": "look4u.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671376": [
        {
            "ioc_value": "lostinwild.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671377": [
        {
            "ioc_value": "lotuskidschennai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671378": [
        {
            "ioc_value": "loyalty-jumbo.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671379": [
        {
            "ioc_value": "lp.clinicacotrel.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671380": [
        {
            "ioc_value": "lp.magalhaesenegris.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671381": [
        {
            "ioc_value": "lp.ramoseandrade.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671382": [
        {
            "ioc_value": "ltt.bel-technology.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671383": [
        {
            "ioc_value": "luakatea.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671384": [
        {
            "ioc_value": "lukelawyer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671385": [
        {
            "ioc_value": "luzietticorreaemachado.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671386": [
        {
            "ioc_value": "m.betingslot-2024.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671387": [
        {
            "ioc_value": "m4kancom.sc1mqxc4751.universe.wf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671388": [
        {
            "ioc_value": "magdielnicholls.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:28",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671357": [
        {
            "ioc_value": "kouei-sangyou.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671358": [
        {
            "ioc_value": "koutube.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671359": [
        {
            "ioc_value": "kundenservice.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671360": [
        {
            "ioc_value": "kurssit.sensuelliluojatar.fi",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671361": [
        {
            "ioc_value": "kzln.kz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-09 13:35:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671362": [
        {
            "ioc_value": "lala88slot.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671363": [
        {
            "ioc_value": "landman.africa.abura.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671364": [
        {
            "ioc_value": "lavernecapital.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671365": [
        {
            "ioc_value": "lawofficesofdurant.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671366": [
        {
            "ioc_value": "learn-way.academy",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671367": [
        {
            "ioc_value": "legalchats.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671368": [
        {
            "ioc_value": "liblink.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671369": [
        {
            "ioc_value": "lic.caodangyduoctphcm.com.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671370": [
        {
            "ioc_value": "licitacao.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-09 13:35:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671371": [
        {
            "ioc_value": "lifewayfwc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671372": [
        {
            "ioc_value": "lindakerbakken.no",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:27",
            "last_seen_utc": "2025-12-12 18:00:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671344": [
        {
            "ioc_value": "justbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671345": [
        {
            "ioc_value": "jyokin-syoudoku.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-09 13:35:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671346": [
        {
            "ioc_value": "kaede-support.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671347": [
        {
            "ioc_value": "kamiyamatoclinic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671348": [
        {
            "ioc_value": "karladesign.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671349": [
        {
            "ioc_value": "karlamuhammed.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671350": [
        {
            "ioc_value": "kesieuthihatinh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-09 13:35:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671351": [
        {
            "ioc_value": "kibris.life",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671352": [
        {
            "ioc_value": "kimuyu2025.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671353": [
        {
            "ioc_value": "klaveness-stiftelsen.bel-technology.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671354": [
        {
            "ioc_value": "kojima-tax.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671355": [
        {
            "ioc_value": "kojinogoen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671356": [
        {
            "ioc_value": "kokoro-koko.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:26",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671328": [
        {
            "ioc_value": "invitriol.graficly.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671329": [
        {
            "ioc_value": "ioredu.com.southernsummits.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671330": [
        {
            "ioc_value": "ioriori.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671331": [
        {
            "ioc_value": "itoshunichi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671332": [
        {
            "ioc_value": "itotalenlinea.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671333": [
        {
            "ioc_value": "itotecsistemas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-09 13:35:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671334": [
        {
            "ioc_value": "itotecsistemas.com.br.victorabrao.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-09 13:35:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671335": [
        {
            "ioc_value": "iyana.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671336": [
        {
            "ioc_value": "jakeislame.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671337": [
        {
            "ioc_value": "jaquelinenunesadv.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-09 13:35:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671338": [
        {
            "ioc_value": "jdtoto.club",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671339": [
        {
            "ioc_value": "jessycatemponi.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671340": [
        {
            "ioc_value": "jonasbarreto.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671341": [
        {
            "ioc_value": "jordanien.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671342": [
        {
            "ioc_value": "joss77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671343": [
        {
            "ioc_value": "jurassicvps.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:25",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671317": [
        {
            "ioc_value": "hopeandfaith.com.np",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671318": [
        {
            "ioc_value": "hostmaster.caodangyduoctphcm.com.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671319": [
        {
            "ioc_value": "hot.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671320": [
        {
            "ioc_value": "hyllecrawfish.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671321": [
        {
            "ioc_value": "icecloudvapor.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671322": [
        {
            "ioc_value": "ik1-423-43732.vs.sakura.ne.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671323": [
        {
            "ioc_value": "imobiliariadevalor.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671324": [
        {
            "ioc_value": "inboximpactlabs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671325": [
        {
            "ioc_value": "ineox.pl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671326": [
        {
            "ioc_value": "infosec.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": "2025-12-10 23:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671327": [
        {
            "ioc_value": "integratedproperties.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:24",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671305": [
        {
            "ioc_value": "grunt.uk.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671306": [
        {
            "ioc_value": "grupoces.nsnservicos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": "2025-12-09 13:35:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671307": [
        {
            "ioc_value": "gruponavegante.nilmaster.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671308": [
        {
            "ioc_value": "guerrera.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671309": [
        {
            "ioc_value": "gym.tasawk.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671310": [
        {
            "ioc_value": "h112-174.rackhostvps.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671311": [
        {
            "ioc_value": "handyman.teamgroovy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671312": [
        {
            "ioc_value": "harappa-ec.e-homepage.vc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671313": [
        {
            "ioc_value": "heavenly-d.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671314": [
        {
            "ioc_value": "hermanngmeinerscz.edu.bo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671315": [
        {
            "ioc_value": "hghlaw.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671316": [
        {
            "ioc_value": "holidayinfo-info.highheelsplace.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:23",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671292": [
        {
            "ioc_value": "getbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": "2025-12-10 23:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671293": [
        {
            "ioc_value": "giaothongvantaitphcm.com.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671294": [
        {
            "ioc_value": "giovanniniadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671295": [
        {
            "ioc_value": "globalipogroup.com.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671296": [
        {
            "ioc_value": "gobirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671297": [
        {
            "ioc_value": "gobirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671298": [
        {
            "ioc_value": "gold-silver-investment.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": "2025-12-10 23:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671299": [
        {
            "ioc_value": "gold-silver-investment.web325.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671300": [
        {
            "ioc_value": "gomesesabraadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671301": [
        {
            "ioc_value": "gr8life.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671302": [
        {
            "ioc_value": "grab.reswis.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671303": [
        {
            "ioc_value": "greengy.tech",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671304": [
        {
            "ioc_value": "gripequipped.hermancedesign.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:22",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671279": [
        {
            "ioc_value": "fixbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": "2025-12-12 18:00:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671280": [
        {
            "ioc_value": "fontesolutions.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671281": [
        {
            "ioc_value": "ford.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671282": [
        {
            "ioc_value": "form.canxium.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671283": [
        {
            "ioc_value": "formatub.groupe-tallec.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671284": [
        {
            "ioc_value": "freekids.amosca.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671285": [
        {
            "ioc_value": "fruits.tasawk.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671286": [
        {
            "ioc_value": "ftp.caodangyduoctphcm.com.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671287": [
        {
            "ioc_value": "ftp.dinsosjombang.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671288": [
        {
            "ioc_value": "ftp.journalultv.edu.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671289": [
        {
            "ioc_value": "Fuel4Design.aho.no",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671290": [
        {
            "ioc_value": "funcampaz.org.develop-app.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": "2025-12-10 23:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671291": [
        {
            "ioc_value": "gdform.navy.lk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671266": [
        {
            "ioc_value": "epistemo.shopschool.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": "2025-12-10 23:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671267": [
        {
            "ioc_value": "equity.loanroad.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": "2025-12-12 18:00:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671268": [
        {
            "ioc_value": "essenceofbrass.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671269": [
        {
            "ioc_value": "estefanystours.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671270": [
        {
            "ioc_value": "evergreenpp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671271": [
        {
            "ioc_value": "ez2.blog",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671272": [
        {
            "ioc_value": "fabrec.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": "2025-12-10 23:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671273": [
        {
            "ioc_value": "falcons.mt-org.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671274": [
        {
            "ioc_value": "fee.wordt-ontwikkeld.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671275": [
        {
            "ioc_value": "ferrod.aztecagoldtoken.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671276": [
        {
            "ioc_value": "fielregistros.com.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671277": [
        {
            "ioc_value": "finance.loanroad.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": "2025-12-12 18:00:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671278": [
        {
            "ioc_value": "fishscreamercharters.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671253": [
        {
            "ioc_value": "ec2-44-221-166-160.compute-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671254": [
        {
            "ioc_value": "ec2-44-233-42-62.us-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671255": [
        {
            "ioc_value": "ec2-44-242-17-237.us-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671256": [
        {
            "ioc_value": "ec2-52-37-0-89.us-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671257": [
        {
            "ioc_value": "ecofes.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671258": [
        {
            "ioc_value": "eduardoaraujo.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671259": [
        {
            "ioc_value": "eduardonaves.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671260": [
        {
            "ioc_value": "elev8ted-men.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671261": [
        {
            "ioc_value": "elisaschefferadvogada.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671262": [
        {
            "ioc_value": "emailbiz.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671263": [
        {
            "ioc_value": "empresa.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671264": [
        {
            "ioc_value": "en.ramorentacar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": "2025-12-10 23:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671265": [
        {
            "ioc_value": "enlightenproject-net.carynesplin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:19",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671238": [
        {
            "ioc_value": "dgworkshop.es",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671239": [
        {
            "ioc_value": "diegodecampos.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671240": [
        {
            "ioc_value": "digital.stc4tech.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671241": [
        {
            "ioc_value": "digitalweb.co.nz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671242": [
        {
            "ioc_value": "dinsosjombang.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671243": [
        {
            "ioc_value": "dioseschido.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671244": [
        {
            "ioc_value": "dioseschido.subastamelo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671245": [
        {
            "ioc_value": "doormatic.tn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671246": [
        {
            "ioc_value": "dramari.imbasites.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671247": [
        {
            "ioc_value": "dulceneriribeiro.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671248": [
        {
            "ioc_value": "dvt.name",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671249": [
        {
            "ioc_value": "easternsafety.com.sa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671250": [
        {
            "ioc_value": "easybuttonoffices.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": "2025-12-10 23:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671251": [
        {
            "ioc_value": "easywebxl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": "2025-12-10 23:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671252": [
        {
            "ioc_value": "ec2-13-127-179-170.ap-south-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671223": [
        {
            "ioc_value": "d.sklep.nozechifa.com.pl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671224": [
        {
            "ioc_value": "dantasemontes.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671225": [
        {
            "ioc_value": "darasahuru.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671226": [
        {
            "ioc_value": "daycuroanhatthanhdat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671227": [
        {
            "ioc_value": "db.truckporter.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671228": [
        {
            "ioc_value": "de-blog.hoteldoge.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671229": [
        {
            "ioc_value": "deborapaiva.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671230": [
        {
            "ioc_value": "demo.dailyquattran.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671231": [
        {
            "ioc_value": "demo.habaneros.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671232": [
        {
            "ioc_value": "demo.hax.com.bd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671233": [
        {
            "ioc_value": "demo2.brainycp.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": "2025-12-11 19:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671234": [
        {
            "ioc_value": "develop-app.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671235": [
        {
            "ioc_value": "dezinsect.uz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": "2025-12-10 23:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671236": [
        {
            "ioc_value": "dfsp.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671237": [
        {
            "ioc_value": "dfspadvocacia.com.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:17",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671211": [
        {
            "ioc_value": "ciriloehansen.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671212": [
        {
            "ioc_value": "clickuhome.com.hk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671213": [
        {
            "ioc_value": "climatestars.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671214": [
        {
            "ioc_value": "clinicasdoctord.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671215": [
        {
            "ioc_value": "cloutworks.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671216": [
        {
            "ioc_value": "coactsoftware.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671217": [
        {
            "ioc_value": "concavomotorcars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671218": [
        {
            "ioc_value": "contest.3squaredco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671219": [
        {
            "ioc_value": "cornerstoneindonesia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671220": [
        {
            "ioc_value": "covidautorelief.com.taxfreeautoloans.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": "2025-12-10 23:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671221": [
        {
            "ioc_value": "curiousseagullstudio.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671222": [
        {
            "ioc_value": "customercareserviceindia.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671200": [
        {
            "ioc_value": "cariresmi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671201": [
        {
            "ioc_value": "caroline.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671202": [
        {
            "ioc_value": "carolinetoledoadvocacia.com.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671203": [
        {
            "ioc_value": "casarolliadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671204": [
        {
            "ioc_value": "cash4lifepowerball.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": "2025-12-13 15:28:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671205": [
        {
            "ioc_value": "cetic.cm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671206": [
        {
            "ioc_value": "cetis2.quimicaelda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671207": [
        {
            "ioc_value": "chamado.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671208": [
        {
            "ioc_value": "chatgpt-lab.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": "2025-12-10 23:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671209": [
        {
            "ioc_value": "chirobasic.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671210": [
        {
            "ioc_value": "cintiafranzenfrank.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:15",
            "last_seen_utc": "2025-12-09 13:35:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671189": [
        {
            "ioc_value": "brain-it-consultancy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671190": [
        {
            "ioc_value": "breezibeauti.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": "2025-12-13 15:28:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671191": [
        {
            "ioc_value": "brightview.bel-technology.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671192": [
        {
            "ioc_value": "bslm.schoolofbeauticians.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671193": [
        {
            "ioc_value": "bullheadinsurance.mirzadev.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671194": [
        {
            "ioc_value": "buteam-com.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671195": [
        {
            "ioc_value": "buzzmollc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671196": [
        {
            "ioc_value": "caldasservice.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671197": [
        {
            "ioc_value": "car.loanroad.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671198": [
        {
            "ioc_value": "car.nathan-charvin.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671199": [
        {
            "ioc_value": "cardozoenascimentoadvocacia.com.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671180": [
        {
            "ioc_value": "birdreptip.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:13",
            "last_seen_utc": "2025-12-10 23:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671181": [
        {
            "ioc_value": "birdreptop.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:13",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671182": [
        {
            "ioc_value": "birdrepus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:13",
            "last_seen_utc": "2025-12-10 23:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671183": [
        {
            "ioc_value": "birdrepuse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:13",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671184": [
        {
            "ioc_value": "birdrepwin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671185": [
        {
            "ioc_value": "blacklandssales.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:13",
            "last_seen_utc": "2025-12-13 15:28:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671186": [
        {
            "ioc_value": "blog.incentiv.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671187": [
        {
            "ioc_value": "bordeaux.unairdedemo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671188": [
        {
            "ioc_value": "bragaediassolucoesjuridicas.website.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671169": [
        {
            "ioc_value": "birdrepbit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671170": [
        {
            "ioc_value": "birdrepfix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671171": [
        {
            "ioc_value": "birdrepfx.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671172": [
        {
            "ioc_value": "birdrepgo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671173": [
        {
            "ioc_value": "birdrephelp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671174": [
        {
            "ioc_value": "birdrepinc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671175": [
        {
            "ioc_value": "birdrepinfo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671176": [
        {
            "ioc_value": "birdrepllc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671177": [
        {
            "ioc_value": "birdrepnet.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671178": [
        {
            "ioc_value": "birdrepnow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-10 23:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671179": [
        {
            "ioc_value": "birdrepopt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:12",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671160": [
        {
            "ioc_value": "birdrankex.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:11",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671161": [
        {
            "ioc_value": "birdrankfx.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:11",
            "last_seen_utc": "2025-12-09 13:35:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671162": [
        {
            "ioc_value": "birdranklab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:11",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671163": [
        {
            "ioc_value": "birdrankllc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:11",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671164": [
        {
            "ioc_value": "birdranknow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:11",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671165": [
        {
            "ioc_value": "birdrankplus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:11",
            "last_seen_utc": "2025-12-10 23:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671166": [
        {
            "ioc_value": "birdranktap.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:11",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671167": [
        {
            "ioc_value": "birdranktop.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:11",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671168": [
        {
            "ioc_value": "birdrankwin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:11",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671150": [
        {
            "ioc_value": "barretos.oligoflora.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671151": [
        {
            "ioc_value": "bartendersunltd.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671152": [
        {
            "ioc_value": "bebirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671153": [
        {
            "ioc_value": "beeighteen.com.pk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671154": [
        {
            "ioc_value": "berkahpoker.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671155": [
        {
            "ioc_value": "bgafix.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671156": [
        {
            "ioc_value": "birdrankace.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671157": [
        {
            "ioc_value": "birdrankapp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671158": [
        {
            "ioc_value": "birdrankbox.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671159": [
        {
            "ioc_value": "birdrankcorp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:10",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671143": [
        {
            "ioc_value": "asunflowersmindset.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:09",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671144": [
        {
            "ioc_value": "atendimento.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:09",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671145": [
        {
            "ioc_value": "atibinhos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:09",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671146": [
        {
            "ioc_value": "autopost.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671147": [
        {
            "ioc_value": "avatarslt.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671148": [
        {
            "ioc_value": "aworthz.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:09",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671149": [
        {
            "ioc_value": "backend.conoeste.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:09",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671133": [
        {
            "ioc_value": "app.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671134": [
        {
            "ioc_value": "aqe.mateusalbuquerque.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671135": [
        {
            "ioc_value": "artwix.artwix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671136": [
        {
            "ioc_value": "aryabet.bet",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671137": [
        {
            "ioc_value": "asap-security.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671138": [
        {
            "ioc_value": "asazmusic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671139": [
        {
            "ioc_value": "asiarisk-gyosei.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671140": [
        {
            "ioc_value": "aslidomino.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671141": [
        {
            "ioc_value": "asmmarketingllc.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671142": [
        {
            "ioc_value": "assertivacriativa.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671123": [
        {
            "ioc_value": "almeidajunior.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671124": [
        {
            "ioc_value": "alvesempreiteira.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671125": [
        {
            "ioc_value": "amenom.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671126": [
        {
            "ioc_value": "andredosanjosadvogado.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671127": [
        {
            "ioc_value": "annapurnapharma.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671128": [
        {
            "ioc_value": "anonimo.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671129": [
        {
            "ioc_value": "anr.theen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671130": [
        {
            "ioc_value": "anuncio.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671131": [
        {
            "ioc_value": "anyamanaska.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671132": [
        {
            "ioc_value": "apollo.makesystems.com.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671115": [
        {
            "ioc_value": "aioredu.org.southernsummits.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:06",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671116": [
        {
            "ioc_value": "aki-office.asto-system.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:06",
            "last_seen_utc": "2025-12-10 23:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671117": [
        {
            "ioc_value": "alexadvogado.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671118": [
        {
            "ioc_value": "alkebulan-investments.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:06",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671119": [
        {
            "ioc_value": "alkebulaninvestment.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:06",
            "last_seen_utc": "2025-12-11 19:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671120": [
        {
            "ioc_value": "allbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:06",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671121": [
        {
            "ioc_value": "alldecor-in.solarisjoka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:06",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671122": [
        {
            "ioc_value": "almeidabarbosa.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671107": [
        {
            "ioc_value": "a8200a18f1f0e7dd8.awsglobalaccelerator.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671108": [
        {
            "ioc_value": "abbeysorchids.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671109": [
        {
            "ioc_value": "acaciamktdigital.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:05",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671110": [
        {
            "ioc_value": "academies.retailo.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671111": [
        {
            "ioc_value": "acenas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:05",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671112": [
        {
            "ioc_value": "acessibi.victorabrao.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:05",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671113": [
        {
            "ioc_value": "adbsurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671114": [
        {
            "ioc_value": "ads.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671105": [
        {
            "ioc_value": "4dsecure.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:04",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671106": [
        {
            "ioc_value": "7seas-media.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:04",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671104": [
        {
            "ioc_value": "3risalvador.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671101": [
        {
            "ioc_value": "104-7-227-11.lightspeed.dybhfl.sbcglobal.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671102": [
        {
            "ioc_value": "247p4ng.uptozion.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:01",
            "last_seen_utc": "2025-12-11 19:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671103": [
        {
            "ioc_value": "24hill.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 19:00:01",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1671100": [
        {
            "ioc_value": "mingle.f1sslehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 18:57:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671093": [
        {
            "ioc_value": "k9r.f1sslehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 18:47:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671092": [
        {
            "ioc_value": "range.s0ckthorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 18:31:09",
            "last_seen_utc": "2025-12-08 18:44:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671091": [
        {
            "ioc_value": "2avp8.s0ckthorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 18:26:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671090": [
        {
            "ioc_value": "9w.s0ckthorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 18:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671089": [
        {
            "ioc_value": "fqusx.s0ckthorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 18:14:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671087": [
        {
            "ioc_value": "omega.puffwarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 18:03:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671083": [
        {
            "ioc_value": "pingback.quadixde.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-08 18:02:31",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251208-srj5xsft9e",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671082": [
        {
            "ioc_value": "ptag1956.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-08 18:02:27",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251208-vye6nafm4v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671081": [
        {
            "ioc_value": "malware.motchilltv.you",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-08 18:00:33",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/bed0d15d8fdecc0f9ef6d51cf68e2bbe494ff77ac87d9e0315728268a8676488/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671071": [
        {
            "ioc_value": "crystal.puffwarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 17:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671070": [
        {
            "ioc_value": "k4l.puffwarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 17:47:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671068": [
        {
            "ioc_value": "kqkm9.puffwarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 17:37:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671066": [
        {
            "ioc_value": "dfad.he2rthyoun8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 17:27:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671065": [
        {
            "ioc_value": "soubrettebaseballlore.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 17:25:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251023-fpfy9sgm9x",
            "tags": "c2,deerstealer,domain,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671063": [
        {
            "ioc_value": "realshow.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-08 17:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.vmray.com/analyses/_vt/177fb9232b7c/report/ioc.html",
            "tags": "c2,domain,vmray,XWorm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671062": [
        {
            "ioc_value": "nova.he2rthyoun8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 17:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671060": [
        {
            "ioc_value": "bikklohdfolksdf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-08 17:13:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.242.67",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671051": [
        {
            "ioc_value": "app.evalsuit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 17:12:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Powerwize",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1671048": [
        {
            "ioc_value": "evalsuit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 17:12:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Powerwize",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1671049": [
        {
            "ioc_value": "bapi.evalsuit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 17:12:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Powerwize",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1671056": [
        {
            "ioc_value": "app.avasup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 17:12:07",
            "last_seen_utc": "2025-12-08 17:08:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Powerwize",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1671059": [
        {
            "ioc_value": "voxpliplioztrodollar.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-08 17:10:35",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/f56521bdca32f04c40e5c1d2d40240bf9f0eecb686224a10a0d100d1ce2660ec/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671052": [
        {
            "ioc_value": "liberti.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 17:01:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f22d7ab1e5580151a09461f6212fce8811a5cbfbe0413092bb6f8a9d1b53d118/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671050": [
        {
            "ioc_value": "a01.he2rthyoun8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 17:01:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671047": [
        {
            "ioc_value": "pixel.he2rthyoun8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 16:53:14",
            "last_seen_utc": "2025-12-08 16:58:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671046": [
        {
            "ioc_value": "corpusfortunaevoque.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:50:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251105-2qfksavrhl",
            "tags": "c2,deerstealer,domain,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671045": [
        {
            "ioc_value": "rodoiluctcrrcqqmbe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:48:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251108-fnfxwatmbt",
            "tags": "c2,deerstealer,domain,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671044": [
        {
            "ioc_value": "ftdar.cherl1ber7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 16:47:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671043": [
        {
            "ioc_value": "temenaga.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:46:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/file/8e357ee66135538c2a639c7d0f52117e47dbd070a2c11c473cd9e66fd7202f21",
            "tags": "c2,domain,stealer,virustotal,WallStealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671042": [
        {
            "ioc_value": "ma37.cherl1ber7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 16:37:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671041": [
        {
            "ioc_value": "bradpittepicureanbanque.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:37:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-kqcqfsdl31",
            "tags": "c2,deerstealer,domain,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671040": [
        {
            "ioc_value": "melissaallenochrely.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:34:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-ka1scavmbz",
            "tags": "c2,deerstealer,domain,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671039": [
        {
            "ioc_value": "pontchamplainpalimpsest.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:33:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251201-ak94natjcl",
            "tags": "c2,deerstealer,domain,Stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671038": [
        {
            "ioc_value": "rozecreekpilotgauge.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:27:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-xcyf8axmdt",
            "tags": "c2,deerstealer,domain,Stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671037": [
        {
            "ioc_value": "barstownocturne.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:26:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-fm8w9stkht",
            "tags": "c2,deerstealer,domain,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671036": [
        {
            "ioc_value": "southhillauricpalfrey.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:24:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251207-syx1csdj7v",
            "tags": "c2,deerstealer,domain,Stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671035": [
        {
            "ioc_value": "palimpsestjackson.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:21:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251208-rpn6eswnhw",
            "tags": "c2,deerstealer,domain,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671034": [
        {
            "ioc_value": "ykpb.cherl1ber7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 16:21:17",
            "last_seen_utc": "2025-12-08 16:34:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671033": [
        {
            "ioc_value": "sarrazinljubljanskogaeld.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 16:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-pnwsrszkbk",
            "tags": "c2,deerstealer,domain,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1671023": [
        {
            "ioc_value": "poweem.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 16:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Poweem",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1671026": [
        {
            "ioc_value": "ccuk.edu.ng",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 16:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Stafnex",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1671029": [
        {
            "ioc_value": "ftp.ccuk.edu.ng",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 16:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Stafnex",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1671032": [
        {
            "ioc_value": "app.visionaryte.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 16:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Poweem",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1671030": [
        {
            "ioc_value": "1bhn.cherl1ber7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 16:17:40",
            "last_seen_utc": "2025-12-08 16:18:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671025": [
        {
            "ioc_value": "ic3ae.l2nd0fenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 16:07:28",
            "last_seen_utc": "2025-12-08 16:10:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671018": [
        {
            "ioc_value": "d4.l2nd0fenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 15:57:40",
            "last_seen_utc": "2025-12-08 15:58:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671017": [
        {
            "ioc_value": "4r.l2nd0fenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 15:47:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671015": [
        {
            "ioc_value": "avocado.gay",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-08 15:39:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/883108e1491ab90780fa3b43ed1580e29786287fdca5cae1a49eea6ec91d90fd/",
            "tags": "MaksRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671013": [
        {
            "ioc_value": "www.foldacces.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-08 15:38:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/883108e1491ab90780fa3b43ed1580e29786287fdca5cae1a49eea6ec91d90fd/",
            "tags": "MaksRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671014": [
        {
            "ioc_value": "www.blackprofit.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-08 15:38:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/883108e1491ab90780fa3b43ed1580e29786287fdca5cae1a49eea6ec91d90fd/",
            "tags": "MaksRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671012": [
        {
            "ioc_value": "core.l2nd0fenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 15:36:57",
            "last_seen_utc": "2025-12-08 15:38:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671011": [
        {
            "ioc_value": "wtvaa.ba7bdecep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-08 15:31:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1671009": [
        {
            "ioc_value": "heartofalion.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-08 15:30:33",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/f71f5930a4d3cd8fb871e901d77f1a76b5adb54e52218e7ced9901b7a2c51af7/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671007": [
        {
            "ioc_value": "fqxtcare.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-08 15:23:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671006": [
        {
            "ioc_value": "flavorwood.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-08 15:22:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671002": [
        {
            "ioc_value": "polystore9-servicebucket.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amatera",
            "malware_alias": null,
            "malware_printable": "Amatera",
            "first_seen_utc": "2025-12-08 15:13:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e284d602c53d0eaf7da927e60bf657edbb778297a478d3160e48f47bb0186924/",
            "tags": "AmateraStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671003": [
        {
            "ioc_value": "globalsnn3-new.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amatera",
            "malware_alias": null,
            "malware_printable": "Amatera",
            "first_seen_utc": "2025-12-08 15:13:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e284d602c53d0eaf7da927e60bf657edbb778297a478d3160e48f47bb0186924/",
            "tags": "AmateraStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1671004": [
        {
            "ioc_value": "telemetry-updatehub.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amatera",
            "malware_alias": null,
            "malware_printable": "Amatera",
            "first_seen_utc": "2025-12-08 15:13:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e284d602c53d0eaf7da927e60bf657edbb778297a478d3160e48f47bb0186924/",
            "tags": "AmateraStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1670856": [
        {
            "ioc_value": "watchsmiler.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-08 14:15:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670860": [
        {
            "ioc_value": "daveshobbymarket.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 14:14:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670864": [
        {
            "ioc_value": "app.rev-prot.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 14:14:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Moxtern",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670866": [
        {
            "ioc_value": "moxtern.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 14:14:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Moxtern",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670852": [
        {
            "ioc_value": "kuliboku.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-08 13:27:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670849": [
        {
            "ioc_value": "gru.automanpk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-08 13:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1670850": [
        {
            "ioc_value": "gru.diraiat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-08 13:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1670803": [
        {
            "ioc_value": "www.ironhorseauctionai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:46:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1822203/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670804": [
        {
            "ioc_value": "www.91wx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:46:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1822203/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670805": [
        {
            "ioc_value": "www.fangdd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:46:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1822203/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670806": [
        {
            "ioc_value": "www.ontra.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:46:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1822203/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670807": [
        {
            "ioc_value": "www.jrdsj.wiki",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:46:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1822203/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670801": [
        {
            "ioc_value": "www.ethegenesis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:46:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1822203/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670802": [
        {
            "ioc_value": "www.lmabogado.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:46:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1822203/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670788": [
        {
            "ioc_value": "www.nastyslice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670789": [
        {
            "ioc_value": "www.point-star.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": "2025-12-08 12:46:05",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670790": [
        {
            "ioc_value": "www.kuwn35.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670791": [
        {
            "ioc_value": "www.walkheaven.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": "2025-12-08 12:46:05",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670792": [
        {
            "ioc_value": "www.i-v-c.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670793": [
        {
            "ioc_value": "www.hj053.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670794": [
        {
            "ioc_value": "www.rpruy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": "2025-12-08 12:46:05",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670795": [
        {
            "ioc_value": "www.fw1i5rno.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670796": [
        {
            "ioc_value": "www.fggwga.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": "2025-12-08 12:46:05",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670797": [
        {
            "ioc_value": "www.tovira.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670798": [
        {
            "ioc_value": "www.1xwingo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670799": [
        {
            "ioc_value": "www.autoscorereport.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670800": [
        {
            "ioc_value": "www.vianware.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 12:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1828717/0/html",
            "tags": "c2,domain,formbook",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670776": [
        {
            "ioc_value": "default-migration.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-08 12:01:42",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251208-mtzeqsdt7f",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670772": [
        {
            "ioc_value": "justinreal-54903.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-08 11:56:58",
            "last_seen_utc": "2025-12-11 13:23:54",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670773": [
        {
            "ioc_value": "mooose-49284.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-08 11:56:58",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670770": [
        {
            "ioc_value": "powermastermr78.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-08 11:56:16",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670768": [
        {
            "ioc_value": "airair.dianying.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-08 11:56:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670769": [
        {
            "ioc_value": "master.0x504.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-08 11:56:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670757": [
        {
            "ioc_value": "www.s2388kg.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670758": [
        {
            "ioc_value": "www.u56bt.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670759": [
        {
            "ioc_value": "www.uildwiththusmi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670760": [
        {
            "ioc_value": "www.uoduoans.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670761": [
        {
            "ioc_value": "www.urolab-certified-peptides.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670762": [
        {
            "ioc_value": "www.wgkixi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670763": [
        {
            "ioc_value": "www.xbl5133.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670764": [
        {
            "ioc_value": "www.y-elisabio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670765": [
        {
            "ioc_value": "www.y2eiqa.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670766": [
        {
            "ioc_value": "www.ytop01.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670767": [
        {
            "ioc_value": "www.zu2w4.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670738": [
        {
            "ioc_value": "www.lacklatterecipe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670739": [
        {
            "ioc_value": "www.lassroomphoto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670740": [
        {
            "ioc_value": "www.lipstorage.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670741": [
        {
            "ioc_value": "www.mh7am.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670742": [
        {
            "ioc_value": "www.nrgtz.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670743": [
        {
            "ioc_value": "www.oapps.se",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670744": [
        {
            "ioc_value": "www.odosbetresmigiris.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670745": [
        {
            "ioc_value": "www.ohnsonpacee.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670746": [
        {
            "ioc_value": "www.oirfluxclothing.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670747": [
        {
            "ioc_value": "www.oosesquad.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670748": [
        {
            "ioc_value": "www.otanika.sk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670749": [
        {
            "ioc_value": "www.pnorway.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670750": [
        {
            "ioc_value": "www.pps-kaiysports.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670751": [
        {
            "ioc_value": "www.qm36.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670752": [
        {
            "ioc_value": "www.ramesbysimon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670753": [
        {
            "ioc_value": "www.rigonist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670754": [
        {
            "ioc_value": "www.rilbit.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670755": [
        {
            "ioc_value": "www.roficienttransportservices.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670756": [
        {
            "ioc_value": "www.rysbx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670713": [
        {
            "ioc_value": "www.ampanyahaftasistok100.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670714": [
        {
            "ioc_value": "www.angtangm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670715": [
        {
            "ioc_value": "www.anutdbasket.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670716": [
        {
            "ioc_value": "www.aqdry2.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670717": [
        {
            "ioc_value": "www.ashionlife.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670718": [
        {
            "ioc_value": "www.astdish.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670719": [
        {
            "ioc_value": "www.b0n4a2a.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670720": [
        {
            "ioc_value": "www.c4es3sl.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670721": [
        {
            "ioc_value": "www.d6pe3.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670722": [
        {
            "ioc_value": "www.eadtheroad.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670723": [
        {
            "ioc_value": "www.eiliao-x.wiki",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670724": [
        {
            "ioc_value": "www.ellycakes.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670725": [
        {
            "ioc_value": "www.eschwisterwagen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670726": [
        {
            "ioc_value": "www.etcreswr.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670727": [
        {
            "ioc_value": "www.extrungquoc2025hub.skin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670728": [
        {
            "ioc_value": "www.f8xk8.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670729": [
        {
            "ioc_value": "www.g3tippn.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670730": [
        {
            "ioc_value": "www.heaspenbuilding.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670731": [
        {
            "ioc_value": "www.i8.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670732": [
        {
            "ioc_value": "www.ibre-avantage.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670733": [
        {
            "ioc_value": "www.idatt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670734": [
        {
            "ioc_value": "www.iizwa.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670735": [
        {
            "ioc_value": "www.isch5e.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670736": [
        {
            "ioc_value": "www.iveforgreen.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670737": [
        {
            "ioc_value": "www.iwnhscc21.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670703": [
        {
            "ioc_value": "www.1azwv0.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670704": [
        {
            "ioc_value": "www.3rbfr2n.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670705": [
        {
            "ioc_value": "www.7kprlr.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670706": [
        {
            "ioc_value": "www.8jfd7.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670707": [
        {
            "ioc_value": "www.acentralcancun.mx",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670708": [
        {
            "ioc_value": "www.agicmeasured.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670709": [
        {
            "ioc_value": "www.ailernz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670710": [
        {
            "ioc_value": "www.ainthr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670711": [
        {
            "ioc_value": "www.airydownthere.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670712": [
        {
            "ioc_value": "www.akeflix.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-12-08 11:55:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670636": [
        {
            "ioc_value": "wt0lafyzx.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-08 11:54:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670629": [
        {
            "ioc_value": "buarkyy3169.freedynamicdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-08 11:53:39",
            "last_seen_utc": "2025-12-12 18:39:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670630": [
        {
            "ioc_value": "tndvyt5qg.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-08 11:53:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1670431": [
        {
            "ioc_value": "api.weightlosstonight.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-12-08 11:39:39",
            "last_seen_utc": "2025-12-12 06:33:55",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115683399341198380",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1670601": [
        {
            "ioc_value": "www.produtoperfeito.tech.suavidaadois.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670602": [
        {
            "ioc_value": "www.puspajobs.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-09 13:35:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670603": [
        {
            "ioc_value": "www.sifld.rajeshmhegde.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670604": [
        {
            "ioc_value": "www.siulyn.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670605": [
        {
            "ioc_value": "www.staging.alaincasault.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670606": [
        {
            "ioc_value": "www.store.xinnomix.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670607": [
        {
            "ioc_value": "www.strimex.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670608": [
        {
            "ioc_value": "www.templates.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-09 13:35:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670609": [
        {
            "ioc_value": "www.teste.mpcservicos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-12 18:01:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670610": [
        {
            "ioc_value": "www.tutions.bhavitutors.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670611": [
        {
            "ioc_value": "www.winbee.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670612": [
        {
            "ioc_value": "xquizit.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670613": [
        {
            "ioc_value": "youthvxolenceproject.com.springvillehomestead.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:51",
            "last_seen_utc": "2025-12-11 19:29:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670579": [
        {
            "ioc_value": "www.d8.cryptocurrencyinfo.today",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670580": [
        {
            "ioc_value": "www.debate.tizambia.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670581": [
        {
            "ioc_value": "www.deeptechcentre.ug",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-10 23:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670582": [
        {
            "ioc_value": "www.developmentsite1.bestchoiceitwebsites.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670583": [
        {
            "ioc_value": "www.educatorshub.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-08 19:00:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670584": [
        {
            "ioc_value": "www.elmeka.lt",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670585": [
        {
            "ioc_value": "www.eri-salon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670586": [
        {
            "ioc_value": "www.francoezannini.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-09 13:35:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670587": [
        {
            "ioc_value": "www.gmb.3squared360.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-09 13:35:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670588": [
        {
            "ioc_value": "www.hakush.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670589": [
        {
            "ioc_value": "www.healthrelate.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670590": [
        {
            "ioc_value": "www.healthyhabitpath.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670591": [
        {
            "ioc_value": "www.insurance.loanroad.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-09 13:35:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670592": [
        {
            "ioc_value": "www.jrqsistemas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670593": [
        {
            "ioc_value": "www.kmhospital.info.digitaljaydeep.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-09 13:35:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670594": [
        {
            "ioc_value": "www.mabosfloor.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-09 13:35:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670595": [
        {
            "ioc_value": "www.metmuseum.wordt-ontwikkeld.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670596": [
        {
            "ioc_value": "www.mijnvriendinenik.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670597": [
        {
            "ioc_value": "www.nothingscares.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670598": [
        {
            "ioc_value": "www.nutraforyou.com.suavidaadois.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670599": [
        {
            "ioc_value": "www.poc-faceid.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670600": [
        {
            "ioc_value": "www.poloidesign.com.75156372-90-20180116090518.webstarterz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:50",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670557": [
        {
            "ioc_value": "theabstinents.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670558": [
        {
            "ioc_value": "thecellophaneflowers.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670559": [
        {
            "ioc_value": "theringflowers.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670560": [
        {
            "ioc_value": "therubberjerusalemexperiment.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670561": [
        {
            "ioc_value": "tnsa.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670562": [
        {
            "ioc_value": "torelliandthefuse.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670563": [
        {
            "ioc_value": "toshindai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670564": [
        {
            "ioc_value": "umadesign.xsrv.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-09 13:35:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670565": [
        {
            "ioc_value": "user3.evobot.uz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670566": [
        {
            "ioc_value": "vegaslog.com.togever.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-11 19:29:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670567": [
        {
            "ioc_value": "vyero.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670568": [
        {
            "ioc_value": "webdisk.firingpinjournal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670569": [
        {
            "ioc_value": "webdisk.mrleeprojects.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670570": [
        {
            "ioc_value": "wesaveafrica.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670571": [
        {
            "ioc_value": "worldvacationtour.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-08 19:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670572": [
        {
            "ioc_value": "www.addon-xinnomixcom.xinnomix-filme.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670573": [
        {
            "ioc_value": "www.agragamidegreecollege.arbrands.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670574": [
        {
            "ioc_value": "www.ashleyspb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670575": [
        {
            "ioc_value": "www.breakout.gsinds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670576": [
        {
            "ioc_value": "www.carlosjuniorleite.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670577": [
        {
            "ioc_value": "www.ccera-icar.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-08 19:00:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670578": [
        {
            "ioc_value": "www.concavomotorcars.concavowheels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:49",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670531": [
        {
            "ioc_value": "oneononefriendship.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670532": [
        {
            "ioc_value": "openai.digitalsails.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670533": [
        {
            "ioc_value": "outl4w.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670534": [
        {
            "ioc_value": "pagina.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670535": [
        {
            "ioc_value": "panamawebhosting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670536": [
        {
            "ioc_value": "paulblissett.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670537": [
        {
            "ioc_value": "poloidesign.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-09 13:35:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670538": [
        {
            "ioc_value": "proseiec.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670539": [
        {
            "ioc_value": "quinn.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670540": [
        {
            "ioc_value": "rawcityrukus.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670541": [
        {
            "ioc_value": "recruitment.xxxx88.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-10 23:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670542": [
        {
            "ioc_value": "rev-and-the-knuckleheads.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670543": [
        {
            "ioc_value": "rpi.capital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-09 13:35:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670544": [
        {
            "ioc_value": "sambaza.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-08 19:00:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670545": [
        {
            "ioc_value": "scanner.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670546": [
        {
            "ioc_value": "scarecrowz.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670547": [
        {
            "ioc_value": "sendhub.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-09 13:35:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670548": [
        {
            "ioc_value": "seoparaecommerce.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670549": [
        {
            "ioc_value": "shoplalaforever.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670550": [
        {
            "ioc_value": "site2.kentinmartel.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670551": [
        {
            "ioc_value": "skyfight-shin-nagata.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670552": [
        {
            "ioc_value": "spindora.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-08 19:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670553": [
        {
            "ioc_value": "stanley-jeter.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670554": [
        {
            "ioc_value": "suiiki-e-r.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670555": [
        {
            "ioc_value": "tablepress.wordt-ontwikkeld.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670556": [
        {
            "ioc_value": "tailar-jnine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:48",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670508": [
        {
            "ioc_value": "kompresszor.info.technorollshop.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670509": [
        {
            "ioc_value": "kongogenie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670510": [
        {
            "ioc_value": "lawrencesumpter.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670511": [
        {
            "ioc_value": "mail.agragamipucollegejakkur.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670512": [
        {
            "ioc_value": "mail.avomawealth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670513": [
        {
            "ioc_value": "mail.azzahrabakery.my",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670514": [
        {
            "ioc_value": "mail.depuffnow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670515": [
        {
            "ioc_value": "mail.ellensvirtualsolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670516": [
        {
            "ioc_value": "mail.journalultv.edu.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670517": [
        {
            "ioc_value": "mail.m2marinemonitor.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670518": [
        {
            "ioc_value": "mail.nisourcetech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670519": [
        {
            "ioc_value": "mail.physioxrsize.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670520": [
        {
            "ioc_value": "mail.shareyourstory.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670521": [
        {
            "ioc_value": "mail.tamiltotamil.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670522": [
        {
            "ioc_value": "mail.virtual-secretarialservice.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-08 13:44:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670523": [
        {
            "ioc_value": "mail.zomin2-sonkhm.uz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670524": [
        {
            "ioc_value": "maria-elena-sanchez.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670525": [
        {
            "ioc_value": "mayrasampaio.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670526": [
        {
            "ioc_value": "mikewilliams.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670527": [
        {
            "ioc_value": "myticket.kwirs.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670528": [
        {
            "ioc_value": "n8n.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": "2025-12-09 13:35:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670529": [
        {
            "ioc_value": "notarioamigo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670530": [
        {
            "ioc_value": "nth-ascension.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670485": [
        {
            "ioc_value": "embratonhost.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670486": [
        {
            "ioc_value": "escape2cashflow.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670487": [
        {
            "ioc_value": "escortseohizmetleri.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-12 18:00:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670488": [
        {
            "ioc_value": "exoreaver.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670489": [
        {
            "ioc_value": "favashop.com.ar",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-09 13:35:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670490": [
        {
            "ioc_value": "ftp.knowzalearning.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-09 13:35:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670491": [
        {
            "ioc_value": "ftp.schoolofhealthcare.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670492": [
        {
            "ioc_value": "galahad.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670493": [
        {
            "ioc_value": "giathaphoanggia.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670494": [
        {
            "ioc_value": "gopanoptica.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-08 19:00:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670495": [
        {
            "ioc_value": "gyaranomi-unfair.alt-ruist.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670496": [
        {
            "ioc_value": "handwriting.gainsschool.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670497": [
        {
            "ioc_value": "heybro.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670498": [
        {
            "ioc_value": "hsleader.ge",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670499": [
        {
            "ioc_value": "idoleyes.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670500": [
        {
            "ioc_value": "ikoi-llc.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670501": [
        {
            "ioc_value": "illinoisreset.ct-poa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670502": [
        {
            "ioc_value": "inspni3q15.nimpr.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670503": [
        {
            "ioc_value": "kammt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-09 13:35:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670504": [
        {
            "ioc_value": "karineferetto.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-09 13:35:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670505": [
        {
            "ioc_value": "kevinsimnacher.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670506": [
        {
            "ioc_value": "kodamablog.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670507": [
        {
            "ioc_value": "kogane-machi-dzukuri.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670461": [
        {
            "ioc_value": "aronlyrd.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670462": [
        {
            "ioc_value": "atto-olive.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-09 13:35:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670463": [
        {
            "ioc_value": "backup.academy.oligoflora.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670464": [
        {
            "ioc_value": "bary-center.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670465": [
        {
            "ioc_value": "bellissimaspa.ma",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670466": [
        {
            "ioc_value": "big-bang-the-sinners.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670467": [
        {
            "ioc_value": "birdrankinc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670468": [
        {
            "ioc_value": "birdranktip.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670469": [
        {
            "ioc_value": "burudu.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670470": [
        {
            "ioc_value": "c-stewart.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670471": [
        {
            "ioc_value": "cblc.mydonor.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670472": [
        {
            "ioc_value": "christaar.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670473": [
        {
            "ioc_value": "clearskybanking.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670474": [
        {
            "ioc_value": "copizzas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-08 19:00:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670475": [
        {
            "ioc_value": "cpcalendars.firingpinjournal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670476": [
        {
            "ioc_value": "datacold.ccdatos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670477": [
        {
            "ioc_value": "death-cat.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670478": [
        {
            "ioc_value": "deibignite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670479": [
        {
            "ioc_value": "direct.adm-center.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670480": [
        {
            "ioc_value": "djbean.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670481": [
        {
            "ioc_value": "djvantigo.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670482": [
        {
            "ioc_value": "dooshaywp.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670483": [
        {
            "ioc_value": "ecom-arteterapeutica.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670484": [
        {
            "ioc_value": "elections.tizambia.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:45",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670457": [
        {
            "ioc_value": "abdulaziz-anan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:44",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670458": [
        {
            "ioc_value": "academie.habg.ci",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:44",
            "last_seen_utc": "2025-12-09 13:35:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670459": [
        {
            "ioc_value": "agentfly42.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670460": [
        {
            "ioc_value": "alive-create.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-08 11:34:44",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1670446": [
        {
            "ioc_value": "rm1.lol",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.lockbit",
            "malware_alias": "ABCD Ransomware",
            "malware_printable": "LockBit",
            "first_seen_utc": "2025-12-08 11:00:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "lockbit",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670433": [
        {
            "ioc_value": "oleoppi.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-08 10:57:34",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670432": [
        {
            "ioc_value": "orange.mokveid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cloudeye",
            "malware_alias": "GuLoader,vbdropper",
            "malware_printable": "CloudEyE",
            "first_seen_utc": "2025-12-08 10:35:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/0a0d5fb5443d6054857b65a80a41eb863a797446a40f81fa877ad5f4143d34bc",
            "tags": "c2,domain,guloader,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670429": [
        {
            "ioc_value": "yozami.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 09:57:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670426": [
        {
            "ioc_value": "capindustrial.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 09:54:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670421": [
        {
            "ioc_value": "upgratesecurityse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 09:02:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670393": [
        {
            "ioc_value": "operationendgame.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 08:59:00",
            "last_seen_utc": "2025-12-08 08:59:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670391": [
        {
            "ioc_value": "1controller.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 08:57:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670389": [
        {
            "ioc_value": "1controller.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 08:55:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670387": [
        {
            "ioc_value": "account-captcha-id4234.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 08:52:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670385": [
        {
            "ioc_value": "account-captchaid5324.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 08:52:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670376": [
        {
            "ioc_value": "hto.diraiat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-08 08:34:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1670377": [
        {
            "ioc_value": "fi.automanpk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-08 08:34:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1670378": [
        {
            "ioc_value": "sw.diraiat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-08 08:34:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1670363": [
        {
            "ioc_value": "vifort.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 08:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Fastwise",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670361": [
        {
            "ioc_value": "fastwise.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 08:16:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Fastwise",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670300": [
        {
            "ioc_value": "mainmenuflo.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-08 07:55:18",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/83faee554243528c7f8d45f2c8433e04efc6012bd2e1e4d6f65d55277fc0534e/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1670301": [
        {
            "ioc_value": "menioffituat.chickenkiller.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-08 07:55:18",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/83faee554243528c7f8d45f2c8433e04efc6012bd2e1e4d6f65d55277fc0534e/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1669977": [
        {
            "ioc_value": "f8beta-2.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-08 07:53:57",
            "last_seen_utc": "2025-12-07 20:54:10",
            "confidence_level": 100,
            "reference": "https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat",
            "tags": "asyncrat,rat",
            "anonymous": "0",
            "reporter": "cagoldhydra1701"
        }
    ],
    "1670016": [
        {
            "ioc_value": "vek.equisphire.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 07:53:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Veeki",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670018": [
        {
            "ioc_value": "veeki.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 07:53:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Veeki",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1670038": [
        {
            "ioc_value": "api.gigaversecentiliumai.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 07:53:49",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "clickfix",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1670037": [
        {
            "ioc_value": "api.grabtrust.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-08 07:53:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "clickfix",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1670287": [
        {
            "ioc_value": "aqua.mircosoftonliine.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-08 06:01:48",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251208-c7v95aaz9b",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670286": [
        {
            "ioc_value": "Aytac7771-43366.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-08 06:01:40",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251208-e4rhwa1jfl",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670030": [
        {
            "ioc_value": "city-therapy.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-08 00:03:28",
            "last_seen_utc": "2025-12-08 11:00:53",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+city-therapy.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670031": [
        {
            "ioc_value": "sueweb.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-08 00:03:28",
            "last_seen_utc": "2025-12-08 11:00:54",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+sueweb.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1670004": [
        {
            "ioc_value": "suraj-estate.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-07 23:00:48",
            "last_seen_utc": "2025-12-08 00:03:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+suraj-estate.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1669964": [
        {
            "ioc_value": "www.yamatosteel.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-11 19:29:29",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669965": [
        {
            "ioc_value": "www.yildirimkitapligi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669966": [
        {
            "ioc_value": "www.yoshinari-raita.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-12 18:01:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669967": [
        {
            "ioc_value": "xpekt.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669968": [
        {
            "ioc_value": "xs785590.xsrv.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669969": [
        {
            "ioc_value": "yama-to-cha.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-12 18:01:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669970": [
        {
            "ioc_value": "yoshiro11.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669971": [
        {
            "ioc_value": "youthviolenceproject.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-10 23:57:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669972": [
        {
            "ioc_value": "youtubethumbnaildownloadhd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669973": [
        {
            "ioc_value": "yukkou.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-10 23:57:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669974": [
        {
            "ioc_value": "yuna-chan.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669975": [
        {
            "ioc_value": "zooguide.blog",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:57",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669942": [
        {
            "ioc_value": "www.teddyclub.su",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669943": [
        {
            "ioc_value": "www.test.beloslav.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669944": [
        {
            "ioc_value": "www.thebatteryspecialist.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669945": [
        {
            "ioc_value": "www.thiagoanselmo.oraculodosorixas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669946": [
        {
            "ioc_value": "www.tomaru.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-08 19:00:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669947": [
        {
            "ioc_value": "www.top10bars.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-11 19:29:28",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669948": [
        {
            "ioc_value": "www.unfair.alt-ruist.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-09 13:35:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669949": [
        {
            "ioc_value": "www.update.inlaser.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-08 19:00:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669950": [
        {
            "ioc_value": "www.v2.petrnesterov.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669951": [
        {
            "ioc_value": "www.vegaslog.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669952": [
        {
            "ioc_value": "www.vf.3squaredco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669953": [
        {
            "ioc_value": "www.vidyaniketanpublicschools.arbrands.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669954": [
        {
            "ioc_value": "www.viralpedia.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669955": [
        {
            "ioc_value": "www.vizecommunications.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669956": [
        {
            "ioc_value": "www.vncomi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-10 23:57:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669957": [
        {
            "ioc_value": "www.vpnkit.tech",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669958": [
        {
            "ioc_value": "www.waterpurificationsvcs.com.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669959": [
        {
            "ioc_value": "www.web.3squaredco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669960": [
        {
            "ioc_value": "www.weiler.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669961": [
        {
            "ioc_value": "www.winneridiomas.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669962": [
        {
            "ioc_value": "www.xn--svenmlleken-vfb.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669963": [
        {
            "ioc_value": "www.xoxbikes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669923": [
        {
            "ioc_value": "www.safetyzone.com.sa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669924": [
        {
            "ioc_value": "www.saude.ba.gov.br.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669925": [
        {
            "ioc_value": "www.schillingemattos.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-08 19:00:44",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669926": [
        {
            "ioc_value": "www.semfronteirasmarcas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-09 13:35:23",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669927": [
        {
            "ioc_value": "www.shamo-cockfighting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-12 18:01:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669928": [
        {
            "ioc_value": "www.shop.dopogara.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669929": [
        {
            "ioc_value": "www.smorodinacosmetics.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669930": [
        {
            "ioc_value": "www.sociasoku.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669931": [
        {
            "ioc_value": "www.sociedade-espirita.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669932": [
        {
            "ioc_value": "www.sotn.igemagency.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669933": [
        {
            "ioc_value": "www.southcoastglobalmedicalcenter.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-08 11:34:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669934": [
        {
            "ioc_value": "www.sscaterer.arbrands.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-08 19:00:46",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669935": [
        {
            "ioc_value": "www.start.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-08 19:00:46",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669936": [
        {
            "ioc_value": "www.stratospb.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-08 11:34:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669937": [
        {
            "ioc_value": "www.swat.welfaretaiwan.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669938": [
        {
            "ioc_value": "www.syedbrands.latestbedding.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-12 18:01:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669939": [
        {
            "ioc_value": "www.tattes.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669940": [
        {
            "ioc_value": "www.techfabintl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669941": [
        {
            "ioc_value": "www.technologieshub.adskonic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:55",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669902": [
        {
            "ioc_value": "www.pg.frassatoadvogados.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-08 19:00:40",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669903": [
        {
            "ioc_value": "www.pinheirodelemosadv.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669904": [
        {
            "ioc_value": "www.planetaalfabetizado.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669905": [
        {
            "ioc_value": "www.planetaalfabetizado.com.br.suavidaadois.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669906": [
        {
            "ioc_value": "www.poc-awsfaceid.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669907": [
        {
            "ioc_value": "www.pontualcascavel.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-09 13:35:22",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669908": [
        {
            "ioc_value": "www.prestigeproperty.samuirenting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669909": [
        {
            "ioc_value": "www.progressyourgym.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669910": [
        {
            "ioc_value": "www.quiz.annuitypal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669911": [
        {
            "ioc_value": "www.raessler.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669912": [
        {
            "ioc_value": "www.ramoseandrade.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669913": [
        {
            "ioc_value": "www.ramosrodrigues.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-08 19:00:42",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669914": [
        {
            "ioc_value": "www.rd2.3squaredco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-09 13:35:22",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669915": [
        {
            "ioc_value": "www.realestateresolutionservices.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-12 18:01:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669916": [
        {
            "ioc_value": "www.reillegomes.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-08 19:00:42",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669917": [
        {
            "ioc_value": "www.repeaca.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669918": [
        {
            "ioc_value": "www.research.tizambia.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-08 11:34:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669919": [
        {
            "ioc_value": "www.reybelly.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669920": [
        {
            "ioc_value": "www.richardsonmaykonadvocacia.adv.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669921": [
        {
            "ioc_value": "www.ringoseika.onaritest-1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669922": [
        {
            "ioc_value": "www.rmjreciclagem.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:54",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669884": [
        {
            "ioc_value": "www.mpcservicos.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-11 19:29:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669885": [
        {
            "ioc_value": "www.mydsn.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669886": [
        {
            "ioc_value": "www.mynepaljourney.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669887": [
        {
            "ioc_value": "www.myrtlebeachdeepseafishing.com.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669888": [
        {
            "ioc_value": "www.nerenollipereira.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-08 19:00:38",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669889": [
        {
            "ioc_value": "www.newsnews.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-11 19:29:22",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669890": [
        {
            "ioc_value": "www.newyorkdolls.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-11 19:29:22",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669891": [
        {
            "ioc_value": "www.nextage-design.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669892": [
        {
            "ioc_value": "www.nisourcetech.arbrands.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-08 19:00:38",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669893": [
        {
            "ioc_value": "www.nutrisavvyhub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669894": [
        {
            "ioc_value": "www.nw.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669895": [
        {
            "ioc_value": "www.omirello.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669896": [
        {
            "ioc_value": "www.oneononefriendship.yln.mfs.temporary.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669897": [
        {
            "ioc_value": "www.ontariocovidresponse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669898": [
        {
            "ioc_value": "www.palasorthodontics.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669899": [
        {
            "ioc_value": "www.panel.sorsell.pl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669900": [
        {
            "ioc_value": "www.pantaleaomartins.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": "2025-12-08 19:00:40",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669901": [
        {
            "ioc_value": "www.pascal-heritier.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669864": [
        {
            "ioc_value": "www.italpharma.al",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669865": [
        {
            "ioc_value": "www.joaovitoralves.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-09 13:35:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669866": [
        {
            "ioc_value": "www.joseviniciusadvocacia.com.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669867": [
        {
            "ioc_value": "www.katumoto-nagano.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669868": [
        {
            "ioc_value": "www.knee360.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669869": [
        {
            "ioc_value": "www.lavorwash.hu.technorollshop.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669870": [
        {
            "ioc_value": "www.lazarobringeladvocacia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-09 13:35:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669871": [
        {
            "ioc_value": "www.lazarobringeladvocacia.com.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-09 13:35:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669872": [
        {
            "ioc_value": "www.lepetitjardinier.sn.weendugroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669873": [
        {
            "ioc_value": "www.lide.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669874": [
        {
            "ioc_value": "www.localgrapevines.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-08 19:00:28",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669875": [
        {
            "ioc_value": "www.lp.teixeiraadvogadosma.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-09 13:35:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669876": [
        {
            "ioc_value": "www.lumadigital.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669877": [
        {
            "ioc_value": "www.maikamakes.obafgkm.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669878": [
        {
            "ioc_value": "www.maquina.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669879": [
        {
            "ioc_value": "www.martinsfranca.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-08 19:00:35",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669880": [
        {
            "ioc_value": "www.massageetrelaxation.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669881": [
        {
            "ioc_value": "www.matheusbaldan.adv.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669882": [
        {
            "ioc_value": "www.mckinley.gsinds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669883": [
        {
            "ioc_value": "www.membros.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:52",
            "last_seen_utc": "2025-12-08 19:00:36",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669841": [
        {
            "ioc_value": "www.getfarr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669842": [
        {
            "ioc_value": "www.glaucoreis.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669843": [
        {
            "ioc_value": "www.gotmedrovenl.com.haydenconsulting.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669844": [
        {
            "ioc_value": "www.graphisland.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-09 13:35:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669845": [
        {
            "ioc_value": "www.grosmann-kosmetologia.pl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669846": [
        {
            "ioc_value": "www.gs.cleeloslirios.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669847": [
        {
            "ioc_value": "www.guardianpayment.systems",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669848": [
        {
            "ioc_value": "www.hastakalainteriors.arbrands.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669849": [
        {
            "ioc_value": "www.hautehealth.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669850": [
        {
            "ioc_value": "www.healing-gardens.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669851": [
        {
            "ioc_value": "www.herbgazette.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669852": [
        {
            "ioc_value": "www.hillsfest.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-08 19:00:23",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669853": [
        {
            "ioc_value": "www.hollygurling.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669854": [
        {
            "ioc_value": "www.honjoeconstantino.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669855": [
        {
            "ioc_value": "www.hotelbienetre.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669856": [
        {
            "ioc_value": "www.hyundaiservisiankara.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669857": [
        {
            "ioc_value": "www.igesigeorge.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669858": [
        {
            "ioc_value": "www.ihat-technologies.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-08 19:00:24",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669859": [
        {
            "ioc_value": "www.ilhaconnect.net.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669860": [
        {
            "ioc_value": "www.imbagacor-rtp.tips",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-08 19:00:24",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669861": [
        {
            "ioc_value": "www.in4rich.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669862": [
        {
            "ioc_value": "www.intra-beta.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669863": [
        {
            "ioc_value": "www.it4pk.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:51",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669822": [
        {
            "ioc_value": "www.email.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669823": [
        {
            "ioc_value": "www.emanoelnasarenoadvocacia.com.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669824": [
        {
            "ioc_value": "www.es-ranking.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669825": [
        {
            "ioc_value": "www.estefanys.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669826": [
        {
            "ioc_value": "www.estudiobogota.com.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-12 18:00:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669827": [
        {
            "ioc_value": "www.fabiooliver.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-08 19:00:20",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669828": [
        {
            "ioc_value": "www.fabioturazza.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-08 19:00:20",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669829": [
        {
            "ioc_value": "www.fagrui.produtoracasabranca.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669830": [
        {
            "ioc_value": "www.fdatributario.com.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669831": [
        {
            "ioc_value": "www.fferreiraessouza.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669832": [
        {
            "ioc_value": "www.fidestecnologias.com.ve",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669833": [
        {
            "ioc_value": "www.financialprotectionstrategies.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-10 23:56:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669834": [
        {
            "ioc_value": "www.firingpinjournal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-08 19:00:20",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669835": [
        {
            "ioc_value": "www.fontesadvocacia.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669836": [
        {
            "ioc_value": "www.fragaribeiroeoliveira.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-08 19:00:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669837": [
        {
            "ioc_value": "www.francolinhof.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669838": [
        {
            "ioc_value": "www.garrygolden.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669839": [
        {
            "ioc_value": "www.genesisfertility.adskonic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669840": [
        {
            "ioc_value": "www.geraldomartins.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:50",
            "last_seen_utc": "2025-12-08 19:00:22",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669800": [
        {
            "ioc_value": "www.bloomchronicle.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669801": [
        {
            "ioc_value": "www.bluedemo.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669802": [
        {
            "ioc_value": "www.bochanghoa247.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-08 19:00:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669803": [
        {
            "ioc_value": "www.bote.company",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-09 13:35:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669804": [
        {
            "ioc_value": "www.bragamoreira.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669805": [
        {
            "ioc_value": "www.bustaff.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-13 15:28:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669806": [
        {
            "ioc_value": "www.camidstudios.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-10 23:56:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669807": [
        {
            "ioc_value": "www.campinas.oligoflora.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669808": [
        {
            "ioc_value": "www.chargaonhoney.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669809": [
        {
            "ioc_value": "www.check-list.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-08 19:00:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669810": [
        {
            "ioc_value": "www.cherie.style",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669811": [
        {
            "ioc_value": "www.claroquetem.com.br.suavidaadois.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669812": [
        {
            "ioc_value": "www.comotec.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669813": [
        {
            "ioc_value": "www.condominioparaiso.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669814": [
        {
            "ioc_value": "www.cs-nekopanchi.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669815": [
        {
            "ioc_value": "www.cymage-media.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-11 19:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669816": [
        {
            "ioc_value": "www.dadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669817": [
        {
            "ioc_value": "www.dinizadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669818": [
        {
            "ioc_value": "www.docokano.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669819": [
        {
            "ioc_value": "www.drpaulocatalao.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-08 19:00:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669820": [
        {
            "ioc_value": "www.durant.localgrapevines.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669821": [
        {
            "ioc_value": "www.educationhmo.com.alaincasault.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:49",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669778": [
        {
            "ioc_value": "www.admin-hileia.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669779": [
        {
            "ioc_value": "www.advcavalcantegoncalves.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669780": [
        {
            "ioc_value": "www.affacorporate.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669781": [
        {
            "ioc_value": "www.agragamipucollegejakkur.arbrands.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669782": [
        {
            "ioc_value": "www.aimbotcheat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-08 19:00:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669783": [
        {
            "ioc_value": "www.amoatibaia.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669784": [
        {
            "ioc_value": "www.anthemmusicllc.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669785": [
        {
            "ioc_value": "www.api-dooka.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669786": [
        {
            "ioc_value": "www.api-empreeendefest.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-08 11:34:45",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669787": [
        {
            "ioc_value": "www.app.tizambia.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669788": [
        {
            "ioc_value": "www.area70.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669789": [
        {
            "ioc_value": "www.asunflowersmindsetmarketing.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669790": [
        {
            "ioc_value": "www.atibaia.oligoflora.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669791": [
        {
            "ioc_value": "www.automation.fabercomunicazione.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669792": [
        {
            "ioc_value": "www.backtobasicdeals.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-09 13:35:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669793": [
        {
            "ioc_value": "www.bacsontech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669794": [
        {
            "ioc_value": "www.basateen.gsinds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-09 13:35:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669795": [
        {
            "ioc_value": "www.bcl.gsinds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669796": [
        {
            "ioc_value": "www.beearchitects.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669797": [
        {
            "ioc_value": "www.beta2.3squaredco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669798": [
        {
            "ioc_value": "www.blog.dsisa.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669799": [
        {
            "ioc_value": "www.blog.fdstributario.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:48",
            "last_seen_utc": "2025-12-08 19:00:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669754": [
        {
            "ioc_value": "website-546f09ba.tizambia.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669755": [
        {
            "ioc_value": "website.motocontrol.mx",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669756": [
        {
            "ioc_value": "whitestar-inc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-12 18:01:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669757": [
        {
            "ioc_value": "whm.karamelsitges.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669758": [
        {
            "ioc_value": "whm.kasatnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-10 23:56:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669759": [
        {
            "ioc_value": "whm.lucratuscfo.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-09 13:35:28",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669760": [
        {
            "ioc_value": "whm.uranium-news.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669761": [
        {
            "ioc_value": "willgoldre.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669762": [
        {
            "ioc_value": "winal.magency.su",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669763": [
        {
            "ioc_value": "winbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669764": [
        {
            "ioc_value": "winbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669765": [
        {
            "ioc_value": "winwinexpert.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669766": [
        {
            "ioc_value": "woo2.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-08 11:34:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669767": [
        {
            "ioc_value": "wootest.lifos.com.tr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669768": [
        {
            "ioc_value": "worlddaoism.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669769": [
        {
            "ioc_value": "worldfa100.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-10 23:57:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669770": [
        {
            "ioc_value": "wp.forworkweb.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669771": [
        {
            "ioc_value": "wp10.unairdedemo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669772": [
        {
            "ioc_value": "wp12.unairdedemo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669773": [
        {
            "ioc_value": "wp6.unairdedemo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669774": [
        {
            "ioc_value": "ws-arteterapeutica.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669775": [
        {
            "ioc_value": "www.1c-bitrix-perenos.adm-center.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-11 19:29:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669776": [
        {
            "ioc_value": "www.7swaterpark.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669777": [
        {
            "ioc_value": "www.addon-tortenzeit2016.xinnomix-filme.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669726": [
        {
            "ioc_value": "usbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669727": [
        {
            "ioc_value": "usebirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669728": [
        {
            "ioc_value": "usebirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-09 13:35:28",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669729": [
        {
            "ioc_value": "usimecltda.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669730": [
        {
            "ioc_value": "v380pro.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-09 13:35:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669731": [
        {
            "ioc_value": "v6bet.coffee",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669732": [
        {
            "ioc_value": "vagas.conceitoprime.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-08 19:00:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669733": [
        {
            "ioc_value": "vakantieklok.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-11 19:29:28",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669734": [
        {
            "ioc_value": "vantanoir.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669735": [
        {
            "ioc_value": "vascofinancial.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669736": [
        {
            "ioc_value": "vascoinsurance.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669737": [
        {
            "ioc_value": "viajantesvistos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669738": [
        {
            "ioc_value": "victorabrao.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669739": [
        {
            "ioc_value": "wabi-sabi-hakko.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669740": [
        {
            "ioc_value": "wanchai-cleaning.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-08 19:00:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669741": [
        {
            "ioc_value": "wavingtheredflag.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-09 13:35:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669742": [
        {
            "ioc_value": "webdisk.chinabandy.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669743": [
        {
            "ioc_value": "webdisk.iranmetalnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-09 13:35:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669744": [
        {
            "ioc_value": "webdisk.mpo77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669745": [
        {
            "ioc_value": "webdisk.originalsvensktkrkort.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-09 13:35:29",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669746": [
        {
            "ioc_value": "webfold.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669747": [
        {
            "ioc_value": "webmail.hotelthilanka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669748": [
        {
            "ioc_value": "webmail.iranmetalnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-09 13:35:29",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669749": [
        {
            "ioc_value": "webmail.maritimnews.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669750": [
        {
            "ioc_value": "webmail.mpo77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669751": [
        {
            "ioc_value": "webmail.sindangkasihnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669752": [
        {
            "ioc_value": "webqlix.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-09 13:35:28",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669753": [
        {
            "ioc_value": "website-441c2a7b.ojo.rsq.mybluehost.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:46",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669704": [
        {
            "ioc_value": "thetalkingpiece.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669705": [
        {
            "ioc_value": "thetavernonfourth.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669706": [
        {
            "ioc_value": "timmeyers.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669707": [
        {
            "ioc_value": "tkgovindarao.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669708": [
        {
            "ioc_value": "tms.evobot.uz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669709": [
        {
            "ioc_value": "toesucking.chat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-09 13:35:26",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669710": [
        {
            "ioc_value": "top-b3-salon.xxxx88.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669711": [
        {
            "ioc_value": "topbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669712": [
        {
            "ioc_value": "topbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669713": [
        {
            "ioc_value": "toyo.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669714": [
        {
            "ioc_value": "trading-lots-money.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669715": [
        {
            "ioc_value": "treasure-1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669716": [
        {
            "ioc_value": "trenord2023.deveyesgroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669717": [
        {
            "ioc_value": "trytebox.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669718": [
        {
            "ioc_value": "tuanthaodesign.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669719": [
        {
            "ioc_value": "tulipsco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-09 13:35:26",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669720": [
        {
            "ioc_value": "ua-beton.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669721": [
        {
            "ioc_value": "ufaheng789.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669722": [
        {
            "ioc_value": "ug.paysoko.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669723": [
        {
            "ioc_value": "uklidprolidi.cz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-09 13:35:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669724": [
        {
            "ioc_value": "upbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-08 19:00:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669725": [
        {
            "ioc_value": "uranus.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:45",
            "last_seen_utc": "2025-12-08 19:00:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669679": [
        {
            "ioc_value": "techinnovhub.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-07 20:34:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669680": [
        {
            "ioc_value": "technologieshub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669681": [
        {
            "ioc_value": "tedxamsterdamed.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669682": [
        {
            "ioc_value": "tennis-bandol.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669683": [
        {
            "ioc_value": "tenryu-site.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669684": [
        {
            "ioc_value": "teslafootwear.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669685": [
        {
            "ioc_value": "test.klearhbc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669686": [
        {
            "ioc_value": "test.onaritest-1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-09 13:35:26",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669687": [
        {
            "ioc_value": "test.strandoliveoils.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669688": [
        {
            "ioc_value": "teste.samtiagoadv.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669689": [
        {
            "ioc_value": "testedominio.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-08 19:00:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669690": [
        {
            "ioc_value": "testserver.sensometer.aqualinkbd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669691": [
        {
            "ioc_value": "the-pterodactyls.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669692": [
        {
            "ioc_value": "the-taxman.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669693": [
        {
            "ioc_value": "thebirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669694": [
        {
            "ioc_value": "thecelticclassic.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669695": [
        {
            "ioc_value": "thedoggroomer.es",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669696": [
        {
            "ioc_value": "theforestrecovery.kinsta.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669697": [
        {
            "ioc_value": "thehowlingtrees.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669698": [
        {
            "ioc_value": "themembranes.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669699": [
        {
            "ioc_value": "themillennialdiyer.com.rmi.pau.temporary.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669700": [
        {
            "ioc_value": "theskilledset.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669701": [
        {
            "ioc_value": "thesmartlender.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669702": [
        {
            "ioc_value": "thesoftwaregardener.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669703": [
        {
            "ioc_value": "thespitiko.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:44",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669657": [
        {
            "ioc_value": "speedmanny.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-08 19:00:46",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669658": [
        {
            "ioc_value": "spencer.winegarden.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669659": [
        {
            "ioc_value": "sportroom.kz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-07 20:34:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669660": [
        {
            "ioc_value": "sscaterer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669661": [
        {
            "ioc_value": "staging.asbeast.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669662": [
        {
            "ioc_value": "staging.yolohealthfoundation.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-12 18:01:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669663": [
        {
            "ioc_value": "stmarkrehab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-12 18:01:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669664": [
        {
            "ioc_value": "story-of-us.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-08 19:00:46",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669665": [
        {
            "ioc_value": "studiobergaminsacolas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669666": [
        {
            "ioc_value": "subtiluz.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669667": [
        {
            "ioc_value": "suimeiso.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669668": [
        {
            "ioc_value": "suizenji-street.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669669": [
        {
            "ioc_value": "sunsblade.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-09 13:35:26",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669670": [
        {
            "ioc_value": "swasthatoys.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669671": [
        {
            "ioc_value": "takayama.ltd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669672": [
        {
            "ioc_value": "takublog1976.xsrv.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-08 19:00:47",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669673": [
        {
            "ioc_value": "talmoelaquila.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669674": [
        {
            "ioc_value": "tanya4d.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-12 18:01:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669675": [
        {
            "ioc_value": "tapbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669676": [
        {
            "ioc_value": "tapensa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669677": [
        {
            "ioc_value": "tatuape.oligoflora.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669678": [
        {
            "ioc_value": "taxicallnow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:43",
            "last_seen_utc": "2025-12-12 18:01:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669634": [
        {
            "ioc_value": "serv-in.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669635": [
        {
            "ioc_value": "shareyourstory.org.zm",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669636": [
        {
            "ioc_value": "shayonmoitra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669637": [
        {
            "ioc_value": "shiogo-seseragi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669638": [
        {
            "ioc_value": "shiroseinavi.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669639": [
        {
            "ioc_value": "shogai-nenkinsodan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669640": [
        {
            "ioc_value": "shop4allthings.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669641": [
        {
            "ioc_value": "sigalitz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669642": [
        {
            "ioc_value": "simanys.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-12 18:01:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669643": [
        {
            "ioc_value": "singkansard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669644": [
        {
            "ioc_value": "sistemaibra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669645": [
        {
            "ioc_value": "site.pr-gr.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-10 23:57:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669646": [
        {
            "ioc_value": "skunktvonline.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669647": [
        {
            "ioc_value": "smcompressores.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669648": [
        {
            "ioc_value": "smtp.amafhemployment.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669649": [
        {
            "ioc_value": "smtp.boission.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669650": [
        {
            "ioc_value": "smtp.inkifyme.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669651": [
        {
            "ioc_value": "smtp.iqbal-ahmad.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669652": [
        {
            "ioc_value": "smtp.strivexventures.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669653": [
        {
            "ioc_value": "smtp.warygroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669654": [
        {
            "ioc_value": "sochi.planeta.ooo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-07 20:34:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669655": [
        {
            "ioc_value": "southafricanza.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669656": [
        {
            "ioc_value": "sp-kazan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:42",
            "last_seen_utc": "2025-12-08 11:34:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669608": [
        {
            "ioc_value": "redlandsclearautobra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669609": [
        {
            "ioc_value": "remembrance.love",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669610": [
        {
            "ioc_value": "renildarosa.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-07 20:34:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669611": [
        {
            "ioc_value": "requenaeoliveira.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-09 13:35:22",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669612": [
        {
            "ioc_value": "restaurant1.3squaredco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-08 19:00:42",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669613": [
        {
            "ioc_value": "restaurants.localgrapevines.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669614": [
        {
            "ioc_value": "reynaldishop.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669615": [
        {
            "ioc_value": "richard.manemaximus.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-08 19:00:43",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669616": [
        {
            "ioc_value": "richate.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-08 19:00:43",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669617": [
        {
            "ioc_value": "rimamarestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669618": [
        {
            "ioc_value": "rinsai3.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-10 23:57:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669619": [
        {
            "ioc_value": "romye.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669620": [
        {
            "ioc_value": "ronniegibson.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669621": [
        {
            "ioc_value": "rossunger.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669622": [
        {
            "ioc_value": "saigodeath.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669623": [
        {
            "ioc_value": "saigoni.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-08 19:00:43",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669624": [
        {
            "ioc_value": "salveseucasamentoprasempre.suavidaadois.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669625": [
        {
            "ioc_value": "sandlefordparade.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669626": [
        {
            "ioc_value": "satabi-guide.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-10 23:57:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669627": [
        {
            "ioc_value": "scillarodriguez.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669628": [
        {
            "ioc_value": "score33.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-10 23:57:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669629": [
        {
            "ioc_value": "scraminebilk.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669630": [
        {
            "ioc_value": "scraminebilkadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669631": [
        {
            "ioc_value": "scsoptions.com.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669632": [
        {
            "ioc_value": "seamesinnovation.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669633": [
        {
            "ioc_value": "selectad.mt-org.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:41",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669583": [
        {
            "ioc_value": "pimentaqueiroz.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669584": [
        {
            "ioc_value": "pizza-king-guadeloupe.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669585": [
        {
            "ioc_value": "pocketpenguin.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-08 19:00:40",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669586": [
        {
            "ioc_value": "polpaeva.com.br.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669587": [
        {
            "ioc_value": "pontopayments.isisfertilidade.co.mz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669588": [
        {
            "ioc_value": "pos.paysoko.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669589": [
        {
            "ioc_value": "preschoolmum.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-08 11:34:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669590": [
        {
            "ioc_value": "primeagencypanama.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669591": [
        {
            "ioc_value": "prize.kultura.city",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669592": [
        {
            "ioc_value": "probirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669593": [
        {
            "ioc_value": "prod.enocia.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669594": [
        {
            "ioc_value": "professor-johan-bring.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669595": [
        {
            "ioc_value": "projectsourdough.workwithastara.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-08 19:00:41",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669596": [
        {
            "ioc_value": "propertyrental.appexperts.us",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669597": [
        {
            "ioc_value": "pruebas.pickterra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669598": [
        {
            "ioc_value": "ptashka.bar",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669599": [
        {
            "ioc_value": "purposehousepublishing.purposehousechristiancounseling.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-12 18:01:01",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669600": [
        {
            "ioc_value": "qccqatar.qa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669601": [
        {
            "ioc_value": "rachelkoller.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669602": [
        {
            "ioc_value": "racism201.sumillionaires.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-09 13:35:23",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669603": [
        {
            "ioc_value": "raessler.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669604": [
        {
            "ioc_value": "raessler.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669605": [
        {
            "ioc_value": "rafadamski.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669606": [
        {
            "ioc_value": "ranierefernandesmoura.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-07 20:34:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669607": [
        {
            "ioc_value": "reachbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:40",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669558": [
        {
            "ioc_value": "ns2.schoolofhealthcare.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669559": [
        {
            "ioc_value": "nutraforyou.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-10 23:57:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669560": [
        {
            "ioc_value": "nzfashion.in.scriptzee.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669561": [
        {
            "ioc_value": "odeon-gongen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669562": [
        {
            "ioc_value": "oemselect.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669563": [
        {
            "ioc_value": "officialreviewhub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669564": [
        {
            "ioc_value": "offomol.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-08 19:00:39",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669565": [
        {
            "ioc_value": "olivar-design.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669566": [
        {
            "ioc_value": "omarlabastida.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669567": [
        {
            "ioc_value": "once-alive.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669568": [
        {
            "ioc_value": "optbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669569": [
        {
            "ioc_value": "origoemforma.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669570": [
        {
            "ioc_value": "oturumkaradag.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669571": [
        {
            "ioc_value": "outbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669572": [
        {
            "ioc_value": "oyunayoga.fit",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669573": [
        {
            "ioc_value": "paintballclub.kiev.ua",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669574": [
        {
            "ioc_value": "papa-ehon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669575": [
        {
            "ioc_value": "pasti.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669576": [
        {
            "ioc_value": "paysoko.ke",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669577": [
        {
            "ioc_value": "pearlxp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669578": [
        {
            "ioc_value": "personalizedparis.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669579": [
        {
            "ioc_value": "pg.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669580": [
        {
            "ioc_value": "photoair.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669581": [
        {
            "ioc_value": "phylogenomics.com.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669582": [
        {
            "ioc_value": "pibu.moimland.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:39",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669533": [
        {
            "ioc_value": "moneygeniushub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-10 23:57:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669534": [
        {
            "ioc_value": "montanoantilia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669535": [
        {
            "ioc_value": "mopuff.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669536": [
        {
            "ioc_value": "mori-midori.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-09 13:35:20",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669537": [
        {
            "ioc_value": "mps-q.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669538": [
        {
            "ioc_value": "multi-business-mind.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669539": [
        {
            "ioc_value": "munichmotorsports.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669540": [
        {
            "ioc_value": "mylabmed.com.salineehealthcare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-11 19:29:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669541": [
        {
            "ioc_value": "myposr.miantech.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669542": [
        {
            "ioc_value": "myrtlebeachdeepseafishing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669543": [
        {
            "ioc_value": "n-system-sendai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-08 19:00:38",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669544": [
        {
            "ioc_value": "naanmudhalvan.ancitedutech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-11 19:29:22",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669545": [
        {
            "ioc_value": "nagano-kusakari.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669546": [
        {
            "ioc_value": "nagomi-ec.e-homepage.vc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669547": [
        {
            "ioc_value": "nagomiya-kokowa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669548": [
        {
            "ioc_value": "nao-burogu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669549": [
        {
            "ioc_value": "nazzuro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-08 19:00:38",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669550": [
        {
            "ioc_value": "neovide.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669551": [
        {
            "ioc_value": "new.tudosobrepug.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669552": [
        {
            "ioc_value": "newage.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669553": [
        {
            "ioc_value": "newzmedia.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669554": [
        {
            "ioc_value": "nndw.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-11 19:29:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669555": [
        {
            "ioc_value": "nova-mogucnost.lunatik.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-08 19:00:38",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669556": [
        {
            "ioc_value": "nowbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-08 19:00:38",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669557": [
        {
            "ioc_value": "nowbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:38",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669506": [
        {
            "ioc_value": "mail.vyaparionline.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669507": [
        {
            "ioc_value": "mail.wpt-8gek.162-215-130-152.cpanel.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-11 19:29:28",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669508": [
        {
            "ioc_value": "mail.yhelwah.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669509": [
        {
            "ioc_value": "mail.youngdesignerscollective.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669510": [
        {
            "ioc_value": "mail2.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-12 18:00:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669511": [
        {
            "ioc_value": "mana.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669512": [
        {
            "ioc_value": "manakai.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-07 20:34:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669513": [
        {
            "ioc_value": "manhomes.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-08 19:00:35",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669514": [
        {
            "ioc_value": "marciomedradophotography.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669515": [
        {
            "ioc_value": "marcondescostaadv.com.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669516": [
        {
            "ioc_value": "mark.dae.moe",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669517": [
        {
            "ioc_value": "max-machine.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669518": [
        {
            "ioc_value": "maxbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669519": [
        {
            "ioc_value": "mbdsmart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669520": [
        {
            "ioc_value": "mercanmuhendislik.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669521": [
        {
            "ioc_value": "mhkhighdesert.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-07 20:34:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669522": [
        {
            "ioc_value": "migroltest.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-08 19:00:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669523": [
        {
            "ioc_value": "mikeofficer.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669524": [
        {
            "ioc_value": "minihangrogzito.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669525": [
        {
            "ioc_value": "mirageinthewater.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669526": [
        {
            "ioc_value": "mirazbakery.com.np",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669527": [
        {
            "ioc_value": "mividatour.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669528": [
        {
            "ioc_value": "modelo.gbdkdesign.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-08 19:00:37",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669529": [
        {
            "ioc_value": "moeostar.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669530": [
        {
            "ioc_value": "mohade.se.khani.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669531": [
        {
            "ioc_value": "momidokoro-asonote.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669532": [
        {
            "ioc_value": "mommy-b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:37",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669477": [
        {
            "ioc_value": "mail.moraespagliuco.adv.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-07 20:34:38",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669478": [
        {
            "ioc_value": "mail.morvets.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669479": [
        {
            "ioc_value": "mail.mousefair.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669480": [
        {
            "ioc_value": "mail.myrtleturtlesavingscard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669481": [
        {
            "ioc_value": "mail.obafgkm.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669482": [
        {
            "ioc_value": "mail.ojq.cvp.mybluehost.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669483": [
        {
            "ioc_value": "mail.okampogw.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669484": [
        {
            "ioc_value": "mail.oklahomasleepfoundation.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669485": [
        {
            "ioc_value": "mail.oscarsalinas.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669486": [
        {
            "ioc_value": "mail.paragraph-youth.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-09 13:35:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669487": [
        {
            "ioc_value": "mail.pixelparcels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669488": [
        {
            "ioc_value": "mail.platinum-painter.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669489": [
        {
            "ioc_value": "mail.quirkyrealty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669490": [
        {
            "ioc_value": "mail.rapidcuba.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-07 20:34:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669491": [
        {
            "ioc_value": "mail.rentobile.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-12 18:00:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669492": [
        {
            "ioc_value": "mail.rhetcompnow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669493": [
        {
            "ioc_value": "mail.rohacoffeee.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669494": [
        {
            "ioc_value": "mail.satyagrahnewstv.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669495": [
        {
            "ioc_value": "mail.smokingantrecords.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669496": [
        {
            "ioc_value": "mail.socialsecurityprimer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-10 23:57:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669497": [
        {
            "ioc_value": "mail.stelaconvites.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-09 13:35:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669498": [
        {
            "ioc_value": "mail.storehouseholdingsinc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669499": [
        {
            "ioc_value": "mail.sudamericanoajedrezescolartemuco2025.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669500": [
        {
            "ioc_value": "mail.syedbrands.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-11 19:29:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669501": [
        {
            "ioc_value": "mail.themillennialdiyer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669502": [
        {
            "ioc_value": "mail.thiagopapaterra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-12 18:00:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669503": [
        {
            "ioc_value": "mail.travelfork.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669504": [
        {
            "ioc_value": "mail.usniacorp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669505": [
        {
            "ioc_value": "mail.vrb.dsc.mybluehost.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:36",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669450": [
        {
            "ioc_value": "mail.facelesslegal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669451": [
        {
            "ioc_value": "mail.forefrontvrchitecture.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-08 19:00:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669452": [
        {
            "ioc_value": "mail.fullhr.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-08 19:00:31",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669453": [
        {
            "ioc_value": "mail.genesisfertility.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-08 19:00:31",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669454": [
        {
            "ioc_value": "mail.gotmedrovenl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669455": [
        {
            "ioc_value": "mail.grindordiestudios.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669456": [
        {
            "ioc_value": "mail.hastakalainteriors.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669457": [
        {
            "ioc_value": "mail.hillpaduampm.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-12 18:00:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669458": [
        {
            "ioc_value": "mail.hotelzlatnazita.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669459": [
        {
            "ioc_value": "mail.imersaodhe.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669460": [
        {
            "ioc_value": "mail.industrialvacuums.net.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669461": [
        {
            "ioc_value": "mail.ioredu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669462": [
        {
            "ioc_value": "mail.itia.org.tw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669463": [
        {
            "ioc_value": "mail.jelmedia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669464": [
        {
            "ioc_value": "mail.kasatnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669465": [
        {
            "ioc_value": "mail.kerbstone.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-08 19:00:26",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669466": [
        {
            "ioc_value": "mail.keyframe.com.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669467": [
        {
            "ioc_value": "mail.kftmakine.com.tr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669468": [
        {
            "ioc_value": "mail.lavorwash.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-08 19:00:32",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669469": [
        {
            "ioc_value": "mail.localgrapevines.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669470": [
        {
            "ioc_value": "mail.lumori.africa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669471": [
        {
            "ioc_value": "mail.madnitv.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669472": [
        {
            "ioc_value": "mail.mahaimran.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669473": [
        {
            "ioc_value": "mail.medql.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-07 20:34:37",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669474": [
        {
            "ioc_value": "mail.mega77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669475": [
        {
            "ioc_value": "mail.menapaints.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-08 19:00:36",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669476": [
        {
            "ioc_value": "mail.mlb999.com.tw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:35",
            "last_seen_utc": "2025-12-07 20:34:37",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669421": [
        {
            "ioc_value": "lumori.africa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669422": [
        {
            "ioc_value": "m-fantasy2021.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-07 20:34:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669423": [
        {
            "ioc_value": "macaron-space.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669424": [
        {
            "ioc_value": "maikamakes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669425": [
        {
            "ioc_value": "mail.a-techsolutionz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669426": [
        {
            "ioc_value": "mail.aalvesimoveisrp.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669427": [
        {
            "ioc_value": "mail.adieinc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669428": [
        {
            "ioc_value": "mail.afomdabo.com.ng",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669429": [
        {
            "ioc_value": "mail.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669430": [
        {
            "ioc_value": "mail.alfildeiquique.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669431": [
        {
            "ioc_value": "mail.anagarlet.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-09 13:35:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669432": [
        {
            "ioc_value": "mail.ashaherq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-10 23:57:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669433": [
        {
            "ioc_value": "mail.blancosettlement.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669434": [
        {
            "ioc_value": "mail.bodhedunpj.com.np",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669435": [
        {
            "ioc_value": "mail.bonzer.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-10 23:57:03",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669436": [
        {
            "ioc_value": "mail.brandauthority.ai",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669437": [
        {
            "ioc_value": "mail.brownmountainangus.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669438": [
        {
            "ioc_value": "mail.businessrepmatters.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669439": [
        {
            "ioc_value": "mail.buteam.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669440": [
        {
            "ioc_value": "mail.caodangyduoctphcm.com.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-08 19:00:30",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669441": [
        {
            "ioc_value": "mail.caworkforce.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-09 13:35:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669442": [
        {
            "ioc_value": "mail.cordovacrafts.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669443": [
        {
            "ioc_value": "mail.daihocdongthap.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669444": [
        {
            "ioc_value": "mail.dcamargobetoneiras.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-09 13:35:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669445": [
        {
            "ioc_value": "mail.derekmcginty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-11 19:29:20",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669446": [
        {
            "ioc_value": "mail.dynamicedge-llc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-10 23:57:03",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669447": [
        {
            "ioc_value": "mail.enor.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-11 19:29:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669448": [
        {
            "ioc_value": "mail.excellencegifts.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669449": [
        {
            "ioc_value": "mail.exosomenebulizers.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:34",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669394": [
        {
            "ioc_value": "kokucho.tokyo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669395": [
        {
            "ioc_value": "korin.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669396": [
        {
            "ioc_value": "kosmiceventsja.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669397": [
        {
            "ioc_value": "kouad100.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669398": [
        {
            "ioc_value": "kouhousentai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669399": [
        {
            "ioc_value": "kraftiapetcare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669400": [
        {
            "ioc_value": "kraul.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669401": [
        {
            "ioc_value": "kraziesaint.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669402": [
        {
            "ioc_value": "kursus88.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-08 11:34:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669403": [
        {
            "ioc_value": "laddersoul.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669404": [
        {
            "ioc_value": "lammerum.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669405": [
        {
            "ioc_value": "landingpages.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669406": [
        {
            "ioc_value": "larva4d.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-09 13:35:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669407": [
        {
            "ioc_value": "lead-mc.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669408": [
        {
            "ioc_value": "leandrocapatti.adv.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-09 13:35:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669409": [
        {
            "ioc_value": "legalchat.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-08 19:00:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669410": [
        {
            "ioc_value": "legalsales.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-09 13:35:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669411": [
        {
            "ioc_value": "letscelebr8rentals.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669412": [
        {
            "ioc_value": "levitonbrasil.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-08 19:00:27",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669413": [
        {
            "ioc_value": "lgtadvocacia.com.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-09 13:35:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669414": [
        {
            "ioc_value": "livingillusion.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669415": [
        {
            "ioc_value": "lorenz-rodgau.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669416": [
        {
            "ioc_value": "loyalty-jumbo-test.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669417": [
        {
            "ioc_value": "lp-europa.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-07 20:34:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669418": [
        {
            "ioc_value": "lp.gomesesabraadvocacia.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669419": [
        {
            "ioc_value": "lp.vasconcellosamadeoadvocacia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": "2025-12-08 19:00:28",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669420": [
        {
            "ioc_value": "ltb2025.unairdedemo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669367": [
        {
            "ioc_value": "jdtoto.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669368": [
        {
            "ioc_value": "jdtoto.ink",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669369": [
        {
            "ioc_value": "jelmedia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-08 19:00:25",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669370": [
        {
            "ioc_value": "jftl.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-10 23:56:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669371": [
        {
            "ioc_value": "jnisa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669372": [
        {
            "ioc_value": "joaobarbosaadv.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669373": [
        {
            "ioc_value": "jobtomilega.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669374": [
        {
            "ioc_value": "josefernando.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669375": [
        {
            "ioc_value": "josemargomesdasilva1751988902000.produtoracasabranca.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669376": [
        {
            "ioc_value": "joyetechegoaio.cz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669377": [
        {
            "ioc_value": "joyfulfitnessjourney.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-10 23:56:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669378": [
        {
            "ioc_value": "justbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669379": [
        {
            "ioc_value": "jw-daniels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669380": [
        {
            "ioc_value": "kachi-maria.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669381": [
        {
            "ioc_value": "kammtblog.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669382": [
        {
            "ioc_value": "karenfernandesadv.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-09 13:35:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669383": [
        {
            "ioc_value": "karlachacon.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-08 19:00:26",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669384": [
        {
            "ioc_value": "karnatakaaviation.com.digitaljaydeep.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-07 20:34:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669385": [
        {
            "ioc_value": "kaufaufrechnung.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-08 19:00:26",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669386": [
        {
            "ioc_value": "kawonairco.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669387": [
        {
            "ioc_value": "keikei-oekaki.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669388": [
        {
            "ioc_value": "kemetichealth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669389": [
        {
            "ioc_value": "kesieuthicantho.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669390": [
        {
            "ioc_value": "kevvai.ee",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669391": [
        {
            "ioc_value": "kincir888.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669392": [
        {
            "ioc_value": "kinglogic.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-09 13:35:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669393": [
        {
            "ioc_value": "knt567.xsrv.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:32",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669338": [
        {
            "ioc_value": "iekoubou-maeda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-07 20:34:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669339": [
        {
            "ioc_value": "imbaslcuana3.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-10 23:56:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669340": [
        {
            "ioc_value": "imersaodhe.vasconcelossolucoes.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-08 19:00:24",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669341": [
        {
            "ioc_value": "imogen-heap.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669342": [
        {
            "ioc_value": "indiasproperty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669343": [
        {
            "ioc_value": "indiygo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669344": [
        {
            "ioc_value": "industrialvacuums.net.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669345": [
        {
            "ioc_value": "infinitywealthfundsmanagement.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669346": [
        {
            "ioc_value": "infobirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669347": [
        {
            "ioc_value": "infobirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669348": [
        {
            "ioc_value": "inipokertop.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669349": [
        {
            "ioc_value": "inspirec.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-09 13:35:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669350": [
        {
            "ioc_value": "intra-staff.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669351": [
        {
            "ioc_value": "intra-stg.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669352": [
        {
            "ioc_value": "intra.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669353": [
        {
            "ioc_value": "intrass.win",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669354": [
        {
            "ioc_value": "inwiththewoods.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669355": [
        {
            "ioc_value": "iot.fautpasfaireca.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669356": [
        {
            "ioc_value": "ip59.ip-51-38-209.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669357": [
        {
            "ioc_value": "ipmmasterclass.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669358": [
        {
            "ioc_value": "ipsova.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669359": [
        {
            "ioc_value": "iranmetalnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669360": [
        {
            "ioc_value": "iriswebportaldesign.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669361": [
        {
            "ioc_value": "iry-mens-datsumou.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669362": [
        {
            "ioc_value": "isabelarteaga.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669363": [
        {
            "ioc_value": "islandshipping.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669364": [
        {
            "ioc_value": "it885.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669365": [
        {
            "ioc_value": "jacuzzi-haute-savoie.nathan-charvin.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669366": [
        {
            "ioc_value": "jayohcee.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669312": [
        {
            "ioc_value": "glassfusion.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669313": [
        {
            "ioc_value": "go88.cz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669314": [
        {
            "ioc_value": "gripprox.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669315": [
        {
            "ioc_value": "hadyhany.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669316": [
        {
            "ioc_value": "hakverdi.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669317": [
        {
            "ioc_value": "hank-ga.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669318": [
        {
            "ioc_value": "hate3.kohalpurdainik.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-08 11:34:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669319": [
        {
            "ioc_value": "hcwindow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669320": [
        {
            "ioc_value": "healthydayspro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669321": [
        {
            "ioc_value": "heartfelt.jpn.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669322": [
        {
            "ioc_value": "helpbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669323": [
        {
            "ioc_value": "helpbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669324": [
        {
            "ioc_value": "herconic.mirzadev.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669325": [
        {
            "ioc_value": "highlevel-highincome.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669326": [
        {
            "ioc_value": "hiportal.bcto.com.ng",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669327": [
        {
            "ioc_value": "hirogeru-mirai.or.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-10 23:56:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669328": [
        {
            "ioc_value": "hiruma17.world",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669329": [
        {
            "ioc_value": "holidayinfo.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669330": [
        {
            "ioc_value": "home-guard-jo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669331": [
        {
            "ioc_value": "hostmaster.citywideagency.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669332": [
        {
            "ioc_value": "hotelzlatnazita.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669333": [
        {
            "ioc_value": "hotgirltiktok.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669334": [
        {
            "ioc_value": "hotmommamaternitique.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669335": [
        {
            "ioc_value": "hrm.tributesit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669336": [
        {
            "ioc_value": "hwi-in.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669337": [
        {
            "ioc_value": "hybrid.mirzadev.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:30",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669287": [
        {
            "ioc_value": "ftp.maritimnews.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669288": [
        {
            "ioc_value": "ftp.mega77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669289": [
        {
            "ioc_value": "ftp.munichmotorsport.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669290": [
        {
            "ioc_value": "ftp.super77a.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-12 18:01:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669291": [
        {
            "ioc_value": "ftp.ubunye-unity.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-08 11:34:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669292": [
        {
            "ioc_value": "fuel4design.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-09 13:35:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669293": [
        {
            "ioc_value": "funcampaz.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669294": [
        {
            "ioc_value": "g42p2t-wigwhowigmecom.site.tb-hosting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669295": [
        {
            "ioc_value": "gabrielabragaadvogada.com.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669296": [
        {
            "ioc_value": "gabriele-saro.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669297": [
        {
            "ioc_value": "galaxpmu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-08 19:00:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669298": [
        {
            "ioc_value": "gamehusters.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669299": [
        {
            "ioc_value": "gbdkdesign.com.br.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669300": [
        {
            "ioc_value": "gedelsurpro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-08 19:00:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669301": [
        {
            "ioc_value": "gedrielpereira.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-09 13:35:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669302": [
        {
            "ioc_value": "geetanjalirealtech.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-10 23:56:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669303": [
        {
            "ioc_value": "genesisfertility.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669304": [
        {
            "ioc_value": "geobats-rdc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669305": [
        {
            "ioc_value": "gerafort.com.br.caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-10 23:56:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669306": [
        {
            "ioc_value": "gesundeswasser.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669307": [
        {
            "ioc_value": "getbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669308": [
        {
            "ioc_value": "getbrandauthority.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-10 23:56:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669309": [
        {
            "ioc_value": "gigistore.es",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-09 13:35:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669310": [
        {
            "ioc_value": "gilsoundworks.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669311": [
        {
            "ioc_value": "giracoin.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:29",
            "last_seen_utc": "2025-12-09 13:35:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669260": [
        {
            "ioc_value": "ex-odia.com.togever.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669261": [
        {
            "ioc_value": "explonortespa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-10 23:56:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669262": [
        {
            "ioc_value": "expoexhibitionstands.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669263": [
        {
            "ioc_value": "extremgadgets.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669264": [
        {
            "ioc_value": "fameitc.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-08 19:00:20",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669265": [
        {
            "ioc_value": "familiaatibinho.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669266": [
        {
            "ioc_value": "farfourhotel.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669267": [
        {
            "ioc_value": "fastpasstijuana.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-08 19:00:20",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669268": [
        {
            "ioc_value": "febgp6.webpractice.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-09 13:35:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669269": [
        {
            "ioc_value": "fibrocem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669270": [
        {
            "ioc_value": "finsweet4.markluigibatoctoy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669271": [
        {
            "ioc_value": "fixbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669272": [
        {
            "ioc_value": "fnassessoria.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-08 19:00:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669273": [
        {
            "ioc_value": "fogdev.icecubestudio.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669274": [
        {
            "ioc_value": "formasarg.com.ar",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669275": [
        {
            "ioc_value": "fossamedia.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669276": [
        {
            "ioc_value": "frassatoadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-09 13:35:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669277": [
        {
            "ioc_value": "ftp.aliyasisolation.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669278": [
        {
            "ioc_value": "ftp.aliyasrealestate.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669279": [
        {
            "ioc_value": "ftp.alugueautos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669280": [
        {
            "ioc_value": "ftp.candlerhistoricalsociety.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669281": [
        {
            "ioc_value": "ftp.cfcbuscar.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669282": [
        {
            "ioc_value": "ftp.cpdendorsed.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669283": [
        {
            "ioc_value": "ftp.daihocdongthap.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-08 19:00:21",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669284": [
        {
            "ioc_value": "ftp.fixmystrings.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-10 23:56:57",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669285": [
        {
            "ioc_value": "ftp.kasatnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669286": [
        {
            "ioc_value": "ftp.leadonline.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669233": [
        {
            "ioc_value": "demo.ninhbinhbds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-08 19:00:17",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669234": [
        {
            "ioc_value": "denshikeiyaku-hikaku.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669235": [
        {
            "ioc_value": "depuffnow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669236": [
        {
            "ioc_value": "dikarealestate.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669237": [
        {
            "ioc_value": "dirongseal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669238": [
        {
            "ioc_value": "djjaner.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669239": [
        {
            "ioc_value": "dkiplay88pro.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669240": [
        {
            "ioc_value": "downward-spiral-mantra.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669241": [
        {
            "ioc_value": "dratatianeferreiraadv.com.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-08 19:00:18",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669242": [
        {
            "ioc_value": "dumpsterpod.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-11 19:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669243": [
        {
            "ioc_value": "dvasilaki.dynacomp2.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669244": [
        {
            "ioc_value": "e493c161-6665-4d17-a590-24da4cda3790.petrnesterov.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669245": [
        {
            "ioc_value": "ebimax.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669246": [
        {
            "ioc_value": "editing-hub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-07 20:34:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669247": [
        {
            "ioc_value": "edj.hjg.temporary.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669248": [
        {
            "ioc_value": "edm.phm-hotels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669249": [
        {
            "ioc_value": "egitim.micromed.com.tr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-10 23:56:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669250": [
        {
            "ioc_value": "egresados.uce.edu.do",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669251": [
        {
            "ioc_value": "ein.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669252": [
        {
            "ioc_value": "elbassiounishop.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669253": [
        {
            "ioc_value": "elettoceramica.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-07 20:34:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669254": [
        {
            "ioc_value": "email.closeoutstocks.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669255": [
        {
            "ioc_value": "emailbiz.webcs.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-08 19:00:19",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669256": [
        {
            "ioc_value": "euroconnectsolution.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669257": [
        {
            "ioc_value": "eutsun.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669258": [
        {
            "ioc_value": "evaluation.kentinmartel.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669259": [
        {
            "ioc_value": "evannatura.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669205": [
        {
            "ioc_value": "cpanel.balbharatischool.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669206": [
        {
            "ioc_value": "cpanel.facelesslegal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669207": [
        {
            "ioc_value": "cpanel.karamelsitges.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669208": [
        {
            "ioc_value": "cpanel.maritimnews.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669209": [
        {
            "ioc_value": "cpanel.mpo77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669210": [
        {
            "ioc_value": "cpanel.mrleeprojects.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-11 19:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669211": [
        {
            "ioc_value": "cpanel.shouryapuram.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669212": [
        {
            "ioc_value": "cpanel.umeedshiksharath.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669213": [
        {
            "ioc_value": "cpcalendars.maritimnews.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669214": [
        {
            "ioc_value": "cpcalendars.mega77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669215": [
        {
            "ioc_value": "cpcalendars.moro-mie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669216": [
        {
            "ioc_value": "cpcalendars.mpo77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669217": [
        {
            "ioc_value": "cpcalendars.originalsvensktkrkort.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669218": [
        {
            "ioc_value": "cpcalendars.parashaktisolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669219": [
        {
            "ioc_value": "creativehangar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669220": [
        {
            "ioc_value": "crystdl-rdin.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669221": [
        {
            "ioc_value": "curtis.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669222": [
        {
            "ioc_value": "cwatest.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-11 19:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669223": [
        {
            "ioc_value": "dailynews25.world",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669224": [
        {
            "ioc_value": "damos.com.cy",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669225": [
        {
            "ioc_value": "dataair.ccdatos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669226": [
        {
            "ioc_value": "datascienceiub.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669227": [
        {
            "ioc_value": "david.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669228": [
        {
            "ioc_value": "dc-6423d9a4e14a.usniacorp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669229": [
        {
            "ioc_value": "dcamargobetoneiras.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": "2025-12-11 19:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669230": [
        {
            "ioc_value": "deadly-buda.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669231": [
        {
            "ioc_value": "debbkitchen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669232": [
        {
            "ioc_value": "delirium.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669178": [
        {
            "ioc_value": "briansimm.novadevelop.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669179": [
        {
            "ioc_value": "burmas.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669180": [
        {
            "ioc_value": "butterflycard.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669181": [
        {
            "ioc_value": "bybirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669182": [
        {
            "ioc_value": "bybirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669183": [
        {
            "ioc_value": "cangkul88login.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-08 19:00:14",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669184": [
        {
            "ioc_value": "carlosnogueiraadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669185": [
        {
            "ioc_value": "carmodesousa.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-08 19:00:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669186": [
        {
            "ioc_value": "carvalho.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669187": [
        {
            "ioc_value": "cashback.evobot.uz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669188": [
        {
            "ioc_value": "cbdoilpro.net.nhm.rtt.mybluehost.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669189": [
        {
            "ioc_value": "ccrjapan.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-07 20:34:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669190": [
        {
            "ioc_value": "cdn.gharbazar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669191": [
        {
            "ioc_value": "certificadodigital.tech.contabilizoom.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669192": [
        {
            "ioc_value": "charlaentreamigos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-09 13:35:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669193": [
        {
            "ioc_value": "chikara.group",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-08 19:00:15",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669194": [
        {
            "ioc_value": "ciclosportporciatti.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669195": [
        {
            "ioc_value": "clab.davideserena.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669196": [
        {
            "ioc_value": "cleanmeup-app.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669197": [
        {
            "ioc_value": "client24.shared.atcihosting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669198": [
        {
            "ioc_value": "cmrt.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669199": [
        {
            "ioc_value": "coco-sapo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669200": [
        {
            "ioc_value": "comet.co.hu.technorollshop.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669201": [
        {
            "ioc_value": "con-vent.spb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669202": [
        {
            "ioc_value": "consultant-life.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-10 23:56:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669203": [
        {
            "ioc_value": "costtaadvogados.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-08 19:00:16",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669204": [
        {
            "ioc_value": "covidautorelief.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:25",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669148": [
        {
            "ioc_value": "birdrepace.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-08 19:00:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669149": [
        {
            "ioc_value": "birdrepapp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669150": [
        {
            "ioc_value": "birdrepbiz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669151": [
        {
            "ioc_value": "birdrepbox.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669152": [
        {
            "ioc_value": "birdrepcorp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669153": [
        {
            "ioc_value": "birdrepex.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669154": [
        {
            "ioc_value": "birdreplab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669155": [
        {
            "ioc_value": "birdrepmax.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669156": [
        {
            "ioc_value": "birdrepout.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669157": [
        {
            "ioc_value": "birdrepplus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669158": [
        {
            "ioc_value": "birdreppro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669159": [
        {
            "ioc_value": "birdrepsys.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669160": [
        {
            "ioc_value": "birdreptap.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-10 23:56:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669161": [
        {
            "ioc_value": "birdrepup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-10 23:56:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669162": [
        {
            "ioc_value": "birdrepusa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669163": [
        {
            "ioc_value": "birdrepvip.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669164": [
        {
            "ioc_value": "birdrepzip.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669165": [
        {
            "ioc_value": "bit-agent.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-08 19:00:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669166": [
        {
            "ioc_value": "bitbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669167": [
        {
            "ioc_value": "bitbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669168": [
        {
            "ioc_value": "biztaxfiling.sabihfinancials.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669169": [
        {
            "ioc_value": "blancosettlement.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-08 19:00:13",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669170": [
        {
            "ioc_value": "bnj.tokyo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669171": [
        {
            "ioc_value": "boldhorizongroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-11 19:29:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669172": [
        {
            "ioc_value": "bonggita.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669173": [
        {
            "ioc_value": "bonus33.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669174": [
        {
            "ioc_value": "bookingmaster.bswan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669175": [
        {
            "ioc_value": "brandauthority.ai.wisefunders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669176": [
        {
            "ioc_value": "branquinhoribeiro.agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669177": [
        {
            "ioc_value": "bravelearning.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:24",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669121": [
        {
            "ioc_value": "beautifulnight.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669122": [
        {
            "ioc_value": "bebirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669123": [
        {
            "ioc_value": "bedpage.cc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-08 19:00:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669124": [
        {
            "ioc_value": "berkahpoker.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669125": [
        {
            "ioc_value": "bestad.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-08 19:00:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669126": [
        {
            "ioc_value": "betingslot-2024.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669127": [
        {
            "ioc_value": "bin88.cyou",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669128": [
        {
            "ioc_value": "bingsatellites.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669129": [
        {
            "ioc_value": "birdrankbit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669130": [
        {
            "ioc_value": "birdrankbiz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669131": [
        {
            "ioc_value": "birdrankfix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-08 19:00:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669132": [
        {
            "ioc_value": "birdrankgo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669133": [
        {
            "ioc_value": "birdrankhelp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669134": [
        {
            "ioc_value": "birdrankinfo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-08 19:00:11",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669135": [
        {
            "ioc_value": "birdrankmax.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669136": [
        {
            "ioc_value": "birdranknet.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669137": [
        {
            "ioc_value": "birdrankopt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669138": [
        {
            "ioc_value": "birdrankout.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669139": [
        {
            "ioc_value": "birdrankpro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669140": [
        {
            "ioc_value": "birdranksys.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669141": [
        {
            "ioc_value": "birdrankup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669142": [
        {
            "ioc_value": "birdrankus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669143": [
        {
            "ioc_value": "birdrankusa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669144": [
        {
            "ioc_value": "birdrankuse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-09 13:35:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669145": [
        {
            "ioc_value": "birdrankvip.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-10 23:56:53",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669146": [
        {
            "ioc_value": "birdrankzen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669147": [
        {
            "ioc_value": "birdrankzip.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:23",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669098": [
        {
            "ioc_value": "articles.loanroad.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669099": [
        {
            "ioc_value": "aruarupedia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669100": [
        {
            "ioc_value": "aryakupal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669101": [
        {
            "ioc_value": "ashaherq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669102": [
        {
            "ioc_value": "aslidomino.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669103": [
        {
            "ioc_value": "asunflowersmindset.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669104": [
        {
            "ioc_value": "athenapremiumcruise.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669105": [
        {
            "ioc_value": "athleongear.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-08 11:34:45",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669106": [
        {
            "ioc_value": "atopy-enkei.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669107": [
        {
            "ioc_value": "autoconfig.moro-mie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669108": [
        {
            "ioc_value": "autoconfig.mrleeprojects.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669109": [
        {
            "ioc_value": "autoconfig.shalomstudios.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669110": [
        {
            "ioc_value": "autodiscover.chinabandy.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-09 13:35:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669111": [
        {
            "ioc_value": "autodiscover.data.epasos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-10 23:56:52",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669112": [
        {
            "ioc_value": "autodiscover.hotelthilanka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669113": [
        {
            "ioc_value": "autodiscover.mpo77b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-07 20:34:38",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669114": [
        {
            "ioc_value": "autodiscover.mrleeprojects.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669115": [
        {
            "ioc_value": "autodiscover.sindangkasihnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-08 19:00:45",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669116": [
        {
            "ioc_value": "avadhmachinerycare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669117": [
        {
            "ioc_value": "avaltozatossagize.corpuscom.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669118": [
        {
            "ioc_value": "avomawealth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669119": [
        {
            "ioc_value": "awards.ssk.in.th",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669120": [
        {
            "ioc_value": "badmowfjonnie.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669074": [
        {
            "ioc_value": "admira.com.tr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-10 23:56:51",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669075": [
        {
            "ioc_value": "adsys-iq.alhadhar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669076": [
        {
            "ioc_value": "advogados.seomidia.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669077": [
        {
            "ioc_value": "agragamipucollege.arbrands.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-08 19:00:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669078": [
        {
            "ioc_value": "agragamipucollege.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-08 19:00:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669079": [
        {
            "ioc_value": "agragamipucollegejakkur.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-08 11:34:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669080": [
        {
            "ioc_value": "agrosk.kz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-07 20:34:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669081": [
        {
            "ioc_value": "ahmadalishop.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669082": [
        {
            "ioc_value": "akari-sekkotuin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669083": [
        {
            "ioc_value": "alaincasault.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-07 20:34:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669084": [
        {
            "ioc_value": "alfildeiquique.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-09 13:35:06",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669085": [
        {
            "ioc_value": "allaboutfarts.com.steventripp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669086": [
        {
            "ioc_value": "allbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669087": [
        {
            "ioc_value": "amoreresina.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669088": [
        {
            "ioc_value": "amsterdamgate.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669089": [
        {
            "ioc_value": "anshin-ec.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669090": [
        {
            "ioc_value": "anupammills.com.ogeninfosystem.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669091": [
        {
            "ioc_value": "api-conectasocio.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669092": [
        {
            "ioc_value": "api-dev.playdagalera.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-07 20:34:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669093": [
        {
            "ioc_value": "api-hileia.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669094": [
        {
            "ioc_value": "apigo.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669095": [
        {
            "ioc_value": "app.accarda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669096": [
        {
            "ioc_value": "appbirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-08 19:00:08",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669097": [
        {
            "ioc_value": "appbirdrep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:21",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669063": [
        {
            "ioc_value": "1048s.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669064": [
        {
            "ioc_value": "206-189-201-40.cprapid.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669065": [
        {
            "ioc_value": "213-165-245-144.cprapid.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669066": [
        {
            "ioc_value": "34.226.31.114.nip.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-10 23:56:50",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669067": [
        {
            "ioc_value": "77eaf1e67f.nxcli.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669068": [
        {
            "ioc_value": "aboutpearlharbor.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669069": [
        {
            "ioc_value": "abs88vip.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669070": [
        {
            "ioc_value": "acat.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-09 13:35:04",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669071": [
        {
            "ioc_value": "account.pendantkart.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669072": [
        {
            "ioc_value": "admin-arteterapeutica.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-07 20:34:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669073": [
        {
            "ioc_value": "admin.facelesslegal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:34:20",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=3fe4873ff6b#tab=host_pairs",
            "tags": "Clickfix",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669044": [
        {
            "ioc_value": "adelanteinmobiliaria.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669045": [
        {
            "ioc_value": "admin-conectasocio.signo.dev.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-08 11:34:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669046": [
        {
            "ioc_value": "admin.ozi.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669047": [
        {
            "ioc_value": "admin.tamiltotamil.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669048": [
        {
            "ioc_value": "afde.unairdedemo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669049": [
        {
            "ioc_value": "agencialegalads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-07 20:34:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669050": [
        {
            "ioc_value": "aipon.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669051": [
        {
            "ioc_value": "alt-ruist.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669052": [
        {
            "ioc_value": "amt-jaguar.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-07 20:34:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669053": [
        {
            "ioc_value": "anita-boyd.novadevelop.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669054": [
        {
            "ioc_value": "api-master.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669055": [
        {
            "ioc_value": "atendimento.mpcservicos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-12 18:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669056": [
        {
            "ioc_value": "atibinho.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-13 15:28:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669057": [
        {
            "ioc_value": "autodiscover.zeus777b.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669058": [
        {
            "ioc_value": "avtokupec.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669059": [
        {
            "ioc_value": "aximoindia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669060": [
        {
            "ioc_value": "banlieuefashion.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669061": [
        {
            "ioc_value": "berani303.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669062": [
        {
            "ioc_value": "bay789.loans",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:15",
            "last_seen_utc": "2025-12-07 20:34:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669037": [
        {
            "ioc_value": "360uae.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:14",
            "last_seen_utc": "2025-12-07 20:34:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669038": [
        {
            "ioc_value": "6120b61b-fad6-46f2-9f8e-510dff2e0283.fs.lucidlink.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:14",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669039": [
        {
            "ioc_value": "a-techsolutionz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:14",
            "last_seen_utc": "2025-12-10 23:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669040": [
        {
            "ioc_value": "a614055982.nxcli.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:14",
            "last_seen_utc": "2025-12-10 23:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669041": [
        {
            "ioc_value": "acebirdrank.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:14",
            "last_seen_utc": "2025-12-08 19:00:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669042": [
        {
            "ioc_value": "adaildavid.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:14",
            "last_seen_utc": "2025-12-10 23:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1669043": [
        {
            "ioc_value": "addon-travelmixch.xinnomix-filme.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 20:17:14",
            "last_seen_utc": "2025-12-07 20:34:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Validin",
            "anonymous": "0",
            "reporter": "DaveLikesMalwre"
        }
    ],
    "1668980": [
        {
            "ioc_value": "tegose9785-39193.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-07 18:01:40",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251207-t9n29sdn6t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668981": [
        {
            "ioc_value": "jidwarf1-34676.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-07 18:01:40",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251207-se9vtazrdp",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668979": [
        {
            "ioc_value": "elecfrunn.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-07 17:27:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1668955": [
        {
            "ioc_value": "aalvesimoveisrp.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-07 17:04:03",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "clickfix",
            "anonymous": "0",
            "reporter": "Mengoh"
        }
    ],
    "1668962": [
        {
            "ioc_value": "happynewyear2.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-07 15:55:13",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7ac7c084a9d8bece07ebde3c286502f79ebe298da2421b5d48b5452bd0a879e5/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668963": [
        {
            "ioc_value": "malware.happynewyear2.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-07 15:55:13",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7ac7c084a9d8bece07ebde3c286502f79ebe298da2421b5d48b5452bd0a879e5/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668949": [
        {
            "ioc_value": "hestiapanel.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-07 12:24:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1668945/",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668946": [
        {
            "ioc_value": "screenconnect.support",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-07 12:24:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1668945/",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668947": [
        {
            "ioc_value": "server1magazine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-07 12:24:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1668945/",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668948": [
        {
            "ioc_value": "myexodus.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-07 12:24:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1668945/",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668943": [
        {
            "ioc_value": "dropctf.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 12:02:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251207-janbksyncz",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668942": [
        {
            "ioc_value": "children-gel.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 12:02:01",
            "last_seen_utc": "2025-12-12 18:39:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251207-nfmz8a1kb1",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668941": [
        {
            "ioc_value": "library-med.gl.joinmc.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 12:01:58",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/251207-ncw4qaxlfm",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668938": [
        {
            "ioc_value": "www.envio25.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-07 11:46:03",
            "last_seen_utc": "2025-12-12 18:39:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668937": [
        {
            "ioc_value": "kfz4gvwg6.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-07 11:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251207-fpsm3avjdr",
            "tags": "c2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668935": [
        {
            "ioc_value": "karma0.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lockbit",
            "malware_alias": "ABCD Ransomware",
            "malware_printable": "LockBit",
            "first_seen_utc": "2025-12-07 11:05:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/RakeshKrish12/status/1997122573512200668",
            "tags": "domain,leaksite,Lockbit,Ransomware",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668924": [
        {
            "ioc_value": "sqwqwasresbkng.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:53:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1963657070764593628",
            "tags": "AsyncRAT,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668923": [
        {
            "ioc_value": "mousycyminays.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:47:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1997575724132352356",
            "tags": "AsyncRAT,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668922": [
        {
            "ioc_value": "apekafilokreilosaka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-07 10:41:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.240.66",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668921": [
        {
            "ioc_value": "archikobalkrtiloka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-07 10:40:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.208.145",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668920": [
        {
            "ioc_value": "amicostrevelkrot.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-07 10:39:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.208.144",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668919": [
        {
            "ioc_value": "tokaritokloiuer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-07 10:38:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.240.65",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668918": [
        {
            "ioc_value": "bikolasdikolertaa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-07 10:36:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1667767/",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668917": [
        {
            "ioc_value": "v3.www.brainspinesurgery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-07 10:24:22",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668910": [
        {
            "ioc_value": "ditmemaytuimayau88ngu.shilohbn.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-07 10:24:21",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668911": [
        {
            "ioc_value": "fuckgoogle.shilohbn.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-07 10:24:21",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668912": [
        {
            "ioc_value": "google.shilohbn.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-07 10:24:21",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668913": [
        {
            "ioc_value": "malware.shilohbn.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-07 10:24:21",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668914": [
        {
            "ioc_value": "porn.shilohbn.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-07 10:24:21",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668915": [
        {
            "ioc_value": "sex.shilohbn.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-07 10:24:21",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668916": [
        {
            "ioc_value": "v2.www.brainspinesurgery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-07 10:24:21",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668906": [
        {
            "ioc_value": "malware.f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:44",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668907": [
        {
            "ioc_value": "multiplayer-games-online.pandajogosgratis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:44",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668908": [
        {
            "ioc_value": "psynovareal.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:44",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668895": [
        {
            "ioc_value": "gatex.vosillustration.logocravings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668896": [
        {
            "ioc_value": "gatex.workflows.edmdroid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668897": [
        {
            "ioc_value": "gatex.www.atlbbqfest.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668898": [
        {
            "ioc_value": "gatex.www.everybodyeveryone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668899": [
        {
            "ioc_value": "gatex.www.franksndawgs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668900": [
        {
            "ioc_value": "gatex.www.iamerinbrown.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:39:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668901": [
        {
            "ioc_value": "gatex.www.mipatriaecuador.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668902": [
        {
            "ioc_value": "gatex.www.monitorduty.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:38:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668903": [
        {
            "ioc_value": "gatex.www.rogerperrybook.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:38:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668904": [
        {
            "ioc_value": "gatex.www.springhousepress.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668905": [
        {
            "ioc_value": "gatex.www.uwff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:43",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668884": [
        {
            "ioc_value": "gatex.fieldblue.logocravings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668885": [
        {
            "ioc_value": "gatex.fighterpilotuniversity.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668886": [
        {
            "ioc_value": "gatex.git.peteralanlloyd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668887": [
        {
            "ioc_value": "gatex.graffitinyc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668888": [
        {
            "ioc_value": "gatex.mail.richardstjohn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668889": [
        {
            "ioc_value": "gatex.new.logocravings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668890": [
        {
            "ioc_value": "gatex.nightmarerecords.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668891": [
        {
            "ioc_value": "gatex.pandajogosgratis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668892": [
        {
            "ioc_value": "gatex.perdre-la-raison.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668893": [
        {
            "ioc_value": "gatex.peteralanlloyd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668894": [
        {
            "ioc_value": "gatex.sitemaps.butchvoices.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:42",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668872": [
        {
            "ioc_value": "fieldblue.logocravings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668873": [
        {
            "ioc_value": "fighterpilotuniversity.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668874": [
        {
            "ioc_value": "gatex.bullstreetgourmetandmarket.lautrec.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668875": [
        {
            "ioc_value": "gatex.cagis.pandajogosgratis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668876": [
        {
            "ioc_value": "gatex.cakhiatv.video",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668877": [
        {
            "ioc_value": "gatex.cakhiatv.watch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668878": [
        {
            "ioc_value": "gatex.cakhiatvb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668879": [
        {
            "ioc_value": "gatex.cakhiatvd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668880": [
        {
            "ioc_value": "gatex.cakhiatvl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668881": [
        {
            "ioc_value": "gatex.cakhiatvx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668882": [
        {
            "ioc_value": "gatex.copenhagenclimatecouncil.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668883": [
        {
            "ioc_value": "gatex.dynamicsyntax.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:41",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668864": [
        {
            "ioc_value": "bullstreetgourmetandmarket.lautrec.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:40",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668865": [
        {
            "ioc_value": "cagis.pandajogosgratis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:40",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668866": [
        {
            "ioc_value": "cakhiatv.video",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:40",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668867": [
        {
            "ioc_value": "cakhiatv.watch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:40",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668868": [
        {
            "ioc_value": "cakhiatvb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668869": [
        {
            "ioc_value": "cakhiatvd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668870": [
        {
            "ioc_value": "copenhagenclimatecouncil.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668871": [
        {
            "ioc_value": "dynamicsyntax.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 10:23:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668851": [
        {
            "ioc_value": "yopaxif225-50693.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-07 06:02:14",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/251207-bv8t1sgn7x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668850": [
        {
            "ioc_value": "g7cnfrcns.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-07 06:01:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251207-fpsm3avjdr",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668835": [
        {
            "ioc_value": "ritualex.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-07 05:30:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668811": [
        {
            "ioc_value": "lols-esports.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-06 23:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/192.227.158.61+lols-esports.com",
            "tags": "AS-COLOCROSSING,AS36352,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1668810": [
        {
            "ioc_value": "trimed.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:56:36",
            "last_seen_utc": "2025-12-08 19:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668808": [
        {
            "ioc_value": "sureclear.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:51:47",
            "last_seen_utc": "2025-12-08 19:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668806": [
        {
            "ioc_value": "buckscountytaxattorney.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:47:41",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668804": [
        {
            "ioc_value": "musl.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:46:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668803": [
        {
            "ioc_value": "travelmix.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:44:53",
            "last_seen_utc": "2025-12-09 13:35:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668801": [
        {
            "ioc_value": "karminis.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:44:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668798": [
        {
            "ioc_value": "aiboxs.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:43:07",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668797": [
        {
            "ioc_value": "cans.systems",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:42:29",
            "last_seen_utc": "2025-12-09 13:35:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668795": [
        {
            "ioc_value": "tophygiene.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:41:36",
            "last_seen_utc": "2025-12-10 23:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668793": [
        {
            "ioc_value": "sparklemyhome.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:40:22",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668791": [
        {
            "ioc_value": "innov8league.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:39:38",
            "last_seen_utc": "2025-12-07 20:34:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668789": [
        {
            "ioc_value": "smokefreehousinginfo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:38:52",
            "last_seen_utc": "2025-12-13 15:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668787": [
        {
            "ioc_value": "storysavers.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:37:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668785": [
        {
            "ioc_value": "suketiawan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:35:53",
            "last_seen_utc": "2025-12-08 19:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668782": [
        {
            "ioc_value": "g-terrace.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-06 22:33:24",
            "last_seen_utc": "2025-12-09 13:35:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668728": [
        {
            "ioc_value": "brightway-tn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 20:02:52",
            "last_seen_utc": "2025-12-06 23:00:40",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+brightway-tn.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668729": [
        {
            "ioc_value": "starjunky.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 20:02:52",
            "last_seen_utc": "2025-12-06 23:00:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+starjunky.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668730": [
        {
            "ioc_value": "cmk.nebula.africa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 20:02:52",
            "last_seen_utc": "2025-12-06 23:00:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+cmk.nebula.africa",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668725": [
        {
            "ioc_value": "ganjar77.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 20:02:51",
            "last_seen_utc": "2025-12-06 23:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+ganjar77.net",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668726": [
        {
            "ioc_value": "nesiabet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 20:02:51",
            "last_seen_utc": "2025-12-06 23:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+nesiabet.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668727": [
        {
            "ioc_value": "mawar500.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 20:02:51",
            "last_seen_utc": "2025-12-06 23:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+mawar500.net",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668712": [
        {
            "ioc_value": "mestre2.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-06 19:00:33",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/ded8ac26fe5cf263c473d957436a597d1eea50fc6ee8cf59aa54a90adca64074/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668702": [
        {
            "ioc_value": "windowsnet.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-12-06 18:04:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-sl9hmayna1",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668699": [
        {
            "ioc_value": "did-renaissance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-06 18:02:09",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-p7l3nstjgq",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668698": [
        {
            "ioc_value": "motchillfm.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-06 18:02:08",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-vzftksxmeq",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668680": [
        {
            "ioc_value": "baronns.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:22",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668679": [
        {
            "ioc_value": "browgew.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:21",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668681": [
        {
            "ioc_value": "beardop.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:21",
            "last_seen_utc": "2025-12-12 12:53:49",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668682": [
        {
            "ioc_value": "benelui.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:20",
            "last_seen_utc": "2025-12-12 12:53:49",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668683": [
        {
            "ioc_value": "clasers.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:20",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668684": [
        {
            "ioc_value": "cubablh.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:20",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668685": [
        {
            "ioc_value": "crossbp.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:19",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668686": [
        {
            "ioc_value": "diagcsl.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:18",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668687": [
        {
            "ioc_value": "eastcxl.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:17",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668688": [
        {
            "ioc_value": "despinm.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:17",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668689": [
        {
            "ioc_value": "foothbo.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:17",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668690": [
        {
            "ioc_value": "footmas.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:17",
            "last_seen_utc": "2025-12-12 12:53:49",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668691": [
        {
            "ioc_value": "handpaw.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:16",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668692": [
        {
            "ioc_value": "mattykp.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:16",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668693": [
        {
            "ioc_value": "oldieeg.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:16",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668694": [
        {
            "ioc_value": "retreaw.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:15",
            "last_seen_utc": "2025-12-12 12:53:49",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668695": [
        {
            "ioc_value": "seejuzd.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:11",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668696": [
        {
            "ioc_value": "snakeig.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:10",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668697": [
        {
            "ioc_value": "whitebt.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-06 17:58:10",
            "last_seen_utc": "2025-12-13 17:40:09",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1668670": [
        {
            "ioc_value": "bpy.is",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-06 16:04:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://urlhaus.abuse.ch/host/bpy.is/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668661": [
        {
            "ioc_value": "taingment.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:34",
            "last_seen_utc": "2025-12-06 23:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+taingment.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668660": [
        {
            "ioc_value": "muscat4d.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:33",
            "last_seen_utc": "2025-12-06 23:00:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+muscat4d.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668659": [
        {
            "ioc_value": "mail.winecountrytrailriding.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:32",
            "last_seen_utc": "2025-12-06 23:00:41",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+mail.winecountrytrailriding.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668658": [
        {
            "ioc_value": "11.mylitapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:30",
            "last_seen_utc": "2025-12-06 23:00:40",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+11.mylitapp.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668657": [
        {
            "ioc_value": "21.mylitapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:29",
            "last_seen_utc": "2025-12-06 23:00:41",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+21.mylitapp.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668656": [
        {
            "ioc_value": "mail.maureenmorrow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:27",
            "last_seen_utc": "2025-12-06 23:00:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+mail.maureenmorrow.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668655": [
        {
            "ioc_value": "wakuwaku.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:26",
            "last_seen_utc": "2025-12-06 23:00:41",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+wakuwaku.online",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668654": [
        {
            "ioc_value": "b.yedekcioto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:25",
            "last_seen_utc": "2025-12-06 23:00:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+b.yedekcioto.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668653": [
        {
            "ioc_value": "www.lockyloadcollectibles.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:24",
            "last_seen_utc": "2025-12-06 23:00:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+www.lockyloadcollectibles.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668652": [
        {
            "ioc_value": "marydunncauleymosaics.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:23",
            "last_seen_utc": "2025-12-06 23:00:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+marydunncauleymosaics.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668651": [
        {
            "ioc_value": "www.allstararena.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:22",
            "last_seen_utc": "2025-12-06 23:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+www.allstararena.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668650": [
        {
            "ioc_value": "bagusdominoqq.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:21",
            "last_seen_utc": "2025-12-06 23:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+bagusdominoqq.net",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668649": [
        {
            "ioc_value": "uk3.mylitapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:20",
            "last_seen_utc": "2025-12-06 23:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+uk3.mylitapp.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668648": [
        {
            "ioc_value": "10.mylitapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:19",
            "last_seen_utc": "2025-12-06 23:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+10.mylitapp.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668647": [
        {
            "ioc_value": "azurecloudteam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:18",
            "last_seen_utc": "2025-12-06 23:00:40",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+azurecloudteam.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668645": [
        {
            "ioc_value": "mccousins.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:17",
            "last_seen_utc": "2025-12-06 23:00:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+mccousins.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668646": [
        {
            "ioc_value": "www.taxpro-ca.mrgadget.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:17",
            "last_seen_utc": "2025-12-06 23:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+www.taxpro-ca.mrgadget.net",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668644": [
        {
            "ioc_value": "tayronasuites.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-06 16:02:16",
            "last_seen_utc": "2025-12-06 23:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.234+tayronasuites.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668351": [
        {
            "ioc_value": "alza7f.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-06 12:11:15",
            "last_seen_utc": "2025-12-06 11:35:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c19b9a5c933f2a33d44e1fa3d491832a2f541d1fb7da2b22c6cdb69e919cace3/",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1668360": [
        {
            "ioc_value": "fi.derayat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-06 12:11:12",
            "last_seen_utc": "2025-12-08 08:34:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/70357cbe6e3eccca3792fe17a0c8a2976a4bc16e851ee04dcc2cf8da553b504f/",
            "tags": "c2,vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1668462": [
        {
            "ioc_value": "spc.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-06 12:11:11",
            "last_seen_utc": "2025-12-06 12:10:28",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/ac631ad518856b80393ddf23bfea4d37a56382239bffb66d8093e447751d1764/detection",
            "tags": "c2,quasar,quasarRAT",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1668463": [
        {
            "ioc_value": "malware.spc.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-06 12:11:11",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/ac631ad518856b80393ddf23bfea4d37a56382239bffb66d8093e447751d1764/detection",
            "tags": "c2,quasar,quasarRAT",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1668464": [
        {
            "ioc_value": "phishing.spc.jp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-06 12:11:11",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/ac631ad518856b80393ddf23bfea4d37a56382239bffb66d8093e447751d1764/detection",
            "tags": "c2,quasar,quasarRAT",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1668466": [
        {
            "ioc_value": "balajibalamurugan.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-06 12:11:10",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/bde1d12e4a9141145fc6a6f1d5aceccf8db3aa3ebe77a7c1e47f09f8ea11b37c/detection",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1668532": [
        {
            "ioc_value": "motphimchillz.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-06 12:10:58",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/2c382f00d6e1aab4af1dbfc44a0e2af6ea8611f76013a06a2484bbba4f7d28ef",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1668533": [
        {
            "ioc_value": "v3.motphimchillz.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-06 12:10:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/2c382f00d6e1aab4af1dbfc44a0e2af6ea8611f76013a06a2484bbba4f7d28ef",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1668407": [
        {
            "ioc_value": "content-distribution-v2.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-12-06 12:10:45",
            "last_seen_utc": "2025-12-10 06:04:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "loader,StealC,stealer",
            "anonymous": "0",
            "reporter": "Bitsight"
        }
    ],
    "1668617": [
        {
            "ioc_value": "different-ncaa.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-06 12:01:52",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-l3abja1qeq",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668614": [
        {
            "ioc_value": "5.tcp.ngrok.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-06 12:01:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-hecj7scx2b",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668610": [
        {
            "ioc_value": "industrial-listed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-06 12:01:35",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-lhgj4sfr21",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668611": [
        {
            "ioc_value": "animals-geology.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-06 12:01:35",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-k3ka3a1khr",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668612": [
        {
            "ioc_value": "ebay-worked.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-06 12:01:35",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-kzew6sdt8d",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668613": [
        {
            "ioc_value": "twistz69-34948.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-06 12:01:35",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-kwm4dadt6g",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668545": [
        {
            "ioc_value": "v2.www.cascaderelief.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-06 09:41:50",
            "last_seen_utc": "2025-12-12 18:38:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668546": [
        {
            "ioc_value": "v3.www.cascaderelief.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-06 09:41:50",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1668523": [
        {
            "ioc_value": "v3.motchilltv.bot",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-06 08:10:21",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5f07c5c4e0e7154e891a3639f76c658eb6488c33d7e551c3bdf655955acb4765/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668522": [
        {
            "ioc_value": "v2.motchilltv.bot",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-06 08:10:20",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5f07c5c4e0e7154e891a3639f76c658eb6488c33d7e551c3bdf655955acb4765/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668521": [
        {
            "ioc_value": "motchilltv.bot",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-06 08:10:19",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5f07c5c4e0e7154e891a3639f76c658eb6488c33d7e551c3bdf655955acb4765/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668520": [
        {
            "ioc_value": "56h.ba7bdecep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 08:09:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668510": [
        {
            "ioc_value": "omega.ba7bdecep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 07:58:50",
            "last_seen_utc": "2025-12-07 22:24:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668509": [
        {
            "ioc_value": "6c.c2nce1rarity.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 07:48:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668508": [
        {
            "ioc_value": "river.c2nce1rarity.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 07:38:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668507": [
        {
            "ioc_value": "gix.c2nce1rarity.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 07:27:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668506": [
        {
            "ioc_value": "vti.c2nce1rarity.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 07:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668505": [
        {
            "ioc_value": "gamma.po0f5hleika.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 07:07:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668504": [
        {
            "ioc_value": "ember.po0f5hleika.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 06:57:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668503": [
        {
            "ioc_value": "bcev3.po0f5hleika.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 06:47:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668502": [
        {
            "ioc_value": "ocb.po0f5hleika.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 06:38:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668501": [
        {
            "ioc_value": "t0.c0nden5easy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 06:27:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668500": [
        {
            "ioc_value": "40p9e.c0nden5easy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668499": [
        {
            "ioc_value": "74.c0nden5easy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 06:07:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668498": [
        {
            "ioc_value": "wegame.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-12-06 06:04:05",
            "last_seen_utc": "2025-12-06 06:04:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-fnbcdsbz9e",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668497": [
        {
            "ioc_value": "insidious764-41058.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-06 06:01:29",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251206-fmrb8adl2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668496": [
        {
            "ioc_value": "jy3j.c0nden5easy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 05:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668495": [
        {
            "ioc_value": "beta.tr2ct0rbuild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 05:47:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668494": [
        {
            "ioc_value": "night.tr2ct0rbuild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 05:37:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668493": [
        {
            "ioc_value": "zk.tr2ct0rbuild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 05:27:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668492": [
        {
            "ioc_value": "wgig.tr2ct0rbuild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 05:17:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668491": [
        {
            "ioc_value": "n5uw1.sc0rp5koroh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 05:08:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668490": [
        {
            "ioc_value": "vector.sc0rp5koroh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 04:58:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668489": [
        {
            "ioc_value": "1ikx.sc0rp5koroh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 04:47:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668488": [
        {
            "ioc_value": "xrw.sc0rp5koroh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 04:37:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668485": [
        {
            "ioc_value": "ddu2.inc1inedn0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 04:29:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668484": [
        {
            "ioc_value": "forest.inc1inedn0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 04:17:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668483": [
        {
            "ioc_value": "4t2.inc1inedn0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 04:07:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668471": [
        {
            "ioc_value": "5gz.inc1inedn0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 03:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668470": [
        {
            "ioc_value": "xbex.in0cubwal1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 03:46:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668469": [
        {
            "ioc_value": "storm.in0cubwal1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 03:38:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668467": [
        {
            "ioc_value": "vbor.in0cubwal1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 03:28:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668465": [
        {
            "ioc_value": "deep.in0cubwal1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 03:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668461": [
        {
            "ioc_value": "bkj3.not0r5atush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 03:07:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668460": [
        {
            "ioc_value": "1s.not0r5atush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 02:57:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668458": [
        {
            "ioc_value": "uxsplooler.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-06 02:53:22",
            "last_seen_utc": "2025-12-14 11:48:17",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668457": [
        {
            "ioc_value": "wwt.not0r5atush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 02:48:45",
            "last_seen_utc": "2025-12-06 02:50:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668456": [
        {
            "ioc_value": "6a.not0r5atush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 02:37:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668455": [
        {
            "ioc_value": "crest.hea1t5ultan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 02:27:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668454": [
        {
            "ioc_value": "t7z.hea1t5ultan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 02:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668449": [
        {
            "ioc_value": "c27.hea1t5ultan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 02:08:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668447": [
        {
            "ioc_value": "20.hea1t5ultan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 01:57:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668446": [
        {
            "ioc_value": "thz.c7ucifto1nov.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 01:48:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668445": [
        {
            "ioc_value": "ru3.c7ucifto1nov.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 01:37:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668444": [
        {
            "ioc_value": "delta.c7ucifto1nov.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 01:27:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668443": [
        {
            "ioc_value": "kx.c7ucifto1nov.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 01:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668442": [
        {
            "ioc_value": "sun.ind1sset5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 01:08:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668440": [
        {
            "ioc_value": "a8.ind1sset5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 00:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668439": [
        {
            "ioc_value": "crystal.ind1sset5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 00:48:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668438": [
        {
            "ioc_value": "6uyj.ind1sset5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 00:36:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668437": [
        {
            "ioc_value": "dll32s.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-12-06 00:36:03",
            "last_seen_utc": "2025-12-14 12:36:03",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=dll32s.lat",
            "tags": "Amadey,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668436": [
        {
            "ioc_value": "dmh.f2rcegro0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 00:28:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668435": [
        {
            "ioc_value": "mist.f2rcegro0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 00:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668434": [
        {
            "ioc_value": "h1.f2rcegro0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-06 00:07:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668426": [
        {
            "ioc_value": "cwtw5.f2rcegro0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 23:57:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668425": [
        {
            "ioc_value": "guard.getr18ht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 23:47:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668422": [
        {
            "ioc_value": "vimsltd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-12-05 23:42:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668421": [
        {
            "ioc_value": "8s.getr18ht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 23:37:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668420": [
        {
            "ioc_value": "at0.getr18ht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 23:28:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668419": [
        {
            "ioc_value": "relativeplanning.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 23:27:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668416": [
        {
            "ioc_value": "0icfl.getr18ht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 23:17:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668414": [
        {
            "ioc_value": "0m95l.st2rudmu7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 23:07:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668380": [
        {
            "ioc_value": "wave.st2rudmu7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 22:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668376": [
        {
            "ioc_value": "ocean.st2rudmu7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 22:47:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668374": [
        {
            "ioc_value": "bookcaptchaextranet.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 22:40:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668372": [
        {
            "ioc_value": "bridge.st2rudmu7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 22:37:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668369": [
        {
            "ioc_value": "6cm1.re1iabteady.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 22:27:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668368": [
        {
            "ioc_value": "zmj0.re1iabteady.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 22:17:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668367": [
        {
            "ioc_value": "flame.re1iabteady.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 22:08:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668366": [
        {
            "ioc_value": "9wf.re1iabteady.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 21:58:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668365": [
        {
            "ioc_value": "clear.buddco1lect0r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 21:46:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668364": [
        {
            "ioc_value": "dark.buddco1lect0r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 21:38:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668363": [
        {
            "ioc_value": "e37.buddco1lect0r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 21:28:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668362": [
        {
            "ioc_value": "stone.buddco1lect0r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 21:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668359": [
        {
            "ioc_value": "pb4.ei8htyern1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 21:07:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668355": [
        {
            "ioc_value": "wild.ei8htyern1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 20:57:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668354": [
        {
            "ioc_value": "8r3y.ei8htyern1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 20:47:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668350": [
        {
            "ioc_value": "frost.ei8htyern1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 20:37:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668347": [
        {
            "ioc_value": "bright.agr0chem1nter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 20:28:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668346": [
        {
            "ioc_value": "alpha.agr0chem1nter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 20:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668345": [
        {
            "ioc_value": "spark.agr0chem1nter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 20:08:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668208": [
        {
            "ioc_value": "tur.agr0chem1nter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 19:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668207": [
        {
            "ioc_value": "light.bi2sedm0uth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 19:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668204": [
        {
            "ioc_value": "tg.bi2sedm0uth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 19:37:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668203": [
        {
            "ioc_value": "ry.bi2sedm0uth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 19:28:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668202": [
        {
            "ioc_value": "hill.bi2sedm0uth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 19:17:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668200": [
        {
            "ioc_value": "www-youtube-com-watchvideo.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 19:15:14",
            "last_seen_utc": "2025-12-07 14:10:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,youtube.com",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668196": [
        {
            "ioc_value": "account-bookscaptcha.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 19:09:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668191": [
        {
            "ioc_value": "account-bookpulse.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 19:07:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668190": [
        {
            "ioc_value": "xt5t8.oceanflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 19:07:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668188": [
        {
            "ioc_value": "bookcaptchasync.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 19:06:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668186": [
        {
            "ioc_value": "account-bookupdate.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 19:05:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668184": [
        {
            "ioc_value": "munichmotorsport.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 19:00:51",
            "last_seen_utc": "2025-12-08 19:00:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668182": [
        {
            "ioc_value": "2m42p.oceanflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668181": [
        {
            "ioc_value": "clinicasdorim.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668176": [
        {
            "ioc_value": "translacat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:54:40",
            "last_seen_utc": "2025-12-12 18:01:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668175": [
        {
            "ioc_value": "nsgrafica.ao",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:52:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668170": [
        {
            "ioc_value": "lowcountrygrapevines.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:49:31",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668167": [
        {
            "ioc_value": "grqd.oceanflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 18:48:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668164": [
        {
            "ioc_value": "sentidoseguros.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668161": [
        {
            "ioc_value": "d10.oceanflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 18:37:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668149": [
        {
            "ioc_value": "lcontrols7.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:32:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668151": [
        {
            "ioc_value": "lcontrols6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:32:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668153": [
        {
            "ioc_value": "lcontrols5.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:32:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668155": [
        {
            "ioc_value": "lcontrols4.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:32:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668157": [
        {
            "ioc_value": "lcontrols3.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:32:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668159": [
        {
            "ioc_value": "lcontrols2.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:32:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668160": [
        {
            "ioc_value": "r1.st0rmwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 18:27:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668145": [
        {
            "ioc_value": "lcontrols9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668147": [
        {
            "ioc_value": "lcontrols8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668142": [
        {
            "ioc_value": "lcontrol-1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668144": [
        {
            "ioc_value": "2ro.st0rmwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 18:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668134": [
        {
            "ioc_value": "lcontrols9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:15:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668133": [
        {
            "ioc_value": "lcontrols10.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:15:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668135": [
        {
            "ioc_value": "lcontrols8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:15:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668136": [
        {
            "ioc_value": "lcontrols7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:15:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668138": [
        {
            "ioc_value": "lcontrols6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:15:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668139": [
        {
            "ioc_value": "lcontrols5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:15:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668140": [
        {
            "ioc_value": "lcontrols4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:15:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668137": [
        {
            "ioc_value": "linhxasro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-05 18:10:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1668102": [
        {
            "ioc_value": "sessionsverificatise.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:03:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668104": [
        {
            "ioc_value": "sessionsverificatse.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 18:03:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1668119": [
        {
            "ioc_value": "hppro1.hpnu.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-05 18:02:20",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-qzfrcs1ph1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668114": [
        {
            "ioc_value": "mike-dozens.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-05 18:01:32",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-rwhl8asjcm",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668112": [
        {
            "ioc_value": "wrufkhnwc.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-05 18:01:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-vra85adp21",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668113": [
        {
            "ioc_value": "privatedns.b3tter.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-05 18:01:31",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-rvffgabq2x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668111": [
        {
            "ioc_value": "100testtt.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-05 18:01:30",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-v2jy1stjen",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668106": [
        {
            "ioc_value": "eg1.st0rmwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 17:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668099": [
        {
            "ioc_value": "reduction-atlas-services-mechanisms.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 17:49:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/b757381f750d0069f663a29fe61a57aa922795248a54488982dca12d7421f54a/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1668098": [
        {
            "ioc_value": "ua7.st0rmwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 17:47:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668097": [
        {
            "ioc_value": "33wk.silentm1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 17:38:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668093": [
        {
            "ioc_value": "69.silentm1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 17:28:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668091": [
        {
            "ioc_value": "vt.silentm1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 17:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668090": [
        {
            "ioc_value": "39.silentm1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 17:07:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668089": [
        {
            "ioc_value": "dxtt.firecrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 16:57:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668088": [
        {
            "ioc_value": "wju.firecrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 16:47:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668087": [
        {
            "ioc_value": "rzv.firecrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 16:38:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668086": [
        {
            "ioc_value": "forest.firecrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 16:28:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668085": [
        {
            "ioc_value": "h3.darkh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 16:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668083": [
        {
            "ioc_value": "iqurf.darkh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 16:07:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668080": [
        {
            "ioc_value": "dods.fern-estates.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 16:02:52",
            "last_seen_utc": "2025-12-05 23:02:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.217.209.155+dods.fern-estates.com",
            "tags": "AS215826,censys,EvilGinx,panel,PARTNER-HOSTING-LTD,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668077": [
        {
            "ioc_value": "sso.fern-estates.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 16:02:51",
            "last_seen_utc": "2025-12-05 23:02:04",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.217.209.155+sso.fern-estates.com",
            "tags": "AS215826,censys,EvilGinx,panel,PARTNER-HOSTING-LTD,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668078": [
        {
            "ioc_value": "pas.fern-estates.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 16:02:51",
            "last_seen_utc": "2025-12-05 23:02:04",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.217.209.155+pas.fern-estates.com",
            "tags": "AS215826,censys,EvilGinx,panel,PARTNER-HOSTING-LTD,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668079": [
        {
            "ioc_value": "outk.fern-estates.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 16:02:51",
            "last_seen_utc": "2025-12-05 23:02:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.217.209.155+outk.fern-estates.com",
            "tags": "AS215826,censys,EvilGinx,panel,PARTNER-HOSTING-LTD,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668074": [
        {
            "ioc_value": "sci.fern-estates.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 16:02:50",
            "last_seen_utc": "2025-12-05 23:02:00",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.217.209.155+sci.fern-estates.com",
            "tags": "AS215826,censys,EvilGinx,panel,PARTNER-HOSTING-LTD,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668075": [
        {
            "ioc_value": "graph.fern-estates.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 16:02:50",
            "last_seen_utc": "2025-12-05 23:02:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.217.209.155+graph.fern-estates.com",
            "tags": "AS215826,censys,EvilGinx,panel,PARTNER-HOSTING-LTD,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668076": [
        {
            "ioc_value": "o.fern-estates.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 16:02:50",
            "last_seen_utc": "2025-12-05 23:02:01",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.217.209.155+o.fern-estates.com",
            "tags": "AS215826,censys,EvilGinx,panel,PARTNER-HOSTING-LTD,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668072": [
        {
            "ioc_value": "conquestcourier.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-05 16:02:35",
            "last_seen_utc": "2025-12-05 23:01:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+conquestcourier.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668073": [
        {
            "ioc_value": "buzzglobal.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-05 16:02:35",
            "last_seen_utc": "2025-12-05 23:01:40",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+buzzglobal.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668071": [
        {
            "ioc_value": "qualitia.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-05 16:02:34",
            "last_seen_utc": "2025-12-05 23:01:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+qualitia.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668064": [
        {
            "ioc_value": "xd.darkh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 15:58:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668063": [
        {
            "ioc_value": "nova.darkh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 15:47:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668062": [
        {
            "ioc_value": "fd.windbr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 15:38:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668061": [
        {
            "ioc_value": "wave.windbr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 15:28:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668060": [
        {
            "ioc_value": "svqwb.windbr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 15:17:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668059": [
        {
            "ioc_value": "yt6sz.windbr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 15:07:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668056": [
        {
            "ioc_value": "dc.nightc0de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 14:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668053": [
        {
            "ioc_value": "z38u.nightc0de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 14:48:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668052": [
        {
            "ioc_value": "hz7en.nightc0de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 14:38:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668051": [
        {
            "ioc_value": "ib.nightc0de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 14:27:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668050": [
        {
            "ioc_value": "0vp7.softw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 14:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668048": [
        {
            "ioc_value": "vla6j.softw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 14:08:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668047": [
        {
            "ioc_value": "cp.softw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 13:58:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668045": [
        {
            "ioc_value": "326.softw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 13:48:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668044": [
        {
            "ioc_value": "gsj.m1ntbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 13:30:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668043": [
        {
            "ioc_value": "m3.m1ntbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 13:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668042": [
        {
            "ioc_value": "hill.m1ntbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 13:08:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668041": [
        {
            "ioc_value": "frost.m1ntbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 12:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668039": [
        {
            "ioc_value": "storm.shadowstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 12:48:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668038": [
        {
            "ioc_value": "0up.shadowstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 12:37:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668037": [
        {
            "ioc_value": "sbh.shadowstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 12:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668035": [
        {
            "ioc_value": "flare.shadowstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 12:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668034": [
        {
            "ioc_value": "sky.r1verstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 12:07:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668032": [
        {
            "ioc_value": "LeDivineEnfant-60344.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-05 12:02:46",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-lerkxaypgm",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668029": [
        {
            "ioc_value": "medloqservices.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-05 12:01:33",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-lnvc6afq2y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1668027": [
        {
            "ioc_value": "e2cw.r1verstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 11:57:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668026": [
        {
            "ioc_value": "td.r1verstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 11:48:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668025": [
        {
            "ioc_value": "ps31j.r1verstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 11:38:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668024": [
        {
            "ioc_value": "r8uw.cl0udwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 11:28:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668023": [
        {
            "ioc_value": "zkc.cl0udwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 11:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668021": [
        {
            "ioc_value": "vk.automanpk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-05 11:10:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1668022": [
        {
            "ioc_value": "vk.btreena.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-05 11:10:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1668018": [
        {
            "ioc_value": "ar0r8.cl0udwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 11:08:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668004": [
        {
            "ioc_value": "lk.cl0udwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 10:57:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668002": [
        {
            "ioc_value": "hcinz.darkc0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 10:47:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668001": [
        {
            "ioc_value": "beta.darkc0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 10:38:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1668000": [
        {
            "ioc_value": "nmj.darkc0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 10:28:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667995": [
        {
            "ioc_value": "hobmjoi.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-05 10:18:17",
            "last_seen_utc": "2025-12-12 12:53:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667994": [
        {
            "ioc_value": "56p3d.darkc0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 10:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667992": [
        {
            "ioc_value": "elastolutdoc.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-05 10:17:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667993": [
        {
            "ioc_value": "eltesoro000.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-05 10:17:53",
            "last_seen_utc": "2025-12-12 18:39:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667987": [
        {
            "ioc_value": "50625.client.sudorat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.orcus_rat",
            "malware_alias": "Schnorchel",
            "malware_printable": "Orcus RAT",
            "first_seen_utc": "2025-12-05 10:16:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,orcus",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667988": [
        {
            "ioc_value": "50625.client.sudorat.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.orcus_rat",
            "malware_alias": "Schnorchel",
            "malware_printable": "Orcus RAT",
            "first_seen_utc": "2025-12-05 10:16:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,orcus",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667986": [
        {
            "ioc_value": "draft22.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-05 10:16:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667985": [
        {
            "ioc_value": "telechea123.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-05 10:16:19",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667982": [
        {
            "ioc_value": "brownandgraymusic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-05 10:16:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667983": [
        {
            "ioc_value": "gatex.brownandgraymusic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-05 10:16:07",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667984": [
        {
            "ioc_value": "myfile.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-05 10:16:07",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667979": [
        {
            "ioc_value": "omega.crystalwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 10:07:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667977": [
        {
            "ioc_value": "7h7gd.crystalwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667976": [
        {
            "ioc_value": "tv.crystalwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 09:47:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667975": [
        {
            "ioc_value": "m0tad.crystalwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 09:37:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667973": [
        {
            "ioc_value": "b9j.wildrange.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 09:28:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667972": [
        {
            "ioc_value": "stone.wildrange.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 09:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667971": [
        {
            "ioc_value": "6p.wildrange.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 09:08:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667968": [
        {
            "ioc_value": "hdzr.wildrange.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 08:57:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667965": [
        {
            "ioc_value": "bn.automanpk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-05 08:48:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1667966": [
        {
            "ioc_value": "bn.btreena.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-05 08:48:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1667963": [
        {
            "ioc_value": "djv.deepc1iff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 08:47:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667957": [
        {
            "ioc_value": "shadow.deepc1iff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 08:38:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667938": [
        {
            "ioc_value": "nimeshpatel.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-05 08:33:34",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/d800d605bcbc80838b4854262555e2133e4a60e2ad170708adcdd5faf2fd44dd",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1667939": [
        {
            "ioc_value": "malware.nimeshpatel.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-05 08:33:34",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/d800d605bcbc80838b4854262555e2133e4a60e2ad170708adcdd5faf2fd44dd",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1667956": [
        {
            "ioc_value": "mint.deepc1iff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 08:27:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667955": [
        {
            "ioc_value": "kla.deepc1iff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 08:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667953": [
        {
            "ioc_value": "6mfff.cloudm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 08:07:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667936": [
        {
            "ioc_value": "silent.cloudm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 07:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667935": [
        {
            "ioc_value": "c1m.cloudm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 07:48:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667934": [
        {
            "ioc_value": "gatw7.cloudm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 07:38:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667933": [
        {
            "ioc_value": "womp.datasurge.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-05 07:31:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/112481469fb1a0e94a8f0a34ff70b76e874540f3913db2a1d6b9b6c3899367e0/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667931": [
        {
            "ioc_value": "w2z.f1rebyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 07:28:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667930": [
        {
            "ioc_value": "range.f1rebyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 07:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667929": [
        {
            "ioc_value": "mm.f1rebyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 07:08:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667862": [
        {
            "ioc_value": "kbbet777.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-05 07:06:23",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/3d7b81ec0219244c31855e8e592a1e6a682c20c0215a964d7274d30458cc5602/relations",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1667869": [
        {
            "ioc_value": "secretcryptos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-05 07:04:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6a1c9f0f30abded1a5ee6b53f0551a7cf7599adf34f1cb6f0d5d62dc5d81a8dc/",
            "tags": null,
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1667863": [
        {
            "ioc_value": "malware.kbbet777.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-05 07:04:00",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/3d7b81ec0219244c31855e8e592a1e6a682c20c0215a964d7274d30458cc5602/relations",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1667864": [
        {
            "ioc_value": "phishing.kbbet777.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-05 07:04:00",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/3d7b81ec0219244c31855e8e592a1e6a682c20c0215a964d7274d30458cc5602/relations",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Aumeg"
        }
    ],
    "1667878": [
        {
            "ioc_value": "request.affiliatesalesagent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-12-05 07:03:59",
            "last_seen_utc": "2025-12-07 10:23:12",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115664759727743304",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1667928": [
        {
            "ioc_value": "crystal.f1rebyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 06:57:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667921": [
        {
            "ioc_value": "night.st0neforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 06:47:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667920": [
        {
            "ioc_value": "delta.st0neforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 06:37:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667919": [
        {
            "ioc_value": "738n.st0neforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 06:28:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667918": [
        {
            "ioc_value": "gamma.st0neforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667917": [
        {
            "ioc_value": "wild.rainb1te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 06:07:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667916": [
        {
            "ioc_value": "clients.enigmasolutions.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-12-05 06:06:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-f9a9hstlb1",
            "tags": "C2,domain,netwire,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667915": [
        {
            "ioc_value": "monbondns.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-12-05 06:06:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251205-fnfxwaspez",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667910": [
        {
            "ioc_value": "bridge.rainb1te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 05:56:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667909": [
        {
            "ioc_value": "river.rainb1te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 05:48:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667908": [
        {
            "ioc_value": "7zos4.rainb1te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 05:38:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667907": [
        {
            "ioc_value": "huh7f.m1stysun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 05:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667906": [
        {
            "ioc_value": "idsb.m1stysun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 05:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667905": [
        {
            "ioc_value": "yoeo7.m1stysun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 05:08:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667902": [
        {
            "ioc_value": "bright.m1stysun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 04:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667901": [
        {
            "ioc_value": "cloud.softcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 04:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667900": [
        {
            "ioc_value": "1u.softcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 04:38:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667899": [
        {
            "ioc_value": "sun.softcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 04:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667898": [
        {
            "ioc_value": "flame.softcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 04:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667895": [
        {
            "ioc_value": "drv.n1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 04:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667883": [
        {
            "ioc_value": "soft.n1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 03:57:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667882": [
        {
            "ioc_value": "ocean.n1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 03:47:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667881": [
        {
            "ioc_value": "4zt.n1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 03:37:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667880": [
        {
            "ioc_value": "wind.silverh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 03:27:36",
            "last_seen_utc": "2025-12-05 03:29:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667879": [
        {
            "ioc_value": "fqz.silverh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 03:17:19",
            "last_seen_utc": "2025-12-05 03:18:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667877": [
        {
            "ioc_value": "8q1qk.silverh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 03:08:07",
            "last_seen_utc": "2025-12-05 03:10:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667876": [
        {
            "ioc_value": "cloud.silverh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 02:58:17",
            "last_seen_utc": "2025-12-05 02:59:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667874": [
        {
            "ioc_value": "www.vxucqb.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-05 02:48:19",
            "last_seen_utc": "2025-12-14 11:48:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667873": [
        {
            "ioc_value": "leaf.s0ftbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 02:47:57",
            "last_seen_utc": "2025-12-05 02:49:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667871": [
        {
            "ioc_value": "spark.s0ftbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 02:37:40",
            "last_seen_utc": "2025-12-05 02:38:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667870": [
        {
            "ioc_value": "4vc.s0ftbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 02:27:55",
            "last_seen_utc": "2025-12-05 02:29:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667868": [
        {
            "ioc_value": "g5wyk.s0ftbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 02:17:36",
            "last_seen_utc": "2025-12-05 02:19:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667867": [
        {
            "ioc_value": "trail.softr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 02:07:09",
            "last_seen_utc": "2025-12-05 02:08:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1667866": [
        {
            "ioc_value": "light.softr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 01:57:24",
            "last_seen_utc": "2025-12-05 01:58:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667865": [
        {
            "ioc_value": "house.softr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 01:47:12",
            "last_seen_utc": "2025-12-05 01:48:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667861": [
        {
            "ioc_value": "ss7e.softr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 01:37:41",
            "last_seen_utc": "2025-12-05 01:37:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1667860": [
        {
            "ioc_value": "crest.riverl1ght.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 01:27:58",
            "last_seen_utc": "2025-12-05 01:29:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667859": [
        {
            "ioc_value": "b0.riverl1ght.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 01:18:16",
            "last_seen_utc": "2025-12-05 01:20:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667858": [
        {
            "ioc_value": "ox.riverl1ght.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 01:07:51",
            "last_seen_utc": "2025-12-05 01:10:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667857": [
        {
            "ioc_value": "mist.riverl1ght.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 00:57:36",
            "last_seen_utc": "2025-12-05 00:59:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667856": [
        {
            "ioc_value": "i2.windshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 00:47:47",
            "last_seen_utc": "2025-12-05 00:49:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667855": [
        {
            "ioc_value": "frost.windshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 00:37:29",
            "last_seen_utc": "2025-12-05 00:39:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667854": [
        {
            "ioc_value": "ma.windshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 00:27:26",
            "last_seen_utc": "2025-12-05 00:28:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667851": [
        {
            "ioc_value": "x5ust.windshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 00:17:27",
            "last_seen_utc": "2025-12-05 00:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667850": [
        {
            "ioc_value": "nova.brightf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-05 00:07:08",
            "last_seen_utc": "2025-12-05 00:08:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667843": [
        {
            "ioc_value": "2lkz.brightf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 23:57:50",
            "last_seen_utc": "2025-12-04 23:58:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667842": [
        {
            "ioc_value": "dawn.brightf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 23:48:01",
            "last_seen_utc": "2025-12-04 23:49:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667839": [
        {
            "ioc_value": "bxq.brightf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 23:37:45",
            "last_seen_utc": "2025-12-04 23:39:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667838": [
        {
            "ioc_value": "bd.brightl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 23:27:57",
            "last_seen_utc": "2025-12-04 23:29:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667837": [
        {
            "ioc_value": "bloom.brightl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 23:17:39",
            "last_seen_utc": "2025-12-04 23:19:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667836": [
        {
            "ioc_value": "gxjo.brightl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 23:07:18",
            "last_seen_utc": "2025-12-04 23:08:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667805": [
        {
            "ioc_value": "cliff.brightl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 22:57:38",
            "last_seen_utc": "2025-12-04 22:58:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667804": [
        {
            "ioc_value": "shift.stoneh0use.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 22:48:16",
            "last_seen_utc": "2025-12-04 22:48:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1667803": [
        {
            "ioc_value": "shadow.stoneh0use.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 22:37:51",
            "last_seen_utc": "2025-12-04 22:39:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667801": [
        {
            "ioc_value": "v0k6.stoneh0use.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 22:28:03",
            "last_seen_utc": "2025-12-04 22:29:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667799": [
        {
            "ioc_value": "hmo.stoneh0use.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 22:17:47",
            "last_seen_utc": "2025-12-04 22:19:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667798": [
        {
            "ioc_value": "28.darkb1rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 22:07:59",
            "last_seen_utc": "2025-12-04 22:09:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667797": [
        {
            "ioc_value": "caiip.darkb1rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 21:57:41",
            "last_seen_utc": "2025-12-04 21:59:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667796": [
        {
            "ioc_value": "lake.darkb1rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 21:47:23",
            "last_seen_utc": "2025-12-04 21:47:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667795": [
        {
            "ioc_value": "forest.darkb1rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 21:38:00",
            "last_seen_utc": "2025-12-04 21:39:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667794": [
        {
            "ioc_value": "sunrise.deep0asis.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 21:28:15",
            "last_seen_utc": "2025-12-04 21:29:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667793": [
        {
            "ioc_value": "4mjo.deep0asis.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 21:16:54",
            "last_seen_utc": "2025-12-04 21:19:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667790": [
        {
            "ioc_value": "fev5.deep0asis.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 21:08:10",
            "last_seen_utc": "2025-12-04 21:09:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667788": [
        {
            "ioc_value": "field.deep0asis.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 20:57:56",
            "last_seen_utc": "2025-12-04 20:59:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667786": [
        {
            "ioc_value": "jjjgaasda.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 20:57:39",
            "last_seen_utc": "2025-12-14 07:39:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c6a83d4a310f3dbeaef1f73bfcbfc96d37856f2dbd32bbd1aa994ff7af15113c/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667785": [
        {
            "ioc_value": "7p1e0901tm70n.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-04 20:48:34",
            "last_seen_utc": "2025-12-14 11:48:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667784": [
        {
            "ioc_value": "alpha.ironbl0om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 20:48:06",
            "last_seen_utc": "2025-12-04 20:48:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667781": [
        {
            "ioc_value": "asmweosiqsaaw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 20:38:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0b1ecb1d5505123ee64955f4cca064997b0139a31a8bf199097c7ab3d61d6a91/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667780": [
        {
            "ioc_value": "silent.ironbl0om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 20:37:48",
            "last_seen_utc": "2025-12-04 20:39:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667779": [
        {
            "ioc_value": "apdlive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-04 20:36:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667778": [
        {
            "ioc_value": "quick.ironbl0om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 20:27:54",
            "last_seen_utc": "2025-12-04 20:28:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667748": [
        {
            "ioc_value": "nimbsjoa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-04 20:23:14",
            "last_seen_utc": "2025-12-04 19:00:57",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115662837065188050",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1667753": [
        {
            "ioc_value": "deregulatedenergy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-04 20:23:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115662837065188050",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1667777": [
        {
            "ioc_value": "tmy.ironbl0om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 20:17:36",
            "last_seen_utc": "2025-12-04 20:19:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667775": [
        {
            "ioc_value": "vk8w.st0neleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 20:07:51",
            "last_seen_utc": "2025-12-04 20:08:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667762": [
        {
            "ioc_value": "r4.st0neleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 19:57:02",
            "last_seen_utc": "2025-12-04 19:58:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667761": [
        {
            "ioc_value": "fk3v.st0neleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 19:47:39",
            "last_seen_utc": "2025-12-04 19:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1667758": [
        {
            "ioc_value": "c1uo.st0neleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 19:37:57",
            "last_seen_utc": "2025-12-04 19:39:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667757": [
        {
            "ioc_value": "nv47.dreamc0ast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 19:28:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667756": [
        {
            "ioc_value": "nc.dreamc0ast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 19:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667755": [
        {
            "ioc_value": "crystal.dreamc0ast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 19:07:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667746": [
        {
            "ioc_value": "delta.dreamc0ast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 18:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667743": [
        {
            "ioc_value": "ix9.cl0udramble.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 18:48:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667733": [
        {
            "ioc_value": "beta.cl0udramble.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 18:37:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667732": [
        {
            "ioc_value": "lyk4e.cl0udramble.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 18:27:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667731": [
        {
            "ioc_value": "ojlj.cl0udramble.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 18:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667730": [
        {
            "ioc_value": "auhf.sunsettrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 18:08:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667729": [
        {
            "ioc_value": "Xlnpe-21642.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-12-04 18:04:04",
            "last_seen_utc": "2025-12-04 19:43:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251204-pa3zxsgm81",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667728": [
        {
            "ioc_value": "major-barrier.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-04 18:03:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251204-rl7hlatpck",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667726": [
        {
            "ioc_value": "making-council.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-04 18:02:21",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251204-ph5tgswjet",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667725": [
        {
            "ioc_value": "blessdx6m50isep.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-04 18:01:35",
            "last_seen_utc": "2025-12-12 18:39:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/251204-q6n2batmck",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667723": [
        {
            "ioc_value": "hackersda-46118.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-04 18:01:23",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251204-sdadkaymft",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667721": [
        {
            "ioc_value": "gamma.sunsettrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 17:58:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667720": [
        {
            "ioc_value": "dg.sunsettrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 17:49:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667719": [
        {
            "ioc_value": "g41i6.sunsettrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 17:39:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667718": [
        {
            "ioc_value": "s8.crystalriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 17:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667717": [
        {
            "ioc_value": "8czk.crystalriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 17:17:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667716": [
        {
            "ioc_value": "river.crystalriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 17:07:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667715": [
        {
            "ioc_value": "dark.crystalriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 16:57:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667714": [
        {
            "ioc_value": "7e.c0ldstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 16:47:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667713": [
        {
            "ioc_value": "myst.c0ldstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 16:37:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667712": [
        {
            "ioc_value": "xhmns.c0ldstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 16:28:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667711": [
        {
            "ioc_value": "qgvn.c0ldstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 16:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667710": [
        {
            "ioc_value": "ember.nightblossom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 16:07:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667701": [
        {
            "ioc_value": "bright.nightblossom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 15:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667700": [
        {
            "ioc_value": "sunny.nightblossom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 15:47:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667699": [
        {
            "ioc_value": "6hat8.nightblossom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 15:37:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667698": [
        {
            "ioc_value": "e4hf.stormpiece.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 15:28:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667697": [
        {
            "ioc_value": "dream.stormpiece.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 15:17:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667696": [
        {
            "ioc_value": "booksbypatriciaschultz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 15:14:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1667695": [
        {
            "ioc_value": "fsdtiototoitweot.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 15:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1667668": [
        {
            "ioc_value": "mahleinc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-12-04 15:09:03",
            "last_seen_utc": "2025-12-04 14:08:43",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115661689031905300",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1667672": [
        {
            "ioc_value": "gqdbvlxq.suprifitas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 15:09:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/464b97fc61b3df70c20552e03373f8b8b460e2028731114a1a1245c48e59a31b/",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1667689": [
        {
            "ioc_value": "valley.stormpiece.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 15:07:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667688": [
        {
            "ioc_value": "flame.stormpiece.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 14:58:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667686": [
        {
            "ioc_value": "stone.l1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 14:48:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667684": [
        {
            "ioc_value": "og.l1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 14:37:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667678": [
        {
            "ioc_value": "lzsj.l1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 14:27:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667675": [
        {
            "ioc_value": "d4d.automanpk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-04 14:25:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1667676": [
        {
            "ioc_value": "d4d.aqarhoosh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-04 14:25:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1667671": [
        {
            "ioc_value": "gate.l1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 14:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667666": [
        {
            "ioc_value": "omega.shadowsprint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 14:08:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667664": [
        {
            "ioc_value": "gold.shadowsprint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 13:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667663": [
        {
            "ioc_value": "gui.shadowsprint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 13:47:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667662": [
        {
            "ioc_value": "bk.shadowsprint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 13:38:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667661": [
        {
            "ioc_value": "5g95w.brightpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 13:27:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667659": [
        {
            "ioc_value": "stream.brightpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 13:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667658": [
        {
            "ioc_value": "x78.brightpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 13:08:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667655": [
        {
            "ioc_value": "googlecret.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-04 12:58:38",
            "last_seen_utc": "2025-12-14 11:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667654": [
        {
            "ioc_value": "2v2.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-04 12:57:59",
            "last_seen_utc": "2025-12-04 19:48:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667653": [
        {
            "ioc_value": "09.brightpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 12:57:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667652": [
        {
            "ioc_value": "23ra.b2yh7ean.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 12:47:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667651": [
        {
            "ioc_value": "q7.b2yh7ean.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 12:37:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667650": [
        {
            "ioc_value": "xvv.b2yh7ean.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 12:28:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667649": [
        {
            "ioc_value": "twu.b2yh7ean.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 12:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667648": [
        {
            "ioc_value": "5b7q.d1sputl2b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 12:08:42",
            "last_seen_utc": "2025-12-04 12:08:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667642": [
        {
            "ioc_value": "s9o.d1sputl2b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 11:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667641": [
        {
            "ioc_value": "64m.d1sputl2b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 11:47:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667640": [
        {
            "ioc_value": "profyfk.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-04 11:43:36",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667633": [
        {
            "ioc_value": "mb3.d1sputl2b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 11:37:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667632": [
        {
            "ioc_value": "prqkv.ma5kd7unk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 11:27:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667630": [
        {
            "ioc_value": "a83.ma5kd7unk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 11:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667628": [
        {
            "ioc_value": "zpj.ma5kd7unk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 11:08:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667601": [
        {
            "ioc_value": "zp3.ma5kd7unk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 10:58:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667600": [
        {
            "ioc_value": "vfzkj.f1owreci7at.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 10:47:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667599": [
        {
            "ioc_value": "cloud.f1owreci7at.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 10:38:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667598": [
        {
            "ioc_value": "q4g.f1owreci7at.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 10:27:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667597": [
        {
            "ioc_value": "dp.f1owreci7at.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 10:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667596": [
        {
            "ioc_value": "work.c0mpen5ducky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 10:07:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667587": [
        {
            "ioc_value": "5g.c0mpen5ducky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 09:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667586": [
        {
            "ioc_value": "9bg.c0mpen5ducky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 09:48:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667585": [
        {
            "ioc_value": "qc6.c0mpen5ducky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 09:37:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667584": [
        {
            "ioc_value": "gold.cr2ckka7bas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 09:27:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667583": [
        {
            "ioc_value": "sgxv.cr2ckka7bas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 09:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667582": [
        {
            "ioc_value": "qu.cr2ckka7bas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 09:07:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667579": [
        {
            "ioc_value": "cb.cr2ckka7bas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 08:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667556": [
        {
            "ioc_value": "test.my-video-live.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1667565": [
        {
            "ioc_value": "mail.geo-home.rw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 08:56:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1667568": [
        {
            "ioc_value": "meet.giooga.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 08:56:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1667570": [
        {
            "ioc_value": "update.giooga.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 08:56:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1667573": [
        {
            "ioc_value": "sh.get5tu6ents.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 08:47:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667571": [
        {
            "ioc_value": "l2l64.get5tu6ents.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 08:37:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667558": [
        {
            "ioc_value": "xrt.automanpk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-04 08:21:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1667559": [
        {
            "ioc_value": "xrt.abalawi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-04 08:21:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1667548": [
        {
            "ioc_value": "cwkx.get5tu6ents.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 08:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667530": [
        {
            "ioc_value": "z5g4.get5tu6ents.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 08:08:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667505": [
        {
            "ioc_value": "ihatemylife.racist.black",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-04 07:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/426d84fd6dea5e277999691fd2c0e0b3f65747ffe309d2437ed8983bc3c2da92/",
            "tags": "Hailbot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667504": [
        {
            "ioc_value": "jtg7.lano5cho0l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 07:57:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667503": [
        {
            "ioc_value": "ilovephysics.48101.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-04 07:56:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/97cd8fe6659fd021a9649cca3bad2c7512fdd3b0b0907c93f097222980771361/",
            "tags": "Hailbot,Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667501": [
        {
            "ioc_value": "8ny.lano5cho0l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 07:47:56",
            "last_seen_utc": "2025-12-04 07:57:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667500": [
        {
            "ioc_value": "unitedpowerrangers2025.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-04 07:40:22",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/adb9b24067cca8b16838ec25ccc1eb81b289820243e3cd5edde4788633c18746/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667498": [
        {
            "ioc_value": "97.lano5cho0l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 07:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667496": [
        {
            "ioc_value": "3ut0.lano5cho0l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 07:27:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667495": [
        {
            "ioc_value": "flmw6.d7um0wl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 07:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667494": [
        {
            "ioc_value": "bold.d7um0wl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 07:08:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667493": [
        {
            "ioc_value": "l6e.d7um0wl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 06:57:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667491": [
        {
            "ioc_value": "20250703.cmgsx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-04 06:50:09",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1667490": [
        {
            "ioc_value": "zd0m.d7um0wl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 06:47:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667489": [
        {
            "ioc_value": "0bot.qzz.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-04 06:45:50",
            "last_seen_utc": "2025-12-04 06:50:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/9f64ea43d9ba0bed705b94251dfbcdc596fc594df8c0d94c512e4573c55b30e5/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667486": [
        {
            "ioc_value": "ok.intr0dki5h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 06:36:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667485": [
        {
            "ioc_value": "cryptoenjoyers.anondns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-04 06:36:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/21ac5563cde511f024577ec38b888745db32793e8b7f54228d2c3cce67d0502c/",
            "tags": "CoinMiner",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667484": [
        {
            "ioc_value": "b3ry.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-04 06:34:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/14fb9997a02cd65be6dd6422c5109b6bafa0fb306135c2b799500360fd936d54/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667482": [
        {
            "ioc_value": "tyq.intr0dki5h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 06:28:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667481": [
        {
            "ioc_value": "m3i.intr0dki5h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667153": [
        {
            "ioc_value": "safepal.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-04 06:09:47",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 75,
            "reference": "https://www.filescan.io/uploads/693099d7856673a0547e11bc/reports/e45857cf-8057-48f1-b4f4-1f9cddcab5df/overview",
            "tags": "c2,Quasar,quasarrat,RAT",
            "anonymous": "1",
            "reporter": "drizenc"
        }
    ],
    "1667183": [
        {
            "ioc_value": "email.whyyoushouldwalk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-12-04 06:09:45",
            "last_seen_utc": "2025-12-07 10:23:12",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115658381128024161",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1667427": [
        {
            "ioc_value": "tuc.co.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-04 06:09:43",
            "last_seen_utc": "2025-12-12 18:39:10",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/1a21e2a177f3a22bf947624c6f7c7f51a674a7e8acfa355b996ba3ae81a0e0a8",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1667477": [
        {
            "ioc_value": "night.intr0dki5h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 06:07:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667475": [
        {
            "ioc_value": "susanamadre.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-04 06:01:54",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/251204-aw74faas9e",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667474": [
        {
            "ioc_value": "ssxzxz.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-04 06:01:26",
            "last_seen_utc": "2025-12-12 18:39:52",
            "confidence_level": 100,
            "reference": "https://tria.ge/251204-dyzrmacn7y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667472": [
        {
            "ioc_value": "rkrse.be5isg2uze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 05:57:38",
            "last_seen_utc": "2025-12-04 06:02:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667471": [
        {
            "ioc_value": "nq5.be5isg2uze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 05:47:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667470": [
        {
            "ioc_value": "trace.be5isg2uze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 05:37:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667469": [
        {
            "ioc_value": "xl978.be5isg2uze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 05:28:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667464": [
        {
            "ioc_value": "quick.inf0rmmou7n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 05:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667462": [
        {
            "ioc_value": "2oh5.inf0rmmou7n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 05:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667461": [
        {
            "ioc_value": "vhm7.inf0rmmou7n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 04:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667460": [
        {
            "ioc_value": "osn.inf0rmmou7n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 04:47:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667459": [
        {
            "ioc_value": "yo3.n2zemt0ler.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 04:37:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667458": [
        {
            "ioc_value": "xr.n2zemt0ler.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 04:27:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667457": [
        {
            "ioc_value": "mint.n2zemt0ler.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 04:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667456": [
        {
            "ioc_value": "6c5k.n2zemt0ler.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 04:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667450": [
        {
            "ioc_value": "aighk.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-04 04:02:58",
            "last_seen_utc": "2025-12-04 11:01:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.183.143+aighk.it.com",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667443": [
        {
            "ioc_value": "nk.d0nit7then.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 03:58:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667441": [
        {
            "ioc_value": "s1.auv.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-04 03:56:58",
            "last_seen_utc": "2025-12-14 11:48:16",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667442": [
        {
            "ioc_value": "s1.biodog.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-04 03:56:58",
            "last_seen_utc": "2025-12-14 11:48:16",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667440": [
        {
            "ioc_value": "ecve.d0nit7then.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 03:47:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667438": [
        {
            "ioc_value": "rwp.d0nit7then.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 03:37:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667437": [
        {
            "ioc_value": "spark.d0nit7then.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 03:27:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667436": [
        {
            "ioc_value": "hzqp.ar2kchd1ans.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 03:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667435": [
        {
            "ioc_value": "2vo6.ar2kchd1ans.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 03:07:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667433": [
        {
            "ioc_value": "h83d8.ar2kchd1ans.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 02:57:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667432": [
        {
            "ioc_value": "da.ar2kchd1ans.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 02:47:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667431": [
        {
            "ioc_value": "d6.gend2rlu1l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 02:38:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667430": [
        {
            "ioc_value": "7dm.gend2rlu1l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 02:27:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667429": [
        {
            "ioc_value": "ut2.gend2rlu1l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 02:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667428": [
        {
            "ioc_value": "sky.gend2rlu1l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 02:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667425": [
        {
            "ioc_value": "31.getp0ver7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 01:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667424": [
        {
            "ioc_value": "owl.getp0ver7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 01:48:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667423": [
        {
            "ioc_value": "wind.getp0ver7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 01:38:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667422": [
        {
            "ioc_value": "ex.getp0ver7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 01:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667421": [
        {
            "ioc_value": "5o.8oodt1me.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 01:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667420": [
        {
            "ioc_value": "l8iwt.8oodt1me.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 01:07:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667198": [
        {
            "ioc_value": "soft.8oodt1me.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 00:58:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667189": [
        {
            "ioc_value": "cloudy.8oodt1me.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 00:48:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667188": [
        {
            "ioc_value": "rrc.nevp0yob5tet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 00:38:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667187": [
        {
            "ioc_value": "qr4z.nevp0yob5tet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 00:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667186": [
        {
            "ioc_value": "wild.nevp0yob5tet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 00:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667184": [
        {
            "ioc_value": "gate.nevp0yob5tet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-04 00:07:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667175": [
        {
            "ioc_value": "fox.rub1er5ane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 23:57:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667174": [
        {
            "ioc_value": "stone.rub1er5ane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 23:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667173": [
        {
            "ioc_value": "group.rub1er5ane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 23:38:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667172": [
        {
            "ioc_value": "hip.rub1er5ane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 23:28:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667171": [
        {
            "ioc_value": "dw.ant1er5noos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 23:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667170": [
        {
            "ioc_value": "deep.ant1er5noos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 23:07:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667155": [
        {
            "ioc_value": "22754.ant1er5noos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 22:57:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667154": [
        {
            "ioc_value": "5k.ant1er5noos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 22:47:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667149": [
        {
            "ioc_value": "hollow.c0uperu8nia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 22:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667146": [
        {
            "ioc_value": "ridge.c0uperu8nia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 22:27:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667141": [
        {
            "ioc_value": "b3fas.c0uperu8nia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 22:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667140": [
        {
            "ioc_value": "3vc.c0uperu8nia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 22:08:15",
            "last_seen_utc": "2025-12-03 22:13:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667139": [
        {
            "ioc_value": "valley.r2dire5our.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 21:56:53",
            "last_seen_utc": "2025-12-03 22:07:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667138": [
        {
            "ioc_value": "light.r2dire5our.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 21:48:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667137": [
        {
            "ioc_value": "coast.r2dire5our.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 21:37:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667136": [
        {
            "ioc_value": "clear.r2dire5our.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 21:28:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667135": [
        {
            "ioc_value": "gamma.rainb0rne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 21:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667134": [
        {
            "ioc_value": "h4v.rainb0rne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 21:07:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667133": [
        {
            "ioc_value": "bdmqf.rainb0rne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 20:57:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667132": [
        {
            "ioc_value": "owl.rainb0rne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 20:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667131": [
        {
            "ioc_value": "o5.mystleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 20:37:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667130": [
        {
            "ioc_value": "sck.mystleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 20:28:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667129": [
        {
            "ioc_value": "gate.mystleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 20:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667128": [
        {
            "ioc_value": "85y.mystleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 20:08:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667120": [
        {
            "ioc_value": "packgerrr.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-03 20:02:24",
            "last_seen_utc": "2025-12-03 23:00:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+packgerrr.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667119": [
        {
            "ioc_value": "ngylp.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-03 20:02:23",
            "last_seen_utc": "2025-12-03 23:00:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+ngylp.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667103": [
        {
            "ioc_value": "1w.br1ghtlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 19:57:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667102": [
        {
            "ioc_value": "gold.br1ghtlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 19:47:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667099": [
        {
            "ioc_value": "uun3l.br1ghtlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 19:37:43",
            "last_seen_utc": "2025-12-03 19:44:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667097": [
        {
            "ioc_value": "bold.br1ghtlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 19:28:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667093": [
        {
            "ioc_value": "territorycaption.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-03 19:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1a4279bf33cd9302c4aae6e05ff9d9ef2de1ddc83da1518a8a2f84d241873f9a/",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667092": [
        {
            "ioc_value": "hvug.deepvalley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 19:17:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667087": [
        {
            "ioc_value": "nova.deepvalley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 19:07:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667085": [
        {
            "ioc_value": "cloud.deepvalley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 18:57:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667079": [
        {
            "ioc_value": "hq82.deepvalley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 18:47:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667077": [
        {
            "ioc_value": "rain.silentcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 18:37:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667076": [
        {
            "ioc_value": "8tx1k.silentcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 18:27:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667075": [
        {
            "ioc_value": "6zq.silentcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 18:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667074": [
        {
            "ioc_value": "silent.silentcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 18:07:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667073": [
        {
            "ioc_value": "xxblessingswealthyblessedman.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-03 18:01:39",
            "last_seen_utc": "2025-12-12 18:39:52",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-rmj4padj6t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667071": [
        {
            "ioc_value": "leading-mass.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-03 18:01:25",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-vga6da1nex",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1667070": [
        {
            "ioc_value": "daty.cloudr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667069": [
        {
            "ioc_value": "f6o.cloudr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:48:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667066": [
        {
            "ioc_value": "night.cloudr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:44:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667065": [
        {
            "ioc_value": "bo4m7.cloudr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:37:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667064": [
        {
            "ioc_value": "hollow.sunr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:35:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667063": [
        {
            "ioc_value": "cliff.sunr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:31:08",
            "last_seen_utc": "2025-12-03 17:32:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667062": [
        {
            "ioc_value": "xgp.sunr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:27:57",
            "last_seen_utc": "2025-12-03 17:28:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667061": [
        {
            "ioc_value": "myst.sunr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:17:40",
            "last_seen_utc": "2025-12-03 17:24:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667060": [
        {
            "ioc_value": "f96.f1recliff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:08:59",
            "last_seen_utc": "2025-12-03 17:11:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667059": [
        {
            "ioc_value": "crest.f1recliff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 17:05:47",
            "last_seen_utc": "2025-12-03 17:08:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667058": [
        {
            "ioc_value": "2y5a.f1recliff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 16:57:21",
            "last_seen_utc": "2025-12-03 17:04:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667055": [
        {
            "ioc_value": "kfhdx.f1recliff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 16:45:50",
            "last_seen_utc": "2025-12-03 16:49:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667052": [
        {
            "ioc_value": "kalongo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-03 16:44:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1667050": [
        {
            "ioc_value": "field.l1ghtforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 16:39:07",
            "last_seen_utc": "2025-12-03 16:41:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667043": [
        {
            "ioc_value": "tiny-queen-ada8.mowal67825.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-12-03 16:31:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1667048": [
        {
            "ioc_value": "valley.l1ghtforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 16:25:30",
            "last_seen_utc": "2025-12-03 16:35:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667047": [
        {
            "ioc_value": "m22u9.l1ghtforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 16:10:15",
            "last_seen_utc": "2025-12-03 16:14:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667042": [
        {
            "ioc_value": "flame.l1ghtforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 16:06:09",
            "last_seen_utc": "2025-12-03 16:10:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667030": [
        {
            "ioc_value": "reasonachiever.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-03 16:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667031": [
        {
            "ioc_value": "workradihleba.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-03 16:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1667029": [
        {
            "ioc_value": "dhi.windc0ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 15:57:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667028": [
        {
            "ioc_value": "anr8p.windc0ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 15:48:15",
            "last_seen_utc": "2025-12-03 15:52:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667006": [
        {
            "ioc_value": "cpanel.succeedwithaffiliatemarketing.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-12-03 15:45:37",
            "last_seen_utc": "2025-12-07 10:23:12",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115656273471277964",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1667009": [
        {
            "ioc_value": "mossyden2011.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-12-03 15:45:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/d41701aa-8f4d-4b1e-9522-4c1c3d0d6892",
            "tags": "MaskGramStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1667027": [
        {
            "ioc_value": "td2qd.windc0ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 15:34:53",
            "last_seen_utc": "2025-12-03 15:36:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1667008": [
        {
            "ioc_value": "sz0.windc0ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 15:23:23",
            "last_seen_utc": "2025-12-03 15:26:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1667007": [
        {
            "ioc_value": "4f.softshadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 15:12:48",
            "last_seen_utc": "2025-12-03 15:18:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666988": [
        {
            "ioc_value": "k0h.softshadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 15:02:21",
            "last_seen_utc": "2025-12-03 15:10:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666981": [
        {
            "ioc_value": "wew.automanpk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-03 14:56:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1666982": [
        {
            "ioc_value": "wew.abalawi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-03 14:56:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1666978": [
        {
            "ioc_value": "sunrise.softshadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:55:08",
            "last_seen_utc": "2025-12-03 14:58:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666977": [
        {
            "ioc_value": "clear.softshadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:51:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666975": [
        {
            "ioc_value": "4rx0l.skyhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:48:05",
            "last_seen_utc": "2025-12-03 14:48:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666973": [
        {
            "ioc_value": "deathshop.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-03 14:46:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666972": [
        {
            "ioc_value": "pe2.skyhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:45:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666970": [
        {
            "ioc_value": "fox.skyhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:38:16",
            "last_seen_utc": "2025-12-03 14:40:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666969": [
        {
            "ioc_value": "forest.skyhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:30:04",
            "last_seen_utc": "2025-12-03 14:33:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666968": [
        {
            "ioc_value": "k8yq6.ch2pernev0d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:24:48",
            "last_seen_utc": "2025-12-03 14:26:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666967": [
        {
            "ioc_value": "trace.ch2pernev0d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:20:08",
            "last_seen_utc": "2025-12-03 14:22:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666966": [
        {
            "ioc_value": "screwbirth.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-12-03 14:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Offstealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666965": [
        {
            "ioc_value": "gate.ch2pernev0d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:12:51",
            "last_seen_utc": "2025-12-03 14:18:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666959": [
        {
            "ioc_value": "iao3.ch2pernev0d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:07:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666958": [
        {
            "ioc_value": "qqplive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-03 14:06:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666955": [
        {
            "ioc_value": "t4r7.chimef2ce1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 14:02:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666954": [
        {
            "ioc_value": "r6tb5.chimef2ce1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 13:58:22",
            "last_seen_utc": "2025-12-03 13:59:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666953": [
        {
            "ioc_value": "1yoye.chimef2ce1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 13:43:40",
            "last_seen_utc": "2025-12-03 13:43:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666952": [
        {
            "ioc_value": "ts.chimef2ce1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 13:39:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666950": [
        {
            "ioc_value": "28xt8.id1otre5ist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 13:31:20",
            "last_seen_utc": "2025-12-03 13:36:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666949": [
        {
            "ioc_value": "mint.id1otre5ist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 13:27:07",
            "last_seen_utc": "2025-12-03 13:29:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666948": [
        {
            "ioc_value": "aehz.id1otre5ist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 13:11:14",
            "last_seen_utc": "2025-12-03 13:16:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666947": [
        {
            "ioc_value": "p9.id1otre5ist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 13:03:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666946": [
        {
            "ioc_value": "j0.f1y5agacious.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 13:01:45",
            "last_seen_utc": "2025-12-03 13:02:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666945": [
        {
            "ioc_value": "vdf.f1y5agacious.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 12:58:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666942": [
        {
            "ioc_value": "xeno-roblox.lol",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-03 12:54:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "stealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1666944": [
        {
            "ioc_value": "vqjhg08j-5500.euw.devtunnels.ms",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-03 12:54:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dc8fb465d9b20ffd3e35e6b505ccd3ba82eb752f7ee2840a13ff4975dfaacaca/",
            "tags": "AgentTesla",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1666943": [
        {
            "ioc_value": "e9.f1y5agacious.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 12:47:48",
            "last_seen_utc": "2025-12-03 12:51:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666941": [
        {
            "ioc_value": "soft.f1y5agacious.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 12:33:30",
            "last_seen_utc": "2025-12-03 12:40:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666938": [
        {
            "ioc_value": "bgh8.1ndu5trinsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 12:24:39",
            "last_seen_utc": "2025-12-03 12:29:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666937": [
        {
            "ioc_value": "gma.1ndu5trinsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 12:20:33",
            "last_seen_utc": "2025-12-03 12:22:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666936": [
        {
            "ioc_value": "ijry.1ndu5trinsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 12:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666935": [
        {
            "ioc_value": "6nb.1ndu5trinsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 12:11:30",
            "last_seen_utc": "2025-12-03 12:15:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666934": [
        {
            "ioc_value": "n9.0prichpe7ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 12:08:31",
            "last_seen_utc": "2025-12-03 12:11:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666930": [
        {
            "ioc_value": "vuloinsioscollid.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-03 12:01:41",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-jhysaawrcn",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666931": [
        {
            "ioc_value": "tallymostfavor.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-03 12:01:41",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-jhysaawrcn",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666927": [
        {
            "ioc_value": "playercollectionpros.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-03 12:01:40",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-j2xz4axkcq",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666928": [
        {
            "ioc_value": "valueforcollections.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-03 12:01:40",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-j2xz4axkcq",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666929": [
        {
            "ioc_value": "manymandyills.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-03 12:01:40",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-jhysaawrcn",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666926": [
        {
            "ioc_value": "practicalplayercontact.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-03 12:01:39",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-j2xz4axkcq",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666924": [
        {
            "ioc_value": "you-friends.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-03 12:01:24",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-m7c4nawlfw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666922": [
        {
            "ioc_value": "qqes.0prichpe7ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 12:01:11",
            "last_seen_utc": "2025-12-03 12:03:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666921": [
        {
            "ioc_value": "24.0prichpe7ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 11:54:27",
            "last_seen_utc": "2025-12-03 11:56:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666920": [
        {
            "ioc_value": "e1.0prichpe7ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 11:46:11",
            "last_seen_utc": "2025-12-03 11:52:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666919": [
        {
            "ioc_value": "delta.lo0kferti1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 11:37:56",
            "last_seen_utc": "2025-12-03 11:40:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666918": [
        {
            "ioc_value": "4dh11.lo0kferti1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 11:28:06",
            "last_seen_utc": "2025-12-03 11:35:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666917": [
        {
            "ioc_value": "0yna.lo0kferti1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 11:17:48",
            "last_seen_utc": "2025-12-03 11:20:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666916": [
        {
            "ioc_value": "86.lo0kferti1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 11:09:52",
            "last_seen_utc": "2025-12-03 11:11:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666915": [
        {
            "ioc_value": "tw926.lu8eti5chkom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 11:05:32",
            "last_seen_utc": "2025-12-03 11:05:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666901": [
        {
            "ioc_value": "sa.lu8eti5chkom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 10:57:36",
            "last_seen_utc": "2025-12-03 10:59:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666900": [
        {
            "ioc_value": "kbrx.lu8eti5chkom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 10:47:20",
            "last_seen_utc": "2025-12-03 10:51:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666899": [
        {
            "ioc_value": "wf.lu8eti5chkom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 10:44:15",
            "last_seen_utc": "2025-12-03 10:46:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666897": [
        {
            "ioc_value": "ndcwsww.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-03 10:41:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://ti.qianxin.com/blog/articles/setcoderat-customized-for-chinese-speaking-regions-en/",
            "tags": "c2,SetcodeRat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666898": [
        {
            "ioc_value": "xiongdaylf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-03 10:41:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://ti.qianxin.com/blog/articles/setcoderat-customized-for-chinese-speaking-regions-en/",
            "tags": "c2,SetcodeRat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666895": [
        {
            "ioc_value": "xionger.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-03 10:41:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://ti.qianxin.com/blog/articles/setcoderat-customized-for-chinese-speaking-regions-en/",
            "tags": "c2,SetcodeRat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666896": [
        {
            "ioc_value": "ssllndac.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-12-03 10:41:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://ti.qianxin.com/blog/articles/setcoderat-customized-for-chinese-speaking-regions-en/",
            "tags": "c2,SetcodeRat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666890": [
        {
            "ioc_value": "oj.c1ubmel0dic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 10:36:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666886": [
        {
            "ioc_value": "dsourceva.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-12-03 10:31:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666889": [
        {
            "ioc_value": "aq.c1ubmel0dic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 10:27:00",
            "last_seen_utc": "2025-12-03 10:31:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666885": [
        {
            "ioc_value": "4p2h.c1ubmel0dic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 10:17:23",
            "last_seen_utc": "2025-12-03 10:18:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666884": [
        {
            "ioc_value": "47.c1ubmel0dic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 10:07:55",
            "last_seen_utc": "2025-12-03 10:14:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666883": [
        {
            "ioc_value": "631cf.ant1d5ulphur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 10:04:28",
            "last_seen_utc": "2025-12-03 10:07:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666882": [
        {
            "ioc_value": "llosj.ant1d5ulphur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:55:34",
            "last_seen_utc": "2025-12-03 09:59:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666881": [
        {
            "ioc_value": "1y6v.ant1d5ulphur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:51:57",
            "last_seen_utc": "2025-12-03 09:53:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666880": [
        {
            "ioc_value": "vzfk0.ant1d5ulphur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:47:43",
            "last_seen_utc": "2025-12-03 09:51:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666879": [
        {
            "ioc_value": "ur.b1eedu4yuk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:38:29",
            "last_seen_utc": "2025-12-03 09:42:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666878": [
        {
            "ioc_value": "p2.b1eedu4yuk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:34:42",
            "last_seen_utc": "2025-12-03 09:37:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666877": [
        {
            "ioc_value": "i4qt.b1eedu4yuk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:29:56",
            "last_seen_utc": "2025-12-03 09:34:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666876": [
        {
            "ioc_value": "i2t0.b1eedu4yuk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:26:17",
            "last_seen_utc": "2025-12-03 09:29:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666875": [
        {
            "ioc_value": "66nx.bep0ver7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:22:32",
            "last_seen_utc": "2025-12-03 09:23:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666874": [
        {
            "ioc_value": "m3edx.bep0ver7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:17:27",
            "last_seen_utc": "2025-12-03 09:21:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666873": [
        {
            "ioc_value": "7yya2.bep0ver7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666871": [
        {
            "ioc_value": "xi.bep0ver7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 09:07:28",
            "last_seen_utc": "2025-12-03 09:10:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666870": [
        {
            "ioc_value": "ao2.bul1upd2ted.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 08:58:11",
            "last_seen_utc": "2025-12-03 09:00:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666863": [
        {
            "ioc_value": "596y.bul1upd2ted.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 08:47:52",
            "last_seen_utc": "2025-12-03 08:49:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666860": [
        {
            "ioc_value": "flowbilding.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-03 08:45:22",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/e9a2e9ce85efba103622a6abf25c4e0d280eb5ca8012e43db46b5394b8a1db10/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666857": [
        {
            "ioc_value": "qppe.bul1upd2ted.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 08:42:30",
            "last_seen_utc": "2025-12-03 08:43:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666856": [
        {
            "ioc_value": "ewp3.bul1upd2ted.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 08:38:12",
            "last_seen_utc": "2025-12-03 08:42:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666844": [
        {
            "ioc_value": "skt.automanpk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-03 08:33:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1666845": [
        {
            "ioc_value": "skt.abalawi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-03 08:33:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1666846": [
        {
            "ioc_value": "sk.ti.milkos.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-03 08:33:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1666833": [
        {
            "ioc_value": "clear.kira5l2nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 08:28:09",
            "last_seen_utc": "2025-12-03 08:30:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666832": [
        {
            "ioc_value": "bold.kira5l2nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 08:21:53",
            "last_seen_utc": "2025-12-03 08:27:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666831": [
        {
            "ioc_value": "mnt.kira5l2nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 08:18:04",
            "last_seen_utc": "2025-12-03 08:20:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666830": [
        {
            "ioc_value": "h2t.kira5l2nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 08:07:22",
            "last_seen_utc": "2025-12-03 08:16:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666810": [
        {
            "ioc_value": "black.racist.black",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-03 07:56:45",
            "last_seen_utc": "2025-12-04 07:58:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c48e7e301c663a0edc7a4372d7e1fcf837c0a5c4a56bfc1f8c2c7e2e2b7ccf8a/",
            "tags": "Hailbot,Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666808": [
        {
            "ioc_value": "xe.ap2rthyub2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 07:56:32",
            "last_seen_utc": "2025-12-03 07:58:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666806": [
        {
            "ioc_value": "3gaz.ap2rthyub2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 07:48:17",
            "last_seen_utc": "2025-12-03 07:51:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666803": [
        {
            "ioc_value": "6cyd.ap2rthyub2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 07:42:33",
            "last_seen_utc": "2025-12-03 07:46:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666802": [
        {
            "ioc_value": "guard.ap2rthyub2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 07:37:19",
            "last_seen_utc": "2025-12-03 07:40:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666801": [
        {
            "ioc_value": "transamadocollections.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-03 07:30:22",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/68b20156f91380f18d34a84d51f7be308c494edebf353462331b3eb2212cd953/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666800": [
        {
            "ioc_value": "forsizillenazzlle.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-03 07:30:21",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/68b20156f91380f18d34a84d51f7be308c494edebf353462331b3eb2212cd953/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666799": [
        {
            "ioc_value": "4bv1v.sl0bozh5treak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 07:25:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666797": [
        {
            "ioc_value": "4j.sl0bozh5treak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 07:20:15",
            "last_seen_utc": "2025-12-03 07:25:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666796": [
        {
            "ioc_value": "xword3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-03 07:15:29",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/85a1f1233894080f2ad174004d240fec588ec2c941824f71ca10b4e65602b50b/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666795": [
        {
            "ioc_value": "xword1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-03 07:15:27",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/bd1c03ebbcedd44270163b446545ccb9eae0cbc918f640e1c5ae339410ea7a1e/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666322": [
        {
            "ioc_value": "midiavideostv.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666323": [
        {
            "ioc_value": "cargafactura.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666325": [
        {
            "ioc_value": "url27.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666326": [
        {
            "ioc_value": "adbd.tech",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666327": [
        {
            "ioc_value": "archivosdwn.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666328": [
        {
            "ioc_value": "cfdimex.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666330": [
        {
            "ioc_value": "facturas.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666329": [
        {
            "ioc_value": "facturacioncontable.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666331": [
        {
            "ioc_value": "facturasm.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666332": [
        {
            "ioc_value": "facturasmex.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666333": [
        {
            "ioc_value": "satventasfac.tech",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666334": [
        {
            "ioc_value": "starlinkspacex.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:44",
            "last_seen_utc": "2025-12-02 19:49:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666335": [
        {
            "ioc_value": "ventasmex123.com.mx",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666336": [
        {
            "ioc_value": "salvec.tech",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666337": [
        {
            "ioc_value": "archivesautomacion.ddns.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metamorfo",
            "malware_alias": "Casbaneiro",
            "malware_printable": "Metamorfo",
            "first_seen_utc": "2025-12-03 07:14:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1666399": [
        {
            "ioc_value": "bgfi-groupe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-03 07:14:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/195.24.237.60+bgfi-groupe.com",
            "tags": "AS60223,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1666741": [
        {
            "ioc_value": "dcragonz.sa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vanillarat",
            "malware_alias": null,
            "malware_printable": "vanillarat",
            "first_seen_utc": "2025-12-03 07:14:27",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/domain/dcragonz.sa.com",
            "tags": "c2,vanillrat",
            "anonymous": "0",
            "reporter": "Amethyste"
        }
    ],
    "1666794": [
        {
            "ioc_value": "ctfi.sl0bozh5treak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 07:07:50",
            "last_seen_utc": "2025-12-03 07:09:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666793": [
        {
            "ioc_value": "3js3.sl0bozh5treak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 07:04:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666792": [
        {
            "ioc_value": "salespe.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-03 07:03:26",
            "last_seen_utc": "2025-12-11 15:13:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666790": [
        {
            "ioc_value": "mpannukwugaegbummadu.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-03 07:02:39",
            "last_seen_utc": "2025-12-12 18:39:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666789": [
        {
            "ioc_value": "crystal.adv0cal1egat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 07:02:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666786": [
        {
            "ioc_value": "srv1200.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-03 07:02:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666787": [
        {
            "ioc_value": "srv1300.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-03 07:02:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666788": [
        {
            "ioc_value": "srv1400.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-03 07:02:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666785": [
        {
            "ioc_value": "srv1000.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-12-03 07:02:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666771": [
        {
            "ioc_value": "phising.vn168.im",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666772": [
        {
            "ioc_value": "sex.55clubz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666773": [
        {
            "ioc_value": "sex.aml-bot.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666774": [
        {
            "ioc_value": "sex.diamondtechnologies.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666775": [
        {
            "ioc_value": "sex.jobdekho.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666776": [
        {
            "ioc_value": "sex.jujutsukaisenmanga.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666777": [
        {
            "ioc_value": "sex.updos.uk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666778": [
        {
            "ioc_value": "sex.vn168.casa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666779": [
        {
            "ioc_value": "sex.vn168.im",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666780": [
        {
            "ioc_value": "socolivezs.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:39:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666781": [
        {
            "ioc_value": "v2.socolivezs.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666782": [
        {
            "ioc_value": "v2.visioncomputer.inleeakali",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-03 07:01:20",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666783": [
        {
            "ioc_value": "v3.socolivezs.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666784": [
        {
            "ioc_value": "v3.visioncomputer.inleeakali",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666755": [
        {
            "ioc_value": "55clubz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666756": [
        {
            "ioc_value": "akska22323.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666757": [
        {
            "ioc_value": "aml-bot.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666758": [
        {
            "ioc_value": "cc.vn168.im",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666759": [
        {
            "ioc_value": "diamondtechnologies.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666760": [
        {
            "ioc_value": "dunntstars.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:39:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666761": [
        {
            "ioc_value": "jobdekho.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666762": [
        {
            "ioc_value": "malware.55clubz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666763": [
        {
            "ioc_value": "malware.aml-bot.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:39:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666764": [
        {
            "ioc_value": "malware.diamondtechnologies.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666765": [
        {
            "ioc_value": "malware.jobdekho.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666766": [
        {
            "ioc_value": "malware.jujutsukaisenmanga.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666767": [
        {
            "ioc_value": "malware.updos.uk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666768": [
        {
            "ioc_value": "malware.vn168.casa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666769": [
        {
            "ioc_value": "malware.vn168.im",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666770": [
        {
            "ioc_value": "phising.diamondtechnologies.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-12-03 07:01:19",
            "last_seen_utc": "2025-12-12 18:38:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666753": [
        {
            "ioc_value": "www.xlz.livecdnem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 07:00:56",
            "last_seen_utc": "2025-12-03 07:00:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666754": [
        {
            "ioc_value": "www.xoilac.livecdnem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 07:00:56",
            "last_seen_utc": "2025-12-03 07:00:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666746": [
        {
            "ioc_value": "91p.livecdnem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 07:00:55",
            "last_seen_utc": "2025-12-03 07:00:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666747": [
        {
            "ioc_value": "ck.livecdnem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 07:00:55",
            "last_seen_utc": "2025-12-03 07:00:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666748": [
        {
            "ioc_value": "dooeys.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 07:00:55",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666749": [
        {
            "ioc_value": "gatex.dooeys.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 07:00:55",
            "last_seen_utc": "2025-12-12 18:39:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666750": [
        {
            "ioc_value": "soco.livecdnem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 07:00:55",
            "last_seen_utc": "2025-12-03 07:00:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666751": [
        {
            "ioc_value": "www.xl365.livecdnem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 07:00:55",
            "last_seen_utc": "2025-12-08 11:53:39",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666752": [
        {
            "ioc_value": "www.xlvi.livecdnem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 07:00:55",
            "last_seen_utc": "2025-12-03 07:00:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666743": [
        {
            "ioc_value": "flame.adv0cal1egat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:55:46",
            "last_seen_utc": "2025-12-03 07:01:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666742": [
        {
            "ioc_value": "shadow.adv0cal1egat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:47:32",
            "last_seen_utc": "2025-12-03 06:48:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666740": [
        {
            "ioc_value": "qkp.adv0cal1egat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:37:57",
            "last_seen_utc": "2025-12-03 06:39:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666739": [
        {
            "ioc_value": "qyjs.c2rndiv1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:34:44",
            "last_seen_utc": "2025-12-03 06:36:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666738": [
        {
            "ioc_value": "6far5.c2rndiv1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:27:22",
            "last_seen_utc": "2025-12-03 06:28:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666737": [
        {
            "ioc_value": "river.c2rndiv1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666736": [
        {
            "ioc_value": "coast.c2rndiv1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:17:41",
            "last_seen_utc": "2025-12-03 06:19:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666735": [
        {
            "ioc_value": "gd5do.b2rvshap0v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:14:16",
            "last_seen_utc": "2025-12-03 06:15:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666731": [
        {
            "ioc_value": "atd.b2rvshap0v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:08:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666730": [
        {
            "ioc_value": "fexgmail.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-12-03 06:03:49",
            "last_seen_utc": "2025-12-12 18:39:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-btqxta1jcs",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666728": [
        {
            "ioc_value": "4ycip.b2rvshap0v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 06:02:07",
            "last_seen_utc": "2025-12-03 06:02:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666725": [
        {
            "ioc_value": "copyright-closed-communication-monster.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-03 06:02:00",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-ee6w9stqap",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666726": [
        {
            "ioc_value": "types-pleasant.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-03 06:02:00",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-ed3s8aem4w",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666727": [
        {
            "ioc_value": "my-client.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-03 06:02:00",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-cqvx2a1mcx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666724": [
        {
            "ioc_value": "proxaa23w.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-03 06:01:40",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-dxyg6shw5e",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666722": [
        {
            "ioc_value": "smayham.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-03 06:01:12",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251203-e5bh2svjep",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666720": [
        {
            "ioc_value": "secure.b2rvshap0v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 05:57:00",
            "last_seen_utc": "2025-12-03 06:01:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666719": [
        {
            "ioc_value": "pql.pu5herw0man.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 05:48:13",
            "last_seen_utc": "2025-12-03 05:50:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666718": [
        {
            "ioc_value": "gp.pu5herw0man.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 05:37:53",
            "last_seen_utc": "2025-12-03 05:47:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666713": [
        {
            "ioc_value": "b2b.pu5herw0man.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 05:31:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666712": [
        {
            "ioc_value": "omega.pu5herw0man.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 05:27:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666710": [
        {
            "ioc_value": "uno.dicti0nvica1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 05:17:38",
            "last_seen_utc": "2025-12-03 05:23:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666709": [
        {
            "ioc_value": "2i.dicti0nvica1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 05:07:17",
            "last_seen_utc": "2025-12-03 05:09:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666708": [
        {
            "ioc_value": "i6.dicti0nvica1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 05:04:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666707": [
        {
            "ioc_value": "fuxb.dicti0nvica1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 04:57:26",
            "last_seen_utc": "2025-12-03 05:03:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666706": [
        {
            "ioc_value": "7anki.p7ecunder8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 04:51:10",
            "last_seen_utc": "2025-12-03 04:57:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666705": [
        {
            "ioc_value": "bright.p7ecunder8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 04:48:28",
            "last_seen_utc": "2025-12-03 04:49:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666704": [
        {
            "ioc_value": "pixel.p7ecunder8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 04:38:07",
            "last_seen_utc": "2025-12-03 04:40:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666514": [
        {
            "ioc_value": "3x7.p7ecunder8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 04:27:47",
            "last_seen_utc": "2025-12-03 04:29:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666512": [
        {
            "ioc_value": "a64.f1auntre6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 04:18:22",
            "last_seen_utc": "2025-12-03 04:20:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666511": [
        {
            "ioc_value": "cpy.f1auntre6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 04:07:46",
            "last_seen_utc": "2025-12-03 04:13:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666507": [
        {
            "ioc_value": "9dv8.f1auntre6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 04:02:36",
            "last_seen_utc": "2025-12-03 04:04:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666467": [
        {
            "ioc_value": "magic.f1auntre6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 03:59:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666466": [
        {
            "ioc_value": "9ujw.de5criptun1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 03:55:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666465": [
        {
            "ioc_value": "pw0kt.de5criptun1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 03:51:22",
            "last_seen_utc": "2025-12-03 03:54:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666463": [
        {
            "ioc_value": "7jb.de5criptun1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 03:47:48",
            "last_seen_utc": "2025-12-03 03:49:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666462": [
        {
            "ioc_value": "amber.de5criptun1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 03:37:22",
            "last_seen_utc": "2025-12-03 03:40:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666461": [
        {
            "ioc_value": "qz6tf.pi1er5pat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 03:30:15",
            "last_seen_utc": "2025-12-03 03:36:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666460": [
        {
            "ioc_value": "1gn.pi1er5pat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 03:27:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666459": [
        {
            "ioc_value": "beta.pi1er5pat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 03:17:59",
            "last_seen_utc": "2025-12-03 03:23:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666458": [
        {
            "ioc_value": "in7o.pi1er5pat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 03:07:59",
            "last_seen_utc": "2025-12-03 03:13:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666457": [
        {
            "ioc_value": "cil3.lifet1met0rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 02:53:04",
            "last_seen_utc": "2025-12-03 02:57:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666456": [
        {
            "ioc_value": "3u3.lifet1met0rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 02:47:56",
            "last_seen_utc": "2025-12-03 02:49:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666454": [
        {
            "ioc_value": "aw.lifet1met0rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 02:37:28",
            "last_seen_utc": "2025-12-03 02:47:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666452": [
        {
            "ioc_value": "forest.lifet1met0rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 02:26:42",
            "last_seen_utc": "2025-12-03 02:30:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666450": [
        {
            "ioc_value": "bj4.crust5p1ant.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 02:17:28",
            "last_seen_utc": "2025-12-03 02:21:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666449": [
        {
            "ioc_value": "hv.crust5p1ant.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 02:05:32",
            "last_seen_utc": "2025-12-03 02:16:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666448": [
        {
            "ioc_value": "5f6.crust5p1ant.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 01:57:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666447": [
        {
            "ioc_value": "storm.crust5p1ant.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 01:44:52",
            "last_seen_utc": "2025-12-03 01:47:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666446": [
        {
            "ioc_value": "nova.cheb0t5agit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 01:37:16",
            "last_seen_utc": "2025-12-03 01:40:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666445": [
        {
            "ioc_value": "t77n.cheb0t5agit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 01:27:51",
            "last_seen_utc": "2025-12-03 01:33:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666443": [
        {
            "ioc_value": "gamma.cheb0t5agit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 01:17:31",
            "last_seen_utc": "2025-12-03 01:22:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666442": [
        {
            "ioc_value": "kj4j9.cheb0t5agit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 01:07:45",
            "last_seen_utc": "2025-12-03 01:10:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666441": [
        {
            "ioc_value": "sunny.dur2treces5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 00:57:26",
            "last_seen_utc": "2025-12-03 01:00:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666440": [
        {
            "ioc_value": "snow.dur2treces5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 00:48:12",
            "last_seen_utc": "2025-12-03 00:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666439": [
        {
            "ioc_value": "vector.dur2treces5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 00:34:39",
            "last_seen_utc": "2025-12-03 00:40:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666438": [
        {
            "ioc_value": "kxqeq.dur2treces5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 00:28:02",
            "last_seen_utc": "2025-12-03 00:28:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666437": [
        {
            "ioc_value": "y5gxz.em1npe0ny.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 00:17:13",
            "last_seen_utc": "2025-12-03 00:24:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666436": [
        {
            "ioc_value": "deep.em1npe0ny.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-03 00:09:28",
            "last_seen_utc": "2025-12-03 00:14:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666433": [
        {
            "ioc_value": "night.em1npe0ny.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 23:57:42",
            "last_seen_utc": "2025-12-02 23:59:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666432": [
        {
            "ioc_value": "72.em1npe0ny.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 23:47:32",
            "last_seen_utc": "2025-12-02 23:50:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666431": [
        {
            "ioc_value": "9gzt.c0ffee8rind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 23:37:35",
            "last_seen_utc": "2025-12-02 23:46:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666430": [
        {
            "ioc_value": "stn.equisphire.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 23:28:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Stafnex",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666428": [
        {
            "ioc_value": "stone.c0ffee8rind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 23:27:18",
            "last_seen_utc": "2025-12-02 23:31:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666427": [
        {
            "ioc_value": "tn7z.c0ffee8rind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 23:17:31",
            "last_seen_utc": "2025-12-02 23:19:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666426": [
        {
            "ioc_value": "smartphotoedit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 23:12:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666424": [
        {
            "ioc_value": "palmettoseasalttherapy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 23:09:59",
            "last_seen_utc": "2025-12-11 19:29:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666422": [
        {
            "ioc_value": "about-birth-control-info.highheelsplace.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 23:08:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666421": [
        {
            "ioc_value": "la.c0ffee8rind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 23:08:07",
            "last_seen_utc": "2025-12-02 23:13:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666419": [
        {
            "ioc_value": "vizyons.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 23:07:18",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666398": [
        {
            "ioc_value": "spark.deve1ins0le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 22:58:21",
            "last_seen_utc": "2025-12-02 23:08:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666396": [
        {
            "ioc_value": "spark-news.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 22:55:21",
            "last_seen_utc": "2025-12-12 18:01:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666395": [
        {
            "ioc_value": "process-session-562-protect-9911.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 22:49:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666393": [
        {
            "ioc_value": "group.deve1ins0le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 22:48:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666392": [
        {
            "ioc_value": "account-extranetcaptchapulse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 22:44:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666390": [
        {
            "ioc_value": "account-bookcaptcha.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 22:42:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666386": [
        {
            "ioc_value": "account-bookextranet.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 22:39:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666385": [
        {
            "ioc_value": "z6.deve1ins0le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 22:38:12",
            "last_seen_utc": "2025-12-02 22:43:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666384": [
        {
            "ioc_value": "kligar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 22:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666381": [
        {
            "ioc_value": "account-bookspulse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 22:36:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666380": [
        {
            "ioc_value": "11qb.deve1ins0le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 22:27:55",
            "last_seen_utc": "2025-12-02 22:29:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666379": [
        {
            "ioc_value": "y54.bana1ity8ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 22:15:33",
            "last_seen_utc": "2025-12-02 22:16:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666378": [
        {
            "ioc_value": "vn.bana1ity8ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 22:01:41",
            "last_seen_utc": "2025-12-02 22:13:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666377": [
        {
            "ioc_value": "field.bana1ity8ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 21:57:26",
            "last_seen_utc": "2025-12-02 21:58:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666376": [
        {
            "ioc_value": "crest.bana1ity8ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 21:43:05",
            "last_seen_utc": "2025-12-02 21:45:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666375": [
        {
            "ioc_value": "dark.a5pirbo0rda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 21:33:59",
            "last_seen_utc": "2025-12-02 21:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666374": [
        {
            "ioc_value": "x5.a5pirbo0rda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 21:25:06",
            "last_seen_utc": "2025-12-02 21:26:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666371": [
        {
            "ioc_value": "cloud.a5pirbo0rda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 21:17:43",
            "last_seen_utc": "2025-12-02 21:21:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666370": [
        {
            "ioc_value": "zx8.a5pirbo0rda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 21:02:51",
            "last_seen_utc": "2025-12-02 21:08:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666369": [
        {
            "ioc_value": "wind.barg5t0get.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 20:57:35",
            "last_seen_utc": "2025-12-02 21:00:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666368": [
        {
            "ioc_value": "0ec.barg5t0get.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 20:47:50",
            "last_seen_utc": "2025-12-02 20:57:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666367": [
        {
            "ioc_value": "bird.barg5t0get.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 20:39:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666366": [
        {
            "ioc_value": "control-7721-process-550-update.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 20:37:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666363": [
        {
            "ioc_value": "3zg.barg5t0get.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 20:35:19",
            "last_seen_utc": "2025-12-02 20:38:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666362": [
        {
            "ioc_value": "ourhealingpoweriswithin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 20:28:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666360": [
        {
            "ioc_value": "qjpc.mes5yr0mp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 20:27:35",
            "last_seen_utc": "2025-12-02 20:30:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666359": [
        {
            "ioc_value": "silent.mes5yr0mp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 20:17:15",
            "last_seen_utc": "2025-12-02 20:21:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666358": [
        {
            "ioc_value": "interrobangtype.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 20:13:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666356": [
        {
            "ioc_value": "maxinsurancecoverage.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 20:11:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666354": [
        {
            "ioc_value": "ctheplanet.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 20:06:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666340": [
        {
            "ioc_value": "eg.mes5yr0mp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 20:01:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666338": [
        {
            "ioc_value": "quick.mes5yr0mp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 19:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666324": [
        {
            "ioc_value": "covel1.cos5acklove1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 19:47:49",
            "last_seen_utc": "2025-12-02 19:52:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666321": [
        {
            "ioc_value": "saclor.cos5acklove1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 19:37:54",
            "last_seen_utc": "2025-12-02 19:47:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666320": [
        {
            "ioc_value": "co5hue.cos5acklove1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 19:27:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666319": [
        {
            "ioc_value": "lovent.cos5acklove1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 19:23:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666316": [
        {
            "ioc_value": "sfmonte.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-02 19:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666313": [
        {
            "ioc_value": "orangepinepo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-02 19:15:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666310": [
        {
            "ioc_value": "cossak.cos5acklove1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 19:10:38",
            "last_seen_utc": "2025-12-02 19:17:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666309": [
        {
            "ioc_value": "linleac.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-12-02 19:10:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666308": [
        {
            "ioc_value": "majr5a.hubr1s5ajor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 19:07:27",
            "last_seen_utc": "2025-12-02 19:09:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666307": [
        {
            "ioc_value": "asdkl.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:59:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666306": [
        {
            "ioc_value": "husaor.hubr1s5ajor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 18:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666304": [
        {
            "ioc_value": "thealphain.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:55:06",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666301": [
        {
            "ioc_value": "numerix360.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:52:42",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666299": [
        {
            "ioc_value": "zeloar.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:50:36",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666297": [
        {
            "ioc_value": "acosgalvao.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:49:57",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666295": [
        {
            "ioc_value": "comres.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:48:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666292": [
        {
            "ioc_value": "elopharma.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:47:47",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666288": [
        {
            "ioc_value": "deep-n.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:46:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666287": [
        {
            "ioc_value": "rorbaxprojects.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:46:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666283": [
        {
            "ioc_value": "wellnesswisewhispers.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:44:58",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666281": [
        {
            "ioc_value": "elizabethpastry.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:43:31",
            "last_seen_utc": "2025-12-10 23:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666279": [
        {
            "ioc_value": "brume1.hubr1s5ajor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 18:42:23",
            "last_seen_utc": "2025-12-02 18:48:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666278": [
        {
            "ioc_value": "rebornpilates-jp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:41:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666276": [
        {
            "ioc_value": "appirockyinn.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:40:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666274": [
        {
            "ioc_value": "sandyrelief.aurovine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:37:57",
            "last_seen_utc": "2025-12-07 20:34:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666271": [
        {
            "ioc_value": "sajor.hubr1s5ajor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 18:37:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666270": [
        {
            "ioc_value": "smokingantrecords.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:36:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666267": [
        {
            "ioc_value": "shiningstarschildcare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:34:49",
            "last_seen_utc": "2025-12-09 13:35:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666264": [
        {
            "ioc_value": "itoyuu.tokyo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:33:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666263": [
        {
            "ioc_value": "bhargavahospital.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:32:49",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666261": [
        {
            "ioc_value": "315kou.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:32:03",
            "last_seen_utc": "2025-12-10 23:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666259": [
        {
            "ioc_value": "invitriol.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:29:19",
            "last_seen_utc": "2025-12-09 13:35:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666257": [
        {
            "ioc_value": "win.prowebsite.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:28:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666255": [
        {
            "ioc_value": "madeireiradunorte.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:27:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666252": [
        {
            "ioc_value": "espace-mandarine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:26:01",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666251": [
        {
            "ioc_value": "asobibasyo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:25:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666249": [
        {
            "ioc_value": "hartvoorregelen.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:24:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666247": [
        {
            "ioc_value": "hubris.hubr1s5ajor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 18:23:44",
            "last_seen_utc": "2025-12-02 18:27:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666246": [
        {
            "ioc_value": "t-prep.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:23:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666244": [
        {
            "ioc_value": "qexmz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:22:09",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666243": [
        {
            "ioc_value": "cryptoclinic.london",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666240": [
        {
            "ioc_value": "3squaredco.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666239": [
        {
            "ioc_value": "tram5s.abstractm1s5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 18:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666237": [
        {
            "ioc_value": "itoyuu-meguro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:11:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666236": [
        {
            "ioc_value": "prcpakistan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:08:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666234": [
        {
            "ioc_value": "dootnode.themesbrand.website",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:08:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666232": [
        {
            "ioc_value": "absray.abstractm1s5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 18:06:40",
            "last_seen_utc": "2025-12-02 18:08:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666230": [
        {
            "ioc_value": "greyfashiondesign.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:05:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666227": [
        {
            "ioc_value": "quimicaelda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:02:21",
            "last_seen_utc": "2025-12-08 19:00:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666224": [
        {
            "ioc_value": "chukwunwike.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-02 18:01:12",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-py547asrfx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666223": [
        {
            "ioc_value": "film-gear.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-02 18:01:07",
            "last_seen_utc": "2025-12-12 18:39:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-sky1hawrgn",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666222": [
        {
            "ioc_value": "mojow-mobiliers.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 18:00:37",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666219": [
        {
            "ioc_value": "m1stic.abstractm1s5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 17:57:54",
            "last_seen_utc": "2025-12-02 17:59:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666218": [
        {
            "ioc_value": "nicholastuck.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 17:55:41",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666215": [
        {
            "ioc_value": "globeerp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 17:54:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666213": [
        {
            "ioc_value": "cashloopmagazine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 17:53:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666212": [
        {
            "ioc_value": "stract.abstractm1s5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 17:47:34",
            "last_seen_utc": "2025-12-02 17:52:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666211": [
        {
            "ioc_value": "abstra.abstractm1s5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 17:37:11",
            "last_seen_utc": "2025-12-02 17:43:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666207": [
        {
            "ioc_value": "rya7nd.ba8ryanhe7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 17:27:27",
            "last_seen_utc": "2025-12-02 17:34:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666204": [
        {
            "ioc_value": "harbyn.ba8ryanhe7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 17:18:13",
            "last_seen_utc": "2025-12-02 17:22:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666202": [
        {
            "ioc_value": "onari-aikido.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 17:09:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666201": [
        {
            "ioc_value": "medicine.gsinds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 17:08:44",
            "last_seen_utc": "2025-12-08 19:00:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666198": [
        {
            "ioc_value": "etpur.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 17:07:12",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666196": [
        {
            "ioc_value": "bayen5.ba8ryanhe7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 17:06:02",
            "last_seen_utc": "2025-12-02 17:06:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666195": [
        {
            "ioc_value": "manabi-station-fukushima.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 17:06:01",
            "last_seen_utc": "2025-12-09 13:35:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666193": [
        {
            "ioc_value": "ranhed.ba8ryanhe7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 16:56:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666192": [
        {
            "ioc_value": "baryan.ba8ryanhe7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 16:47:44",
            "last_seen_utc": "2025-12-02 16:53:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666190": [
        {
            "ioc_value": "sessionsverificats.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 16:43:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1666188": [
        {
            "ioc_value": "quill5.auth0r1etter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 16:37:53",
            "last_seen_utc": "2025-12-02 16:40:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666187": [
        {
            "ioc_value": "inkset.auth0r1etter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 16:26:31",
            "last_seen_utc": "2025-12-02 16:31:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666186": [
        {
            "ioc_value": "rhet1c.auth0r1etter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 16:20:34",
            "last_seen_utc": "2025-12-02 16:20:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666185": [
        {
            "ioc_value": "lettyr.auth0r1etter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 16:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666183": [
        {
            "ioc_value": "author.auth0r1etter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 16:07:19",
            "last_seen_utc": "2025-12-02 16:16:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666177": [
        {
            "ioc_value": "email.meta-email.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 16:03:37",
            "last_seen_utc": "2025-12-02 23:01:00",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/165.22.37.154+email.meta-email.online",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666172": [
        {
            "ioc_value": "derv1n.de5per5eem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 15:50:33",
            "last_seen_utc": "2025-12-02 15:56:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666171": [
        {
            "ioc_value": "demure.de5per5eem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 15:42:05",
            "last_seen_utc": "2025-12-02 15:49:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666170": [
        {
            "ioc_value": "peren5.de5per5eem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 15:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666169": [
        {
            "ioc_value": "depra.de5per5eem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 15:28:14",
            "last_seen_utc": "2025-12-02 15:29:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666166": [
        {
            "ioc_value": "deepem.de5per5eem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 15:18:52",
            "last_seen_utc": "2025-12-02 15:20:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666165": [
        {
            "ioc_value": "benra8.be8ref7ain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 15:07:50",
            "last_seen_utc": "2025-12-02 15:10:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666140": [
        {
            "ioc_value": "abqsales.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-12-02 15:01:59",
            "last_seen_utc": "2025-12-02 14:06:34",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115650120276994136",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1666162": [
        {
            "ioc_value": "billing.keywordmatters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-12-02 15:01:58",
            "last_seen_utc": "2025-12-07 10:23:12",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115650528794544896",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1666164": [
        {
            "ioc_value": "refayn.be8ref7ain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 14:57:26",
            "last_seen_utc": "2025-12-02 15:01:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666163": [
        {
            "ioc_value": "breez5.be8ref7ain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 14:52:17",
            "last_seen_utc": "2025-12-02 14:53:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666161": [
        {
            "ioc_value": "rainel.be8ref7ain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 14:47:38",
            "last_seen_utc": "2025-12-02 14:49:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666160": [
        {
            "ioc_value": "befrin.be8ref7ain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 14:33:12",
            "last_seen_utc": "2025-12-02 14:34:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666159": [
        {
            "ioc_value": "sevyn5.seven5pr2y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 14:21:25",
            "last_seen_utc": "2025-12-02 14:24:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666158": [
        {
            "ioc_value": "venpry.seven5pr2y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 14:17:06",
            "last_seen_utc": "2025-12-02 14:17:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666157": [
        {
            "ioc_value": "pravy2.seven5pr2y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 14:07:52",
            "last_seen_utc": "2025-12-02 14:12:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666156": [
        {
            "ioc_value": "spryn.seven5pr2y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 13:55:02",
            "last_seen_utc": "2025-12-02 13:56:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666155": [
        {
            "ioc_value": "sevray.seven5pr2y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 13:42:42",
            "last_seen_utc": "2025-12-02 13:46:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666151": [
        {
            "ioc_value": "trs.jyhsolucion.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-02 13:42:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1666152": [
        {
            "ioc_value": "trs.whitehallalliance.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-02 13:42:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1666146": [
        {
            "ioc_value": "uvelf1.fu1lneve7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 13:32:31",
            "last_seen_utc": "2025-12-02 13:41:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666145": [
        {
            "ioc_value": "flevin.fu1lneve7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 13:23:38",
            "last_seen_utc": "2025-12-02 13:29:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666144": [
        {
            "ioc_value": "lumen7.fu1lneve7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 13:20:24",
            "last_seen_utc": "2025-12-02 13:23:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666143": [
        {
            "ioc_value": "nevar.fu1lneve7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 13:13:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666138": [
        {
            "ioc_value": "fulen.fu1lneve7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 13:03:27",
            "last_seen_utc": "2025-12-02 13:05:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666136": [
        {
            "ioc_value": "nebpt.b2ptb1ryuk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 12:50:17",
            "last_seen_utc": "2025-12-02 13:01:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666135": [
        {
            "ioc_value": "rybuk7.b2ptb1ryuk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 12:49:03",
            "last_seen_utc": "2025-12-02 12:51:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666132": [
        {
            "ioc_value": "ptarb.b2ptb1ryuk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 12:39:54",
            "last_seen_utc": "2025-12-02 12:44:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666131": [
        {
            "ioc_value": "tapel1.b2ptb1ryuk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 12:31:13",
            "last_seen_utc": "2025-12-02 12:39:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666129": [
        {
            "ioc_value": "bryuk.b2ptb1ryuk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 12:22:58",
            "last_seen_utc": "2025-12-02 12:29:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666128": [
        {
            "ioc_value": "a23.nbdsnb2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.fatal_rat",
            "malware_alias": "Sainbox RAT",
            "malware_printable": "FatalRat",
            "first_seen_utc": "2025-12-02 12:12:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-g2gxrs1pap",
            "tags": "C2,domain,fatalrat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666127": [
        {
            "ioc_value": "talcry.decor1cry5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 12:11:28",
            "last_seen_utc": "2025-12-02 12:12:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666123": [
        {
            "ioc_value": "uuuucome.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-12-02 12:09:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-l6yhjazrdz",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666122": [
        {
            "ioc_value": "velorn.decor1cry5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 12:07:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666121": [
        {
            "ioc_value": "coolboy123123431-41087.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-02 12:05:22",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-mv4qvael8x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666120": [
        {
            "ioc_value": "youcool12334213213-52394.portmap.hos",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-02 12:05:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-m4rgwaen4s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666119": [
        {
            "ioc_value": "youcool12334213213-62107.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-02 12:05:14",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-nflgdsep4s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666118": [
        {
            "ioc_value": "youcool12334213213-42391.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-02 12:05:08",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-ngpkfa1nh1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666117": [
        {
            "ioc_value": "youcool12334213213-43544.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-02 12:05:03",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-njq62s1pcx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666113": [
        {
            "ioc_value": "unionserver.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-02 12:03:25",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-lf792szmcx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1666105": [
        {
            "ioc_value": "drift5.decor1cry5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 11:51:14",
            "last_seen_utc": "2025-12-02 11:56:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666104": [
        {
            "ioc_value": "ocryl.decor1cry5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 11:47:34",
            "last_seen_utc": "2025-12-02 11:50:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666103": [
        {
            "ioc_value": "decryn.decor1cry5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 11:34:08",
            "last_seen_utc": "2025-12-02 11:43:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666102": [
        {
            "ioc_value": "dcv.snowtrace.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 11:30:01",
            "last_seen_utc": "2025-12-02 11:33:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666101": [
        {
            "ioc_value": "wne.snowtrace.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 11:24:16",
            "last_seen_utc": "2025-12-02 11:29:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666100": [
        {
            "ioc_value": "68.snowtrace.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 11:21:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666099": [
        {
            "ioc_value": "fjhk.snowtrace.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 11:17:02",
            "last_seen_utc": "2025-12-02 11:18:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666098": [
        {
            "ioc_value": "delta.gr0upw0rk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 11:08:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666084": [
        {
            "ioc_value": "gx0tr.gr0upw0rk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 10:57:51",
            "last_seen_utc": "2025-12-02 11:04:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666083": [
        {
            "ioc_value": "ohbro.krebstresser.st",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.aisuru",
            "malware_alias": null,
            "malware_printable": "Aisuru",
            "first_seen_utc": "2025-12-02 10:56:17",
            "last_seen_utc": "2025-12-03 04:24:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c2d5b05659726d788cbfdcb8585f645096f816a65e39e5e3230c030ea1e628c9/",
            "tags": "AISURU",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666079": [
        {
            "ioc_value": "7juhe.gr0upw0rk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 10:47:27",
            "last_seen_utc": "2025-12-02 10:53:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666078": [
        {
            "ioc_value": "seris.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-02 10:39:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/882358dc8cf66ff68ed248a152aa83ed04a33863df42f46ea5bd472b303f049b/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666077": [
        {
            "ioc_value": "kq.gr0upw0rk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 10:37:45",
            "last_seen_utc": "2025-12-02 10:45:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666076": [
        {
            "ioc_value": "qn.m1stybird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 10:32:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666008": [
        {
            "ioc_value": "s1603.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666009": [
        {
            "ioc_value": "s1619.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666010": [
        {
            "ioc_value": "s1270.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666011": [
        {
            "ioc_value": "s1256.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666012": [
        {
            "ioc_value": "s1533.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666013": [
        {
            "ioc_value": "s1276.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666014": [
        {
            "ioc_value": "s1252.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666015": [
        {
            "ioc_value": "s1264.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666016": [
        {
            "ioc_value": "s1535.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666017": [
        {
            "ioc_value": "s1266.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666018": [
        {
            "ioc_value": "s1244.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666019": [
        {
            "ioc_value": "s1531.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666020": [
        {
            "ioc_value": "s1262.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666021": [
        {
            "ioc_value": "s1254.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666022": [
        {
            "ioc_value": "s1272.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666023": [
        {
            "ioc_value": "s1246.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666024": [
        {
            "ioc_value": "s1248.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666026": [
        {
            "ioc_value": "s1274.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666025": [
        {
            "ioc_value": "s1258.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666027": [
        {
            "ioc_value": "s1268.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666028": [
        {
            "ioc_value": "s1613.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666029": [
        {
            "ioc_value": "s1621.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666030": [
        {
            "ioc_value": "s1617.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666031": [
        {
            "ioc_value": "s1609.house-spirit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-02 10:29:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "popa,proxyware",
            "anonymous": "0",
            "reporter": "synth"
        }
    ],
    "1666074": [
        {
            "ioc_value": "z9l5.m1stybird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 10:27:27",
            "last_seen_utc": "2025-12-02 10:31:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666069": [
        {
            "ioc_value": "beta.m1stybird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 10:16:09",
            "last_seen_utc": "2025-12-02 10:23:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666068": [
        {
            "ioc_value": "v9y32.m1stybird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 10:11:31",
            "last_seen_utc": "2025-12-02 10:15:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666066": [
        {
            "ioc_value": "73r.wildc0ast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 10:07:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666065": [
        {
            "ioc_value": "d038t.wildc0ast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:57:03",
            "last_seen_utc": "2025-12-02 10:03:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666064": [
        {
            "ioc_value": "0zi.wildc0ast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:50:15",
            "last_seen_utc": "2025-12-02 09:54:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666062": [
        {
            "ioc_value": "cpqps.wildc0ast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:45:57",
            "last_seen_utc": "2025-12-02 09:50:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666059": [
        {
            "ioc_value": "o3x5v.c1earstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:41:45",
            "last_seen_utc": "2025-12-02 09:42:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666058": [
        {
            "ioc_value": "ld5f.c1earstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:36:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666057": [
        {
            "ioc_value": "vuqov.c1earstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:29:37",
            "last_seen_utc": "2025-12-02 09:30:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666056": [
        {
            "ioc_value": "qau.c1earstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:24:46",
            "last_seen_utc": "2025-12-02 09:28:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666055": [
        {
            "ioc_value": "lhv.cloudp0nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:19:32",
            "last_seen_utc": "2025-12-02 09:25:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666054": [
        {
            "ioc_value": "wind.cloudp0nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:12:49",
            "last_seen_utc": "2025-12-02 09:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666052": [
        {
            "ioc_value": "fg.cloudp0nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 09:08:07",
            "last_seen_utc": "2025-12-02 09:10:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666050": [
        {
            "ioc_value": "sunny.cloudp0nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 08:53:08",
            "last_seen_utc": "2025-12-02 09:05:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666046": [
        {
            "ioc_value": "jalz.stonef1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 08:43:24",
            "last_seen_utc": "2025-12-02 08:51:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666045": [
        {
            "ioc_value": "pew.stonef1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 08:30:58",
            "last_seen_utc": "2025-12-02 08:41:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666044": [
        {
            "ioc_value": "b2x0.stonef1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 08:24:14",
            "last_seen_utc": "2025-12-02 08:28:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666043": [
        {
            "ioc_value": "owl.stonef1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 08:21:58",
            "last_seen_utc": "2025-12-02 08:22:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666042": [
        {
            "ioc_value": "wild.f1recrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 08:14:45",
            "last_seen_utc": "2025-12-02 08:22:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666041": [
        {
            "ioc_value": "group.f1recrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 08:06:03",
            "last_seen_utc": "2025-12-02 08:07:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666039": [
        {
            "ioc_value": "glow.f1recrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 08:01:57",
            "last_seen_utc": "2025-12-02 08:02:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666032": [
        {
            "ioc_value": "crest.f1recrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:57:40",
            "last_seen_utc": "2025-12-02 07:58:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666006": [
        {
            "ioc_value": "public.dvrexpert.st",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.aisuru",
            "malware_alias": null,
            "malware_printable": "Aisuru",
            "first_seen_utc": "2025-12-02 07:46:07",
            "last_seen_utc": "2025-12-04 08:13:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "AISURU",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1666005": [
        {
            "ioc_value": "work.nightm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:41:05",
            "last_seen_utc": "2025-12-02 07:48:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666003": [
        {
            "ioc_value": "stone.nightm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:37:29",
            "last_seen_utc": "2025-12-02 07:39:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1666002": [
        {
            "ioc_value": "tovool123343123-42020.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-02 07:30:15",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666001": [
        {
            "ioc_value": "to-appreciation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-12-02 07:29:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1666000": [
        {
            "ioc_value": "3h2p.nightm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:29:15",
            "last_seen_utc": "2025-12-02 07:34:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665999": [
        {
            "ioc_value": "silver.nightm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:26:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665998": [
        {
            "ioc_value": "light.forestgl0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:22:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665997": [
        {
            "ioc_value": "night.forestgl0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:18:30",
            "last_seen_utc": "2025-12-02 07:22:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665996": [
        {
            "ioc_value": "efjgerws.galaxias.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-02 07:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/597aa97ab884a7d6e5639aab5f4bfee55e04c76e74d8ea86b4ae8d8509efaf7e/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1665993": [
        {
            "ioc_value": "dl9e.forestgl0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:12:14",
            "last_seen_utc": "2025-12-02 07:16:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665992": [
        {
            "ioc_value": "bz.forestgl0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:09:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665991": [
        {
            "ioc_value": "quick.silenth1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 07:06:24",
            "last_seen_utc": "2025-12-02 07:06:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665988": [
        {
            "ioc_value": "e7.silenth1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 06:52:54",
            "last_seen_utc": "2025-12-02 06:56:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665987": [
        {
            "ioc_value": "31x.silenth1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 06:48:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665986": [
        {
            "ioc_value": "spark.silenth1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 06:35:38",
            "last_seen_utc": "2025-12-02 06:41:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665985": [
        {
            "ioc_value": "xnaw.windsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 06:31:47",
            "last_seen_utc": "2025-12-02 06:35:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665861": [
        {
            "ioc_value": "alexiac.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:40",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665862": [
        {
            "ioc_value": "ascetin.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:39",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665863": [
        {
            "ioc_value": "boflijo.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:38",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665864": [
        {
            "ioc_value": "entraiz.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:37",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665865": [
        {
            "ioc_value": "extirpo.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:36",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665866": [
        {
            "ioc_value": "leonhat.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:36",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665867": [
        {
            "ioc_value": "rotfqxu.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:34",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665868": [
        {
            "ioc_value": "truxaqn.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:32",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665869": [
        {
            "ioc_value": "simonts.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:32",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665870": [
        {
            "ioc_value": "souldey.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:31",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665871": [
        {
            "ioc_value": "townsex.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-02 06:23:30",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1665847": [
        {
            "ioc_value": "soft-dns.sejilod7488888.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-12-02 06:23:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1665983": [
        {
            "ioc_value": "gold.windsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 06:20:26",
            "last_seen_utc": "2025-12-02 06:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665982": [
        {
            "ioc_value": "1qc.windsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 06:12:38",
            "last_seen_utc": "2025-12-02 06:13:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665981": [
        {
            "ioc_value": "5adm.windsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 06:08:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665979": [
        {
            "ioc_value": "jun-suppliers.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-02 06:01:12",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-fajfvaznfn",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665977": [
        {
            "ioc_value": "needs-developed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-02 06:01:11",
            "last_seen_utc": "2025-12-12 18:39:26",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-fzw38s1jhk",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665978": [
        {
            "ioc_value": "envio2777.mysynology.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-02 06:01:11",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251202-fr1fpabn6z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665976": [
        {
            "ioc_value": "sf.deepflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 05:59:06",
            "last_seen_utc": "2025-12-02 06:01:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665975": [
        {
            "ioc_value": "llbf.deepflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 05:47:14",
            "last_seen_utc": "2025-12-02 05:49:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665974": [
        {
            "ioc_value": "shadow.deepflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 05:38:59",
            "last_seen_utc": "2025-12-02 05:42:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665973": [
        {
            "ioc_value": "00f.deepflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 05:34:40",
            "last_seen_utc": "2025-12-02 05:38:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665972": [
        {
            "ioc_value": "coast.w1ndcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 05:28:00",
            "last_seen_utc": "2025-12-02 05:30:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665970": [
        {
            "ioc_value": "h3m.w1ndcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 05:17:36",
            "last_seen_utc": "2025-12-02 05:26:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665969": [
        {
            "ioc_value": "vnq.w1ndcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 05:11:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665968": [
        {
            "ioc_value": "hl.w1ndcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 05:07:53",
            "last_seen_utc": "2025-12-02 05:08:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665967": [
        {
            "ioc_value": "a6u.wildm1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 04:57:33",
            "last_seen_utc": "2025-12-02 05:00:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665966": [
        {
            "ioc_value": "p7l0.wildm1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 04:47:35",
            "last_seen_utc": "2025-12-02 04:48:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665964": [
        {
            "ioc_value": "mzu8.wildm1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 04:37:16",
            "last_seen_utc": "2025-12-02 04:38:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665963": [
        {
            "ioc_value": "flare.wildm1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 04:25:16",
            "last_seen_utc": "2025-12-02 04:28:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665962": [
        {
            "ioc_value": "uw.n1ghtbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 04:14:03",
            "last_seen_utc": "2025-12-02 04:24:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665956": [
        {
            "ioc_value": "sbtua.n1ghtbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 04:02:06",
            "last_seen_utc": "2025-12-02 04:05:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665938": [
        {
            "ioc_value": "6f.n1ghtbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 03:53:51",
            "last_seen_utc": "2025-12-02 03:57:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665937": [
        {
            "ioc_value": "pond.n1ghtbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 03:47:38",
            "last_seen_utc": "2025-12-02 03:48:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665936": [
        {
            "ioc_value": "jn.stoneflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 03:37:43",
            "last_seen_utc": "2025-12-02 03:38:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665935": [
        {
            "ioc_value": "river.stoneflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 03:23:20",
            "last_seen_utc": "2025-12-02 03:28:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665934": [
        {
            "ioc_value": "6tal.stoneflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 03:17:13",
            "last_seen_utc": "2025-12-02 03:17:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665933": [
        {
            "ioc_value": "84m.stoneflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 03:07:25",
            "last_seen_utc": "2025-12-02 03:08:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665932": [
        {
            "ioc_value": "forest.mistyflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 02:58:09",
            "last_seen_utc": "2025-12-02 03:03:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665928": [
        {
            "ioc_value": "368.mistyflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 02:48:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665927": [
        {
            "ioc_value": "x40.mistyflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 02:37:59",
            "last_seen_utc": "2025-12-02 02:44:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665926": [
        {
            "ioc_value": "kd7u.mistyflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 02:26:07",
            "last_seen_utc": "2025-12-02 02:32:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665925": [
        {
            "ioc_value": "j8kd7.brightst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 02:17:31",
            "last_seen_utc": "2025-12-02 02:24:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665924": [
        {
            "ioc_value": "ydb7x.brightst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 02:07:40",
            "last_seen_utc": "2025-12-02 02:08:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665923": [
        {
            "ioc_value": "soft.brightst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 01:57:42",
            "last_seen_utc": "2025-12-02 02:01:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665922": [
        {
            "ioc_value": "k9yn.crystal0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 01:47:24",
            "last_seen_utc": "2025-12-02 01:57:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665921": [
        {
            "ioc_value": "trace.crystal0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 01:41:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665920": [
        {
            "ioc_value": "j1bn.crystal0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 01:35:20",
            "last_seen_utc": "2025-12-02 01:38:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665919": [
        {
            "ioc_value": "alpha.crystal0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 01:27:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665918": [
        {
            "ioc_value": "8m.rivershad0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 01:18:11",
            "last_seen_utc": "2025-12-02 01:21:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665917": [
        {
            "ioc_value": "7c.rivershad0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 01:07:39",
            "last_seen_utc": "2025-12-02 01:12:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665916": [
        {
            "ioc_value": "5h.rivershad0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 00:58:47",
            "last_seen_utc": "2025-12-02 00:59:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665915": [
        {
            "ioc_value": "gate.rivershad0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 00:49:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665914": [
        {
            "ioc_value": "19r6l.softgl1de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 00:44:58",
            "last_seen_utc": "2025-12-02 00:49:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665913": [
        {
            "ioc_value": "92nr.softgl1de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 00:37:37",
            "last_seen_utc": "2025-12-02 00:42:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665912": [
        {
            "ioc_value": "7qqa.softgl1de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 00:27:17",
            "last_seen_utc": "2025-12-02 00:36:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665911": [
        {
            "ioc_value": "g6vi.softgl1de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 00:17:22",
            "last_seen_utc": "2025-12-02 00:23:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665910": [
        {
            "ioc_value": "crystal.cloudb1te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-02 00:08:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665906": [
        {
            "ioc_value": "silent.cloudb1te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 23:58:15",
            "last_seen_utc": "2025-12-02 00:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665905": [
        {
            "ioc_value": "bold.cloudb1te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 23:47:51",
            "last_seen_utc": "2025-12-01 23:50:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665904": [
        {
            "ioc_value": "hzjx5.cloudb1te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 23:37:59",
            "last_seen_utc": "2025-12-01 23:40:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665903": [
        {
            "ioc_value": "n9vgt.n1ghtowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 23:31:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665902": [
        {
            "ioc_value": "3047.n1ghtowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 23:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665901": [
        {
            "ioc_value": "2fd.n1ghtowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 23:17:32",
            "last_seen_utc": "2025-12-01 23:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665900": [
        {
            "ioc_value": "dg45.n1ghtowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 23:05:42",
            "last_seen_utc": "2025-12-01 23:13:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665889": [
        {
            "ioc_value": "c21.sun5t0rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 22:56:20",
            "last_seen_utc": "2025-12-01 23:04:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665888": [
        {
            "ioc_value": "6n.sun5t0rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 22:47:03",
            "last_seen_utc": "2025-12-01 22:56:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665887": [
        {
            "ioc_value": "yxhsc.sun5t0rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 22:41:52",
            "last_seen_utc": "2025-12-01 22:43:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665886": [
        {
            "ioc_value": "jv.sun5t0rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 22:37:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665885": [
        {
            "ioc_value": "ljo.cl0udfall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 22:27:49",
            "last_seen_utc": "2025-12-01 22:35:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665883": [
        {
            "ioc_value": "mariklogisaretina.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-01 22:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.135",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665882": [
        {
            "ioc_value": "varchidublikatsre.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-01 22:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.133",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665881": [
        {
            "ioc_value": "yj.cl0udfall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 22:18:02",
            "last_seen_utc": "2025-12-01 22:25:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665880": [
        {
            "ioc_value": "kristimalayasrtertyu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-01 22:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.137",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665879": [
        {
            "ioc_value": "uxizfixcomplandrush.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-01 22:17:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.136",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665878": [
        {
            "ioc_value": "gigastlasteryux.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-01 22:16:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.134",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665877": [
        {
            "ioc_value": "fliarcibasdoklosave.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-01 22:14:24",
            "last_seen_utc": "2025-12-01 22:15:34",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.132",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665876": [
        {
            "ioc_value": "xuykoliuasdopin.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-12-01 22:13:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.208.159",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665875": [
        {
            "ioc_value": "frost.cl0udfall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 22:07:48",
            "last_seen_utc": "2025-12-01 22:11:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665874": [
        {
            "ioc_value": "apomlwi.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-12-01 22:03:27",
            "last_seen_utc": "2025-12-13 17:40:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665873": [
        {
            "ioc_value": "17gx.cl0udfall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 21:57:29",
            "last_seen_utc": "2025-12-01 22:03:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665872": [
        {
            "ioc_value": "hqo.soft5and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 21:47:37",
            "last_seen_utc": "2025-12-01 21:55:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665860": [
        {
            "ioc_value": "field.soft5and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 21:37:19",
            "last_seen_utc": "2025-12-01 21:45:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665859": [
        {
            "ioc_value": "io9.soft5and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 21:33:12",
            "last_seen_utc": "2025-12-01 21:34:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665858": [
        {
            "ioc_value": "p0.soft5and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 21:27:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665857": [
        {
            "ioc_value": "1cwm.wildf1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 21:17:13",
            "last_seen_utc": "2025-12-01 21:26:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665856": [
        {
            "ioc_value": "p5.wildf1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 21:08:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665855": [
        {
            "ioc_value": "bsnpt.wildf1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 21:05:14",
            "last_seen_utc": "2025-12-01 21:08:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665854": [
        {
            "ioc_value": "dbg.wildf1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 20:58:00",
            "last_seen_utc": "2025-12-01 20:58:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665853": [
        {
            "ioc_value": "c81.darkm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 20:48:07",
            "last_seen_utc": "2025-12-01 20:57:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665852": [
        {
            "ioc_value": "pft5.darkm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 20:36:50",
            "last_seen_utc": "2025-12-01 20:41:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665849": [
        {
            "ioc_value": "rm32.darkm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 20:29:36",
            "last_seen_utc": "2025-12-01 20:32:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665848": [
        {
            "ioc_value": "wm6ko.darkm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 20:20:50",
            "last_seen_utc": "2025-12-01 20:28:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665845": [
        {
            "ioc_value": "www.mpsloan.site.loanbankbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-12-01 20:03:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.14.23.42+www.mpsloan.site.loanbankbd.com",
            "tags": "AS152698,C2,censys,Gafgyt,open-dir,ZORN-AS-AP",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665843": [
        {
            "ioc_value": "throughput.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-01 20:01:47",
            "last_seen_utc": "2025-12-01 23:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+throughput.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665840": [
        {
            "ioc_value": "sunshinefertility.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-01 20:01:46",
            "last_seen_utc": "2025-12-01 23:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+sunshinefertility.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665841": [
        {
            "ioc_value": "shea-ray.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-01 20:01:46",
            "last_seen_utc": "2025-12-01 23:00:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+shea-ray.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665842": [
        {
            "ioc_value": "ohmwellbeing.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-12-01 20:01:46",
            "last_seen_utc": "2025-12-01 23:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+ohmwellbeing.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665832": [
        {
            "ioc_value": "qou8q.boldf0nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 20:00:41",
            "last_seen_utc": "2025-12-01 20:11:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665812": [
        {
            "ioc_value": "wnlgghgffr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665813": [
        {
            "ioc_value": "wpaxdlstrs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665814": [
        {
            "ioc_value": "wqfmumga.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665815": [
        {
            "ioc_value": "wvogkbbapujp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665816": [
        {
            "ioc_value": "wwgxwnil.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665817": [
        {
            "ioc_value": "wxurahlisqbmppqss.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665818": [
        {
            "ioc_value": "xeucibnop.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665819": [
        {
            "ioc_value": "xnttkdfunybxgn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665820": [
        {
            "ioc_value": "xoodachpaujnikmpp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665821": [
        {
            "ioc_value": "xqdrbrjiqwwpahhk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665822": [
        {
            "ioc_value": "xsredbpaef.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665823": [
        {
            "ioc_value": "xxkoixiiiqpyecxoaka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665824": [
        {
            "ioc_value": "yicgycrtyoxaiu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665825": [
        {
            "ioc_value": "ykesfabqxbvmns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665826": [
        {
            "ioc_value": "ykkcsanct.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665827": [
        {
            "ioc_value": "ynergdikorjg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665828": [
        {
            "ioc_value": "yqvndqgijbpmx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665829": [
        {
            "ioc_value": "yyeyutjgnsfrmswdygl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665787": [
        {
            "ioc_value": "txapbjdlsrtpea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665788": [
        {
            "ioc_value": "ucwkkgbdxvjexa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665789": [
        {
            "ioc_value": "udvnniovrov.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665790": [
        {
            "ioc_value": "ugwytktvhslgjm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665791": [
        {
            "ioc_value": "uigwsscasowqdiyp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665792": [
        {
            "ioc_value": "uilmabdaxqlaxuj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665793": [
        {
            "ioc_value": "uiwbtjfp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665794": [
        {
            "ioc_value": "umiuqmrmvsuiscitx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665795": [
        {
            "ioc_value": "ushfktptgmspn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665796": [
        {
            "ioc_value": "utpsygswnjjw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665797": [
        {
            "ioc_value": "uxlyihgvfnqcrfcf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665798": [
        {
            "ioc_value": "uxqbewwdunihwscfl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665799": [
        {
            "ioc_value": "vgfsnrewuxeaoxoh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665800": [
        {
            "ioc_value": "vlupfbsuppipkrvbsdy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665801": [
        {
            "ioc_value": "vmdgwbenh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665802": [
        {
            "ioc_value": "vmhgbribbhm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665803": [
        {
            "ioc_value": "vmurixwrquhb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665804": [
        {
            "ioc_value": "vnskyqlkrdfnnp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665805": [
        {
            "ioc_value": "vvhvidpeog.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665806": [
        {
            "ioc_value": "vxpxgorqkihafv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665807": [
        {
            "ioc_value": "vyibjxjnshtry.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665808": [
        {
            "ioc_value": "watqjvqnf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665809": [
        {
            "ioc_value": "wgkyyalemnvhdrai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665810": [
        {
            "ioc_value": "wiyqctbhe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665811": [
        {
            "ioc_value": "wldpcgpkdxhdhvlpjc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665761": [
        {
            "ioc_value": "qsrywodlwhorwibvy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665762": [
        {
            "ioc_value": "qwfxemkbuee.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665763": [
        {
            "ioc_value": "qxdfhujechixcrgdb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665764": [
        {
            "ioc_value": "rapbmprhwwm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665765": [
        {
            "ioc_value": "rcnnhkcagerrquby.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665766": [
        {
            "ioc_value": "relmyplngdrdxpyv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665767": [
        {
            "ioc_value": "rgcdictp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665768": [
        {
            "ioc_value": "rhoaahddyhbg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665769": [
        {
            "ioc_value": "rkxukunrgvpkgmc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665770": [
        {
            "ioc_value": "rsmhdfgpgw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665771": [
        {
            "ioc_value": "rtcocsaitmadupgl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665772": [
        {
            "ioc_value": "rwjsxxvvkbspdjoedi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665773": [
        {
            "ioc_value": "rxckgnatt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665774": [
        {
            "ioc_value": "secdfbpyopjhyhuw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665775": [
        {
            "ioc_value": "sgjwptrfosjeico.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665776": [
        {
            "ioc_value": "sliokrvnkjenhwgpjl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665777": [
        {
            "ioc_value": "slmomdmcjuoaxdip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665778": [
        {
            "ioc_value": "snpltixygwcpifp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665779": [
        {
            "ioc_value": "sptihuxubpj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665780": [
        {
            "ioc_value": "suhfvuljuihmevldp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665781": [
        {
            "ioc_value": "tfgixgmqhdowexm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665782": [
        {
            "ioc_value": "tfpohsjc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665783": [
        {
            "ioc_value": "ticfmjsce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665784": [
        {
            "ioc_value": "tnueoqahys.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665785": [
        {
            "ioc_value": "tuisyirhweflhvqyxh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665786": [
        {
            "ioc_value": "tvxwdutxo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665737": [
        {
            "ioc_value": "nyyhahsslkflyhulcgl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665738": [
        {
            "ioc_value": "oaifpapl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665739": [
        {
            "ioc_value": "obcjfjseku.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665740": [
        {
            "ioc_value": "ocnsfoyrdplmewnyx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665741": [
        {
            "ioc_value": "ohpmyviumie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665742": [
        {
            "ioc_value": "ojmitlcyjsuyb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665743": [
        {
            "ioc_value": "ojvpkaohbddmbfac.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665744": [
        {
            "ioc_value": "omsilsdcpdsgpxm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665745": [
        {
            "ioc_value": "oqayununxmqdxo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665746": [
        {
            "ioc_value": "oukicfldnvxhrtxvuqr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665747": [
        {
            "ioc_value": "ouwwtmcnuiudw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665748": [
        {
            "ioc_value": "oxjlrgepfnkvdprbr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665749": [
        {
            "ioc_value": "pbwjbkgdo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665750": [
        {
            "ioc_value": "pdcdcwjwrqsq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665751": [
        {
            "ioc_value": "pphxfntktjvhgti.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665752": [
        {
            "ioc_value": "ppwnhnvwnvtggifhbv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665753": [
        {
            "ioc_value": "prcgijpwvrl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665754": [
        {
            "ioc_value": "pvbmlrybufe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665755": [
        {
            "ioc_value": "qadjgxayck.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665756": [
        {
            "ioc_value": "qanmwnpvpcyqsa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665757": [
        {
            "ioc_value": "qbpcpmcijn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665758": [
        {
            "ioc_value": "qdfgqwiovjlfegdcepm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665759": [
        {
            "ioc_value": "qfitnlxp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665760": [
        {
            "ioc_value": "qqsvttcnvsigkh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665714": [
        {
            "ioc_value": "ldanknmdiqtrot.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665715": [
        {
            "ioc_value": "lgeohbboqpngfap.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665716": [
        {
            "ioc_value": "lnjrtxcjbiaov.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665717": [
        {
            "ioc_value": "lvmrpvkyo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665718": [
        {
            "ioc_value": "lyghwyciguta.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665719": [
        {
            "ioc_value": "mavjlatqkpuban.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665720": [
        {
            "ioc_value": "mcchphgndpadclga.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665721": [
        {
            "ioc_value": "mcnegeytoyh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665722": [
        {
            "ioc_value": "mefqtfwlxrfhguru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665723": [
        {
            "ioc_value": "mggtqypybfts.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665724": [
        {
            "ioc_value": "mjuqovvuruldy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665725": [
        {
            "ioc_value": "mlhlurqylttjc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665726": [
        {
            "ioc_value": "mmmngmrhvvohfnv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665727": [
        {
            "ioc_value": "mpefryhfpwhfvj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665728": [
        {
            "ioc_value": "mstwcsnvylmullkqh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665729": [
        {
            "ioc_value": "mwiadfsqcbjkudxd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665730": [
        {
            "ioc_value": "nbvhroptghtmsydrfq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665731": [
        {
            "ioc_value": "nirxlosffmarpbp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665732": [
        {
            "ioc_value": "njqvexdhwhutar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665733": [
        {
            "ioc_value": "ntnwcxtwgxwecrdxr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665734": [
        {
            "ioc_value": "ntohnxgjijsgi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665735": [
        {
            "ioc_value": "nwetlnpjovgxmj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665736": [
        {
            "ioc_value": "nwrqebry.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665693": [
        {
            "ioc_value": "ilasqwag.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665694": [
        {
            "ioc_value": "iljmekbkcukps.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665695": [
        {
            "ioc_value": "irfldtfkhgyrpsarcje.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665696": [
        {
            "ioc_value": "ixnaxrqn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665697": [
        {
            "ioc_value": "jabdfnuridle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665698": [
        {
            "ioc_value": "jdrqnbtklqwqrv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665699": [
        {
            "ioc_value": "jexgpprgph.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665700": [
        {
            "ioc_value": "jfvxpfbgo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665701": [
        {
            "ioc_value": "jktlguslfhcwqkmai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665702": [
        {
            "ioc_value": "jmvkyepiiqyixw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665703": [
        {
            "ioc_value": "jnjgogpcehsdkbnl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665704": [
        {
            "ioc_value": "jxnbdfwh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665705": [
        {
            "ioc_value": "kgrrxfmyixossjmk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665706": [
        {
            "ioc_value": "kiiwacbehxexixl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665707": [
        {
            "ioc_value": "kjjeuhhqiwvfnuvvtkd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665708": [
        {
            "ioc_value": "kmyxdodog.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665709": [
        {
            "ioc_value": "kpkyaxyytagbk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665710": [
        {
            "ioc_value": "kqrkegigdtjxxcrvl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665711": [
        {
            "ioc_value": "ktdofbmltjyt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665712": [
        {
            "ioc_value": "kvoxyhnaggyqrcc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665713": [
        {
            "ioc_value": "laiotlboxklvpcdfhu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665670": [
        {
            "ioc_value": "fokvmmygnngm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665671": [
        {
            "ioc_value": "fsksblipt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665672": [
        {
            "ioc_value": "fssuatmti.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665673": [
        {
            "ioc_value": "fujosogkpsxthf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665674": [
        {
            "ioc_value": "fxkapveygtffbkv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665675": [
        {
            "ioc_value": "ggpmcodfppkjirg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665676": [
        {
            "ioc_value": "gjvhfiouvwiqvtewbu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665677": [
        {
            "ioc_value": "gkholyjchymn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665678": [
        {
            "ioc_value": "gkusimsgjcauehgdjn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665679": [
        {
            "ioc_value": "gmeuasnn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665680": [
        {
            "ioc_value": "gqmrhecnntccmawclmq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665681": [
        {
            "ioc_value": "gwbdgrlikclhthyivym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665682": [
        {
            "ioc_value": "haqkwkokaigcdslnrlr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665683": [
        {
            "ioc_value": "hbwpvcnwwcdgfojuixm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665684": [
        {
            "ioc_value": "hetjymgiddyamqq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665685": [
        {
            "ioc_value": "hfegocufjkndwc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665686": [
        {
            "ioc_value": "hgubujdad.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665687": [
        {
            "ioc_value": "hhowujyrcvdrwpdvsck.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665688": [
        {
            "ioc_value": "hijkitpq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665689": [
        {
            "ioc_value": "hugnnpnymbwnhtuh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665690": [
        {
            "ioc_value": "hxpgffdwbevww.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665691": [
        {
            "ioc_value": "iedaagmofvk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665692": [
        {
            "ioc_value": "ihoxyanyker.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665648": [
        {
            "ioc_value": "dfyxptqjxwtdkjjbiu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665649": [
        {
            "ioc_value": "dgrdrqkpmggukqo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665650": [
        {
            "ioc_value": "dlsvfpmniphnmxnvoeo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665651": [
        {
            "ioc_value": "dpjbclufd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665652": [
        {
            "ioc_value": "dpyeoipbso.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665653": [
        {
            "ioc_value": "drpfrkvdttdkhgpqi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665654": [
        {
            "ioc_value": "dthcjcsdxywxlsng.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665655": [
        {
            "ioc_value": "dxovrcmyletmggxf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665656": [
        {
            "ioc_value": "dykxkasesippbsjb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665657": [
        {
            "ioc_value": "dypislng.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665658": [
        {
            "ioc_value": "ebddteinurkortapgs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665659": [
        {
            "ioc_value": "ecmdkxukhtf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665660": [
        {
            "ioc_value": "edqmjbyjcxyjqnjjodh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665661": [
        {
            "ioc_value": "egcftpguclkoi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665662": [
        {
            "ioc_value": "eijahjdmm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665663": [
        {
            "ioc_value": "ejjogggfqcmc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665664": [
        {
            "ioc_value": "erfhytwpgitkpgudo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665665": [
        {
            "ioc_value": "expecvmanfaydv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665666": [
        {
            "ioc_value": "fdkasoupvgxigejgdfb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665667": [
        {
            "ioc_value": "fidjlfphserhycexjhf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665668": [
        {
            "ioc_value": "fkcxdfiv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665669": [
        {
            "ioc_value": "fksudkswknxd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665630": [
        {
            "ioc_value": "adhcssvuayv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665631": [
        {
            "ioc_value": "agpdvawvr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665632": [
        {
            "ioc_value": "aguhlabfubbvek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665633": [
        {
            "ioc_value": "amobragjgge.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665634": [
        {
            "ioc_value": "anxpepxpukbfmh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665635": [
        {
            "ioc_value": "arhpgoeeasi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665636": [
        {
            "ioc_value": "awckeliqcherasntmin.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665637": [
        {
            "ioc_value": "bbmfswfgmljwj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665638": [
        {
            "ioc_value": "bklerdwiadlxxbjunwu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665639": [
        {
            "ioc_value": "bllkuhftropiwymr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665640": [
        {
            "ioc_value": "btfkjkqv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665641": [
        {
            "ioc_value": "bxnrxuyjcytf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665642": [
        {
            "ioc_value": "byraiyodqfdx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665643": [
        {
            "ioc_value": "caosuihgsvivlxh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665644": [
        {
            "ioc_value": "catvfmsxowehqvfahu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665645": [
        {
            "ioc_value": "cpmsussgpibatpmswq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665646": [
        {
            "ioc_value": "cqlmxlukplhlfdo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665647": [
        {
            "ioc_value": "cswtnpnuhixdwjgm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-12-01 19:51:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665628": [
        {
            "ioc_value": "login.maintainertools.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-01 19:51:16",
            "last_seen_utc": "2025-12-01 19:51:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665629": [
        {
            "ioc_value": "sso.maintainertools.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-01 19:51:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665625": [
        {
            "ioc_value": "jsr.boldf0nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 19:50:16",
            "last_seen_utc": "2025-12-01 19:54:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665623": [
        {
            "ioc_value": "83.boldf0nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 19:44:26",
            "last_seen_utc": "2025-12-01 20:19:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665620": [
        {
            "ioc_value": "bright.fireh0rn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 19:38:15",
            "last_seen_utc": "2025-12-01 19:43:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665619": [
        {
            "ioc_value": "nl.fireh0rn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 19:22:42",
            "last_seen_utc": "2025-12-01 19:25:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665618": [
        {
            "ioc_value": "i4u.fireh0rn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 19:17:03",
            "last_seen_utc": "2025-12-01 19:18:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665616": [
        {
            "ioc_value": "q9l.fireh0rn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 19:07:43",
            "last_seen_utc": "2025-12-01 19:14:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665615": [
        {
            "ioc_value": "zk3.deepw0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 18:57:54",
            "last_seen_utc": "2025-12-01 19:02:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665612": [
        {
            "ioc_value": "x85.deepw0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 18:46:37",
            "last_seen_utc": "2025-12-01 18:56:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665607": [
        {
            "ioc_value": "ocmdj.deepw0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 18:41:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665606": [
        {
            "ioc_value": "5h0tb.deepw0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 18:31:22",
            "last_seen_utc": "2025-12-01 18:35:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665605": [
        {
            "ioc_value": "whichphablet.highheelsplace.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 18:31:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665603": [
        {
            "ioc_value": "ilvisa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 18:30:24",
            "last_seen_utc": "2025-12-08 19:00:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665601": [
        {
            "ioc_value": "livingstonscleaning.com.mobimark.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 18:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665598": [
        {
            "ioc_value": "suzume-design.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 18:26:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665597": [
        {
            "ioc_value": "1v.fastl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 18:25:10",
            "last_seen_utc": "2025-12-01 18:30:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665595": [
        {
            "ioc_value": "sosracismjuif2025.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 18:22:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665593": [
        {
            "ioc_value": "ry9.fastl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 18:18:08",
            "last_seen_utc": "2025-12-01 18:18:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665592": [
        {
            "ioc_value": "e8vdb.fastl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 18:07:09",
            "last_seen_utc": "2025-12-01 18:13:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665589": [
        {
            "ioc_value": "central-comes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-01 18:01:09",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251201-s92gxstjcm",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665588": [
        {
            "ioc_value": "icejqq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 17:59:15",
            "last_seen_utc": "2025-12-02 22:41:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665586": [
        {
            "ioc_value": "account-bookcaptcha.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 17:57:39",
            "last_seen_utc": "2025-12-01 18:00:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665584": [
        {
            "ioc_value": "account-extranetpulser.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 17:56:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665576": [
        {
            "ioc_value": "omega.fastl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 17:53:11",
            "last_seen_utc": "2025-12-01 17:54:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665575": [
        {
            "ioc_value": "session-verify-118-secure-7222.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 17:50:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665573": [
        {
            "ioc_value": "auth-device-553-security-3314.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 17:49:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665571": [
        {
            "ioc_value": "b20gc.sea5t0rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 17:47:59",
            "last_seen_utc": "2025-12-01 17:49:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665570": [
        {
            "ioc_value": "skygrowthhq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 17:47:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1665566": [
        {
            "ioc_value": "lojl5.sea5t0rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 17:33:36",
            "last_seen_utc": "2025-12-01 17:43:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665564": [
        {
            "ioc_value": "oly.sea5t0rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 17:24:51",
            "last_seen_utc": "2025-12-01 17:28:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665563": [
        {
            "ioc_value": "tuh.sea5t0rm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 17:17:32",
            "last_seen_utc": "2025-12-01 17:21:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665562": [
        {
            "ioc_value": "hfvty.f1eldgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 17:09:12",
            "last_seen_utc": "2025-12-01 17:13:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665561": [
        {
            "ioc_value": "enrb3.f1eldgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 17:06:33",
            "last_seen_utc": "2025-12-01 17:08:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665559": [
        {
            "ioc_value": "2do9h.f1eldgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 16:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665558": [
        {
            "ioc_value": "silver.f1eldgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 16:42:15",
            "last_seen_utc": "2025-12-01 16:45:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665557": [
        {
            "ioc_value": "jjrx.a4chptr1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 16:38:24",
            "last_seen_utc": "2025-12-01 16:41:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665556": [
        {
            "ioc_value": "d81vh.a4chptr1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 16:33:07",
            "last_seen_utc": "2025-12-01 16:36:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665555": [
        {
            "ioc_value": "spark.a4chptr1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 16:27:52",
            "last_seen_utc": "2025-12-01 16:32:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665552": [
        {
            "ioc_value": "o8v8m.a4chptr1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 16:12:59",
            "last_seen_utc": "2025-12-01 16:23:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665551": [
        {
            "ioc_value": "a6rmr.compo5tc0or.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 16:07:39",
            "last_seen_utc": "2025-12-01 16:11:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665543": [
        {
            "ioc_value": "y2.compo5tc0or.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 15:53:46",
            "last_seen_utc": "2025-12-01 16:06:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665542": [
        {
            "ioc_value": "eiz.compo5tc0or.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 15:47:32",
            "last_seen_utc": "2025-12-01 15:49:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665541": [
        {
            "ioc_value": "y936b.compo5tc0or.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 15:36:12",
            "last_seen_utc": "2025-12-01 15:41:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665540": [
        {
            "ioc_value": "light.imp2rtund0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 15:22:18",
            "last_seen_utc": "2025-12-01 15:24:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665539": [
        {
            "ioc_value": "u1y.imp2rtund0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 15:16:05",
            "last_seen_utc": "2025-12-01 15:19:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665538": [
        {
            "ioc_value": "wylf.imp2rtund0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 15:12:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665537": [
        {
            "ioc_value": "bbd.imp2rtund0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 15:08:02",
            "last_seen_utc": "2025-12-01 15:11:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665536": [
        {
            "ioc_value": "dhyt7.bri8hten0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 15:03:49",
            "last_seen_utc": "2025-12-01 15:06:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665535": [
        {
            "ioc_value": "gold.bri8hten0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 14:59:03",
            "last_seen_utc": "2025-12-01 15:02:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665534": [
        {
            "ioc_value": "z3f7x.bri8hten0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 14:55:52",
            "last_seen_utc": "2025-12-01 14:57:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665533": [
        {
            "ioc_value": "987i.bri8hten0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 14:47:37",
            "last_seen_utc": "2025-12-01 14:48:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665522": [
        {
            "ioc_value": "uortyfivev.crabdance.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-01 14:40:21",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/53bd45a2da8a0db00c6202fd66651bde1b5ede0cdee998654c64d037ccfa9b68/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1665521": [
        {
            "ioc_value": "onebyoneset.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-12-01 14:40:20",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/53bd45a2da8a0db00c6202fd66651bde1b5ede0cdee998654c64d037ccfa9b68/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1665520": [
        {
            "ioc_value": "2huv.itki5se1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 14:39:47",
            "last_seen_utc": "2025-12-01 14:41:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665519": [
        {
            "ioc_value": "zpa.itki5se1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 14:33:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665518": [
        {
            "ioc_value": "dt4h2.itki5se1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 14:30:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665517": [
        {
            "ioc_value": "gbeq.itki5se1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 14:21:40",
            "last_seen_utc": "2025-12-01 14:25:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665516": [
        {
            "ioc_value": "4s.g4eyhhar1eq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 14:12:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665512": [
        {
            "ioc_value": "ulaicavr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-12-01 14:10:44",
            "last_seen_utc": "2025-12-01 14:06:54",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115644695006378271",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1665515": [
        {
            "ioc_value": "xj8qd.g4eyhhar1eq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 14:07:35",
            "last_seen_utc": "2025-12-01 14:10:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665510": [
        {
            "ioc_value": "wba1.g4eyhhar1eq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 13:58:20",
            "last_seen_utc": "2025-12-01 14:06:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665504": [
        {
            "ioc_value": "jxad.g4eyhhar1eq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 13:48:02",
            "last_seen_utc": "2025-12-01 13:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665503": [
        {
            "ioc_value": "zu.dnet.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 13:45:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://urlhaus.abuse.ch/url/3552617/",
            "tags": "irc,ircbot",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1665501": [
        {
            "ioc_value": "j4.gre2tre7ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 13:38:15",
            "last_seen_utc": "2025-12-01 13:43:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665500": [
        {
            "ioc_value": "tj.gre2tre7ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 13:27:58",
            "last_seen_utc": "2025-12-01 13:30:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665498": [
        {
            "ioc_value": "p20o.gre2tre7ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 13:17:37",
            "last_seen_utc": "2025-12-01 13:26:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665494": [
        {
            "ioc_value": "nexthosting.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-12-01 13:06:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6a6143a7219f352c1d36fc2844861d2faf9bef8c172b719b397c9fbecc031b6d/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1665492": [
        {
            "ioc_value": "bbl.jyhsolucion.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-01 13:06:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1665493": [
        {
            "ioc_value": "bbl.whitehallalliance.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-01 13:06:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1665489": [
        {
            "ioc_value": "shadow.gre2tre7ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 13:04:49",
            "last_seen_utc": "2025-12-01 13:07:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665487": [
        {
            "ioc_value": "jgvs.amb1gf0rest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 12:55:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665485": [
        {
            "ioc_value": "rwg.amb1gf0rest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 12:47:28",
            "last_seen_utc": "2025-12-01 12:52:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665484": [
        {
            "ioc_value": "uv3mf.amb1gf0rest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 12:37:27",
            "last_seen_utc": "2025-12-01 12:42:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665483": [
        {
            "ioc_value": "iv.amb1gf0rest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 12:30:11",
            "last_seen_utc": "2025-12-01 12:34:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665482": [
        {
            "ioc_value": "gate.c1earrec0ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 12:26:03",
            "last_seen_utc": "2025-12-01 12:27:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665481": [
        {
            "ioc_value": "3ul.c1earrec0ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 12:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665480": [
        {
            "ioc_value": "kfl6f.c1earrec0ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 12:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665478": [
        {
            "ioc_value": "k0l.c1earrec0ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 12:03:08",
            "last_seen_utc": "2025-12-01 12:12:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665476": [
        {
            "ioc_value": "dec-end.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-12-01 12:01:22",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251201-mwcczshs7d",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1665474": [
        {
            "ioc_value": "storm.co7nrev0ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 11:56:54",
            "last_seen_utc": "2025-12-01 12:01:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665470": [
        {
            "ioc_value": "3l.co7nrev0ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 11:47:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665469": [
        {
            "ioc_value": "a5wnr.co7nrev0ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 11:35:40",
            "last_seen_utc": "2025-12-01 11:41:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665468": [
        {
            "ioc_value": "ecioc.co7nrev0ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 11:24:17",
            "last_seen_utc": "2025-12-01 11:34:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665467": [
        {
            "ioc_value": "0imm.sh2mvi5cous.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 11:16:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665466": [
        {
            "ioc_value": "nln8.sh2mvi5cous.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 11:07:09",
            "last_seen_utc": "2025-12-01 11:10:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665453": [
        {
            "ioc_value": "ov1.sh2mvi5cous.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 10:57:19",
            "last_seen_utc": "2025-12-01 10:59:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665451": [
        {
            "ioc_value": "deep.sh2mvi5cous.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 10:45:48",
            "last_seen_utc": "2025-12-01 10:55:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665450": [
        {
            "ioc_value": "wild.windm1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 10:43:12",
            "last_seen_utc": "2025-12-01 10:45:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665449": [
        {
            "ioc_value": "l0.windm1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 10:39:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665448": [
        {
            "ioc_value": "hn.windm1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 10:32:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665447": [
        {
            "ioc_value": "c9iz.windm1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 10:25:38",
            "last_seen_utc": "2025-12-01 10:26:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665445": [
        {
            "ioc_value": "support.kingwoodcomputercenter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-12-01 10:16:07",
            "last_seen_utc": "2025-12-07 10:23:12",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115643762709334726",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1665446": [
        {
            "ioc_value": "xd.br1ckw0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 10:12:43",
            "last_seen_utc": "2025-12-01 10:22:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665444": [
        {
            "ioc_value": "7k24.br1ckw0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 10:08:42",
            "last_seen_utc": "2025-12-01 10:10:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665441": [
        {
            "ioc_value": "969.br1ckw0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 10:00:24",
            "last_seen_utc": "2025-12-01 10:06:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665440": [
        {
            "ioc_value": "7r8r.br1ckw0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 09:52:31",
            "last_seen_utc": "2025-12-01 09:56:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665439": [
        {
            "ioc_value": "cloudy.quickf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 09:48:29",
            "last_seen_utc": "2025-12-01 09:48:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665438": [
        {
            "ioc_value": "mx283.quickf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 09:37:05",
            "last_seen_utc": "2025-12-01 09:46:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665437": [
        {
            "ioc_value": "hq.quickf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 09:27:13",
            "last_seen_utc": "2025-12-01 09:34:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665435": [
        {
            "ioc_value": "u7b9.quickf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 09:13:06",
            "last_seen_utc": "2025-12-01 09:23:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665434": [
        {
            "ioc_value": "gamma.f1rest0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 09:08:48",
            "last_seen_utc": "2025-12-01 09:11:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665433": [
        {
            "ioc_value": "bold.f1rest0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 09:01:31",
            "last_seen_utc": "2025-12-01 09:06:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665430": [
        {
            "ioc_value": "wind.f1rest0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 08:55:50",
            "last_seen_utc": "2025-12-01 08:58:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665429": [
        {
            "ioc_value": "qq.f1rest0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 08:47:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665428": [
        {
            "ioc_value": "x4dpn.sun5park.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 08:31:32",
            "last_seen_utc": "2025-12-01 08:33:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665427": [
        {
            "ioc_value": "q6.sun5park.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 08:26:44",
            "last_seen_utc": "2025-12-01 08:28:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665426": [
        {
            "ioc_value": "zwdq.sun5park.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 08:16:44",
            "last_seen_utc": "2025-12-01 08:18:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665425": [
        {
            "ioc_value": "zrq0.sun5park.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 08:10:29",
            "last_seen_utc": "2025-12-01 08:11:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665424": [
        {
            "ioc_value": "zj1ij.sun5hine.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 08:04:10",
            "last_seen_utc": "2025-12-01 08:06:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665413": [
        {
            "ioc_value": "61.sun5hine.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 07:57:56",
            "last_seen_utc": "2025-12-01 07:59:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665412": [
        {
            "ioc_value": "delta.sun5hine.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 07:48:11",
            "last_seen_utc": "2025-12-01 07:49:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665399": [
        {
            "ioc_value": "soft.sun5hine.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 07:33:46",
            "last_seen_utc": "2025-12-01 07:35:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665398": [
        {
            "ioc_value": "fox.cl0udland.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 07:23:46",
            "last_seen_utc": "2025-12-01 07:26:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665397": [
        {
            "ioc_value": "vs.cl0udland.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 07:17:31",
            "last_seen_utc": "2025-12-01 07:19:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665396": [
        {
            "ioc_value": "nmqg.cl0udland.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 07:11:17",
            "last_seen_utc": "2025-12-01 07:12:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665391": [
        {
            "ioc_value": "class-rouge.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-01 07:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665392": [
        {
            "ioc_value": "contains-are.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-01 07:09:20",
            "last_seen_utc": "2025-12-03 07:03:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665393": [
        {
            "ioc_value": "physical-concepts.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-01 07:09:20",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665388": [
        {
            "ioc_value": "sync.dareck.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665389": [
        {
            "ioc_value": "sync.juzgadorama.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665380": [
        {
            "ioc_value": "api.dareck.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665381": [
        {
            "ioc_value": "api.juzgadorama.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665382": [
        {
            "ioc_value": "cdn.dareck.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665383": [
        {
            "ioc_value": "cdn.juzgadorama.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665384": [
        {
            "ioc_value": "cloud.dareck.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665385": [
        {
            "ioc_value": "cloud.juzgadorama.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665386": [
        {
            "ioc_value": "portal.dareck.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665387": [
        {
            "ioc_value": "portal.juzgadorama.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-12-01 07:08:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1665376": [
        {
            "ioc_value": "quick.cl0udland.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 07:05:32",
            "last_seen_utc": "2025-12-01 07:06:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665362": [
        {
            "ioc_value": "jql0.dark5hip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 07:01:15",
            "last_seen_utc": "2025-12-01 07:02:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665304": [
        {
            "ioc_value": "8z2a.dark5hip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 06:57:35",
            "last_seen_utc": "2025-12-01 06:58:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663841": [
        {
            "ioc_value": "ga.rt.threat.city",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-12-01 06:57:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/168.231.110.190+ga.rt.threat.city",
            "tags": "AS-HOSTINGER,AS47583,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1663869": [
        {
            "ioc_value": "stars-party.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-01 06:56:58",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/8500ad7f-090d-43b8-9c57-c6b19b2ec55c",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1663868": [
        {
            "ioc_value": "century-see.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-12-01 06:56:57",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/5d2ad6db-1d38-496f-8987-46a691c2a229",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "amznemu"
        }
    ],
    "1665278": [
        {
            "ioc_value": "m8hpd.dark5hip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 06:47:16",
            "last_seen_utc": "2025-12-01 06:48:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665277": [
        {
            "ioc_value": "8k.dark5hip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 06:35:56",
            "last_seen_utc": "2025-12-01 06:37:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1665276": [
        {
            "ioc_value": "zw0.lightb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 06:27:05",
            "last_seen_utc": "2025-12-01 06:29:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1664721": [
        {
            "ioc_value": "00.lightb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 06:18:51",
            "last_seen_utc": "2025-12-01 06:19:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663941": [
        {
            "ioc_value": "s41p4.lightb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 06:06:56",
            "last_seen_utc": "2025-12-01 06:07:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663929": [
        {
            "ioc_value": "ttr.jyhsolucion.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-01 06:00:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1663930": [
        {
            "ioc_value": "ttr.tokiejegedeinitiative.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-01 06:00:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1663931": [
        {
            "ioc_value": "uyu.jyhsolucion.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-01 06:00:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1663932": [
        {
            "ioc_value": "uyu.wantedrelief.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-12-01 06:00:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1663918": [
        {
            "ioc_value": "he62g.lightb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 05:57:38",
            "last_seen_utc": "2025-12-01 05:58:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663917": [
        {
            "ioc_value": "o1i.clear5ky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 05:47:41",
            "last_seen_utc": "2025-12-01 05:48:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663916": [
        {
            "ioc_value": "sky.clear5ky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 05:37:21",
            "last_seen_utc": "2025-12-01 05:39:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663915": [
        {
            "ioc_value": "2epwa.clear5ky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 05:29:08",
            "last_seen_utc": "2025-12-01 05:29:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663914": [
        {
            "ioc_value": "ypa.clear5ky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 05:17:15",
            "last_seen_utc": "2025-12-01 05:19:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663913": [
        {
            "ioc_value": "fzr.p0larday.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 05:07:51",
            "last_seen_utc": "2025-12-01 05:08:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663912": [
        {
            "ioc_value": "cloud.p0larday.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 04:58:04",
            "last_seen_utc": "2025-12-01 04:59:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663911": [
        {
            "ioc_value": "4o.p0larday.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 04:47:42",
            "last_seen_utc": "2025-12-01 04:49:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663910": [
        {
            "ioc_value": "alpha.p0larday.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 04:37:53",
            "last_seen_utc": "2025-12-01 04:39:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663909": [
        {
            "ioc_value": "crest.chri5t1anget.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 04:27:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663908": [
        {
            "ioc_value": "gh.chri5t1anget.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 04:17:53",
            "last_seen_utc": "2025-12-01 04:23:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663907": [
        {
            "ioc_value": "k2i1p.chri5t1anget.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 04:07:29",
            "last_seen_utc": "2025-12-01 04:08:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663894": [
        {
            "ioc_value": "mist.chri5t1anget.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 03:55:52",
            "last_seen_utc": "2025-12-01 04:00:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663893": [
        {
            "ioc_value": "09o.ap2thsh0pk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 03:45:07",
            "last_seen_utc": "2025-12-01 03:54:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663892": [
        {
            "ioc_value": "qjwe.ap2thsh0pk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 03:37:53",
            "last_seen_utc": "2025-12-01 03:41:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663891": [
        {
            "ioc_value": "nv57.ap2thsh0pk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 03:29:44",
            "last_seen_utc": "2025-12-01 03:32:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663890": [
        {
            "ioc_value": "38.ap2thsh0pk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 03:28:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663889": [
        {
            "ioc_value": "xy.aistem0rpho1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 03:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663888": [
        {
            "ioc_value": "dark.aistem0rpho1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 03:07:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663887": [
        {
            "ioc_value": "stone.aistem0rpho1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 02:59:34",
            "last_seen_utc": "2025-12-01 02:59:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663882": [
        {
            "ioc_value": "host.globalinfohost.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-12-01 02:47:50",
            "last_seen_utc": "2025-12-14 11:48:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663881": [
        {
            "ioc_value": "xv.aistem0rpho1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 02:46:14",
            "last_seen_utc": "2025-12-01 02:58:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663879": [
        {
            "ioc_value": "wr.evacu0t0nova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 02:39:27",
            "last_seen_utc": "2025-12-01 02:41:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663878": [
        {
            "ioc_value": "khw6m.evacu0t0nova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 02:33:17",
            "last_seen_utc": "2025-12-01 02:34:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663877": [
        {
            "ioc_value": "9iqq.evacu0t0nova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 02:26:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663876": [
        {
            "ioc_value": "qit.evacu0t0nova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 02:17:12",
            "last_seen_utc": "2025-12-01 02:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663875": [
        {
            "ioc_value": "river.def1nmem0r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 02:06:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663874": [
        {
            "ioc_value": "pmv.def1nmem0r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 01:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663873": [
        {
            "ioc_value": "9pft.def1nmem0r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 01:44:34",
            "last_seen_utc": "2025-12-01 01:50:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663872": [
        {
            "ioc_value": "h3.def1nmem0r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 01:37:58",
            "last_seen_utc": "2025-12-01 01:40:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663871": [
        {
            "ioc_value": "qh1wl.5eertr1ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 01:22:26",
            "last_seen_utc": "2025-12-01 01:27:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663870": [
        {
            "ioc_value": "crystal.5eertr1ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 01:18:34",
            "last_seen_utc": "2025-12-01 01:22:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663867": [
        {
            "ioc_value": "ld8bd.5eertr1ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 01:08:03",
            "last_seen_utc": "2025-12-01 01:08:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663866": [
        {
            "ioc_value": "beta.5eertr1ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 00:58:26",
            "last_seen_utc": "2025-12-01 01:05:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663865": [
        {
            "ioc_value": "night.f1nsh2ytan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 00:48:02",
            "last_seen_utc": "2025-12-01 00:57:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663863": [
        {
            "ioc_value": "sunny.f1nsh2ytan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 00:36:44",
            "last_seen_utc": "2025-12-01 00:40:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663862": [
        {
            "ioc_value": "silent.f1nsh2ytan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 00:28:01",
            "last_seen_utc": "2025-12-01 00:29:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663861": [
        {
            "ioc_value": "flame.f1nsh2ytan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 00:16:41",
            "last_seen_utc": "2025-12-01 00:21:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663860": [
        {
            "ioc_value": "clear.che7nt2rp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-12-01 00:05:04",
            "last_seen_utc": "2025-12-01 00:08:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663857": [
        {
            "ioc_value": "jx.che7nt2rp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 23:57:30",
            "last_seen_utc": "2025-12-01 00:03:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663856": [
        {
            "ioc_value": "xyw.che7nt2rp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 23:44:07",
            "last_seen_utc": "2025-11-30 23:56:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663855": [
        {
            "ioc_value": "xnds.che7nt2rp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 23:32:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663852": [
        {
            "ioc_value": "d1k5ev.go-1-dkamy-5-hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 23:23:04",
            "last_seen_utc": "2025-11-30 23:31:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663851": [
        {
            "ioc_value": "gok7am.go-1-dkamy-5-hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 23:17:53",
            "last_seen_utc": "2025-11-30 23:19:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663849": [
        {
            "ioc_value": "hev5g1.go-1-dkamy-5-hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 23:07:01",
            "last_seen_utc": "2025-11-30 23:08:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663839": [
        {
            "ioc_value": "dk5my1.go-1-dkamy-5-hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 22:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663838": [
        {
            "ioc_value": "g1d5hv.go-1-dkamy-5-hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 22:47:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663837": [
        {
            "ioc_value": "g7r8ev.ger8y5evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 22:37:38",
            "last_seen_utc": "2025-11-30 22:37:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663836": [
        {
            "ioc_value": "ruga85.ger8y5evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 22:27:18",
            "last_seen_utc": "2025-11-30 22:37:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663821": [
        {
            "ioc_value": "gy58va.ger8y5evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 22:16:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663820": [
        {
            "ioc_value": "ev5g8r.ger8y5evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 22:07:10",
            "last_seen_utc": "2025-11-30 22:15:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663637": [
        {
            "ioc_value": "g8v5ru.ger8y5evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 22:03:02",
            "last_seen_utc": "2025-11-30 22:06:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663636": [
        {
            "ioc_value": "k4myh5.go1dkamy5hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 21:58:20",
            "last_seen_utc": "2025-11-30 22:02:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663635": [
        {
            "ioc_value": "g15hev.go1dkamy5hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 21:47:59",
            "last_seen_utc": "2025-11-30 21:55:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663634": [
        {
            "ioc_value": "kamy5v.go1dkamy5hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 21:37:46",
            "last_seen_utc": "2025-11-30 21:42:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663633": [
        {
            "ioc_value": "go1d7k.go1dkamy5hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 21:31:02",
            "last_seen_utc": "2025-11-30 21:35:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663632": [
        {
            "ioc_value": "gk5hev.go1dkamy5hev.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 21:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663631": [
        {
            "ioc_value": "l0r9np.l0ngpo1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 21:17:28",
            "last_seen_utc": "2025-11-30 21:25:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663630": [
        {
            "ioc_value": "po1e7x.l0ngpo1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 21:07:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663629": [
        {
            "ioc_value": "ngp4o1.l0ngpo1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 20:57:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663628": [
        {
            "ioc_value": "l0g5pe.l0ngpo1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 20:47:27",
            "last_seen_utc": "2025-11-30 20:49:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663627": [
        {
            "ioc_value": "lng7p0.l0ngpo1e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 20:38:11",
            "last_seen_utc": "2025-11-30 20:47:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663626": [
        {
            "ioc_value": "c1wx9d.c1othwou1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 20:26:15",
            "last_seen_utc": "2025-11-30 20:30:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663625": [
        {
            "ioc_value": "cl5t1d.c1othwou1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 20:15:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663624": [
        {
            "ioc_value": "w1d7ou.c1othwou1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 20:08:18",
            "last_seen_utc": "2025-11-30 20:12:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663618": [
        {
            "ioc_value": "ashproperties.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-30 20:02:16",
            "last_seen_utc": "2025-11-30 23:00:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+ashproperties.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663619": [
        {
            "ioc_value": "sheebahospitality.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-30 20:02:16",
            "last_seen_utc": "2025-11-30 23:00:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+sheebahospitality.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663616": [
        {
            "ioc_value": "ipandi.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-30 20:02:15",
            "last_seen_utc": "2025-11-30 23:00:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+ipandi.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663617": [
        {
            "ioc_value": "windsorcourt.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-30 20:02:15",
            "last_seen_utc": "2025-11-30 23:00:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+windsorcourt.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663612": [
        {
            "ioc_value": "oth5c1.c1othwou1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 20:01:55",
            "last_seen_utc": "2025-11-30 20:08:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663609": [
        {
            "ioc_value": "c1owd7.c1othwou1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 19:57:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663608": [
        {
            "ioc_value": "gy8vra.ger-8-y-5-evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 19:51:56",
            "last_seen_utc": "2025-11-30 19:57:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663607": [
        {
            "ioc_value": "ru5g8y.ger-8-y-5-evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 19:47:43",
            "last_seen_utc": "2025-11-30 19:51:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663606": [
        {
            "ioc_value": "gr85vx.ger-8-y-5-evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 19:39:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663605": [
        {
            "ioc_value": "evr7g5.ger-8-y-5-evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 19:33:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663602": [
        {
            "ioc_value": "g8y5ru.ger-8-y-5-evruga.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 19:27:27",
            "last_seen_utc": "2025-11-30 19:30:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663601": [
        {
            "ioc_value": "lg5n0e.l-0-ngpo-1-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 19:23:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663600": [
        {
            "ioc_value": "n9g0pe.l-0-ngpo-1-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 19:17:30",
            "last_seen_utc": "2025-11-30 19:19:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663599": [
        {
            "ioc_value": "l0xp1e.l-0-ngpo-1-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 19:07:10",
            "last_seen_utc": "2025-11-30 19:12:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663598": [
        {
            "ioc_value": "ngp4le.l-0-ngpo-1-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 18:56:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663597": [
        {
            "ioc_value": "l0ng1e.l-0-ngpo-1-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 18:55:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663596": [
        {
            "ioc_value": "bq5ect.br2qin5pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 18:47:58",
            "last_seen_utc": "2025-11-30 18:52:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663591": [
        {
            "ioc_value": "r2p5qx.br2qin5pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 18:44:51",
            "last_seen_utc": "2025-11-30 18:46:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663588": [
        {
            "ioc_value": "qin8p5.br2qin5pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 18:37:14",
            "last_seen_utc": "2025-11-30 18:42:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663587": [
        {
            "ioc_value": "b2q7pt.br2qin5pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 18:27:42",
            "last_seen_utc": "2025-11-30 18:29:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663586": [
        {
            "ioc_value": "brq5n2.br2qin5pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 18:17:49",
            "last_seen_utc": "2025-11-30 18:21:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663585": [
        {
            "ioc_value": "arc9m5.mar5hma1narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 18:07:26",
            "last_seen_utc": "2025-11-30 18:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663583": [
        {
            "ioc_value": "r5h1ma.mar5hma1narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 18:04:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663580": [
        {
            "ioc_value": "quantum123-56094.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-30 18:01:38",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-r3dxlsak8y",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663579": [
        {
            "ioc_value": "live-ro.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-30 18:00:59",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-q8ycrswlfw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663578": [
        {
            "ioc_value": "m1x5hn.mar5hma1narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 17:57:30",
            "last_seen_utc": "2025-11-30 18:03:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663577": [
        {
            "ioc_value": "hmarc7.mar5hma1narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 17:48:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663576": [
        {
            "ioc_value": "m5narc.mar5hma1narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 17:36:52",
            "last_seen_utc": "2025-11-30 17:47:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663575": [
        {
            "ioc_value": "pex7in.br-2-qin-5-pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 17:27:41",
            "last_seen_utc": "2025-11-30 17:28:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663574": [
        {
            "ioc_value": "b2q5ct.br-2-qin-5-pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 17:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663573": [
        {
            "ioc_value": "rq5pec.br-2-qin-5-pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 17:17:44",
            "last_seen_utc": "2025-11-30 17:21:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663572": [
        {
            "ioc_value": "qin5pt.br-2-qin-5-pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 17:02:51",
            "last_seen_utc": "2025-11-30 17:09:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663571": [
        {
            "ioc_value": "brq2n7.br-2-qin-5-pect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 16:57:44",
            "last_seen_utc": "2025-11-30 17:01:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663565": [
        {
            "ioc_value": "d0rux5.c-1-othwou-1-d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 16:47:49",
            "last_seen_utc": "2025-11-30 16:52:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663564": [
        {
            "ioc_value": "cl7twd.c-1-othwou-1-d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 16:43:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663563": [
        {
            "ioc_value": "wux4d1.c-1-othwou-1-d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 16:34:18",
            "last_seen_utc": "2025-11-30 16:38:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663562": [
        {
            "ioc_value": "oth5wd.c-1-othwou-1-d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 16:28:26",
            "last_seen_utc": "2025-11-30 16:33:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663561": [
        {
            "ioc_value": "c1ow7d.c-1-othwou-1-d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 16:15:01",
            "last_seen_utc": "2025-11-30 16:19:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663559": [
        {
            "ioc_value": "hm5ark.mar-5-hma-1-narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 16:08:56",
            "last_seen_utc": "2025-11-30 16:14:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663556": [
        {
            "ioc_value": "www.websitetest.optikl.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-30 16:02:18",
            "last_seen_utc": "2025-11-30 23:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/109.205.214.88+www.websitetest.optikl.ink",
            "tags": "AS203363,C2,censys,KUROIT,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663554": [
        {
            "ioc_value": "fog7mn.mar-5-hma-1-narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 16:01:09",
            "last_seen_utc": "2025-11-30 16:05:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663552": [
        {
            "ioc_value": "mar9hx.mar-5-hma-1-narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 15:57:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663551": [
        {
            "ioc_value": "narcx7.mar-5-hma-1-narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 15:53:43",
            "last_seen_utc": "2025-11-30 15:54:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663550": [
        {
            "ioc_value": "z5mhn1.mar-5-hma-1-narc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 15:44:59",
            "last_seen_utc": "2025-11-30 15:50:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663548": [
        {
            "ioc_value": "burn0t.firew0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 15:30:38",
            "last_seen_utc": "2025-11-30 15:37:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663547": [
        {
            "ioc_value": "glyph9.firew0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 15:27:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663546": [
        {
            "ioc_value": "spark7.firew0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 15:24:39",
            "last_seen_utc": "2025-11-30 15:25:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663545": [
        {
            "ioc_value": "w0rdix.firew0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 15:16:53",
            "last_seen_utc": "2025-11-30 15:18:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663544": [
        {
            "ioc_value": "fir3wd.firew0rd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 15:06:34",
            "last_seen_utc": "2025-11-30 15:14:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663543": [
        {
            "ioc_value": "st1llw.s1lentlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 14:52:07",
            "last_seen_utc": "2025-11-30 14:59:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663542": [
        {
            "ioc_value": "ech0lk.s1lentlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 14:45:52",
            "last_seen_utc": "2025-11-30 14:50:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663541": [
        {
            "ioc_value": "hush9r.s1lentlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 14:35:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663540": [
        {
            "ioc_value": "lak3sh.s1lentlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 14:25:51",
            "last_seen_utc": "2025-11-30 14:28:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663539": [
        {
            "ioc_value": "slnt7k.s1lentlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 14:18:28",
            "last_seen_utc": "2025-11-30 14:25:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663538": [
        {
            "ioc_value": "flare1.windf1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 14:06:39",
            "last_seen_utc": "2025-11-30 14:09:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663537": [
        {
            "ioc_value": "bl0stw.windf1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 13:57:22",
            "last_seen_utc": "2025-11-30 14:01:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663536": [
        {
            "ioc_value": "emb3rz.windf1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 13:48:30",
            "last_seen_utc": "2025-11-30 13:55:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663535": [
        {
            "ioc_value": "gale9f.windf1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 13:38:09",
            "last_seen_utc": "2025-11-30 13:40:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663534": [
        {
            "ioc_value": "wndf7r.windf1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 13:28:25",
            "last_seen_utc": "2025-11-30 13:31:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663533": [
        {
            "ioc_value": "fl0ckz.black5wan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 13:20:03",
            "last_seen_utc": "2025-11-30 13:26:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663532": [
        {
            "ioc_value": "noir7w.black5wan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 13:12:13",
            "last_seen_utc": "2025-11-30 13:17:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663531": [
        {
            "ioc_value": "obs1dx.black5wan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 13:04:58",
            "last_seen_utc": "2025-11-30 13:10:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663529": [
        {
            "ioc_value": "sw4nyx.black5wan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 12:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663528": [
        {
            "ioc_value": "blk5wn.black5wan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 12:55:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663527": [
        {
            "ioc_value": "den7fd.deepf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 12:45:49",
            "last_seen_utc": "2025-11-30 12:49:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663525": [
        {
            "ioc_value": "slursontel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-30 12:44:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/3648de9ea826c454dfaa66e0fa4b4c66dc92f8f3007b9a8ad89d3afc28c9f0a8/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663524": [
        {
            "ioc_value": "vulp3x.deepf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 12:42:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663523": [
        {
            "ioc_value": "sly9fx.deepf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 12:37:50",
            "last_seen_utc": "2025-11-30 12:42:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663496": [
        {
            "ioc_value": "kingmaker.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-30 12:37:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663498": [
        {
            "ioc_value": "handball.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-30 12:37:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663497": [
        {
            "ioc_value": "78win.kholanhdaian.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-30 12:37:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663500": [
        {
            "ioc_value": "mail.f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.crat",
            "malware_alias": null,
            "malware_printable": "CRAT",
            "first_seen_utc": "2025-11-30 12:37:06",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663501": [
        {
            "ioc_value": "sales.f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.crat",
            "malware_alias": null,
            "malware_printable": "CRAT",
            "first_seen_utc": "2025-11-30 12:37:05",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663502": [
        {
            "ioc_value": "mta-sts.f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.crat",
            "malware_alias": null,
            "malware_printable": "CRAT",
            "first_seen_utc": "2025-11-30 12:37:05",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663503": [
        {
            "ioc_value": "api.f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.crat",
            "malware_alias": null,
            "malware_printable": "CRAT",
            "first_seen_utc": "2025-11-30 12:37:04",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663504": [
        {
            "ioc_value": "cdn.f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.crat",
            "malware_alias": null,
            "malware_printable": "CRAT",
            "first_seen_utc": "2025-11-30 12:37:04",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663505": [
        {
            "ioc_value": "account.f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.crat",
            "malware_alias": null,
            "malware_printable": "CRAT",
            "first_seen_utc": "2025-11-30 12:37:04",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663506": [
        {
            "ioc_value": "uat.f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.crat",
            "malware_alias": null,
            "malware_printable": "CRAT",
            "first_seen_utc": "2025-11-30 12:37:03",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663507": [
        {
            "ioc_value": "app.f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.crat",
            "malware_alias": null,
            "malware_printable": "CRAT",
            "first_seen_utc": "2025-11-30 12:37:03",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663522": [
        {
            "ioc_value": "peacezoneflow.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lokipws",
            "malware_alias": "Burkina,Loki,LokiBot,LokiPWS",
            "malware_printable": "Loki Password Stealer (PWS)",
            "first_seen_utc": "2025-11-30 12:36:02",
            "last_seen_utc": "2025-12-14 12:36:03",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=peacezoneflow.ydns.eu",
            "tags": "Lokibot,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663521": [
        {
            "ioc_value": "acronis.aspirindrained.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 12:36:00",
            "last_seen_utc": "2025-11-30 12:36:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "Clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1663519": [
        {
            "ioc_value": "bur0wx.deepf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 12:27:34",
            "last_seen_utc": "2025-11-30 12:34:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663518": [
        {
            "ioc_value": "d3pf0x.deepf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 12:15:46",
            "last_seen_utc": "2025-11-30 12:23:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663517": [
        {
            "ioc_value": "sh4dow.darkf1sh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 12:07:23",
            "last_seen_utc": "2025-11-30 12:09:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663511": [
        {
            "ioc_value": "screen-debut.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-30 12:01:04",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-myzw3ayqfj",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663509": [
        {
            "ioc_value": "murk0y.darkf1sh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 11:58:01",
            "last_seen_utc": "2025-11-30 12:03:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663508": [
        {
            "ioc_value": "f1nned.darkf1sh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 11:48:15",
            "last_seen_utc": "2025-11-30 11:52:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663499": [
        {
            "ioc_value": "abyss7.darkf1sh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 11:37:54",
            "last_seen_utc": "2025-11-30 11:38:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663495": [
        {
            "ioc_value": "drkf1x.darkf1sh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 11:28:02",
            "last_seen_utc": "2025-11-30 11:29:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663484": [
        {
            "ioc_value": "iframe.rt.threat.city",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-30 11:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/168.231.110.190+iframe.rt.threat.city",
            "tags": "AS-HOSTINGER,AS47583,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1663482": [
        {
            "ioc_value": "www.xixzao.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-30 11:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.137.8+www.xixzao.cn",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1663485": [
        {
            "ioc_value": "g.rt.threat.city",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-30 11:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/168.231.110.190+g.rt.threat.city",
            "tags": "AS-HOSTINGER,AS47583,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1663494": [
        {
            "ioc_value": "fastgn.quick5and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 11:17:44",
            "last_seen_utc": "2025-11-30 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663493": [
        {
            "ioc_value": "sift0r.quick5and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 11:04:45",
            "last_seen_utc": "2025-11-30 11:14:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663481": [
        {
            "ioc_value": "dune7x.quick5and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 10:55:27",
            "last_seen_utc": "2025-11-30 11:03:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663472": [
        {
            "ioc_value": "s4ndup.quick5and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 10:49:14",
            "last_seen_utc": "2025-11-30 10:52:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663470": [
        {
            "ioc_value": "qianxin.googleshop.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-30 10:48:32",
            "last_seen_utc": "2025-12-14 11:48:16",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663469": [
        {
            "ioc_value": "crystal.ns.cloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-30 10:48:19",
            "last_seen_utc": "2025-12-14 11:48:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663468": [
        {
            "ioc_value": "aqmhjfm80pp0e.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-30 10:48:17",
            "last_seen_utc": "2025-12-04 19:48:32",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663467": [
        {
            "ioc_value": "a6gycsh8hr68j.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-30 10:48:15",
            "last_seen_utc": "2025-12-14 11:48:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663465": [
        {
            "ioc_value": "qk5ndx.quick5and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 10:37:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663464": [
        {
            "ioc_value": "tr1pgo.longj0urney.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 10:26:57",
            "last_seen_utc": "2025-11-30 10:29:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663463": [
        {
            "ioc_value": "r0adly.longj0urney.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 10:18:03",
            "last_seen_utc": "2025-11-30 10:25:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663461": [
        {
            "ioc_value": "trekx9.longj0urney.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 10:07:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663459": [
        {
            "ioc_value": "journ3.longj0urney.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 09:52:45",
            "last_seen_utc": "2025-11-30 10:02:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663458": [
        {
            "ioc_value": "lng7jr.longj0urney.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 09:47:53",
            "last_seen_utc": "2025-11-30 09:50:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663457": [
        {
            "ioc_value": "slot0p.smartb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 09:37:41",
            "last_seen_utc": "2025-11-30 09:43:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663450": [
        {
            "ioc_value": "br41nx.smartb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 09:26:19",
            "last_seen_utc": "2025-11-30 09:37:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663449": [
        {
            "ioc_value": "cas3bx.smartb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 09:19:39",
            "last_seen_utc": "2025-11-30 09:21:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663448": [
        {
            "ioc_value": "b0xify.smartb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 09:12:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663447": [
        {
            "ioc_value": "smrt7x.smartb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 09:08:19",
            "last_seen_utc": "2025-11-30 09:10:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663446": [
        {
            "ioc_value": "c0gw3r.cl0ckw0rk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 08:57:50",
            "last_seen_utc": "2025-11-30 09:02:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663444": [
        {
            "ioc_value": "wh3elz.cl0ckw0rk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 08:46:06",
            "last_seen_utc": "2025-11-30 08:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663439": [
        {
            "ioc_value": "tik9wk.cl0ckw0rk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 08:39:49",
            "last_seen_utc": "2025-11-30 08:45:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663437": [
        {
            "ioc_value": "gear0x.cl0ckw0rk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 08:31:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663436": [
        {
            "ioc_value": "clk7wr.cl0ckw0rk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 08:25:54",
            "last_seen_utc": "2025-11-30 08:31:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663433": [
        {
            "ioc_value": "f8bet.gr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-30 08:23:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/collection/83908efa26d3d1c105398e5db1a5d32b901f2f289c84e689db787a93d4a183e2",
            "tags": "C2,dcrat",
            "anonymous": "0",
            "reporter": "CaGoldHydra"
        }
    ],
    "1663435": [
        {
            "ioc_value": "st0nsy.sun5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 08:21:39",
            "last_seen_utc": "2025-11-30 08:25:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663434": [
        {
            "ioc_value": "solax9.sun5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 08:17:29",
            "last_seen_utc": "2025-11-30 08:21:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663163": [
        {
            "ioc_value": "poisonmantr.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-30 08:11:18",
            "last_seen_utc": "2025-11-29 18:08:51",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115634321770560860",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1663168": [
        {
            "ioc_value": "kolmina.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-30 08:11:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115634321770560860",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1663432": [
        {
            "ioc_value": "glar3t.sun5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 08:09:47",
            "last_seen_utc": "2025-11-30 08:13:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663430": [
        {
            "ioc_value": "aure0n.sun5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 08:03:36",
            "last_seen_utc": "2025-11-30 08:05:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663415": [
        {
            "ioc_value": "sunx57.sun5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 07:57:17",
            "last_seen_utc": "2025-11-30 07:57:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663414": [
        {
            "ioc_value": "h0urly.t1metalk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 07:47:22",
            "last_seen_utc": "2025-11-30 07:56:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663413": [
        {
            "ioc_value": "tikc7o.t1metalk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 07:37:03",
            "last_seen_utc": "2025-11-30 07:44:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663412": [
        {
            "ioc_value": "224.ip.gl.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-30 07:22:03",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1663410": [
        {
            "ioc_value": "liquorbot.anondns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-30 07:21:29",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1663406": [
        {
            "ioc_value": "alvaradosready.accesscam.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-30 07:21:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1663407": [
        {
            "ioc_value": "probellsadss.mysynology.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-30 07:21:13",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1663408": [
        {
            "ioc_value": "v2.xoilaczzxzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-30 07:21:13",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1663409": [
        {
            "ioc_value": "v3.xoilaczzxzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-30 07:21:13",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1663405": [
        {
            "ioc_value": "kron0x.t1metalk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 07:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663403": [
        {
            "ioc_value": "xoilaczzxzzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-30 07:20:43",
            "last_seen_utc": "2025-11-30 07:21:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1663399": [
        {
            "ioc_value": "tim4zx.t1metalk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 07:15:57",
            "last_seen_utc": "2025-11-30 07:20:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663398": [
        {
            "ioc_value": "z1mtk9.t1metalk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 07:10:12",
            "last_seen_utc": "2025-11-30 07:12:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663397": [
        {
            "ioc_value": "tw1gx9.leafjump.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 07:08:08",
            "last_seen_utc": "2025-11-30 07:08:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1663395": [
        {
            "ioc_value": "b0unce.leafjump.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 06:57:59",
            "last_seen_utc": "2025-11-30 07:03:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663394": [
        {
            "ioc_value": "spr1ng.leafjump.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 06:41:32",
            "last_seen_utc": "2025-11-30 06:42:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663393": [
        {
            "ioc_value": "jump5r.leafjump.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 06:37:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663391": [
        {
            "ioc_value": "leaf7y.leafjump.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 06:27:24",
            "last_seen_utc": "2025-11-30 06:33:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663390": [
        {
            "ioc_value": "soft9p.c1oudcat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 06:22:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663389": [
        {
            "ioc_value": "purr5x.c1oudcat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 06:17:14",
            "last_seen_utc": "2025-11-30 06:21:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663388": [
        {
            "ioc_value": "me0wly.c1oudcat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 06:04:54",
            "last_seen_utc": "2025-11-30 06:09:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663386": [
        {
            "ioc_value": "MemoUD-59303.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-30 06:02:03",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-f44nwawper",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663387": [
        {
            "ioc_value": "zqous3223355-30142.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-30 06:02:03",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-f97ygser9w",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663385": [
        {
            "ioc_value": "the91lottery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-30 06:01:26",
            "last_seen_utc": "2025-11-30 06:01:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-aqf3rstqgk",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663384": [
        {
            "ioc_value": "55clubplay.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-30 06:01:22",
            "last_seen_utc": "2025-11-30 06:01:24",
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-aqf3rstqgk",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663383": [
        {
            "ioc_value": "newera.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-30 06:01:08",
            "last_seen_utc": "2025-12-12 18:39:52",
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-esv2xswmem",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663382": [
        {
            "ioc_value": "fewdays.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-30 06:01:07",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251130-esv2xswmem",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663381": [
        {
            "ioc_value": "c4tair.c1oudcat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 05:50:58",
            "last_seen_utc": "2025-11-30 06:03:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663380": [
        {
            "ioc_value": "cloud7.c1oudcat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 05:47:47",
            "last_seen_utc": "2025-11-30 05:49:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663379": [
        {
            "ioc_value": "tap0ut.fastp1ay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 05:38:02",
            "last_seen_utc": "2025-11-30 05:40:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663378": [
        {
            "ioc_value": "spee4d.fastp1ay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 05:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663377": [
        {
            "ioc_value": "rush9x.fastp1ay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 05:17:25",
            "last_seen_utc": "2025-11-30 05:23:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663376": [
        {
            "ioc_value": "p1ayer.fastp1ay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 05:03:28",
            "last_seen_utc": "2025-11-30 05:13:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663374": [
        {
            "ioc_value": "fast7p.fastp1ay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 04:57:17",
            "last_seen_utc": "2025-11-30 04:57:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663372": [
        {
            "ioc_value": "gl0win.f1amewise.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 04:47:00",
            "last_seen_utc": "2025-11-30 04:54:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663371": [
        {
            "ioc_value": "ember9.f1amewise.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 04:34:08",
            "last_seen_utc": "2025-11-30 04:36:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663370": [
        {
            "ioc_value": "sparx5.f1amewise.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 04:26:49",
            "last_seen_utc": "2025-11-30 04:31:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663369": [
        {
            "ioc_value": "wise7r.f1amewise.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 04:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663368": [
        {
            "ioc_value": "flam3w.f1amewise.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 04:07:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663358": [
        {
            "ioc_value": "bright.sunfold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 03:54:57",
            "last_seen_utc": "2025-11-30 04:02:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663357": [
        {
            "ioc_value": "ray0ut.sunfold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 03:47:34",
            "last_seen_utc": "2025-11-30 03:49:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663355": [
        {
            "ioc_value": "flare5.sunfold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 03:37:08",
            "last_seen_utc": "2025-11-30 03:39:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663354": [
        {
            "ioc_value": "fold9r.sunfold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 03:25:21",
            "last_seen_utc": "2025-11-30 03:31:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663353": [
        {
            "ioc_value": "sun7fd.sunfold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 03:18:18",
            "last_seen_utc": "2025-11-30 03:20:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663352": [
        {
            "ioc_value": "vibra7.soundg0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 03:11:21",
            "last_seen_utc": "2025-11-30 03:11:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663350": [
        {
            "ioc_value": "ech0ly.soundg0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 03:06:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663348": [
        {
            "ioc_value": "tone9x.soundg0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 02:57:52",
            "last_seen_utc": "2025-11-30 03:06:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663347": [
        {
            "ioc_value": "azurefree.ignorelist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-30 02:48:07",
            "last_seen_utc": "2025-12-14 11:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663346": [
        {
            "ioc_value": "audio5.soundg0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 02:48:05",
            "last_seen_utc": "2025-11-30 02:54:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663345": [
        {
            "ioc_value": "snd7go.soundg0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 02:38:47",
            "last_seen_utc": "2025-11-30 02:42:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663344": [
        {
            "ioc_value": "c4lmly.windzero.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 02:33:36",
            "last_seen_utc": "2025-11-30 02:34:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663343": [
        {
            "ioc_value": "breez9.windzero.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 02:22:49",
            "last_seen_utc": "2025-11-30 02:27:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663342": [
        {
            "ioc_value": "gust5y.windzero.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 02:17:37",
            "last_seen_utc": "2025-11-30 02:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663341": [
        {
            "ioc_value": "zer0br.windzero.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 02:07:48",
            "last_seen_utc": "2025-11-30 02:07:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1663340": [
        {
            "ioc_value": "wind7x.windzero.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 01:57:22",
            "last_seen_utc": "2025-11-30 02:07:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663339": [
        {
            "ioc_value": "bubb7e.g0ldfish.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 01:46:54",
            "last_seen_utc": "2025-11-30 01:53:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663338": [
        {
            "ioc_value": "f1sher.g0ldfish.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 01:39:17",
            "last_seen_utc": "2025-11-30 01:42:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663337": [
        {
            "ioc_value": "sw1mly.g0ldfish.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 01:35:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663336": [
        {
            "ioc_value": "fin5er.g0ldfish.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 01:22:10",
            "last_seen_utc": "2025-11-30 01:34:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663335": [
        {
            "ioc_value": "gold7y.g0ldfish.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 01:10:46",
            "last_seen_utc": "2025-11-30 01:11:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663333": [
        {
            "ioc_value": "optn4k.keyhope.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 01:07:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663332": [
        {
            "ioc_value": "trez5r.keyhope.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 00:58:10",
            "last_seen_utc": "2025-11-30 00:59:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663331": [
        {
            "ioc_value": "l0ckey.keyhope.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 00:42:22",
            "last_seen_utc": "2025-11-30 00:43:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663330": [
        {
            "ioc_value": "hope9r.keyhope.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 00:37:32",
            "last_seen_utc": "2025-11-30 00:39:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663329": [
        {
            "ioc_value": "key7hp.keyhope.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 00:27:17",
            "last_seen_utc": "2025-11-30 00:28:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663328": [
        {
            "ioc_value": "quak3r.fr0gtime.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 00:16:54",
            "last_seen_utc": "2025-11-30 00:19:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663327": [
        {
            "ioc_value": "sprng9.fr0gtime.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-30 00:08:13",
            "last_seen_utc": "2025-11-30 00:13:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663319": [
        {
            "ioc_value": "pond5x.fr0gtime.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 23:57:46",
            "last_seen_utc": "2025-11-29 23:59:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663317": [
        {
            "ioc_value": "t1melo.fr0gtime.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 23:41:46",
            "last_seen_utc": "2025-11-29 23:43:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663316": [
        {
            "ioc_value": "for.drearilystrobe.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 23:39:25",
            "last_seen_utc": "2025-11-29 23:39:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1663314": [
        {
            "ioc_value": "frog7y.fr0gtime.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 23:34:32",
            "last_seen_utc": "2025-11-29 23:40:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663313": [
        {
            "ioc_value": "gl0wbx.b0xlight.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 23:27:49",
            "last_seen_utc": "2025-11-29 23:32:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663312": [
        {
            "ioc_value": "lumix5.b0xlight.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 23:16:29",
            "last_seen_utc": "2025-11-29 23:20:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663311": [
        {
            "ioc_value": "crat0n.b0xlight.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 23:07:08",
            "last_seen_utc": "2025-11-29 23:11:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663271": [
        {
            "ioc_value": "l1tgle.b0xlight.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 22:53:15",
            "last_seen_utc": "2025-11-29 23:06:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663270": [
        {
            "ioc_value": "box7ly.b0xlight.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 22:46:55",
            "last_seen_utc": "2025-11-29 22:51:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663269": [
        {
            "ioc_value": "cl0udy.ra1nbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 22:38:09",
            "last_seen_utc": "2025-11-29 22:46:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663268": [
        {
            "ioc_value": "cast4r.ra1nbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 22:26:49",
            "last_seen_utc": "2025-11-29 22:37:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663267": [
        {
            "ioc_value": "drip9y.ra1nbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 22:11:49",
            "last_seen_utc": "2025-11-29 22:18:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663266": [
        {
            "ioc_value": "byte5r.ra1nbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 22:07:40",
            "last_seen_utc": "2025-11-29 22:09:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663265": [
        {
            "ioc_value": "rain7x.ra1nbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 21:57:26",
            "last_seen_utc": "2025-11-29 21:58:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663264": [
        {
            "ioc_value": "h4ilnd.5tormfoid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 21:47:37",
            "last_seen_utc": "2025-11-29 21:54:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663263": [
        {
            "ioc_value": "void9r.5tormfoid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 21:37:18",
            "last_seen_utc": "2025-11-29 21:38:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663261": [
        {
            "ioc_value": "gust5y.5tormfoid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 21:26:58",
            "last_seen_utc": "2025-11-29 21:34:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663260": [
        {
            "ioc_value": "fo1dex.5tormfoid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 21:18:13",
            "last_seen_utc": "2025-11-29 21:26:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663259": [
        {
            "ioc_value": "storm7.5tormfoid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 21:02:16",
            "last_seen_utc": "2025-11-29 21:08:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663258": [
        {
            "ioc_value": "pad1le.5unm0ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 20:57:35",
            "last_seen_utc": "2025-11-29 20:59:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663257": [
        {
            "ioc_value": "grove9.5unm0ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 20:49:54",
            "last_seen_utc": "2025-11-29 20:55:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663256": [
        {
            "ioc_value": "tuft4r.5unm0ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 20:46:38",
            "last_seen_utc": "2025-11-29 20:49:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663255": [
        {
            "ioc_value": "moss7y.5unm0ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 20:37:26",
            "last_seen_utc": "2025-11-29 20:44:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663254": [
        {
            "ioc_value": "sunm0x.5unm0ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 20:27:37",
            "last_seen_utc": "2025-11-29 20:29:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663253": [
        {
            "ioc_value": "orb1ta.5tardr0pper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 20:17:14",
            "last_seen_utc": "2025-11-29 20:23:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663252": [
        {
            "ioc_value": "skyr4y.5tardr0pper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 20:08:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663249": [
        {
            "ioc_value": "scontent.meta-ads.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 20:01:59",
            "last_seen_utc": "2025-11-29 23:01:14",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/165.22.37.154+scontent.meta-ads.online",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663246": [
        {
            "ioc_value": "okta.meta-email.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 20:01:58",
            "last_seen_utc": "2025-11-29 23:01:15",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/165.22.37.154+okta.meta-email.online",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663247": [
        {
            "ioc_value": "myaccount.meta-email.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 20:01:58",
            "last_seen_utc": "2025-12-02 23:01:00",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/165.22.37.154+myaccount.meta-email.online",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663248": [
        {
            "ioc_value": "web.meta-email.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 20:01:58",
            "last_seen_utc": "2025-11-29 23:01:14",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/165.22.37.154+web.meta-email.online",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663219": [
        {
            "ioc_value": "fall9n.5tardr0pper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 19:58:07",
            "last_seen_utc": "2025-11-29 19:58:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663218": [
        {
            "ioc_value": "drop5r.5tardr0pper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 19:47:47",
            "last_seen_utc": "2025-11-29 19:54:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663217": [
        {
            "ioc_value": "star7x.5tardr0pper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 19:38:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663216": [
        {
            "ioc_value": "clust9.cioudberryx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 19:33:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663215": [
        {
            "ioc_value": "bush4y.cioudberryx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 19:28:00",
            "last_seen_utc": "2025-11-29 19:31:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663214": [
        {
            "ioc_value": "pla7ina.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 19:23:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake,MacOS,osascript",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1663213": [
        {
            "ioc_value": "jam7ly.cioudberryx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 19:15:33",
            "last_seen_utc": "2025-11-29 19:22:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663212": [
        {
            "ioc_value": "ci0udx.cioudberryx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 19:05:26",
            "last_seen_utc": "2025-11-29 19:10:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663208": [
        {
            "ioc_value": "berry5.cioudberryx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663207": [
        {
            "ioc_value": "flake9.fr0stpetai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:53:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663206": [
        {
            "ioc_value": "ic3bud.fr0stpetai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:47:22",
            "last_seen_utc": "2025-11-29 18:50:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663199": [
        {
            "ioc_value": "chill5.fr0stpetai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:34:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663198": [
        {
            "ioc_value": "petal7.fr0stpetai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:28:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663197": [
        {
            "ioc_value": "fr0stx.fr0stpetai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:25:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663196": [
        {
            "ioc_value": "mix3on.fu5i0npeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663195": [
        {
            "ioc_value": "ridge4.fu5i0npeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663194": [
        {
            "ioc_value": "peak9r.fu5i0npeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:16:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663191": [
        {
            "ioc_value": "indu-1-ra-8-ing.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663192": [
        {
            "ioc_value": "indu1ra8ing.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663193": [
        {
            "ioc_value": "ma-1-ektrin-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663176": [
        {
            "ioc_value": "l1mewave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663177": [
        {
            "ioc_value": "ma1tre5cene.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663178": [
        {
            "ioc_value": "mintfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663179": [
        {
            "ioc_value": "mistpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663180": [
        {
            "ioc_value": "mor-5-tud-1-es.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": "2025-11-29 18:09:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663181": [
        {
            "ioc_value": "nightbl0om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663182": [
        {
            "ioc_value": "octet-0-r-9-in.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663183": [
        {
            "ioc_value": "octet0r9in.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663184": [
        {
            "ioc_value": "pr0tein5uch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663185": [
        {
            "ioc_value": "ra1nbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663186": [
        {
            "ioc_value": "red0.mor-5-tud-1-es.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663187": [
        {
            "ioc_value": "ston3garden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663188": [
        {
            "ioc_value": "cae-5-arf-0-rk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663189": [
        {
            "ioc_value": "frostmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663190": [
        {
            "ioc_value": "fu5i0npeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663169": [
        {
            "ioc_value": "0akshade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663170": [
        {
            "ioc_value": "7-ustterrib-1-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663171": [
        {
            "ioc_value": "b-1-ttper-7-ent.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663172": [
        {
            "ioc_value": "c0deshore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663173": [
        {
            "ioc_value": "cu1tivga5tr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663174": [
        {
            "ioc_value": "frostb1rd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663175": [
        {
            "ioc_value": "l-0-tta-1-ent.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1663161": [
        {
            "ioc_value": "ion7pk.fu5i0npeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 18:07:49",
            "last_seen_utc": "2025-11-29 18:08:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663158": [
        {
            "ioc_value": "nomygod11.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-29 18:01:12",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-tpnwrswpcy",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663157": [
        {
            "ioc_value": "seguritypostload.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-29 18:01:05",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-q1yzbshn5z",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663156": [
        {
            "ioc_value": "commission-lcd.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 18:00:58",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-qhcndahl9w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663155": [
        {
            "ioc_value": "fuse5x.fu5i0npeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 17:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663154": [
        {
            "ioc_value": "auric8.br1ghtvaie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 17:47:38",
            "last_seen_utc": "2025-11-29 17:54:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663153": [
        {
            "ioc_value": "ray5lt.br1ghtvaie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 17:37:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663152": [
        {
            "ioc_value": "gl0wrn.br1ghtvaie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 17:28:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663151": [
        {
            "ioc_value": "shine7.br1ghtvaie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 17:18:41",
            "last_seen_utc": "2025-11-29 17:26:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663150": [
        {
            "ioc_value": "br1gva.br1ghtvaie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 17:12:19",
            "last_seen_utc": "2025-11-29 17:15:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663149": [
        {
            "ioc_value": "menta3.mintfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 17:07:10",
            "last_seen_utc": "2025-11-29 17:11:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663148": [
        {
            "ioc_value": "leaf9x.mintfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 17:03:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663147": [
        {
            "ioc_value": "herb5y.mintfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 16:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663142": [
        {
            "ioc_value": "fiare7.mintfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 16:47:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663141": [
        {
            "ioc_value": "m1ntia.mintfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 16:37:57",
            "last_seen_utc": "2025-11-29 16:38:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663140": [
        {
            "ioc_value": "crest5.wiidcre5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 16:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663139": [
        {
            "ioc_value": "wiid7x.wiidcre5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 16:31:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663138": [
        {
            "ioc_value": "umbrk3.shad0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 16:28:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663137": [
        {
            "ioc_value": "fog1sy.shad0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 16:15:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663136": [
        {
            "ioc_value": "gloam5.shad0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 16:07:40",
            "last_seen_utc": "2025-11-29 16:10:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663096": [
        {
            "ioc_value": "upgratesecuritys.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 15:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/48c3cdfd-a363-4798-8e71-dd7eb458e375",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "MalasadaTech"
        }
    ],
    "1663099": [
        {
            "ioc_value": "shd0wm.shad0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 15:57:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663093": [
        {
            "ioc_value": "mint7x.shad0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 15:48:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663092": [
        {
            "ioc_value": "flash9.stormglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 15:37:03",
            "last_seen_utc": "2025-11-29 15:41:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663088": [
        {
            "ioc_value": "lumen8.stormglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 15:28:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663084": [
        {
            "ioc_value": "cat.imeowforaliving.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-29 15:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6a1f3f2805f56b4e7fcf6e8c15542754442b33af9451ff300d446a24b5289e4b/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663064": [
        {
            "ioc_value": "gust5r.stormglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 15:12:53",
            "last_seen_utc": "2025-11-29 15:17:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663056": [
        {
            "ioc_value": "bougndi.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-29 15:08:19",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1663057": [
        {
            "ioc_value": "dianubv.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-29 15:08:18",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1663058": [
        {
            "ioc_value": "fidppbi.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-29 15:08:18",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1663059": [
        {
            "ioc_value": "orgpkdm.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-29 15:08:17",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1663060": [
        {
            "ioc_value": "gl0war.stormglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 15:07:38",
            "last_seen_utc": "2025-11-29 15:08:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663055": [
        {
            "ioc_value": "strmx7.stormglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 14:57:52",
            "last_seen_utc": "2025-11-29 15:00:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663054": [
        {
            "ioc_value": "cl1ffo.mistpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 14:48:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663053": [
        {
            "ioc_value": "summ1t.mistpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 14:40:45",
            "last_seen_utc": "2025-11-29 14:43:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663052": [
        {
            "ioc_value": "ridge5.mistpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 14:32:28",
            "last_seen_utc": "2025-11-29 14:39:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663051": [
        {
            "ioc_value": "peak7y.mistpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 14:25:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663050": [
        {
            "ioc_value": "m1stpk.mistpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 14:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663049": [
        {
            "ioc_value": "hedg7r.ston3garden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 14:11:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663048": [
        {
            "ioc_value": "m0ssly.ston3garden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 14:04:54",
            "last_seen_utc": "2025-11-29 14:06:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663047": [
        {
            "ioc_value": "petal9.ston3garden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 14:03:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663046": [
        {
            "ioc_value": "g4rden.ston3garden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:55:59",
            "last_seen_utc": "2025-11-29 14:00:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663045": [
        {
            "ioc_value": "ston3y.ston3garden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:46:03",
            "last_seen_utc": "2025-11-29 13:50:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663028": [
        {
            "ioc_value": "app.pofelal314.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-11-29 13:44:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1663044": [
        {
            "ioc_value": "foam9y.l1mewave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:42:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663043": [
        {
            "ioc_value": "spla5h.l1mewave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:38:42",
            "last_seen_utc": "2025-11-29 13:40:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663042": [
        {
            "ioc_value": "citr1x.l1mewave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:33:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663041": [
        {
            "ioc_value": "wav3on.l1mewave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:30:16",
            "last_seen_utc": "2025-11-29 13:32:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663040": [
        {
            "ioc_value": "lime7x.l1mewave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663039": [
        {
            "ioc_value": "gl0wda.sunforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:15:34",
            "last_seen_utc": "2025-11-29 13:17:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663037": [
        {
            "ioc_value": "hamr7d.sunforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663036": [
        {
            "ioc_value": "sm3lta.sunforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 13:06:34",
            "last_seen_utc": "2025-11-29 13:09:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663035": [
        {
            "ioc_value": "forge5.sunforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 12:58:21",
            "last_seen_utc": "2025-11-29 13:04:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663034": [
        {
            "ioc_value": "sun8ry.sunforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 12:48:00",
            "last_seen_utc": "2025-11-29 12:49:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663033": [
        {
            "ioc_value": "scr1pt.c0deshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 12:39:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663032": [
        {
            "ioc_value": "alg0r3.c0deshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 12:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663031": [
        {
            "ioc_value": "bit5ea.c0deshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 12:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663030": [
        {
            "ioc_value": "shore8.c0deshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 12:25:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663029": [
        {
            "ioc_value": "c0dexy.c0deshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 12:15:48",
            "last_seen_utc": "2025-11-29 12:23:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663027": [
        {
            "ioc_value": "twig7s.0akshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 12:04:57",
            "last_seen_utc": "2025-11-29 12:07:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663023": [
        {
            "ioc_value": "gr0vny.0akshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 12:01:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663021": [
        {
            "ioc_value": "vip.xg.frp.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-29 12:01:38",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-hey37sev7a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663022": [
        {
            "ioc_value": "vip.bj.frp.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-29 12:01:38",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-hey37sev7a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663019": [
        {
            "ioc_value": "list-term.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-29 12:01:37",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-nxz14sgp9x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663020": [
        {
            "ioc_value": "xg-8.frp.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-29 12:01:37",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-hey37sev7a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663016": [
        {
            "ioc_value": "outplsfinishy.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-29 12:01:11",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-n3m9hatrdy",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663017": [
        {
            "ioc_value": "somwayz.gleeze.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-29 12:01:11",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-l48kqafr31",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663018": [
        {
            "ioc_value": "Somwayzbackup.ooguy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-29 12:01:11",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-l48kqafr31",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663015": [
        {
            "ioc_value": "8.tcp.cpolar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 12:00:58",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-jgblcser2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663014": [
        {
            "ioc_value": "day-mortgage.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 12:00:57",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-kfknbafl4y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1663011": [
        {
            "ioc_value": "linconlskype.ddnsguru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 12:00:27",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/445c84ddf3138bee315155f52a5c5cdcd1aff9d4e2dcc11d324d0cec215c9ecd/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1663010": [
        {
            "ioc_value": "can0py.0akshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 11:57:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663008": [
        {
            "ioc_value": "shad3o.0akshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 11:44:44",
            "last_seen_utc": "2025-11-29 11:51:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663006": [
        {
            "ioc_value": "oak5hd.0akshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 11:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663005": [
        {
            "ioc_value": "bark9t.flashwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 11:30:33",
            "last_seen_utc": "2025-11-29 11:34:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663004": [
        {
            "ioc_value": "timbr3.flashwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 11:23:20",
            "last_seen_utc": "2025-11-29 11:24:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663003": [
        {
            "ioc_value": "ember6.flashwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 11:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663001": [
        {
            "ioc_value": "spark7.flashwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 11:16:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1663000": [
        {
            "ioc_value": "fl4sho.flashwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 11:08:04",
            "last_seen_utc": "2025-11-29 11:15:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1662991": [
        {
            "ioc_value": "shad0w.duskfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 10:56:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1662990": [
        {
            "ioc_value": "gloam7.duskfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 10:42:58",
            "last_seen_utc": "2025-11-29 10:56:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1662989": [
        {
            "ioc_value": "tw1lyt.duskfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 10:31:33",
            "last_seen_utc": "2025-11-29 10:39:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1662988": [
        {
            "ioc_value": "fi3lda.duskfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 10:27:53",
            "last_seen_utc": "2025-11-29 10:29:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1662987": [
        {
            "ioc_value": "dusk4r.duskfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 10:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1662986": [
        {
            "ioc_value": "ray9st.brightlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 10:07:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1662975": [
        {
            "ioc_value": "zy.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662976": [
        {
            "ioc_value": "zy6ym.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662977": [
        {
            "ioc_value": "zy8.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662978": [
        {
            "ioc_value": "zydytuy3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662979": [
        {
            "ioc_value": "zyxyqie.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662980": [
        {
            "ioc_value": "zyy93.miststone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662981": [
        {
            "ioc_value": "zyz.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662982": [
        {
            "ioc_value": "zz.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662983": [
        {
            "ioc_value": "zz5.emberharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662984": [
        {
            "ioc_value": "zzto.gyro-desk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662951": [
        {
            "ioc_value": "zt.focove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662952": [
        {
            "ioc_value": "zt.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662953": [
        {
            "ioc_value": "zt.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662954": [
        {
            "ioc_value": "zt.kijx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662955": [
        {
            "ioc_value": "zt.n-96-f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662956": [
        {
            "ioc_value": "zt.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662957": [
        {
            "ioc_value": "zt.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662958": [
        {
            "ioc_value": "zt.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662959": [
        {
            "ioc_value": "zt.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662960": [
        {
            "ioc_value": "zt.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662961": [
        {
            "ioc_value": "zt3.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662962": [
        {
            "ioc_value": "zts.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662963": [
        {
            "ioc_value": "ztu.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662964": [
        {
            "ioc_value": "zu.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662965": [
        {
            "ioc_value": "zue.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662966": [
        {
            "ioc_value": "zumil.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662967": [
        {
            "ioc_value": "zuqfv.wolkenspur3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662968": [
        {
            "ioc_value": "zuvul.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662969": [
        {
            "ioc_value": "zv.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662970": [
        {
            "ioc_value": "zv.wqix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662971": [
        {
            "ioc_value": "zwf.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662972": [
        {
            "ioc_value": "zx.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662973": [
        {
            "ioc_value": "zx.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662974": [
        {
            "ioc_value": "zx.vem4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662931": [
        {
            "ioc_value": "zorn.nightf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662932": [
        {
            "ioc_value": "zorn.silvanbruch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662933": [
        {
            "ioc_value": "zoy.m-1-dnightr-0-ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662934": [
        {
            "ioc_value": "zp.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662935": [
        {
            "ioc_value": "zp.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662936": [
        {
            "ioc_value": "zp.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662937": [
        {
            "ioc_value": "zpa.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662938": [
        {
            "ioc_value": "zq.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662939": [
        {
            "ioc_value": "zqof-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662940": [
        {
            "ioc_value": "zqq4g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662941": [
        {
            "ioc_value": "zr.fjot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662942": [
        {
            "ioc_value": "zr.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662943": [
        {
            "ioc_value": "zs.b1tcrush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662944": [
        {
            "ioc_value": "zs.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662945": [
        {
            "ioc_value": "zs.kunb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662946": [
        {
            "ioc_value": "zt.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662947": [
        {
            "ioc_value": "zt.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662948": [
        {
            "ioc_value": "zt.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662949": [
        {
            "ioc_value": "zt.ember-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662950": [
        {
            "ioc_value": "zt.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662912": [
        {
            "ioc_value": "zny.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662913": [
        {
            "ioc_value": "zny1.a-8-ain-4-unt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662914": [
        {
            "ioc_value": "znz.xexykuo2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662915": [
        {
            "ioc_value": "zo.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662916": [
        {
            "ioc_value": "zo.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662917": [
        {
            "ioc_value": "zo.ttif.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662918": [
        {
            "ioc_value": "zoa.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662919": [
        {
            "ioc_value": "zoby-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662920": [
        {
            "ioc_value": "zoby0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662921": [
        {
            "ioc_value": "zogun.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662922": [
        {
            "ioc_value": "zon.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662923": [
        {
            "ioc_value": "zone0.mintspr1ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662924": [
        {
            "ioc_value": "zoo.st0bepress.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662925": [
        {
            "ioc_value": "zorn.boulderfield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662926": [
        {
            "ioc_value": "zorn.brassgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662927": [
        {
            "ioc_value": "zorn.breezef0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662928": [
        {
            "ioc_value": "zorn.brightv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662929": [
        {
            "ioc_value": "zorn.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662930": [
        {
            "ioc_value": "zorn.granitekamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662892": [
        {
            "ioc_value": "ziqyrae.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662893": [
        {
            "ioc_value": "zisoqiy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662894": [
        {
            "ioc_value": "zit-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662895": [
        {
            "ioc_value": "zit5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662896": [
        {
            "ioc_value": "zivad.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662897": [
        {
            "ioc_value": "zj.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662898": [
        {
            "ioc_value": "zj.z99l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662899": [
        {
            "ioc_value": "zk.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662900": [
        {
            "ioc_value": "zk.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662901": [
        {
            "ioc_value": "zk.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662902": [
        {
            "ioc_value": "zk.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662903": [
        {
            "ioc_value": "zkaw.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662904": [
        {
            "ioc_value": "zkefi.brightvoyage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662905": [
        {
            "ioc_value": "zl.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662906": [
        {
            "ioc_value": "zl.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662907": [
        {
            "ioc_value": "zlx.5t0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662908": [
        {
            "ioc_value": "zm.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662909": [
        {
            "ioc_value": "zm4.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662910": [
        {
            "ioc_value": "zm6392.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662911": [
        {
            "ioc_value": "zn.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662871": [
        {
            "ioc_value": "zera.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662872": [
        {
            "ioc_value": "zerfa2.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662873": [
        {
            "ioc_value": "zezar.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662874": [
        {
            "ioc_value": "zf.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662875": [
        {
            "ioc_value": "zf.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662876": [
        {
            "ioc_value": "zfp.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662877": [
        {
            "ioc_value": "zgna.cl1ppleap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662878": [
        {
            "ioc_value": "zh.d09r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662879": [
        {
            "ioc_value": "zhc.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662880": [
        {
            "ioc_value": "zi.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662881": [
        {
            "ioc_value": "zi.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662882": [
        {
            "ioc_value": "zi.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662883": [
        {
            "ioc_value": "zicedoo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662884": [
        {
            "ioc_value": "zijozui29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662885": [
        {
            "ioc_value": "zil.bashglider.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662886": [
        {
            "ioc_value": "zimloop.ru4r1i.zenithsnap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662887": [
        {
            "ioc_value": "zimwl.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662888": [
        {
            "ioc_value": "zinuwue5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662889": [
        {
            "ioc_value": "zinyjuu1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662890": [
        {
            "ioc_value": "zip.zen-and.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662891": [
        {
            "ioc_value": "zipuk.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662854": [
        {
            "ioc_value": "zc.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662855": [
        {
            "ioc_value": "zd.w20s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662856": [
        {
            "ioc_value": "zdqdc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662857": [
        {
            "ioc_value": "zdvey.y0ur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662858": [
        {
            "ioc_value": "ze.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662859": [
        {
            "ioc_value": "ze.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662860": [
        {
            "ioc_value": "zebat.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662861": [
        {
            "ioc_value": "zed.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662862": [
        {
            "ioc_value": "zed9ra.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662863": [
        {
            "ioc_value": "zefyr7.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662864": [
        {
            "ioc_value": "zeit.cranezeit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662865": [
        {
            "ioc_value": "zen-and.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662866": [
        {
            "ioc_value": "zeniqaa7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662867": [
        {
            "ioc_value": "zenithspitze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662868": [
        {
            "ioc_value": "zeph1r.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662869": [
        {
            "ioc_value": "zephyr.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662870": [
        {
            "ioc_value": "zephyrsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662834": [
        {
            "ioc_value": "z9m.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662835": [
        {
            "ioc_value": "z9m.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662836": [
        {
            "ioc_value": "z9m.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662837": [
        {
            "ioc_value": "z9m.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662838": [
        {
            "ioc_value": "z9u4qm1.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662839": [
        {
            "ioc_value": "za.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662840": [
        {
            "ioc_value": "za.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662841": [
        {
            "ioc_value": "za9.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662842": [
        {
            "ioc_value": "zapugoi7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662843": [
        {
            "ioc_value": "zarew.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662844": [
        {
            "ioc_value": "zarokai9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662845": [
        {
            "ioc_value": "zatoh.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662846": [
        {
            "ioc_value": "zaun.tigerzaun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662847": [
        {
            "ioc_value": "zb.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662848": [
        {
            "ioc_value": "zc.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662849": [
        {
            "ioc_value": "zc.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662850": [
        {
            "ioc_value": "zc.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662851": [
        {
            "ioc_value": "zc.lobd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662852": [
        {
            "ioc_value": "zc.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662853": [
        {
            "ioc_value": "zc.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662811": [
        {
            "ioc_value": "z6l.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662812": [
        {
            "ioc_value": "z6u.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662813": [
        {
            "ioc_value": "z7.7-gb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662814": [
        {
            "ioc_value": "z7.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662815": [
        {
            "ioc_value": "z7.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662816": [
        {
            "ioc_value": "z7.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662817": [
        {
            "ioc_value": "z7.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662818": [
        {
            "ioc_value": "z7.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662819": [
        {
            "ioc_value": "z7.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662820": [
        {
            "ioc_value": "z7f1q0h.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662821": [
        {
            "ioc_value": "z8.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662822": [
        {
            "ioc_value": "z8.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662823": [
        {
            "ioc_value": "z8914.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662824": [
        {
            "ioc_value": "z8n2.st0nesurge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662825": [
        {
            "ioc_value": "z9.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662826": [
        {
            "ioc_value": "z9.4kl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662827": [
        {
            "ioc_value": "z9.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662828": [
        {
            "ioc_value": "z9.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662829": [
        {
            "ioc_value": "z9m.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662830": [
        {
            "ioc_value": "z9m.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662831": [
        {
            "ioc_value": "z9m.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662832": [
        {
            "ioc_value": "z9m.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662833": [
        {
            "ioc_value": "z9m.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662792": [
        {
            "ioc_value": "z1q8m.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662793": [
        {
            "ioc_value": "z1w.st0y70renka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662794": [
        {
            "ioc_value": "z2.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662795": [
        {
            "ioc_value": "z2.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662796": [
        {
            "ioc_value": "z2.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662797": [
        {
            "ioc_value": "z2.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662798": [
        {
            "ioc_value": "z2.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662799": [
        {
            "ioc_value": "z3.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662800": [
        {
            "ioc_value": "z3.stonefog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662801": [
        {
            "ioc_value": "z3n7c4.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662802": [
        {
            "ioc_value": "z3t.skybr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662803": [
        {
            "ioc_value": "z3x.drift-meadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662804": [
        {
            "ioc_value": "z4.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662805": [
        {
            "ioc_value": "z4.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662806": [
        {
            "ioc_value": "z4cp.waver-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662807": [
        {
            "ioc_value": "z4d.quartzweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662808": [
        {
            "ioc_value": "z4k.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662809": [
        {
            "ioc_value": "z5.bl1nkswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662810": [
        {
            "ioc_value": "z6.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662770": [
        {
            "ioc_value": "z1.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662771": [
        {
            "ioc_value": "z1.falconhimmel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662772": [
        {
            "ioc_value": "z1.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662773": [
        {
            "ioc_value": "z1.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662774": [
        {
            "ioc_value": "z1.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662775": [
        {
            "ioc_value": "z1.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662776": [
        {
            "ioc_value": "z1.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662777": [
        {
            "ioc_value": "z1.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662778": [
        {
            "ioc_value": "z1.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662779": [
        {
            "ioc_value": "z1.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662780": [
        {
            "ioc_value": "z1.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662781": [
        {
            "ioc_value": "z1.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662782": [
        {
            "ioc_value": "z1.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662783": [
        {
            "ioc_value": "z1.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662784": [
        {
            "ioc_value": "z1.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662785": [
        {
            "ioc_value": "z1.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662786": [
        {
            "ioc_value": "z1.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662787": [
        {
            "ioc_value": "z1.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662788": [
        {
            "ioc_value": "z1.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662789": [
        {
            "ioc_value": "z1.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662790": [
        {
            "ioc_value": "z14.gi0wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662791": [
        {
            "ioc_value": "z1f.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662747": [
        {
            "ioc_value": "z.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662748": [
        {
            "ioc_value": "z.l8o6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662749": [
        {
            "ioc_value": "z.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662750": [
        {
            "ioc_value": "z.p9v7g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662751": [
        {
            "ioc_value": "z.ror6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662752": [
        {
            "ioc_value": "z.t4c5d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662753": [
        {
            "ioc_value": "z.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662754": [
        {
            "ioc_value": "z.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662755": [
        {
            "ioc_value": "z0d.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662756": [
        {
            "ioc_value": "z0h.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662757": [
        {
            "ioc_value": "z0r.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662758": [
        {
            "ioc_value": "z0rfu3s.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662759": [
        {
            "ioc_value": "z0v.gug7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662760": [
        {
            "ioc_value": "z1.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662761": [
        {
            "ioc_value": "z1.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662762": [
        {
            "ioc_value": "z1.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662763": [
        {
            "ioc_value": "z1.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662764": [
        {
            "ioc_value": "z1.8g89.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662765": [
        {
            "ioc_value": "z1.97qm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662766": [
        {
            "ioc_value": "z1.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662767": [
        {
            "ioc_value": "z1.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662768": [
        {
            "ioc_value": "z1.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662769": [
        {
            "ioc_value": "z1.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662726": [
        {
            "ioc_value": "yw.wtan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662727": [
        {
            "ioc_value": "yw0.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662728": [
        {
            "ioc_value": "yw7.v0xelmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662729": [
        {
            "ioc_value": "ywc.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662730": [
        {
            "ioc_value": "yx80.sketchloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662731": [
        {
            "ioc_value": "yxb.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662732": [
        {
            "ioc_value": "yxm.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662733": [
        {
            "ioc_value": "yxm4.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662734": [
        {
            "ioc_value": "yxyz.zyxy.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": "2025-11-29 09:59:38",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662735": [
        {
            "ioc_value": "yy.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662736": [
        {
            "ioc_value": "yy.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662737": [
        {
            "ioc_value": "yyb0w.shad0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662738": [
        {
            "ioc_value": "yz.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662739": [
        {
            "ioc_value": "yz.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662740": [
        {
            "ioc_value": "yzc.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662741": [
        {
            "ioc_value": "yze.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662742": [
        {
            "ioc_value": "z.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662743": [
        {
            "ioc_value": "z.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662744": [
        {
            "ioc_value": "z.g69p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662745": [
        {
            "ioc_value": "z.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662746": [
        {
            "ioc_value": "z.h934.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662705": [
        {
            "ioc_value": "yonder.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662706": [
        {
            "ioc_value": "you.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662707": [
        {
            "ioc_value": "yoxel2.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662708": [
        {
            "ioc_value": "yoz.v1b3forge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662709": [
        {
            "ioc_value": "yp.amin0mer3ges.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662710": [
        {
            "ioc_value": "yp.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662711": [
        {
            "ioc_value": "yq.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662712": [
        {
            "ioc_value": "yq2z.fluxcrate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662713": [
        {
            "ioc_value": "yq9g.diab4uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662714": [
        {
            "ioc_value": "yr.h-73-n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662715": [
        {
            "ioc_value": "yr4y5.shadowsun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662716": [
        {
            "ioc_value": "yrg.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662717": [
        {
            "ioc_value": "yspm.orbitling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662718": [
        {
            "ioc_value": "yt.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662719": [
        {
            "ioc_value": "yt.silverpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662720": [
        {
            "ioc_value": "yt6.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662721": [
        {
            "ioc_value": "yu.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662722": [
        {
            "ioc_value": "yu2.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662723": [
        {
            "ioc_value": "yub.wildh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662724": [
        {
            "ioc_value": "yw.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662725": [
        {
            "ioc_value": "yw.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662685": [
        {
            "ioc_value": "yiie.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662686": [
        {
            "ioc_value": "yje.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662687": [
        {
            "ioc_value": "yje.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662688": [
        {
            "ioc_value": "yjxm4.ever-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662689": [
        {
            "ioc_value": "ykh0q.plixhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662690": [
        {
            "ioc_value": "yl.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662691": [
        {
            "ioc_value": "yl.p93z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662692": [
        {
            "ioc_value": "yl.suf1nau8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662693": [
        {
            "ioc_value": "yl56b.galy8phony.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662694": [
        {
            "ioc_value": "ylr.g-0-ss-lamp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662695": [
        {
            "ioc_value": "ylu.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662696": [
        {
            "ioc_value": "ym.vadykoe7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662697": [
        {
            "ioc_value": "yn.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662698": [
        {
            "ioc_value": "yn.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662699": [
        {
            "ioc_value": "ynbr8.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662700": [
        {
            "ioc_value": "ynk.c0rkpr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662701": [
        {
            "ioc_value": "yo.kfko-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662702": [
        {
            "ioc_value": "yo.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662703": [
        {
            "ioc_value": "yo.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662704": [
        {
            "ioc_value": "yo.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662665": [
        {
            "ioc_value": "ye.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662666": [
        {
            "ioc_value": "ye.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662667": [
        {
            "ioc_value": "ye.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662668": [
        {
            "ioc_value": "year.cewyzui61.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662669": [
        {
            "ioc_value": "year.chit7a5tat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662670": [
        {
            "ioc_value": "year8.chit-7-a-5-tat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662671": [
        {
            "ioc_value": "yen.v3sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662672": [
        {
            "ioc_value": "yf.pr0wldrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662673": [
        {
            "ioc_value": "yf.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662674": [
        {
            "ioc_value": "yffl9.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662675": [
        {
            "ioc_value": "yft.toludye0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662676": [
        {
            "ioc_value": "yg.mor5tud1es.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662677": [
        {
            "ioc_value": "yg.sjoh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662678": [
        {
            "ioc_value": "yg3jg.cliffwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662679": [
        {
            "ioc_value": "ygz.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662680": [
        {
            "ioc_value": "yh.gjat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662681": [
        {
            "ioc_value": "yh.n96f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662682": [
        {
            "ioc_value": "yhu.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662683": [
        {
            "ioc_value": "yi.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662684": [
        {
            "ioc_value": "yi.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662643": [
        {
            "ioc_value": "yaw.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662644": [
        {
            "ioc_value": "yawn9x.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662645": [
        {
            "ioc_value": "yay.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662646": [
        {
            "ioc_value": "yb.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662647": [
        {
            "ioc_value": "yb.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662648": [
        {
            "ioc_value": "yb.w20s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662649": [
        {
            "ioc_value": "ybg.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662650": [
        {
            "ioc_value": "ybi.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662651": [
        {
            "ioc_value": "yc.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662652": [
        {
            "ioc_value": "yc.n44s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662653": [
        {
            "ioc_value": "yco.nufypiy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662654": [
        {
            "ioc_value": "ydq.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662655": [
        {
            "ioc_value": "ye.fy-7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662656": [
        {
            "ioc_value": "ye.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662657": [
        {
            "ioc_value": "ye.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662658": [
        {
            "ioc_value": "ye.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662659": [
        {
            "ioc_value": "ye.kfko-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662660": [
        {
            "ioc_value": "ye.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662661": [
        {
            "ioc_value": "ye.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662662": [
        {
            "ioc_value": "ye.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662663": [
        {
            "ioc_value": "ye.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662664": [
        {
            "ioc_value": "ye.scramblehub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662623": [
        {
            "ioc_value": "y7g.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662624": [
        {
            "ioc_value": "y7n.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662625": [
        {
            "ioc_value": "y7n.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662626": [
        {
            "ioc_value": "y7n.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662627": [
        {
            "ioc_value": "y8.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662628": [
        {
            "ioc_value": "y8h.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662629": [
        {
            "ioc_value": "y8mb.mintspr1ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662630": [
        {
            "ioc_value": "y8t4s2w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662631": [
        {
            "ioc_value": "y9.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662632": [
        {
            "ioc_value": "y9w7.gl-1-tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662633": [
        {
            "ioc_value": "ya.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662634": [
        {
            "ioc_value": "ya.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662635": [
        {
            "ioc_value": "ya.p2-om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662636": [
        {
            "ioc_value": "ya.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662637": [
        {
            "ioc_value": "ya.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662638": [
        {
            "ioc_value": "ya.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662639": [
        {
            "ioc_value": "ya.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662640": [
        {
            "ioc_value": "yam.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662641": [
        {
            "ioc_value": "yap.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662642": [
        {
            "ioc_value": "yap.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662600": [
        {
            "ioc_value": "y4c.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662601": [
        {
            "ioc_value": "y4k.pyroclay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662602": [
        {
            "ioc_value": "y4l.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662603": [
        {
            "ioc_value": "y5.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662604": [
        {
            "ioc_value": "y5.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662605": [
        {
            "ioc_value": "y5i1.st3elflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662606": [
        {
            "ioc_value": "y6w.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662607": [
        {
            "ioc_value": "y7.017fk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662608": [
        {
            "ioc_value": "y7.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662609": [
        {
            "ioc_value": "y7.259ox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662610": [
        {
            "ioc_value": "y7.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662611": [
        {
            "ioc_value": "y7.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662612": [
        {
            "ioc_value": "y7.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662613": [
        {
            "ioc_value": "y7.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662614": [
        {
            "ioc_value": "y7.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662615": [
        {
            "ioc_value": "y7.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662616": [
        {
            "ioc_value": "y7.pixelstern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662617": [
        {
            "ioc_value": "y7.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662618": [
        {
            "ioc_value": "y7.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662619": [
        {
            "ioc_value": "y7.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662620": [
        {
            "ioc_value": "y7.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662621": [
        {
            "ioc_value": "y7.t408.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662622": [
        {
            "ioc_value": "y714.dewroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662578": [
        {
            "ioc_value": "y.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662579": [
        {
            "ioc_value": "y.mijk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662580": [
        {
            "ioc_value": "y.p9v7g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662581": [
        {
            "ioc_value": "y.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662582": [
        {
            "ioc_value": "y.q1s6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662583": [
        {
            "ioc_value": "y.vxof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662584": [
        {
            "ioc_value": "y.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662585": [
        {
            "ioc_value": "y0.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662586": [
        {
            "ioc_value": "y0mkq.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662587": [
        {
            "ioc_value": "y0s.hap7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662588": [
        {
            "ioc_value": "y1.leafshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662589": [
        {
            "ioc_value": "y1.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662590": [
        {
            "ioc_value": "y2.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662591": [
        {
            "ioc_value": "y2.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662592": [
        {
            "ioc_value": "y27.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662593": [
        {
            "ioc_value": "y2aew.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662594": [
        {
            "ioc_value": "y3.pihp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662595": [
        {
            "ioc_value": "y3a.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662596": [
        {
            "ioc_value": "y3a81.gyrodesk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662597": [
        {
            "ioc_value": "y3q6.l0ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662598": [
        {
            "ioc_value": "y4.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662599": [
        {
            "ioc_value": "y4.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662561": [
        {
            "ioc_value": "xw.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662562": [
        {
            "ioc_value": "xx6.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662563": [
        {
            "ioc_value": "xxzu.plum-wav-ru.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662564": [
        {
            "ioc_value": "xy.lysyrei3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662565": [
        {
            "ioc_value": "xy.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662566": [
        {
            "ioc_value": "xyh.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662567": [
        {
            "ioc_value": "xyhyleo1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662568": [
        {
            "ioc_value": "xyq.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662569": [
        {
            "ioc_value": "xz.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662570": [
        {
            "ioc_value": "xzh.nightwharf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662571": [
        {
            "ioc_value": "xzil.d7un4recid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662572": [
        {
            "ioc_value": "xzoeg.m1stzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662573": [
        {
            "ioc_value": "y.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662574": [
        {
            "ioc_value": "y.97jt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662575": [
        {
            "ioc_value": "y.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662576": [
        {
            "ioc_value": "y.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662577": [
        {
            "ioc_value": "y.h8y0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662542": [
        {
            "ioc_value": "xt.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662543": [
        {
            "ioc_value": "xt.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662544": [
        {
            "ioc_value": "xt.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662545": [
        {
            "ioc_value": "xt.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662546": [
        {
            "ioc_value": "xt.jzak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662547": [
        {
            "ioc_value": "xt.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662548": [
        {
            "ioc_value": "xt.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662549": [
        {
            "ioc_value": "xt.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662550": [
        {
            "ioc_value": "xt.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662551": [
        {
            "ioc_value": "xt.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662552": [
        {
            "ioc_value": "xt83.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662553": [
        {
            "ioc_value": "xu.d09r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662554": [
        {
            "ioc_value": "xu.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662555": [
        {
            "ioc_value": "xu5ud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662556": [
        {
            "ioc_value": "xucaxye9.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662557": [
        {
            "ioc_value": "xue.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662558": [
        {
            "ioc_value": "xufx.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662559": [
        {
            "ioc_value": "xuvyc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662560": [
        {
            "ioc_value": "xuwilye4.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662526": [
        {
            "ioc_value": "xq9.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662527": [
        {
            "ioc_value": "xqgn6.echozig.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662528": [
        {
            "ioc_value": "xqi.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662529": [
        {
            "ioc_value": "xqs.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662530": [
        {
            "ioc_value": "xr.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662531": [
        {
            "ioc_value": "xrc.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662532": [
        {
            "ioc_value": "xrp.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662533": [
        {
            "ioc_value": "xshy.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662534": [
        {
            "ioc_value": "xt.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662535": [
        {
            "ioc_value": "xt.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662536": [
        {
            "ioc_value": "xt.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662537": [
        {
            "ioc_value": "xt.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662538": [
        {
            "ioc_value": "xt.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662539": [
        {
            "ioc_value": "xt.bvqu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662540": [
        {
            "ioc_value": "xt.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662541": [
        {
            "ioc_value": "xt.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662504": [
        {
            "ioc_value": "xo.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662505": [
        {
            "ioc_value": "xopi-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662506": [
        {
            "ioc_value": "xopi1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662507": [
        {
            "ioc_value": "xoqywoa2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662508": [
        {
            "ioc_value": "xotap.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662509": [
        {
            "ioc_value": "xp.sjef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662510": [
        {
            "ioc_value": "xpkyb.n-0-rthw-1-nd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662511": [
        {
            "ioc_value": "xpl.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662512": [
        {
            "ioc_value": "xpx.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662513": [
        {
            "ioc_value": "xq.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662514": [
        {
            "ioc_value": "xq.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662515": [
        {
            "ioc_value": "xq.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662516": [
        {
            "ioc_value": "xq.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662517": [
        {
            "ioc_value": "xq9.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662518": [
        {
            "ioc_value": "xq9.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662519": [
        {
            "ioc_value": "xq9.diab4uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662520": [
        {
            "ioc_value": "xq9.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662521": [
        {
            "ioc_value": "xq9.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662522": [
        {
            "ioc_value": "xq9.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662523": [
        {
            "ioc_value": "xq9.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662524": [
        {
            "ioc_value": "xq9.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662525": [
        {
            "ioc_value": "xq9.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662482": [
        {
            "ioc_value": "xj.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662483": [
        {
            "ioc_value": "xj.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662484": [
        {
            "ioc_value": "xj.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662485": [
        {
            "ioc_value": "xj0.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662486": [
        {
            "ioc_value": "xjh.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662487": [
        {
            "ioc_value": "xjk.luxemyy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662488": [
        {
            "ioc_value": "xjqi.emberhoehle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662489": [
        {
            "ioc_value": "xk.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662490": [
        {
            "ioc_value": "xk.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662491": [
        {
            "ioc_value": "xk9.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662492": [
        {
            "ioc_value": "xl.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662493": [
        {
            "ioc_value": "xl.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662494": [
        {
            "ioc_value": "xla.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662495": [
        {
            "ioc_value": "xla.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662496": [
        {
            "ioc_value": "xlomm.wildh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662497": [
        {
            "ioc_value": "xm.fjot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662498": [
        {
            "ioc_value": "xm9v.sn0rtling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662499": [
        {
            "ioc_value": "xmn.clear-fog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662500": [
        {
            "ioc_value": "xn.x73r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662501": [
        {
            "ioc_value": "xo.a8ain4unt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662502": [
        {
            "ioc_value": "xo.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662503": [
        {
            "ioc_value": "xo.v-96-g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662460": [
        {
            "ioc_value": "xfgvj.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662461": [
        {
            "ioc_value": "xg.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662462": [
        {
            "ioc_value": "xg.vihuqau.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662463": [
        {
            "ioc_value": "xgnv.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662464": [
        {
            "ioc_value": "xhw.icymoth.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662465": [
        {
            "ioc_value": "xi.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662466": [
        {
            "ioc_value": "xi.kfko-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662467": [
        {
            "ioc_value": "xi.ko-8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662468": [
        {
            "ioc_value": "xi.pl-8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662469": [
        {
            "ioc_value": "xi.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662470": [
        {
            "ioc_value": "xi.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662471": [
        {
            "ioc_value": "xi.v3ctorplum.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662472": [
        {
            "ioc_value": "xi.z-99-l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662473": [
        {
            "ioc_value": "xihilia5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662474": [
        {
            "ioc_value": "xijoxou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662475": [
        {
            "ioc_value": "ximyt.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662476": [
        {
            "ioc_value": "xiqek40ye8.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662477": [
        {
            "ioc_value": "xiqek40ye8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662478": [
        {
            "ioc_value": "xisav.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662479": [
        {
            "ioc_value": "xivehey5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662480": [
        {
            "ioc_value": "xixonua5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662481": [
        {
            "ioc_value": "xizaf.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662442": [
        {
            "ioc_value": "xb19f.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662443": [
        {
            "ioc_value": "xbiq-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662444": [
        {
            "ioc_value": "xc.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662445": [
        {
            "ioc_value": "xc6.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662446": [
        {
            "ioc_value": "xcmt.brim-hopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662447": [
        {
            "ioc_value": "xcx.fro5tlane.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662448": [
        {
            "ioc_value": "xd.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662449": [
        {
            "ioc_value": "xd.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662450": [
        {
            "ioc_value": "xd.t-65-p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662451": [
        {
            "ioc_value": "xe.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662452": [
        {
            "ioc_value": "xe.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662453": [
        {
            "ioc_value": "xekifye8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662454": [
        {
            "ioc_value": "xepetiu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662455": [
        {
            "ioc_value": "xeq.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662456": [
        {
            "ioc_value": "xeqnm.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662457": [
        {
            "ioc_value": "xes.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662458": [
        {
            "ioc_value": "xey4.qu1ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662459": [
        {
            "ioc_value": "xf.p-93-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662421": [
        {
            "ioc_value": "x9.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662422": [
        {
            "ioc_value": "x9.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662423": [
        {
            "ioc_value": "x9.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662424": [
        {
            "ioc_value": "x9.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662425": [
        {
            "ioc_value": "x9.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662426": [
        {
            "ioc_value": "x9.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662427": [
        {
            "ioc_value": "x9.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662428": [
        {
            "ioc_value": "x9.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662429": [
        {
            "ioc_value": "x9d.7-fd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662430": [
        {
            "ioc_value": "x9k4f2q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662431": [
        {
            "ioc_value": "xa.frostmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662432": [
        {
            "ioc_value": "xa.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662433": [
        {
            "ioc_value": "xa3q.dewroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662434": [
        {
            "ioc_value": "xadokyy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662435": [
        {
            "ioc_value": "xajazu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662436": [
        {
            "ioc_value": "xal.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662437": [
        {
            "ioc_value": "xap.gr1zzlepad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662438": [
        {
            "ioc_value": "xatig3iy4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662439": [
        {
            "ioc_value": "xb.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662440": [
        {
            "ioc_value": "xb.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662441": [
        {
            "ioc_value": "xb.xxos.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662400": [
        {
            "ioc_value": "x7.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662401": [
        {
            "ioc_value": "x7.gethe4e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662402": [
        {
            "ioc_value": "x7.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662403": [
        {
            "ioc_value": "x7.oceandrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662404": [
        {
            "ioc_value": "x7.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662405": [
        {
            "ioc_value": "x7.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662406": [
        {
            "ioc_value": "x74.j-7m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662407": [
        {
            "ioc_value": "x7f.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662408": [
        {
            "ioc_value": "x7m.op76.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662409": [
        {
            "ioc_value": "x8.13-yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662410": [
        {
            "ioc_value": "x8.9-ck6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662411": [
        {
            "ioc_value": "x8.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662412": [
        {
            "ioc_value": "x8.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662413": [
        {
            "ioc_value": "x8d.byq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662414": [
        {
            "ioc_value": "x8n.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662415": [
        {
            "ioc_value": "x8n.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662416": [
        {
            "ioc_value": "x8n.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662417": [
        {
            "ioc_value": "x8n.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662418": [
        {
            "ioc_value": "x8n.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662419": [
        {
            "ioc_value": "x8n.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": "2025-11-29 09:59:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662420": [
        {
            "ioc_value": "x9.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662377": [
        {
            "ioc_value": "x2.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662378": [
        {
            "ioc_value": "x2j.2se.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662379": [
        {
            "ioc_value": "x2j.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662380": [
        {
            "ioc_value": "x2j.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662381": [
        {
            "ioc_value": "x2j.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662382": [
        {
            "ioc_value": "x2j.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662383": [
        {
            "ioc_value": "x2j.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662384": [
        {
            "ioc_value": "x2j.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662385": [
        {
            "ioc_value": "x2j.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662386": [
        {
            "ioc_value": "x2m.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662387": [
        {
            "ioc_value": "x2n.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662388": [
        {
            "ioc_value": "x2n.tem5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662389": [
        {
            "ioc_value": "x2r.icetap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662390": [
        {
            "ioc_value": "x2u4v.b3aconz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662391": [
        {
            "ioc_value": "x3y.st0nesurge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662392": [
        {
            "ioc_value": "x4.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662393": [
        {
            "ioc_value": "x4m.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662394": [
        {
            "ioc_value": "x5.starforged.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662395": [
        {
            "ioc_value": "x5.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662396": [
        {
            "ioc_value": "x5m.drift-bay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662397": [
        {
            "ioc_value": "x64.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662398": [
        {
            "ioc_value": "x7.5v05.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662399": [
        {
            "ioc_value": "x7.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662354": [
        {
            "ioc_value": "x.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662355": [
        {
            "ioc_value": "x.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662356": [
        {
            "ioc_value": "x0.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662357": [
        {
            "ioc_value": "x1.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662358": [
        {
            "ioc_value": "x1.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662359": [
        {
            "ioc_value": "x1.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662360": [
        {
            "ioc_value": "x1.embergarten.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662361": [
        {
            "ioc_value": "x1.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662362": [
        {
            "ioc_value": "x1.m1dnightr0ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662363": [
        {
            "ioc_value": "x1.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662364": [
        {
            "ioc_value": "x1p.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662365": [
        {
            "ioc_value": "x1rje.horizonbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662366": [
        {
            "ioc_value": "x2.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662367": [
        {
            "ioc_value": "x2.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662368": [
        {
            "ioc_value": "x2.91-7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662369": [
        {
            "ioc_value": "x2.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662370": [
        {
            "ioc_value": "x2.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662371": [
        {
            "ioc_value": "x2.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662372": [
        {
            "ioc_value": "x2.ew-w3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662373": [
        {
            "ioc_value": "x2.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662374": [
        {
            "ioc_value": "x2.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662375": [
        {
            "ioc_value": "x2.velvetnebel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662376": [
        {
            "ioc_value": "x2.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662330": [
        {
            "ioc_value": "x.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662331": [
        {
            "ioc_value": "x.onyxmorgen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662332": [
        {
            "ioc_value": "x.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662333": [
        {
            "ioc_value": "x.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662334": [
        {
            "ioc_value": "x.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662335": [
        {
            "ioc_value": "x.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662336": [
        {
            "ioc_value": "x.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662337": [
        {
            "ioc_value": "x.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662338": [
        {
            "ioc_value": "x.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662339": [
        {
            "ioc_value": "x.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662340": [
        {
            "ioc_value": "x.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662341": [
        {
            "ioc_value": "x.t3m3d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662342": [
        {
            "ioc_value": "x.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662343": [
        {
            "ioc_value": "x.u-na5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662344": [
        {
            "ioc_value": "x.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662345": [
        {
            "ioc_value": "x.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662346": [
        {
            "ioc_value": "x.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662347": [
        {
            "ioc_value": "x.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662348": [
        {
            "ioc_value": "x.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662349": [
        {
            "ioc_value": "x.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662350": [
        {
            "ioc_value": "x.wlh84.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662351": [
        {
            "ioc_value": "x.x0e8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662352": [
        {
            "ioc_value": "x.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662353": [
        {
            "ioc_value": "x.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662308": [
        {
            "ioc_value": "x.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662309": [
        {
            "ioc_value": "x.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662310": [
        {
            "ioc_value": "x.b8c90.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662311": [
        {
            "ioc_value": "x.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662312": [
        {
            "ioc_value": "x.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662313": [
        {
            "ioc_value": "x.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662314": [
        {
            "ioc_value": "x.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662315": [
        {
            "ioc_value": "x.d8w6l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662316": [
        {
            "ioc_value": "x.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662317": [
        {
            "ioc_value": "x.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662318": [
        {
            "ioc_value": "x.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662319": [
        {
            "ioc_value": "x.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662320": [
        {
            "ioc_value": "x.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662321": [
        {
            "ioc_value": "x.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662322": [
        {
            "ioc_value": "x.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662323": [
        {
            "ioc_value": "x.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662324": [
        {
            "ioc_value": "x.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662325": [
        {
            "ioc_value": "x.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662326": [
        {
            "ioc_value": "x.l-5228.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662327": [
        {
            "ioc_value": "x.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662328": [
        {
            "ioc_value": "x.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662329": [
        {
            "ioc_value": "x.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662288": [
        {
            "ioc_value": "wz.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662289": [
        {
            "ioc_value": "wz.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662290": [
        {
            "ioc_value": "wz.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662291": [
        {
            "ioc_value": "wz.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662292": [
        {
            "ioc_value": "wz.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662293": [
        {
            "ioc_value": "wzs.manual1sa1yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662294": [
        {
            "ioc_value": "wzu.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662295": [
        {
            "ioc_value": "x.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662296": [
        {
            "ioc_value": "x.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662297": [
        {
            "ioc_value": "x.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662298": [
        {
            "ioc_value": "x.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662299": [
        {
            "ioc_value": "x.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662300": [
        {
            "ioc_value": "x.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662301": [
        {
            "ioc_value": "x.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662302": [
        {
            "ioc_value": "x.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662303": [
        {
            "ioc_value": "x.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662304": [
        {
            "ioc_value": "x.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662305": [
        {
            "ioc_value": "x.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662306": [
        {
            "ioc_value": "x.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662307": [
        {
            "ioc_value": "x.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662265": [
        {
            "ioc_value": "wy.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662266": [
        {
            "ioc_value": "wybod.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662267": [
        {
            "ioc_value": "wyhinua4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662268": [
        {
            "ioc_value": "wyhocie8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662269": [
        {
            "ioc_value": "wykupae1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662270": [
        {
            "ioc_value": "wylde.s0ftvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662271": [
        {
            "ioc_value": "wyp.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662272": [
        {
            "ioc_value": "wytz.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662273": [
        {
            "ioc_value": "wyxam.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662274": [
        {
            "ioc_value": "wz.25qx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662275": [
        {
            "ioc_value": "wz.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662276": [
        {
            "ioc_value": "wz.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662277": [
        {
            "ioc_value": "wz.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662278": [
        {
            "ioc_value": "wz.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662279": [
        {
            "ioc_value": "wz.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662280": [
        {
            "ioc_value": "wz.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662281": [
        {
            "ioc_value": "wz.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662282": [
        {
            "ioc_value": "wz.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662283": [
        {
            "ioc_value": "wz.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662284": [
        {
            "ioc_value": "wz.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662285": [
        {
            "ioc_value": "wz.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662286": [
        {
            "ioc_value": "wz.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662287": [
        {
            "ioc_value": "wz.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662251": [
        {
            "ioc_value": "wu.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662252": [
        {
            "ioc_value": "wu.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662253": [
        {
            "ioc_value": "wubys.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662254": [
        {
            "ioc_value": "wudav.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662255": [
        {
            "ioc_value": "wv.safofoe5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662256": [
        {
            "ioc_value": "wvnqb.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662257": [
        {
            "ioc_value": "ww.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662258": [
        {
            "ioc_value": "ww8.kalmykvic0te.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662259": [
        {
            "ioc_value": "wx.jorx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662260": [
        {
            "ioc_value": "wx.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662261": [
        {
            "ioc_value": "wx.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662262": [
        {
            "ioc_value": "wxe.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662263": [
        {
            "ioc_value": "wxy.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662264": [
        {
            "ioc_value": "wy.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662243": [
        {
            "ioc_value": "wrltc.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662244": [
        {
            "ioc_value": "ws.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662245": [
        {
            "ioc_value": "wso.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662246": [
        {
            "ioc_value": "wsxy.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662247": [
        {
            "ioc_value": "wsyu.t1nkerbay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662248": [
        {
            "ioc_value": "wt.f05t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662249": [
        {
            "ioc_value": "wtg2.heatherkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662250": [
        {
            "ioc_value": "wth.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662237": [
        {
            "ioc_value": "wp.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662238": [
        {
            "ioc_value": "wp6.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662239": [
        {
            "ioc_value": "wq.cl1ffwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662240": [
        {
            "ioc_value": "wq3b0k7.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662241": [
        {
            "ioc_value": "wr.baruruy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662242": [
        {
            "ioc_value": "wren.wrenhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662218": [
        {
            "ioc_value": "wolke3.br-0-ad-temp-1-ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662219": [
        {
            "ioc_value": "wolke9.lindenarc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662220": [
        {
            "ioc_value": "wolken.prariehafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662221": [
        {
            "ioc_value": "wolken6.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662222": [
        {
            "ioc_value": "wolken9.heatherkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662223": [
        {
            "ioc_value": "wolkr.2tannenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662224": [
        {
            "ioc_value": "wolkr.c1earpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662225": [
        {
            "ioc_value": "wonohi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662226": [
        {
            "ioc_value": "wood.a-5-t-1-gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662227": [
        {
            "ioc_value": "wood.sun0rbit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662228": [
        {
            "ioc_value": "wood4.cloud5eed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662229": [
        {
            "ioc_value": "wopyhay6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662230": [
        {
            "ioc_value": "wosicee6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662231": [
        {
            "ioc_value": "wow.kuvuboa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662232": [
        {
            "ioc_value": "woxivie8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662233": [
        {
            "ioc_value": "wp.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662234": [
        {
            "ioc_value": "wp.frost-wilder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662235": [
        {
            "ioc_value": "wp.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662236": [
        {
            "ioc_value": "wp.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662192": [
        {
            "ioc_value": "wolke.oakensiegel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662193": [
        {
            "ioc_value": "wolke.orionfeld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662194": [
        {
            "ioc_value": "wolke.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662195": [
        {
            "ioc_value": "wolke.polarhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662196": [
        {
            "ioc_value": "wolke.quillwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662197": [
        {
            "ioc_value": "wolke.rapidmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662198": [
        {
            "ioc_value": "wolke.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662199": [
        {
            "ioc_value": "wolke.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662200": [
        {
            "ioc_value": "wolke.silberhain9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662201": [
        {
            "ioc_value": "wolke.silverbirke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662202": [
        {
            "ioc_value": "wolke.skyblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662203": [
        {
            "ioc_value": "wolke.sprigkompass.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662204": [
        {
            "ioc_value": "wolke.st0necloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662205": [
        {
            "ioc_value": "wolke.st0nepath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662206": [
        {
            "ioc_value": "wolke.starl1nq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662207": [
        {
            "ioc_value": "wolke.stormlaterne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662208": [
        {
            "ioc_value": "wolke.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662209": [
        {
            "ioc_value": "wolke.thistleforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662210": [
        {
            "ioc_value": "wolke.thundergrove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662211": [
        {
            "ioc_value": "wolke.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662212": [
        {
            "ioc_value": "wolke.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662213": [
        {
            "ioc_value": "wolke1.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662214": [
        {
            "ioc_value": "wolke2.dis5h7gien.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662215": [
        {
            "ioc_value": "wolke2.oceantrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662216": [
        {
            "ioc_value": "wolke2.stormpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662217": [
        {
            "ioc_value": "wolke3.awreti3uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662169": [
        {
            "ioc_value": "wolke.brightf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662170": [
        {
            "ioc_value": "wolke.brightstep.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662171": [
        {
            "ioc_value": "wolke.brightv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662172": [
        {
            "ioc_value": "wolke.c1earwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662173": [
        {
            "ioc_value": "wolke.ciearforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662174": [
        {
            "ioc_value": "wolke.clearpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662175": [
        {
            "ioc_value": "wolke.cloudkreis.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662176": [
        {
            "ioc_value": "wolke.darkspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662177": [
        {
            "ioc_value": "wolke.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662178": [
        {
            "ioc_value": "wolke.elmfalter.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662179": [
        {
            "ioc_value": "wolke.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662180": [
        {
            "ioc_value": "wolke.flintpaddle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662181": [
        {
            "ioc_value": "wolke.glimmerstrand.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662182": [
        {
            "ioc_value": "wolke.granitekamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662183": [
        {
            "ioc_value": "wolke.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662184": [
        {
            "ioc_value": "wolke.heatherpass.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662185": [
        {
            "ioc_value": "wolke.ic0n1cforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662186": [
        {
            "ioc_value": "wolke.immigrant5p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662187": [
        {
            "ioc_value": "wolke.kab1spr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662188": [
        {
            "ioc_value": "wolke.l1ghtcloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662189": [
        {
            "ioc_value": "wolke.l1necloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662190": [
        {
            "ioc_value": "wolke.mintzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662191": [
        {
            "ioc_value": "wolke.nimbusforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662148": [
        {
            "ioc_value": "wo2lke.nar7owsized.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662149": [
        {
            "ioc_value": "wofehoo0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662150": [
        {
            "ioc_value": "wok.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662151": [
        {
            "ioc_value": "wolf.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662152": [
        {
            "ioc_value": "wolf.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662153": [
        {
            "ioc_value": "wolfe.deepstream.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662154": [
        {
            "ioc_value": "wolfe.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662155": [
        {
            "ioc_value": "wolfe.guan0mesca.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662156": [
        {
            "ioc_value": "wolfe.kab-1-spr-0-tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662157": [
        {
            "ioc_value": "wolfe.nebulaquelle3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662158": [
        {
            "ioc_value": "wolfe.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662159": [
        {
            "ioc_value": "wolfe.netit-0-c-0-rec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662160": [
        {
            "ioc_value": "wolfe.pixelbuche.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662161": [
        {
            "ioc_value": "wolfe2.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662162": [
        {
            "ioc_value": "wolfe2.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662163": [
        {
            "ioc_value": "wolke.5ilverm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662164": [
        {
            "ioc_value": "wolke.ashenkrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662165": [
        {
            "ioc_value": "wolke.b1ue5pr1lng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662166": [
        {
            "ioc_value": "wolke.bluecr4ft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662167": [
        {
            "ioc_value": "wolke.br1ght5tar.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662168": [
        {
            "ioc_value": "wolke.br1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662128": [
        {
            "ioc_value": "wkck4.b1tcrush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662129": [
        {
            "ioc_value": "wl.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662130": [
        {
            "ioc_value": "wl.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662131": [
        {
            "ioc_value": "wlk.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662132": [
        {
            "ioc_value": "wm.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662133": [
        {
            "ioc_value": "wm.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662134": [
        {
            "ioc_value": "wm.vxof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662135": [
        {
            "ioc_value": "wm.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662136": [
        {
            "ioc_value": "wm1wu.aud1mi5s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662137": [
        {
            "ioc_value": "wmu.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662138": [
        {
            "ioc_value": "wmw2.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662139": [
        {
            "ioc_value": "wn.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662140": [
        {
            "ioc_value": "wn.mysticdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662141": [
        {
            "ioc_value": "wn.n0v0se1prew.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662142": [
        {
            "ioc_value": "wn.v0xelspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662143": [
        {
            "ioc_value": "wndb.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662144": [
        {
            "ioc_value": "wnf.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662145": [
        {
            "ioc_value": "wnn.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662146": [
        {
            "ioc_value": "wo.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662147": [
        {
            "ioc_value": "wo.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662109": [
        {
            "ioc_value": "wind.sageufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662110": [
        {
            "ioc_value": "wind.shad0wline.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662111": [
        {
            "ioc_value": "wind.zirconweg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662112": [
        {
            "ioc_value": "wind2.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662113": [
        {
            "ioc_value": "wind3.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662114": [
        {
            "ioc_value": "wind3.dustycode.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662115": [
        {
            "ioc_value": "wind4.ciearbug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662116": [
        {
            "ioc_value": "wind5.brackenloft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662117": [
        {
            "ioc_value": "wind9.silverrun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662118": [
        {
            "ioc_value": "winde.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662119": [
        {
            "ioc_value": "wink3l.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662120": [
        {
            "ioc_value": "winkel.harewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662121": [
        {
            "ioc_value": "wire8.mintburst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662122": [
        {
            "ioc_value": "wise.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662123": [
        {
            "ioc_value": "wj.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662124": [
        {
            "ioc_value": "wj.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662125": [
        {
            "ioc_value": "wk.copperlattice.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662126": [
        {
            "ioc_value": "wk.n96f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662127": [
        {
            "ioc_value": "wk.sketch-loom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662092": [
        {
            "ioc_value": "wildpioneer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662093": [
        {
            "ioc_value": "will7o.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662094": [
        {
            "ioc_value": "willow.stormharrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662095": [
        {
            "ioc_value": "willow.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662096": [
        {
            "ioc_value": "willow9.windowl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662097": [
        {
            "ioc_value": "wind.auricfluss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662098": [
        {
            "ioc_value": "wind.aurorafels.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662099": [
        {
            "ioc_value": "wind.awreti-3-uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662100": [
        {
            "ioc_value": "wind.c1earwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662101": [
        {
            "ioc_value": "wind.cairnsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662102": [
        {
            "ioc_value": "wind.cedarsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662103": [
        {
            "ioc_value": "wind.clearpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662104": [
        {
            "ioc_value": "wind.f1anerchan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662105": [
        {
            "ioc_value": "wind.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662106": [
        {
            "ioc_value": "wind.hawkmast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662107": [
        {
            "ioc_value": "wind.ravenkamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662108": [
        {
            "ioc_value": "wind.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662075": [
        {
            "ioc_value": "whittle.razorplume.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662076": [
        {
            "ioc_value": "whlox.flint-zoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662077": [
        {
            "ioc_value": "why.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": "2025-11-29 09:59:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662078": [
        {
            "ioc_value": "wi.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662079": [
        {
            "ioc_value": "wi.wolkenspur3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662080": [
        {
            "ioc_value": "wi1nd.dr0gaguaran.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662081": [
        {
            "ioc_value": "wide.w1ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662082": [
        {
            "ioc_value": "wig.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662083": [
        {
            "ioc_value": "wiidcre5t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662084": [
        {
            "ioc_value": "wild.boargrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662085": [
        {
            "ioc_value": "wild.m1stbird.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662086": [
        {
            "ioc_value": "wild.stormharrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662087": [
        {
            "ioc_value": "wild0.stonecl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662088": [
        {
            "ioc_value": "wild3.l1festone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662089": [
        {
            "ioc_value": "wild6.s1lver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662090": [
        {
            "ioc_value": "wild6.skybl1ss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662091": [
        {
            "ioc_value": "wild7.r1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662053": [
        {
            "ioc_value": "weiss.prismgrau.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662054": [
        {
            "ioc_value": "weiss.sagehollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662055": [
        {
            "ioc_value": "weiss.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662056": [
        {
            "ioc_value": "weiss.solarpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662057": [
        {
            "ioc_value": "weiss.starfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662058": [
        {
            "ioc_value": "weiss.stargl0w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662059": [
        {
            "ioc_value": "weiss.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662060": [
        {
            "ioc_value": "weiss.yewhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662061": [
        {
            "ioc_value": "wemaweo9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662062": [
        {
            "ioc_value": "weo.clearfog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662063": [
        {
            "ioc_value": "wepe.j1gglestone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662064": [
        {
            "ioc_value": "wet.app-6-v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662065": [
        {
            "ioc_value": "wet.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662066": [
        {
            "ioc_value": "wet.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662067": [
        {
            "ioc_value": "wevolyo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662068": [
        {
            "ioc_value": "wf.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662069": [
        {
            "ioc_value": "wf.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662070": [
        {
            "ioc_value": "wg.f42s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662071": [
        {
            "ioc_value": "wh.p-93-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662072": [
        {
            "ioc_value": "wharf.cinderloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662073": [
        {
            "ioc_value": "whisper-lake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662074": [
        {
            "ioc_value": "white.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662030": [
        {
            "ioc_value": "wegazo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662031": [
        {
            "ioc_value": "wei5ss.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662032": [
        {
            "ioc_value": "weid7e.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662033": [
        {
            "ioc_value": "weide.7willowkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662034": [
        {
            "ioc_value": "weide.glimmerufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662035": [
        {
            "ioc_value": "weide.ravenkloster.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662036": [
        {
            "ioc_value": "weide.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662037": [
        {
            "ioc_value": "weiss.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662038": [
        {
            "ioc_value": "weiss.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662039": [
        {
            "ioc_value": "weiss.cedarberg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662040": [
        {
            "ioc_value": "weiss.crystalrun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662041": [
        {
            "ioc_value": "weiss.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662042": [
        {
            "ioc_value": "weiss.elmquarry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662043": [
        {
            "ioc_value": "weiss.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662044": [
        {
            "ioc_value": "weiss.ferretpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662045": [
        {
            "ioc_value": "weiss.granitehaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662046": [
        {
            "ioc_value": "weiss.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662047": [
        {
            "ioc_value": "weiss.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662048": [
        {
            "ioc_value": "weiss.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662049": [
        {
            "ioc_value": "weiss.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662050": [
        {
            "ioc_value": "weiss.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662051": [
        {
            "ioc_value": "weiss.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662052": [
        {
            "ioc_value": "weiss.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662006": [
        {
            "ioc_value": "weald.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662007": [
        {
            "ioc_value": "weald.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662008": [
        {
            "ioc_value": "weald.nightspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662009": [
        {
            "ioc_value": "weald.quirkforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662010": [
        {
            "ioc_value": "weald.s1lvergate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662011": [
        {
            "ioc_value": "weald.saffronhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662012": [
        {
            "ioc_value": "weald.silentwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662013": [
        {
            "ioc_value": "weald.slatefalke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662014": [
        {
            "ioc_value": "weald.softl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662015": [
        {
            "ioc_value": "weald.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662016": [
        {
            "ioc_value": "weald.storml1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662017": [
        {
            "ioc_value": "weald3.breezef0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662018": [
        {
            "ioc_value": "wear.kuvuboa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662019": [
        {
            "ioc_value": "weave.m00nweaver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662020": [
        {
            "ioc_value": "web-d-n-45.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662021": [
        {
            "ioc_value": "web-d-n45.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662022": [
        {
            "ioc_value": "web-d-n45.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662023": [
        {
            "ioc_value": "webis.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662024": [
        {
            "ioc_value": "wec6.fie1dcl0se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662025": [
        {
            "ioc_value": "wed.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662026": [
        {
            "ioc_value": "wed.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662027": [
        {
            "ioc_value": "wee.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662028": [
        {
            "ioc_value": "weg.otterweg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662029": [
        {
            "ioc_value": "weg.w1ndmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661983": [
        {
            "ioc_value": "we.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661984": [
        {
            "ioc_value": "we.myda4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661985": [
        {
            "ioc_value": "we.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661986": [
        {
            "ioc_value": "we.raha1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661987": [
        {
            "ioc_value": "we.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661988": [
        {
            "ioc_value": "we.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661989": [
        {
            "ioc_value": "we.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661990": [
        {
            "ioc_value": "we.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661991": [
        {
            "ioc_value": "we1iss.test6yvarn1sh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661992": [
        {
            "ioc_value": "we4g.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661993": [
        {
            "ioc_value": "weald.0akstream.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661994": [
        {
            "ioc_value": "weald.auroralinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661995": [
        {
            "ioc_value": "weald.br-0-ad-temp-1-ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661996": [
        {
            "ioc_value": "weald.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661997": [
        {
            "ioc_value": "weald.cobaltquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661998": [
        {
            "ioc_value": "weald.ec0nomyfl0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661999": [
        {
            "ioc_value": "weald.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662000": [
        {
            "ioc_value": "weald.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662001": [
        {
            "ioc_value": "weald.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662002": [
        {
            "ioc_value": "weald.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662003": [
        {
            "ioc_value": "weald.kick-5-ubs-4-ance.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662004": [
        {
            "ioc_value": "weald.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1662005": [
        {
            "ioc_value": "weald.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661965": [
        {
            "ioc_value": "waxix7eu4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661966": [
        {
            "ioc_value": "way.cawyfie51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661967": [
        {
            "ioc_value": "way.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661968": [
        {
            "ioc_value": "way.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661969": [
        {
            "ioc_value": "way.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661970": [
        {
            "ioc_value": "wb.kesogio6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661971": [
        {
            "ioc_value": "wc.dabytea7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661972": [
        {
            "ioc_value": "wc.f-05-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661973": [
        {
            "ioc_value": "wc18k.comp-0-tsab-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661974": [
        {
            "ioc_value": "wd.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661975": [
        {
            "ioc_value": "wd.z-99-l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": "2025-11-29 09:59:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661976": [
        {
            "ioc_value": "wdax-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661977": [
        {
            "ioc_value": "wdh.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661978": [
        {
            "ioc_value": "wdr.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661979": [
        {
            "ioc_value": "we.bo-x2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661980": [
        {
            "ioc_value": "we.devy3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661981": [
        {
            "ioc_value": "we.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661982": [
        {
            "ioc_value": "we.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661943": [
        {
            "ioc_value": "wall8.f0rce.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661944": [
        {
            "ioc_value": "walnut.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661945": [
        {
            "ioc_value": "waqj.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661946": [
        {
            "ioc_value": "war.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661947": [
        {
            "ioc_value": "war.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661948": [
        {
            "ioc_value": "warm.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661949": [
        {
            "ioc_value": "wasar.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661950": [
        {
            "ioc_value": "water.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661951": [
        {
            "ioc_value": "watt.fucirai75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661952": [
        {
            "ioc_value": "wav3ly.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661953": [
        {
            "ioc_value": "wave.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661954": [
        {
            "ioc_value": "wave.flint-zoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661955": [
        {
            "ioc_value": "wave.mintforest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661956": [
        {
            "ioc_value": "wave.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661957": [
        {
            "ioc_value": "wave.pen1sp7edef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661958": [
        {
            "ioc_value": "wave.rivermote.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661959": [
        {
            "ioc_value": "wave.zenithsnap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661960": [
        {
            "ioc_value": "wave1.cieardrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661961": [
        {
            "ioc_value": "wave5.ju4enpare1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661962": [
        {
            "ioc_value": "wave6.brahtr0phy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661963": [
        {
            "ioc_value": "wave6.gl1tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661964": [
        {
            "ioc_value": "wave7x.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661920": [
        {
            "ioc_value": "wald.harmfu1tw0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661921": [
        {
            "ioc_value": "wald.hum2nk0str.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661922": [
        {
            "ioc_value": "wald.in-ha-4-it-mu-1-ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661923": [
        {
            "ioc_value": "wald.m1stwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661924": [
        {
            "ioc_value": "wald.martenhain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661925": [
        {
            "ioc_value": "wald.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661926": [
        {
            "ioc_value": "wald.nickelweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661927": [
        {
            "ioc_value": "wald.oakensiegel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661928": [
        {
            "ioc_value": "wald.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661929": [
        {
            "ioc_value": "wald.payc0medy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661930": [
        {
            "ioc_value": "wald.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661931": [
        {
            "ioc_value": "wald.r1verbend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661932": [
        {
            "ioc_value": "wald.rowanstead.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661933": [
        {
            "ioc_value": "wald.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661934": [
        {
            "ioc_value": "wald.wlnd5hore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661935": [
        {
            "ioc_value": "wald.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661936": [
        {
            "ioc_value": "wald.wolspfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661937": [
        {
            "ioc_value": "wald3.mintstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661938": [
        {
            "ioc_value": "wald7.br0adtemp1ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661939": [
        {
            "ioc_value": "walk.wildm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661940": [
        {
            "ioc_value": "wall1.shadowf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661941": [
        {
            "ioc_value": "wall5.5t0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661942": [
        {
            "ioc_value": "wall6.shadowf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661901": [
        {
            "ioc_value": "w9.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661902": [
        {
            "ioc_value": "w9.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661903": [
        {
            "ioc_value": "w9.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": "2025-11-29 09:59:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661904": [
        {
            "ioc_value": "w92.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661905": [
        {
            "ioc_value": "w9el.hover-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661906": [
        {
            "ioc_value": "w9s.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661907": [
        {
            "ioc_value": "w9t3z8.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661908": [
        {
            "ioc_value": "w9t7k.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661909": [
        {
            "ioc_value": "w9x.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661910": [
        {
            "ioc_value": "wa.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661911": [
        {
            "ioc_value": "wa.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661912": [
        {
            "ioc_value": "wa.sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661913": [
        {
            "ioc_value": "wafag.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661914": [
        {
            "ioc_value": "wajinye8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661915": [
        {
            "ioc_value": "wal3d.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661916": [
        {
            "ioc_value": "wald.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661917": [
        {
            "ioc_value": "wald.c0nsiumpond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661918": [
        {
            "ioc_value": "wald.cedarquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661919": [
        {
            "ioc_value": "wald.copperhang.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661882": [
        {
            "ioc_value": "w3b.driftmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661883": [
        {
            "ioc_value": "w4.cioudriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661884": [
        {
            "ioc_value": "w4.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661885": [
        {
            "ioc_value": "w4.sm-0-kewood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661886": [
        {
            "ioc_value": "w43.law-5-andw-1-ch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661887": [
        {
            "ioc_value": "w4g.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661888": [
        {
            "ioc_value": "w4l.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661889": [
        {
            "ioc_value": "w5t.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661890": [
        {
            "ioc_value": "w6.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661891": [
        {
            "ioc_value": "w6.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661892": [
        {
            "ioc_value": "w65.es-ca-1-t-3-ust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661893": [
        {
            "ioc_value": "w7.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661894": [
        {
            "ioc_value": "w7c5n2.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661895": [
        {
            "ioc_value": "w7x.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661896": [
        {
            "ioc_value": "w8.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661897": [
        {
            "ioc_value": "w8v.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661898": [
        {
            "ioc_value": "w8y3n2d.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661899": [
        {
            "ioc_value": "w9.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661900": [
        {
            "ioc_value": "w9.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661865": [
        {
            "ioc_value": "w0umz.s0ftfern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661866": [
        {
            "ioc_value": "w1.7n28r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661867": [
        {
            "ioc_value": "w1.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661868": [
        {
            "ioc_value": "w1.ie45.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661869": [
        {
            "ioc_value": "w1.quartzleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661870": [
        {
            "ioc_value": "w1558.ma-shrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661871": [
        {
            "ioc_value": "w1656569g.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661872": [
        {
            "ioc_value": "w1i.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661873": [
        {
            "ioc_value": "w1n.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661874": [
        {
            "ioc_value": "w1n.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661875": [
        {
            "ioc_value": "w1n.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661876": [
        {
            "ioc_value": "w1ndo.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661877": [
        {
            "ioc_value": "w2.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661878": [
        {
            "ioc_value": "w2.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661879": [
        {
            "ioc_value": "w2.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661880": [
        {
            "ioc_value": "w2.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661881": [
        {
            "ioc_value": "w3.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661842": [
        {
            "ioc_value": "vydic1eu1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661843": [
        {
            "ioc_value": "vyf3.mirthcap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661844": [
        {
            "ioc_value": "vyjilua3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661845": [
        {
            "ioc_value": "vynen.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661846": [
        {
            "ioc_value": "vyt.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661847": [
        {
            "ioc_value": "vyt.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661848": [
        {
            "ioc_value": "vytoz.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661849": [
        {
            "ioc_value": "vyzap.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661850": [
        {
            "ioc_value": "vyzu.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661851": [
        {
            "ioc_value": "vz.derl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661852": [
        {
            "ioc_value": "vz.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661853": [
        {
            "ioc_value": "vzh.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661854": [
        {
            "ioc_value": "w.d3l4d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661855": [
        {
            "ioc_value": "w.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661856": [
        {
            "ioc_value": "w.q5z9s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661857": [
        {
            "ioc_value": "w.q780.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661858": [
        {
            "ioc_value": "w.s3i1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661859": [
        {
            "ioc_value": "w.vem4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661860": [
        {
            "ioc_value": "w.x-73-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661861": [
        {
            "ioc_value": "w0.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661862": [
        {
            "ioc_value": "w0ald.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661863": [
        {
            "ioc_value": "w0eh.copperlattice.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661864": [
        {
            "ioc_value": "w0f7n3ty.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661822": [
        {
            "ioc_value": "vukyp.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661823": [
        {
            "ioc_value": "vuram.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661824": [
        {
            "ioc_value": "vusy.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661825": [
        {
            "ioc_value": "vv.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661826": [
        {
            "ioc_value": "vv.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661827": [
        {
            "ioc_value": "vv.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661828": [
        {
            "ioc_value": "vv.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661829": [
        {
            "ioc_value": "vv.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661830": [
        {
            "ioc_value": "vvi.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661831": [
        {
            "ioc_value": "vvp.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661832": [
        {
            "ioc_value": "vvx.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661833": [
        {
            "ioc_value": "vw.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661834": [
        {
            "ioc_value": "vx.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661835": [
        {
            "ioc_value": "vy.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661836": [
        {
            "ioc_value": "vy.sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661837": [
        {
            "ioc_value": "vy.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661838": [
        {
            "ioc_value": "vy6.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661839": [
        {
            "ioc_value": "vyc.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661840": [
        {
            "ioc_value": "vyce-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661841": [
        {
            "ioc_value": "vyce2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661800": [
        {
            "ioc_value": "vow.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661801": [
        {
            "ioc_value": "vp.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661802": [
        {
            "ioc_value": "vp.wuk0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661803": [
        {
            "ioc_value": "vpcp.clipmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661804": [
        {
            "ioc_value": "vq.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661805": [
        {
            "ioc_value": "vq.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661806": [
        {
            "ioc_value": "vq.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661807": [
        {
            "ioc_value": "vq.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661808": [
        {
            "ioc_value": "vqtn.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661809": [
        {
            "ioc_value": "vr.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661810": [
        {
            "ioc_value": "vr.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661811": [
        {
            "ioc_value": "vrix5a.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661812": [
        {
            "ioc_value": "vrxl3.primurib1er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661813": [
        {
            "ioc_value": "vsdd.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661814": [
        {
            "ioc_value": "vsieh.emberiake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661815": [
        {
            "ioc_value": "vsm.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661816": [
        {
            "ioc_value": "vt7.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661817": [
        {
            "ioc_value": "vtbg5.icy-moth.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661818": [
        {
            "ioc_value": "vth.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661819": [
        {
            "ioc_value": "vu.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661820": [
        {
            "ioc_value": "vu.n-44-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661821": [
        {
            "ioc_value": "vu.sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661777": [
        {
            "ioc_value": "vkp.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661778": [
        {
            "ioc_value": "vl.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661779": [
        {
            "ioc_value": "vl.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661780": [
        {
            "ioc_value": "vlr.quartz-flip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661781": [
        {
            "ioc_value": "vlrbq.fr0stharrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661782": [
        {
            "ioc_value": "vm.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661783": [
        {
            "ioc_value": "vm.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661784": [
        {
            "ioc_value": "vmkkb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661785": [
        {
            "ioc_value": "vmzts.g0b1ncore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661786": [
        {
            "ioc_value": "vn.wqix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661787": [
        {
            "ioc_value": "vni.l0ngprope1l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661788": [
        {
            "ioc_value": "vnv.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661789": [
        {
            "ioc_value": "vnvqj.t1decrystai.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661790": [
        {
            "ioc_value": "vo.sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661791": [
        {
            "ioc_value": "vo5.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661792": [
        {
            "ioc_value": "vo7.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661793": [
        {
            "ioc_value": "vogos.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661794": [
        {
            "ioc_value": "vohe7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661795": [
        {
            "ioc_value": "volez.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661796": [
        {
            "ioc_value": "volp.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661797": [
        {
            "ioc_value": "voqyxio6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661798": [
        {
            "ioc_value": "vortex7.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661799": [
        {
            "ioc_value": "vovoh.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661756": [
        {
            "ioc_value": "vhx.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661757": [
        {
            "ioc_value": "vi.dgod.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661758": [
        {
            "ioc_value": "vi.t-65-p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661759": [
        {
            "ioc_value": "vi.twistnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661760": [
        {
            "ioc_value": "vib3ro.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661761": [
        {
            "ioc_value": "vibe.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661762": [
        {
            "ioc_value": "vihuqau.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661763": [
        {
            "ioc_value": "vindex5.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661764": [
        {
            "ioc_value": "violetmoos.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661765": [
        {
            "ioc_value": "viqon.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661766": [
        {
            "ioc_value": "vivid8.kalmykvic0te.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661767": [
        {
            "ioc_value": "vj.w20s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661768": [
        {
            "ioc_value": "vk.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661769": [
        {
            "ioc_value": "vk.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661770": [
        {
            "ioc_value": "vk.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661771": [
        {
            "ioc_value": "vk.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661772": [
        {
            "ioc_value": "vk.kos0ltyu4etey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661773": [
        {
            "ioc_value": "vk.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661774": [
        {
            "ioc_value": "vk.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": "2025-11-29 09:59:18",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661775": [
        {
            "ioc_value": "vk.z-99-l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661776": [
        {
            "ioc_value": "vkf.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661736": [
        {
            "ioc_value": "vento.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661737": [
        {
            "ioc_value": "vento5.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661738": [
        {
            "ioc_value": "vepyvei3.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661739": [
        {
            "ioc_value": "verde7.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661740": [
        {
            "ioc_value": "verge.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661741": [
        {
            "ioc_value": "vet.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661742": [
        {
            "ioc_value": "veu.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661743": [
        {
            "ioc_value": "vex.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661744": [
        {
            "ioc_value": "vex7in.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661745": [
        {
            "ioc_value": "vf.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661746": [
        {
            "ioc_value": "vfp.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661747": [
        {
            "ioc_value": "vg.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661748": [
        {
            "ioc_value": "vgg.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661749": [
        {
            "ioc_value": "vh.emberiake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661750": [
        {
            "ioc_value": "vh.vwof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661751": [
        {
            "ioc_value": "vh0.cl0ckmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661752": [
        {
            "ioc_value": "vh1xr.ju4enpare1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661753": [
        {
            "ioc_value": "vh7.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661754": [
        {
            "ioc_value": "vhi.j935.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661755": [
        {
            "ioc_value": "vhu.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661718": [
        {
            "ioc_value": "ve.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661719": [
        {
            "ioc_value": "ve.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661720": [
        {
            "ioc_value": "ve.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661721": [
        {
            "ioc_value": "ve.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661722": [
        {
            "ioc_value": "ve.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661723": [
        {
            "ioc_value": "ve.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661724": [
        {
            "ioc_value": "vector.v3ctorplum.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661725": [
        {
            "ioc_value": "vector.zapkinetic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661726": [
        {
            "ioc_value": "vector.zenithsnap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": "2025-11-29 09:59:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661727": [
        {
            "ioc_value": "vectorblitz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661728": [
        {
            "ioc_value": "vef.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661729": [
        {
            "ioc_value": "vegyt.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661730": [
        {
            "ioc_value": "veiii.st0negate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661731": [
        {
            "ioc_value": "veil.stonefog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661732": [
        {
            "ioc_value": "vekeq.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661733": [
        {
            "ioc_value": "velvet.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": "2025-11-29 09:59:01",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661734": [
        {
            "ioc_value": "vememye3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661735": [
        {
            "ioc_value": "ven.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661697": [
        {
            "ioc_value": "vat.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661698": [
        {
            "ioc_value": "vaw.du2iv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661699": [
        {
            "ioc_value": "vaw2.du2iv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661700": [
        {
            "ioc_value": "vazyr4ii9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661701": [
        {
            "ioc_value": "vb.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661702": [
        {
            "ioc_value": "vb.plx5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661703": [
        {
            "ioc_value": "vbq6.v1b3forge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661704": [
        {
            "ioc_value": "vc.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661705": [
        {
            "ioc_value": "vc.rogosie4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661706": [
        {
            "ioc_value": "vcv.v0rt3xlab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661707": [
        {
            "ioc_value": "vd.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661708": [
        {
            "ioc_value": "vd.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661709": [
        {
            "ioc_value": "vd.padj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661710": [
        {
            "ioc_value": "vdj3j.protohush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661711": [
        {
            "ioc_value": "vdn.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661712": [
        {
            "ioc_value": "vdx.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661713": [
        {
            "ioc_value": "ve.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661714": [
        {
            "ioc_value": "ve.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661715": [
        {
            "ioc_value": "ve.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661716": [
        {
            "ioc_value": "ve.htif.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661717": [
        {
            "ioc_value": "ve.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661675": [
        {
            "ioc_value": "vale.le-3-nsnet-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661676": [
        {
            "ioc_value": "vale.patchvine.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661677": [
        {
            "ioc_value": "vale.quantmelt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661678": [
        {
            "ioc_value": "vale.s0ftmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661679": [
        {
            "ioc_value": "vale.wildr0sehub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661680": [
        {
            "ioc_value": "vale.zenith-snap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661681": [
        {
            "ioc_value": "vale0.cinderloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661682": [
        {
            "ioc_value": "vale1.le-3-nsnet-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661683": [
        {
            "ioc_value": "vale2.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661684": [
        {
            "ioc_value": "vale3.fro5tlane.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661685": [
        {
            "ioc_value": "vale4.w1ldforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661686": [
        {
            "ioc_value": "vale4.zenbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661687": [
        {
            "ioc_value": "vale6.c1earwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661688": [
        {
            "ioc_value": "vale8.wild0ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661689": [
        {
            "ioc_value": "vale9.fal-1-ow-7-an.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661690": [
        {
            "ioc_value": "valeschild.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661691": [
        {
            "ioc_value": "vally.s0ftvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661692": [
        {
            "ioc_value": "van.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661693": [
        {
            "ioc_value": "vap0ra.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661694": [
        {
            "ioc_value": "vapr.basaltwisp9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661695": [
        {
            "ioc_value": "vasih.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661696": [
        {
            "ioc_value": "vast.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661655": [
        {
            "ioc_value": "v98.cliffwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661656": [
        {
            "ioc_value": "va.d09r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661657": [
        {
            "ioc_value": "va.deltasync.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661658": [
        {
            "ioc_value": "va.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661659": [
        {
            "ioc_value": "va.van1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661660": [
        {
            "ioc_value": "va.xe3ax.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661661": [
        {
            "ioc_value": "va3.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661662": [
        {
            "ioc_value": "va43.du2iv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661663": [
        {
            "ioc_value": "vaboz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661664": [
        {
            "ioc_value": "vacoraa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661665": [
        {
            "ioc_value": "vadykoe7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661666": [
        {
            "ioc_value": "vajigiy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661667": [
        {
            "ioc_value": "vale.amin0mer3ges.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661668": [
        {
            "ioc_value": "vale.bowin1nca5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661669": [
        {
            "ioc_value": "vale.cioudharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661670": [
        {
            "ioc_value": "vale.cioudnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661671": [
        {
            "ioc_value": "vale.dup1ic4ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661672": [
        {
            "ioc_value": "vale.ever-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661673": [
        {
            "ioc_value": "vale.hovermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661674": [
        {
            "ioc_value": "vale.lakespry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661637": [
        {
            "ioc_value": "v42le.fog-map.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661638": [
        {
            "ioc_value": "v4n.0rbishade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661639": [
        {
            "ioc_value": "v5.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661640": [
        {
            "ioc_value": "v5.mossowl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661641": [
        {
            "ioc_value": "v5.plasmabout.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661642": [
        {
            "ioc_value": "v5.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661643": [
        {
            "ioc_value": "v5w.r1mrock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661644": [
        {
            "ioc_value": "v6kxb.a6il1oyal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661645": [
        {
            "ioc_value": "v6m2a.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661646": [
        {
            "ioc_value": "v6n.crystalcavern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661647": [
        {
            "ioc_value": "v7.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661648": [
        {
            "ioc_value": "v7b.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661649": [
        {
            "ioc_value": "v7c.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661650": [
        {
            "ioc_value": "v8.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661651": [
        {
            "ioc_value": "v8.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661652": [
        {
            "ioc_value": "v81h.m0rning.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661653": [
        {
            "ioc_value": "v8im.c-0-sm-1-cweld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661654": [
        {
            "ioc_value": "v9.brightsage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661613": [
        {
            "ioc_value": "v2q.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": "2025-11-29 09:59:21",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661614": [
        {
            "ioc_value": "v2r.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661615": [
        {
            "ioc_value": "v3.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661616": [
        {
            "ioc_value": "v3.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661617": [
        {
            "ioc_value": "v3.802d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661618": [
        {
            "ioc_value": "v3.cloverschnee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661619": [
        {
            "ioc_value": "v3.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661620": [
        {
            "ioc_value": "v3.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661621": [
        {
            "ioc_value": "v3.kuq5g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661622": [
        {
            "ioc_value": "v3.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661623": [
        {
            "ioc_value": "v3.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661624": [
        {
            "ioc_value": "v3.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661625": [
        {
            "ioc_value": "v3.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661626": [
        {
            "ioc_value": "v3.sproutkraft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661627": [
        {
            "ioc_value": "v3.t-nin.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661628": [
        {
            "ioc_value": "v3.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661629": [
        {
            "ioc_value": "v3.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661630": [
        {
            "ioc_value": "v3.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661631": [
        {
            "ioc_value": "v3.zms-u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661632": [
        {
            "ioc_value": "v30.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661633": [
        {
            "ioc_value": "v3d1.st3elflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661634": [
        {
            "ioc_value": "v3kxh.nib-snap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661635": [
        {
            "ioc_value": "v3n2.opal-hollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661636": [
        {
            "ioc_value": "v3r.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661594": [
        {
            "ioc_value": "v.n6p5j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661595": [
        {
            "ioc_value": "v0.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661596": [
        {
            "ioc_value": "v0g.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661597": [
        {
            "ioc_value": "v0m.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661598": [
        {
            "ioc_value": "v0s.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661599": [
        {
            "ioc_value": "v1.8-fr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661600": [
        {
            "ioc_value": "v1.jaxdrill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661601": [
        {
            "ioc_value": "v1.q780.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661602": [
        {
            "ioc_value": "v1i.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661603": [
        {
            "ioc_value": "v1i.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": "2025-11-29 09:59:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661604": [
        {
            "ioc_value": "v2.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661605": [
        {
            "ioc_value": "v2.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661606": [
        {
            "ioc_value": "v2.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": "2025-11-29 09:59:25",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661607": [
        {
            "ioc_value": "v2l.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661608": [
        {
            "ioc_value": "v2n.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661609": [
        {
            "ioc_value": "v2n.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661610": [
        {
            "ioc_value": "v2n.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661611": [
        {
            "ioc_value": "v2n.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661612": [
        {
            "ioc_value": "v2n.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:30",
            "last_seen_utc": "2025-11-29 09:59:09",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661574": [
        {
            "ioc_value": "uvd.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661575": [
        {
            "ioc_value": "uvu.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661576": [
        {
            "ioc_value": "uvu60.tundra-flip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661577": [
        {
            "ioc_value": "uvwh.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661578": [
        {
            "ioc_value": "uwf.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661579": [
        {
            "ioc_value": "ux.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661580": [
        {
            "ioc_value": "ux.twist-nova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661581": [
        {
            "ioc_value": "uxg.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661582": [
        {
            "ioc_value": "uy.jorx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661583": [
        {
            "ioc_value": "uy1.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661584": [
        {
            "ioc_value": "uy2k6.razor-plume.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661585": [
        {
            "ioc_value": "uy3hc.mintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661586": [
        {
            "ioc_value": "uy4g.fl-0-wbud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661587": [
        {
            "ioc_value": "uz.d09r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661588": [
        {
            "ioc_value": "uz.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": "2025-11-29 09:58:40",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661589": [
        {
            "ioc_value": "uz5.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661590": [
        {
            "ioc_value": "uzw.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661591": [
        {
            "ioc_value": "v.d1a8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661592": [
        {
            "ioc_value": "v.d3g7t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661593": [
        {
            "ioc_value": "v.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661552": [
        {
            "ioc_value": "us.bavyzeo47.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661553": [
        {
            "ioc_value": "us.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661554": [
        {
            "ioc_value": "us.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661555": [
        {
            "ioc_value": "us.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661556": [
        {
            "ioc_value": "us.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661557": [
        {
            "ioc_value": "us.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661558": [
        {
            "ioc_value": "us.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661559": [
        {
            "ioc_value": "us.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661560": [
        {
            "ioc_value": "us.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661561": [
        {
            "ioc_value": "use.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661562": [
        {
            "ioc_value": "ut.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661563": [
        {
            "ioc_value": "ut.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661564": [
        {
            "ioc_value": "ut.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661565": [
        {
            "ioc_value": "ut.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661566": [
        {
            "ioc_value": "ut.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661567": [
        {
            "ioc_value": "ut.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661568": [
        {
            "ioc_value": "uu.po1ba8esett.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661569": [
        {
            "ioc_value": "uubb.jam-crest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661570": [
        {
            "ioc_value": "uuf.v0xelmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661571": [
        {
            "ioc_value": "uv.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661572": [
        {
            "ioc_value": "uv.z99l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661573": [
        {
            "ioc_value": "uv4.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661530": [
        {
            "ioc_value": "uo.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661531": [
        {
            "ioc_value": "up.ciqe8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661532": [
        {
            "ioc_value": "up.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661533": [
        {
            "ioc_value": "up.fucirai75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661534": [
        {
            "ioc_value": "up.jiky7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661535": [
        {
            "ioc_value": "up.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661536": [
        {
            "ioc_value": "up.myda4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661537": [
        {
            "ioc_value": "up.qenogia7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661538": [
        {
            "ioc_value": "up.raha1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661539": [
        {
            "ioc_value": "up.sypyguu85.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661540": [
        {
            "ioc_value": "up.tydubyo66.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661541": [
        {
            "ioc_value": "up.xonulee9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661542": [
        {
            "ioc_value": "up.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661543": [
        {
            "ioc_value": "up.yq-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661544": [
        {
            "ioc_value": "upux.firetrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661545": [
        {
            "ioc_value": "uq.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661546": [
        {
            "ioc_value": "uq.xexykuo2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": "2025-11-29 09:59:12",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661547": [
        {
            "ioc_value": "uq.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661548": [
        {
            "ioc_value": "uq1.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661549": [
        {
            "ioc_value": "uqb.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": "2025-11-29 09:59:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661550": [
        {
            "ioc_value": "uqy.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661551": [
        {
            "ioc_value": "ur.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661507": [
        {
            "ioc_value": "uik.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661508": [
        {
            "ioc_value": "uirs.br1arwild.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661509": [
        {
            "ioc_value": "uk.g-04-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661510": [
        {
            "ioc_value": "ultimate.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661511": [
        {
            "ioc_value": "ultra.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661512": [
        {
            "ioc_value": "ulv.wildr0sehub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661513": [
        {
            "ioc_value": "um.mjef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661514": [
        {
            "ioc_value": "um.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661515": [
        {
            "ioc_value": "um.xe-1r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661516": [
        {
            "ioc_value": "um.xvqy-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": "2025-11-29 09:59:17",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661517": [
        {
            "ioc_value": "um.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661518": [
        {
            "ioc_value": "umbra6.shad0wdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661519": [
        {
            "ioc_value": "umbra8.darksun5et.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661520": [
        {
            "ioc_value": "umv.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661521": [
        {
            "ioc_value": "umw.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661522": [
        {
            "ioc_value": "un.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661523": [
        {
            "ioc_value": "un.xvqy-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661524": [
        {
            "ioc_value": "un3.c0ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661525": [
        {
            "ioc_value": "undemodqah.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661526": [
        {
            "ioc_value": "ung.sewumoa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661527": [
        {
            "ioc_value": "unp6e.a6il1oyal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661528": [
        {
            "ioc_value": "uny.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661529": [
        {
            "ioc_value": "uo.bwag.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661484": [
        {
            "ioc_value": "ufer4.c0dehawk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661485": [
        {
            "ioc_value": "ufer5.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661486": [
        {
            "ioc_value": "ufer9.prariehafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661487": [
        {
            "ioc_value": "ufsu.commi-5-sfa-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661488": [
        {
            "ioc_value": "ug.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661489": [
        {
            "ioc_value": "ug.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661490": [
        {
            "ioc_value": "ug0.k7t0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661491": [
        {
            "ioc_value": "ug0.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661492": [
        {
            "ioc_value": "ug8.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661493": [
        {
            "ioc_value": "ugmbe.a-5-t-1-gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661494": [
        {
            "ioc_value": "ugodat.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661495": [
        {
            "ioc_value": "uh.67tf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661496": [
        {
            "ioc_value": "uh.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661497": [
        {
            "ioc_value": "uh.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661498": [
        {
            "ioc_value": "uh.tfba6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661499": [
        {
            "ioc_value": "uh.xvqy-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661500": [
        {
            "ioc_value": "uh.yq-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661501": [
        {
            "ioc_value": "uhf.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661502": [
        {
            "ioc_value": "uhv.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661503": [
        {
            "ioc_value": "uhxkj.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661504": [
        {
            "ioc_value": "uhz.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661505": [
        {
            "ioc_value": "ui.qu1ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661506": [
        {
            "ioc_value": "ui.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:25",
            "last_seen_utc": "2025-11-29 09:59:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661460": [
        {
            "ioc_value": "ufer.ravenkamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661461": [
        {
            "ioc_value": "ufer.ravenquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661462": [
        {
            "ioc_value": "ufer.ravensteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661463": [
        {
            "ioc_value": "ufer.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661464": [
        {
            "ioc_value": "ufer.s0ftwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661465": [
        {
            "ioc_value": "ufer.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661466": [
        {
            "ioc_value": "ufer.shadowtal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661467": [
        {
            "ioc_value": "ufer.spruce5moor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661468": [
        {
            "ioc_value": "ufer.starfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661469": [
        {
            "ioc_value": "ufer.stoneharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661470": [
        {
            "ioc_value": "ufer.thrushmere.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661471": [
        {
            "ioc_value": "ufer.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661472": [
        {
            "ioc_value": "ufer.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661473": [
        {
            "ioc_value": "ufer.wolkenkueste.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661474": [
        {
            "ioc_value": "ufer.wrenhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661475": [
        {
            "ioc_value": "ufer.zirconweg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661476": [
        {
            "ioc_value": "ufer1.hum-2-nk-0-str.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661477": [
        {
            "ioc_value": "ufer1.inha4itmu1ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661478": [
        {
            "ioc_value": "ufer1.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661479": [
        {
            "ioc_value": "ufer1.nightspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661480": [
        {
            "ioc_value": "ufer1.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661481": [
        {
            "ioc_value": "ufer2.cl0udnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661482": [
        {
            "ioc_value": "ufer2.fl0wbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661483": [
        {
            "ioc_value": "ufer3.brightstep.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:24",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661436": [
        {
            "ioc_value": "ufb.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661437": [
        {
            "ioc_value": "ufel.ember-cross.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661438": [
        {
            "ioc_value": "ufer.acornhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661439": [
        {
            "ioc_value": "ufer.anvilklee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661440": [
        {
            "ioc_value": "ufer.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661441": [
        {
            "ioc_value": "ufer.bramblequell.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661442": [
        {
            "ioc_value": "ufer.c0nsiumpond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661443": [
        {
            "ioc_value": "ufer.cedarsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661444": [
        {
            "ioc_value": "ufer.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661445": [
        {
            "ioc_value": "ufer.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661446": [
        {
            "ioc_value": "ufer.eiderquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661447": [
        {
            "ioc_value": "ufer.emberbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661448": [
        {
            "ioc_value": "ufer.flintpaddle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661449": [
        {
            "ioc_value": "ufer.grin5cra7ers.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661450": [
        {
            "ioc_value": "ufer.harmfu1tw0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661451": [
        {
            "ioc_value": "ufer.kick5ubs4ance.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661452": [
        {
            "ioc_value": "ufer.l1ghtcloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661453": [
        {
            "ioc_value": "ufer.mintzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661454": [
        {
            "ioc_value": "ufer.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661455": [
        {
            "ioc_value": "ufer.oceanbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661456": [
        {
            "ioc_value": "ufer.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661457": [
        {
            "ioc_value": "ufer.otterweg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661458": [
        {
            "ioc_value": "ufer.quartzstollen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661459": [
        {
            "ioc_value": "ufer.rap1d5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661415": [
        {
            "ioc_value": "u8.sn-0-wmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661416": [
        {
            "ioc_value": "u81r.w1ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661417": [
        {
            "ioc_value": "u9.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661418": [
        {
            "ioc_value": "u9.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661419": [
        {
            "ioc_value": "u98.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661420": [
        {
            "ioc_value": "u9fer.bil1sun8en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661421": [
        {
            "ioc_value": "u9ldz.jatrophizt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661422": [
        {
            "ioc_value": "ua.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661423": [
        {
            "ioc_value": "ua7.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661424": [
        {
            "ioc_value": "uad8d.a-8-ain-4-unt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661425": [
        {
            "ioc_value": "ub.n-96-f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661426": [
        {
            "ioc_value": "ublak5.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661427": [
        {
            "ioc_value": "uc.p93z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661428": [
        {
            "ioc_value": "ucx.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661429": [
        {
            "ioc_value": "ucx.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661430": [
        {
            "ioc_value": "ud.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661431": [
        {
            "ioc_value": "ue.gyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661432": [
        {
            "ioc_value": "ue.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661433": [
        {
            "ioc_value": "ue.sun0rbit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661434": [
        {
            "ioc_value": "uefer.c1earpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661435": [
        {
            "ioc_value": "uf6qo.fr0stciiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661395": [
        {
            "ioc_value": "u18t.oakember.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661396": [
        {
            "ioc_value": "u1r.ror6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661397": [
        {
            "ioc_value": "u1yee.spry-volt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661398": [
        {
            "ioc_value": "u3.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661399": [
        {
            "ioc_value": "u3c.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": "2025-11-29 09:58:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661400": [
        {
            "ioc_value": "u3i3y.st0nefield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661401": [
        {
            "ioc_value": "u3k.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661402": [
        {
            "ioc_value": "u3z.pr0wldrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661403": [
        {
            "ioc_value": "u3zc.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661404": [
        {
            "ioc_value": "u5.m1stzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661405": [
        {
            "ioc_value": "u5.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661406": [
        {
            "ioc_value": "u5p1d7qg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661407": [
        {
            "ioc_value": "u6.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661408": [
        {
            "ioc_value": "u6.quantmelt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661409": [
        {
            "ioc_value": "u6fer.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661410": [
        {
            "ioc_value": "u7.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661411": [
        {
            "ioc_value": "u7.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661412": [
        {
            "ioc_value": "u7423.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661413": [
        {
            "ioc_value": "u7j.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661414": [
        {
            "ioc_value": "u7wq0c9.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661372": [
        {
            "ioc_value": "u.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661373": [
        {
            "ioc_value": "u.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661374": [
        {
            "ioc_value": "u.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661375": [
        {
            "ioc_value": "u.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661376": [
        {
            "ioc_value": "u.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661377": [
        {
            "ioc_value": "u.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661378": [
        {
            "ioc_value": "u.pymh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661379": [
        {
            "ioc_value": "u.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661380": [
        {
            "ioc_value": "u.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661381": [
        {
            "ioc_value": "u.r0z8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661382": [
        {
            "ioc_value": "u.s9i1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661383": [
        {
            "ioc_value": "u.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661384": [
        {
            "ioc_value": "u.v-9542.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661385": [
        {
            "ioc_value": "u.vjef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661386": [
        {
            "ioc_value": "u.w6n2t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661387": [
        {
            "ioc_value": "u0.f1restone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661388": [
        {
            "ioc_value": "u0.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661389": [
        {
            "ioc_value": "u0.op76.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661390": [
        {
            "ioc_value": "u0.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661391": [
        {
            "ioc_value": "u1.1cher.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661392": [
        {
            "ioc_value": "u1.campsitegradually.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661393": [
        {
            "ioc_value": "u1.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661394": [
        {
            "ioc_value": "u1.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661353": [
        {
            "ioc_value": "gl1nty.brightlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": "2025-11-29 10:00:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1661354": [
        {
            "ioc_value": "tw.xx-os.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661355": [
        {
            "ioc_value": "tw80g.b1uespark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661356": [
        {
            "ioc_value": "twelve.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661357": [
        {
            "ioc_value": "twig9x.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661358": [
        {
            "ioc_value": "twirl5.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661359": [
        {
            "ioc_value": "two.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661360": [
        {
            "ioc_value": "tx.fid1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661361": [
        {
            "ioc_value": "tx8.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661362": [
        {
            "ioc_value": "txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661363": [
        {
            "ioc_value": "tycyn.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661364": [
        {
            "ioc_value": "tyfew.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661365": [
        {
            "ioc_value": "tyhavau6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661366": [
        {
            "ioc_value": "tyro.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661367": [
        {
            "ioc_value": "tyvuxie7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661368": [
        {
            "ioc_value": "tywip.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661369": [
        {
            "ioc_value": "tz.driftshad0w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661370": [
        {
            "ioc_value": "tz.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661371": [
        {
            "ioc_value": "tz.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661338": [
        {
            "ioc_value": "ts.x-73-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": "2025-11-29 09:59:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661339": [
        {
            "ioc_value": "ttz.op76.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661340": [
        {
            "ioc_value": "tu.luxemyy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661341": [
        {
            "ioc_value": "tugy.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661342": [
        {
            "ioc_value": "tujomay07.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661343": [
        {
            "ioc_value": "tuk.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661344": [
        {
            "ioc_value": "tumut.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661345": [
        {
            "ioc_value": "tumyr.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661346": [
        {
            "ioc_value": "tuqad.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661347": [
        {
            "ioc_value": "turm.ravenkloster.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661348": [
        {
            "ioc_value": "turne.mistytrai1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661349": [
        {
            "ioc_value": "tv.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661350": [
        {
            "ioc_value": "tvaz.dunn-0-en-7-el.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661351": [
        {
            "ioc_value": "tvoj-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661352": [
        {
            "ioc_value": "tvx.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661315": [
        {
            "ioc_value": "trail.ventrill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661316": [
        {
            "ioc_value": "trail.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661317": [
        {
            "ioc_value": "trail0.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661318": [
        {
            "ioc_value": "trail0.skylintap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661319": [
        {
            "ioc_value": "trail2.esca1t3ust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661320": [
        {
            "ioc_value": "trail2.pen-1-sp-7-edef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661321": [
        {
            "ioc_value": "trail2.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661322": [
        {
            "ioc_value": "trail3.brimhopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661323": [
        {
            "ioc_value": "trail3.knackquill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661324": [
        {
            "ioc_value": "trail3.ravenflux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661325": [
        {
            "ioc_value": "trail5.rift-cog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661326": [
        {
            "ioc_value": "trail6.hre-9-in-7-mamma.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661327": [
        {
            "ioc_value": "trail6.skyb1end.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661328": [
        {
            "ioc_value": "trail8.gr1zzlepad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661329": [
        {
            "ioc_value": "trail9.mintburst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661330": [
        {
            "ioc_value": "trakk.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661331": [
        {
            "ioc_value": "tree.4y3e4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661332": [
        {
            "ioc_value": "tree.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661333": [
        {
            "ioc_value": "tresk9.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661334": [
        {
            "ioc_value": "try.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661335": [
        {
            "ioc_value": "try.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661336": [
        {
            "ioc_value": "ts.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661337": [
        {
            "ioc_value": "ts.wtan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661292": [
        {
            "ioc_value": "tqf.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661293": [
        {
            "ioc_value": "tqf.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661294": [
        {
            "ioc_value": "tr.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661295": [
        {
            "ioc_value": "tr.qenogia7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661296": [
        {
            "ioc_value": "tr.st1ltforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661297": [
        {
            "ioc_value": "tr.x-73-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661298": [
        {
            "ioc_value": "tr0npetal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661299": [
        {
            "ioc_value": "tr8.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": "2025-11-29 09:59:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661300": [
        {
            "ioc_value": "trac3r.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661301": [
        {
            "ioc_value": "trace.5h0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661302": [
        {
            "ioc_value": "trace.nob0dy5yabky.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661303": [
        {
            "ioc_value": "trace.plixhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661304": [
        {
            "ioc_value": "trace.razor-plume.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661305": [
        {
            "ioc_value": "trace.s1nkflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661306": [
        {
            "ioc_value": "trace.st3elflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661307": [
        {
            "ioc_value": "trace4.raven-flux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661308": [
        {
            "ioc_value": "track4.stoner0ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661309": [
        {
            "ioc_value": "trail.br1ghtmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661310": [
        {
            "ioc_value": "trail.cliffwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661311": [
        {
            "ioc_value": "trail.ede1g0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661312": [
        {
            "ioc_value": "trail.flintzoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661313": [
        {
            "ioc_value": "trail.rumble-kin.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661314": [
        {
            "ioc_value": "trail.skym0tion.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661267": [
        {
            "ioc_value": "tq.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661268": [
        {
            "ioc_value": "tq.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661269": [
        {
            "ioc_value": "tq.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661270": [
        {
            "ioc_value": "tq.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661271": [
        {
            "ioc_value": "tq.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661272": [
        {
            "ioc_value": "tq.derl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661273": [
        {
            "ioc_value": "tq.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661274": [
        {
            "ioc_value": "tq.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661275": [
        {
            "ioc_value": "tq.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661276": [
        {
            "ioc_value": "tq.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661277": [
        {
            "ioc_value": "tq.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661278": [
        {
            "ioc_value": "tq.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661279": [
        {
            "ioc_value": "tq.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661280": [
        {
            "ioc_value": "tq.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661281": [
        {
            "ioc_value": "tq.pixelstern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661282": [
        {
            "ioc_value": "tq.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661283": [
        {
            "ioc_value": "tq.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661284": [
        {
            "ioc_value": "tq.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661285": [
        {
            "ioc_value": "tq.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661286": [
        {
            "ioc_value": "tq.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661287": [
        {
            "ioc_value": "tq.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661288": [
        {
            "ioc_value": "tq.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661289": [
        {
            "ioc_value": "tq.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661290": [
        {
            "ioc_value": "tq.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661291": [
        {
            "ioc_value": "tq1ze.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661255": [
        {
            "ioc_value": "tofyjoi0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661256": [
        {
            "ioc_value": "tolaj.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661257": [
        {
            "ioc_value": "too.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661258": [
        {
            "ioc_value": "top.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661259": [
        {
            "ioc_value": "top.harekae65.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661260": [
        {
            "ioc_value": "top.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661261": [
        {
            "ioc_value": "topaz.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661262": [
        {
            "ioc_value": "topazrand.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661263": [
        {
            "ioc_value": "totyc.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661264": [
        {
            "ioc_value": "tp.op76.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661265": [
        {
            "ioc_value": "tpa.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661266": [
        {
            "ioc_value": "tq.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661254": [
        {
            "ioc_value": "tm.bowin1nca5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661251": [
        {
            "ioc_value": "tg0y.d7un4recid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661252": [
        {
            "ioc_value": "tgx.aud1mi5s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661253": [
        {
            "ioc_value": "tide4.oceandrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661249": [
        {
            "ioc_value": "storm.stonefog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661250": [
        {
            "ioc_value": "storm6.snowbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661248": [
        {
            "ioc_value": "stack8.f-2-na-7-under.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661247": [
        {
            "ioc_value": "srjxi.aud-1-mi-5-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661246": [
        {
            "ioc_value": "spark8.fie1dcl0se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661245": [
        {
            "ioc_value": "snow.br1ghtzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661243": [
        {
            "ioc_value": "simple.a8ain4unt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661244": [
        {
            "ioc_value": "simple6.gethe-4-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661242": [
        {
            "ioc_value": "sh0re7.brightlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661241": [
        {
            "ioc_value": "s8.l1ghtflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661240": [
        {
            "ioc_value": "rur2.fal1ow7an.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661237": [
        {
            "ioc_value": "rope.po1ba8esett.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661238": [
        {
            "ioc_value": "rope3.fal1ow7an.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661239": [
        {
            "ioc_value": "rope5.gethe-4-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661233": [
        {
            "ioc_value": "rjcy.fie-1-dcl-0-se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661234": [
        {
            "ioc_value": "rk3.l1ghtflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661235": [
        {
            "ioc_value": "road.crysta1drop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661236": [
        {
            "ioc_value": "road6.wildh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661230": [
        {
            "ioc_value": "ridge.gethe4e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661231": [
        {
            "ioc_value": "ridge.wildspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661232": [
        {
            "ioc_value": "ridge1.f2na7under.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661229": [
        {
            "ioc_value": "quill.wildspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:29",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661228": [
        {
            "ioc_value": "qsa.gethe4e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661227": [
        {
            "ioc_value": "qk9.0rbishade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661226": [
        {
            "ioc_value": "pulse.starblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661225": [
        {
            "ioc_value": "pulse.lu-7-hichma-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661223": [
        {
            "ioc_value": "prime.luc-7-y-5-nub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661224": [
        {
            "ioc_value": "prime5.a6il1oyal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661222": [
        {
            "ioc_value": "plume.windcrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661221": [
        {
            "ioc_value": "pen-1-sp-7-edef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661220": [
        {
            "ioc_value": "path.wildh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:09",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661219": [
        {
            "ioc_value": "p5q.f1restone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661218": [
        {
            "ioc_value": "osh.chit7a5tat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661217": [
        {
            "ioc_value": "nv.fa-1-cbrea-5-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661214": [
        {
            "ioc_value": "note.fa1cbrea5t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661215": [
        {
            "ioc_value": "nova.l1ghtflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661216": [
        {
            "ioc_value": "nova.law5andw1ch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661213": [
        {
            "ioc_value": "netst0rm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661212": [
        {
            "ioc_value": "ne.a8ain4unt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661210": [
        {
            "ioc_value": "n7v.wildspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661211": [
        {
            "ioc_value": "n8p.f-2-na-7-under.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661209": [
        {
            "ioc_value": "moss.starblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:44",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661208": [
        {
            "ioc_value": "mist.windcrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:40",
            "last_seen_utc": "2025-11-29 09:58:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661207": [
        {
            "ioc_value": "ma1ektrin7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661205": [
        {
            "ioc_value": "m2q.oceandrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661206": [
        {
            "ioc_value": "m3pv.po-1-ba-8-esett.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661204": [
        {
            "ioc_value": "m1styx.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661203": [
        {
            "ioc_value": "lyy.ga-1-e-7-ajudush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661202": [
        {
            "ioc_value": "lynx.f1restone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661199": [
        {
            "ioc_value": "lucky.fa1cbrea5t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661200": [
        {
            "ioc_value": "lucky6.chit7a5tat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661201": [
        {
            "ioc_value": "lucky8.es-ca-1-t-3-ust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661197": [
        {
            "ioc_value": "lolhy.a6il1oyal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661198": [
        {
            "ioc_value": "long.l0ngprope1l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661196": [
        {
            "ioc_value": "ln.esca1t3ust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661195": [
        {
            "ioc_value": "lg.ga-1-e-7-ajudush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661193": [
        {
            "ioc_value": "learn.law5andw1ch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661194": [
        {
            "ioc_value": "learn5.fal-1-ow-7-an.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661187": [
        {
            "ioc_value": "lake2.snowbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661188": [
        {
            "ioc_value": "lake9.shadowtrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661189": [
        {
            "ioc_value": "layer.gethe4e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661190": [
        {
            "ioc_value": "layer1.es-ca-1-t-3-ust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661191": [
        {
            "ioc_value": "layer3.f2na7under.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661192": [
        {
            "ioc_value": "layer9.fal-1-ow-7-an.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661185": [
        {
            "ioc_value": "lak3on.brightlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661186": [
        {
            "ioc_value": "lake.shadowtrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:22",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661184": [
        {
            "ioc_value": "kjw.es-ca-1-t-3-ust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661183": [
        {
            "ioc_value": "kcjdc.c1earway.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661182": [
        {
            "ioc_value": "k9p.stonefog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661181": [
        {
            "ioc_value": "jq8ob.bowin1nca5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661180": [
        {
            "ioc_value": "j2.st0rmbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661179": [
        {
            "ioc_value": "iud.snowbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661178": [
        {
            "ioc_value": "iqm.commi-5-sfa-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661176": [
        {
            "ioc_value": "ilf4a.c1earway.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661177": [
        {
            "ioc_value": "iq.f-2-na-7-under.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:56:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661175": [
        {
            "ioc_value": "hill2.h1ddenlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661173": [
        {
            "ioc_value": "haze.leafshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661174": [
        {
            "ioc_value": "haze9r.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:50",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661172": [
        {
            "ioc_value": "h9j.l0ngprope1l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661171": [
        {
            "ioc_value": "gl1m.0rbishade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661170": [
        {
            "ioc_value": "gethe4e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661167": [
        {
            "ioc_value": "g8r.windcrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661168": [
        {
            "ioc_value": "gate.chit-7-a-5-tat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661169": [
        {
            "ioc_value": "gate2.a8ain4unt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661165": [
        {
            "ioc_value": "fu4.h1ddenlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661166": [
        {
            "ioc_value": "fund.aud-1-mi-5-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661164": [
        {
            "ioc_value": "fpx0w.bowin-1-nca-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661163": [
        {
            "ioc_value": "flux9.l1ghtflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:25",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661162": [
        {
            "ioc_value": "flow8.1-nyearbo-0-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661160": [
        {
            "ioc_value": "flar7e.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661161": [
        {
            "ioc_value": "flare.f1restone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661156": [
        {
            "ioc_value": "field.chit-7-a-5-tat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661157": [
        {
            "ioc_value": "field0.fa-1-cbrea-5-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661158": [
        {
            "ioc_value": "field1.law-5-andw-1-ch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661159": [
        {
            "ioc_value": "fire3.crysta1drop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661155": [
        {
            "ioc_value": "fall.po1ba8esett.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661153": [
        {
            "ioc_value": "f1restone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661154": [
        {
            "ioc_value": "f6b.st0rmbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:16",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661151": [
        {
            "ioc_value": "eo9.fa-1-cbrea-5-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661152": [
        {
            "ioc_value": "es-ca-1-t-3-ust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661150": [
        {
            "ioc_value": "ember.0rbishade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661147": [
        {
            "ioc_value": "ec.gethe-4-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661148": [
        {
            "ioc_value": "echo.luc7y5nub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661149": [
        {
            "ioc_value": "echo6.shadowtrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661146": [
        {
            "ioc_value": "e3.wildspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661145": [
        {
            "ioc_value": "dxv.lu7hichma7t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:55:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661144": [
        {
            "ioc_value": "drop.crysta1drop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661143": [
        {
            "ioc_value": "dr1zle.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661142": [
        {
            "ioc_value": "delta.d7un4recid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661141": [
        {
            "ioc_value": "db5.f2na7under.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661138": [
        {
            "ioc_value": "data.fal-1-ow-7-an.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:52",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661139": [
        {
            "ioc_value": "data1.fa-1-cbrea-5-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:52",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661140": [
        {
            "ioc_value": "data8.po-1-ba-8-esett.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:52",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661137": [
        {
            "ioc_value": "d4t.leafshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661135": [
        {
            "ioc_value": "d1d.ga-1-e-7-ajudush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661136": [
        {
            "ioc_value": "d2.bowin-1-nca-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661133": [
        {
            "ioc_value": "custv.bowin-1-nca-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661134": [
        {
            "ioc_value": "cv.law-5-andw-1-ch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661128": [
        {
            "ioc_value": "crypt.st0rmbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661129": [
        {
            "ioc_value": "crysta1drop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661130": [
        {
            "ioc_value": "crystal.br1ghtzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661131": [
        {
            "ioc_value": "crystal2.shadowtrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661132": [
        {
            "ioc_value": "cu-1-tivga-5-tr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661127": [
        {
            "ioc_value": "creek.leafshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:47",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661124": [
        {
            "ioc_value": "core.bowin-1-nca-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661125": [
        {
            "ioc_value": "core9.luc7y5nub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:46",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661126": [
        {
            "ioc_value": "cqr6.fie1dcl0se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661121": [
        {
            "ioc_value": "commit.ga-1-e-7-ajudush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:45",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661122": [
        {
            "ioc_value": "commit0.gethe-4-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:45",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661123": [
        {
            "ioc_value": "commit8.lu7hichma7t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:45",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661120": [
        {
            "ioc_value": "ca.f-2-na-7-under.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:36",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661119": [
        {
            "ioc_value": "c7z.starblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661118": [
        {
            "ioc_value": "c1.windcrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661117": [
        {
            "ioc_value": "bru81.aud-1-mi-5-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661114": [
        {
            "ioc_value": "bright9.c1earway.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661115": [
        {
            "ioc_value": "brightmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661116": [
        {
            "ioc_value": "brisk.oceandrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:29",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661111": [
        {
            "ioc_value": "br1gty.brightlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:28",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661112": [
        {
            "ioc_value": "breaker.br1ghtzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661113": [
        {
            "ioc_value": "breaker1.br1ghtzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661110": [
        {
            "ioc_value": "br1ghtzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661109": [
        {
            "ioc_value": "bowin-1-nca-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661108": [
        {
            "ioc_value": "bll.fie1dcl0se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:25",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661107": [
        {
            "ioc_value": "bk0hq.lu7hichma7t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661105": [
        {
            "ioc_value": "base.fa1cbrea5t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661106": [
        {
            "ioc_value": "base7.d7un4recid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:18",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661104": [
        {
            "ioc_value": "b1ttper7ent.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661103": [
        {
            "ioc_value": "axis.st0rmbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661102": [
        {
            "ioc_value": "aulf.po1ba8esett.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:12",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661100": [
        {
            "ioc_value": "aud-1-mi-5-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661101": [
        {
            "ioc_value": "audio.aud-1-mi-5-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661099": [
        {
            "ioc_value": "ar.luc-7-y-5-nub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661098": [
        {
            "ioc_value": "alqb.f2na7under.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:07",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661097": [
        {
            "ioc_value": "again.l0ngprope1l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:05",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661094": [
        {
            "ioc_value": "a2x.starblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661095": [
        {
            "ioc_value": "a6il1oyal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661096": [
        {
            "ioc_value": "a8ain4unt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:54:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661093": [
        {
            "ioc_value": "9n4s.law5andw1ch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661088": [
        {
            "ioc_value": "7ms.snowbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:50",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661089": [
        {
            "ioc_value": "7n.luc7y5nub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661090": [
        {
            "ioc_value": "7p53k.commi-5-sfa-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661091": [
        {
            "ioc_value": "7ruo5.aud1mi5s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661092": [
        {
            "ioc_value": "7tlu.chit7a5tat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:50",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661086": [
        {
            "ioc_value": "6uh.fie-1-dcl-0-se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661087": [
        {
            "ioc_value": "6z4.h1ddenlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661085": [
        {
            "ioc_value": "6dze.lu-7-hichma-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661083": [
        {
            "ioc_value": "5z5e.lu7hichma7t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661084": [
        {
            "ioc_value": "61.lu-7-hichma-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661081": [
        {
            "ioc_value": "5nafr.esca1t3ust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661082": [
        {
            "ioc_value": "5oe.law-5-andw-1-ch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:42",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661079": [
        {
            "ioc_value": "5kmb.fie-1-dcl-0-se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661080": [
        {
            "ioc_value": "5m7n8.law5andw1ch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:41",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661078": [
        {
            "ioc_value": "56og2.luc7y5nub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661077": [
        {
            "ioc_value": "51ev.lu-7-hichma-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:39",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661076": [
        {
            "ioc_value": "4wmi.luc-7-y-5-nub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661075": [
        {
            "ioc_value": "4d6.luc-7-y-5-nub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:37",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661074": [
        {
            "ioc_value": "42y.1-nyearbo-0-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661072": [
        {
            "ioc_value": "3t6.a-8-ain-4-unt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661073": [
        {
            "ioc_value": "3yj.chit-7-a-5-tat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:34",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661071": [
        {
            "ioc_value": "33ys.fie-1-dcl-0-se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:32",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661068": [
        {
            "ioc_value": "2qj0g.esca1t3ust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:30",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661069": [
        {
            "ioc_value": "2u.aud1mi5s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:30",
            "last_seen_utc": "2025-11-29 09:54:11",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661070": [
        {
            "ioc_value": "2vx.bowin1nca5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661066": [
        {
            "ioc_value": "1tpe.c1earway.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:27",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661067": [
        {
            "ioc_value": "1yc.commi-5-sfa-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:27",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661065": [
        {
            "ioc_value": "1ot1.fal1ow7an.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661064": [
        {
            "ioc_value": "19um.fa1cbrea5t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:24",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661063": [
        {
            "ioc_value": "1-nyearbo-0-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661062": [
        {
            "ioc_value": "0ty.a-8-ain-4-unt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:22",
            "last_seen_utc": "2025-11-29 09:53:58",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661060": [
        {
            "ioc_value": "0kon.h1ddenlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:21",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661061": [
        {
            "ioc_value": "0rbishade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661059": [
        {
            "ioc_value": "01o.fal1ow7an.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:53:18",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1661058": [
        {
            "ioc_value": "jocafas.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-29 09:49:32",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1661057": [
        {
            "ioc_value": "sh0re7.brightlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:46:58",
            "last_seen_utc": "2025-11-29 09:51:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1661051": [
        {
            "ioc_value": "document-mutual.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 09:45:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1661052": [
        {
            "ioc_value": "mary-brochures.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 09:45:32",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1661053": [
        {
            "ioc_value": "physical-parliamentary.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 09:45:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1661049": [
        {
            "ioc_value": "awesome2344.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-29 09:45:12",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1661050": [
        {
            "ioc_value": "blessingsplscome497.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-29 09:45:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1661048": [
        {
            "ioc_value": "vserge42.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-29 09:44:32",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1661047": [
        {
            "ioc_value": "nika123.duckdn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-29 09:44:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1660978": [
        {
            "ioc_value": "sikkimgamepro.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-29 09:43:10",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1660979": [
        {
            "ioc_value": "streameast.co.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-29 09:43:10",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1660980": [
        {
            "ioc_value": "v2.socolive1.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-29 09:43:10",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1660981": [
        {
            "ioc_value": "v3.socolive1.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-29 09:43:10",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1660973": [
        {
            "ioc_value": "90phuttj.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-29 09:42:31",
            "last_seen_utc": "2025-11-29 09:42:31",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1660974": [
        {
            "ioc_value": "gatex.socolive.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-29 09:42:31",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1660975": [
        {
            "ioc_value": "socolive1.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-29 09:42:31",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1660956": [
        {
            "ioc_value": "lak3on.brightlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:38:13",
            "last_seen_utc": "2025-11-29 09:45:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660727": [
        {
            "ioc_value": "account-extrapulse.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 09:31:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660730": [
        {
            "ioc_value": "account-extranetportal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 09:31:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660734": [
        {
            "ioc_value": "ish.co.ke",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 09:31:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Adobe Update,PDQ Connect",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660737": [
        {
            "ioc_value": "kubetting.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 09:31:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660789": [
        {
            "ioc_value": "api.equisphire.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 09:31:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.validin.com/blog/inside_dprk_fake_job_platform/",
            "tags": "Contagious Interview,DPRK,Fake Job Platform,Koover",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660797": [
        {
            "ioc_value": "sessionsverificates.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 09:31:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660694": [
        {
            "ioc_value": "rasslablen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-29 09:30:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660812": [
        {
            "ioc_value": "btexe3dc53f6dc453f6a9f461a5h.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 09:30:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660951": [
        {
            "ioc_value": "br1gty.brightlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:28:52",
            "last_seen_utc": "2025-11-29 09:36:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660947": [
        {
            "ioc_value": "haze9r.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660946": [
        {
            "ioc_value": "vap0ra.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660945": [
        {
            "ioc_value": "dr1zle.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 09:07:42",
            "last_seen_utc": "2025-11-29 09:13:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660942": [
        {
            "ioc_value": "flar7e.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 08:56:50",
            "last_seen_utc": "2025-11-29 09:04:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660941": [
        {
            "ioc_value": "m1styx.mistflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 08:49:35",
            "last_seen_utc": "2025-11-29 08:57:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660940": [
        {
            "ioc_value": "moss.starblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 08:44:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660931": [
        {
            "ioc_value": "c7z.starblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 08:38:39",
            "last_seen_utc": "2025-11-29 08:44:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660930": [
        {
            "ioc_value": "pulse.starblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 08:27:21",
            "last_seen_utc": "2025-11-29 08:33:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660929": [
        {
            "ioc_value": "a2x.starblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 08:17:24",
            "last_seen_utc": "2025-11-29 08:20:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660928": [
        {
            "ioc_value": "veil.stonefog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 08:08:11",
            "last_seen_utc": "2025-11-29 08:14:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660913": [
        {
            "ioc_value": "k9p.stonefog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 07:57:12",
            "last_seen_utc": "2025-11-29 08:02:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660912": [
        {
            "ioc_value": "storm.stonefog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 07:47:56",
            "last_seen_utc": "2025-11-29 07:49:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660911": [
        {
            "ioc_value": "z3.stonefog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 07:31:21",
            "last_seen_utc": "2025-11-29 07:47:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660910": [
        {
            "ioc_value": "haze.leafshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 07:27:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660909": [
        {
            "ioc_value": "d4t.leafshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 07:17:22",
            "last_seen_utc": "2025-11-29 07:18:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660908": [
        {
            "ioc_value": "creek.leafshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 07:08:34",
            "last_seen_utc": "2025-11-29 07:09:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660907": [
        {
            "ioc_value": "y1.leafshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 06:58:21",
            "last_seen_utc": "2025-11-29 06:59:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660906": [
        {
            "ioc_value": "lynx.f1restone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 06:53:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660905": [
        {
            "ioc_value": "p5q.f1restone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 06:50:18",
            "last_seen_utc": "2025-11-29 06:51:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660904": [
        {
            "ioc_value": "flare.f1restone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 06:45:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660903": [
        {
            "ioc_value": "u0.f1restone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 06:37:47",
            "last_seen_utc": "2025-11-29 06:44:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660902": [
        {
            "ioc_value": "ridge.wildspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 06:24:54",
            "last_seen_utc": "2025-11-29 06:33:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660900": [
        {
            "ioc_value": "n7v.wildspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 06:19:31",
            "last_seen_utc": "2025-11-29 06:22:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660899": [
        {
            "ioc_value": "quill.wildspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 06:12:50",
            "last_seen_utc": "2025-11-29 06:16:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660898": [
        {
            "ioc_value": "e3.wildspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 06:07:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660897": [
        {
            "ioc_value": "dupemuss2.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-11-29 06:05:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-gfw5ka1kgz",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660896": [
        {
            "ioc_value": "www.tfuuuk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-29 06:03:43",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-dsm6mszphs",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660895": [
        {
            "ioc_value": "uuh9890-32474.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 06:01:01",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-d64qjsdx5d",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660894": [
        {
            "ioc_value": "average-samuel.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 06:01:00",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-esystazrfw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660893": [
        {
            "ioc_value": "tour-meta.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-29 06:00:59",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251129-fawfeadr8z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660892": [
        {
            "ioc_value": "crypt.st0rmbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 05:57:39",
            "last_seen_utc": "2025-11-29 06:06:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660891": [
        {
            "ioc_value": "f6b.st0rmbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 05:45:21",
            "last_seen_utc": "2025-11-29 05:53:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660889": [
        {
            "ioc_value": "axis.st0rmbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 05:31:24",
            "last_seen_utc": "2025-11-29 05:44:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660888": [
        {
            "ioc_value": "j2.st0rmbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 05:28:11",
            "last_seen_utc": "2025-11-29 05:30:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660887": [
        {
            "ioc_value": "plume.windcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 05:18:15",
            "last_seen_utc": "2025-11-29 05:25:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660886": [
        {
            "ioc_value": "g8r.windcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 05:08:10",
            "last_seen_utc": "2025-11-29 05:14:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660885": [
        {
            "ioc_value": "mist.windcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 04:57:52",
            "last_seen_utc": "2025-11-29 05:04:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660884": [
        {
            "ioc_value": "c1.windcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 04:40:55",
            "last_seen_utc": "2025-11-29 04:44:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660883": [
        {
            "ioc_value": "2u.aud1mi5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 04:37:46",
            "last_seen_utc": "2025-11-29 04:38:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660882": [
        {
            "ioc_value": "wm1wu.aud1mi5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 04:22:22",
            "last_seen_utc": "2025-11-29 04:28:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660881": [
        {
            "ioc_value": "7ruo5.aud1mi5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 04:17:39",
            "last_seen_utc": "2025-11-29 04:19:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660880": [
        {
            "ioc_value": "rope3.fal1ow7an.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 04:04:07",
            "last_seen_utc": "2025-11-29 04:09:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660866": [
        {
            "ioc_value": "rur2.fal1ow7an.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 03:57:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660865": [
        {
            "ioc_value": "1ot1.fal1ow7an.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 03:45:56",
            "last_seen_utc": "2025-11-29 03:50:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660864": [
        {
            "ioc_value": "01o.fal1ow7an.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 03:38:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660862": [
        {
            "ioc_value": "tm.bowin1nca5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 03:28:41",
            "last_seen_utc": "2025-11-29 03:34:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660861": [
        {
            "ioc_value": "jq8ob.bowin1nca5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 03:10:48",
            "last_seen_utc": "2025-11-29 03:15:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660860": [
        {
            "ioc_value": "2vx.bowin1nca5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 03:06:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660857": [
        {
            "ioc_value": "vale.bowin1nca5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 02:57:17",
            "last_seen_utc": "2025-11-29 03:00:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660855": [
        {
            "ioc_value": "pu1785.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-29 02:48:23",
            "last_seen_utc": "2025-12-14 11:48:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1660854": [
        {
            "ioc_value": "fu5599.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-29 02:48:15",
            "last_seen_utc": "2025-12-14 11:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1660853": [
        {
            "ioc_value": "dy6288.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-29 02:48:14",
            "last_seen_utc": "2025-12-14 11:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1660852": [
        {
            "ioc_value": "dk2799.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-29 02:48:13",
            "last_seen_utc": "2025-12-14 11:48:05",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1660851": [
        {
            "ioc_value": "audio.aud-1-mi-5-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 02:46:25",
            "last_seen_utc": "2025-11-29 02:49:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660850": [
        {
            "ioc_value": "bru81.aud-1-mi-5-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 02:30:20",
            "last_seen_utc": "2025-11-29 02:34:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660849": [
        {
            "ioc_value": "srjxi.aud-1-mi-5-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 02:27:17",
            "last_seen_utc": "2025-11-29 02:27:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660848": [
        {
            "ioc_value": "fund.aud-1-mi-5-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 02:17:56",
            "last_seen_utc": "2025-11-29 02:19:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660847": [
        {
            "ioc_value": "core.bowin-1-nca-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 02:02:56",
            "last_seen_utc": "2025-11-29 02:05:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660846": [
        {
            "ioc_value": "custv.bowin-1-nca-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 01:52:56",
            "last_seen_utc": "2025-11-29 01:59:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660845": [
        {
            "ioc_value": "d2.bowin-1-nca-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 01:47:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660844": [
        {
            "ioc_value": "fpx0w.bowin-1-nca-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 01:37:27",
            "last_seen_utc": "2025-11-29 01:40:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660843": [
        {
            "ioc_value": "7p53k.commi-5-sfa-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 01:28:16",
            "last_seen_utc": "2025-11-29 01:35:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660842": [
        {
            "ioc_value": "1yc.commi-5-sfa-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 01:18:29",
            "last_seen_utc": "2025-11-29 01:28:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660841": [
        {
            "ioc_value": "iqm.commi-5-sfa-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 01:04:07",
            "last_seen_utc": "2025-11-29 01:05:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660838": [
        {
            "ioc_value": "ufsu.commi-5-sfa-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 00:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660837": [
        {
            "ioc_value": "aulf.po1ba8esett.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 00:45:59",
            "last_seen_utc": "2025-11-29 00:56:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660836": [
        {
            "ioc_value": "fall.po1ba8esett.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 00:41:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660835": [
        {
            "ioc_value": "rope.po1ba8esett.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 00:39:01",
            "last_seen_utc": "2025-11-29 00:40:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660834": [
        {
            "ioc_value": "uu.po1ba8esett.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 00:27:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660833": [
        {
            "ioc_value": "2qj0g.esca1t3ust.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 00:17:55",
            "last_seen_utc": "2025-11-29 00:21:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660832": [
        {
            "ioc_value": "ln.esca1t3ust.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-29 00:07:39",
            "last_seen_utc": "2025-11-29 00:11:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660831": [
        {
            "ioc_value": "cdn.rs-dns.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-29 00:03:01",
            "last_seen_utc": "2025-11-29 11:02:23",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.90.144.124+cdn.rs-dns.sbs",
            "tags": "AS24940,censys,EvilGinx,HETZNER-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660816": [
        {
            "ioc_value": "5nafr.esca1t3ust.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 23:58:22",
            "last_seen_utc": "2025-11-29 00:04:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660815": [
        {
            "ioc_value": "trail2.esca1t3ust.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 23:48:01",
            "last_seen_utc": "2025-11-28 23:51:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660814": [
        {
            "ioc_value": "v6kxb.a6il1oyal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 23:38:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660813": [
        {
            "ioc_value": "prime5.a6il1oyal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 23:34:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660811": [
        {
            "ioc_value": "unp6e.a6il1oyal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 23:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660808": [
        {
            "ioc_value": "lolhy.a6il1oyal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 23:18:00",
            "last_seen_utc": "2025-11-28 23:24:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660807": [
        {
            "ioc_value": "nova.law5andw1ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 23:07:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660794": [
        {
            "ioc_value": "5m7n8.law5andw1ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 22:57:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660793": [
        {
            "ioc_value": "9n4s.law5andw1ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 22:46:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660792": [
        {
            "ioc_value": "learn.law5andw1ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 22:41:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660791": [
        {
            "ioc_value": "lucky8.es-ca-1-t-3-ust.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 22:37:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660788": [
        {
            "ioc_value": "kjw.es-ca-1-t-3-ust.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 22:30:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660787": [
        {
            "ioc_value": "layer1.es-ca-1-t-3-ust.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 22:27:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660786": [
        {
            "ioc_value": "w65.es-ca-1-t-3-ust.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 22:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660785": [
        {
            "ioc_value": "5oe.law-5-andw-1-ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 22:08:04",
            "last_seen_utc": "2025-11-28 22:10:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660784": [
        {
            "ioc_value": "w43.law-5-andw-1-ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:58:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660783": [
        {
            "ioc_value": "field1.law-5-andw-1-ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:53:24",
            "last_seen_utc": "2025-11-28 21:57:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660782": [
        {
            "ioc_value": "cv.law-5-andw-1-ch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:48:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660781": [
        {
            "ioc_value": "data1.fa-1-cbrea-5-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:42:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660780": [
        {
            "ioc_value": "field0.fa-1-cbrea-5-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:37:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660779": [
        {
            "ioc_value": "eo9.fa-1-cbrea-5-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:34:36",
            "last_seen_utc": "2025-11-28 21:36:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660778": [
        {
            "ioc_value": "nv.fa-1-cbrea-5-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:31:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660777": [
        {
            "ioc_value": "base.fa1cbrea5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:28:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660775": [
        {
            "ioc_value": "lucky.fa1cbrea5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:22:54",
            "last_seen_utc": "2025-11-28 21:27:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660774": [
        {
            "ioc_value": "note.fa1cbrea5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:17:38",
            "last_seen_utc": "2025-11-28 21:20:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660772": [
        {
            "ioc_value": "19um.fa1cbrea5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:12:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660769": [
        {
            "ioc_value": "spark8.fie1dcl0se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 21:06:03",
            "last_seen_utc": "2025-11-28 21:08:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660768": [
        {
            "ioc_value": "wec6.fie1dcl0se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 20:57:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660767": [
        {
            "ioc_value": "bll.fie1dcl0se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 20:48:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660766": [
        {
            "ioc_value": "cqr6.fie1dcl0se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 20:35:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660765": [
        {
            "ioc_value": "year.chit7a5tat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 20:26:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660764": [
        {
            "ioc_value": "lucky6.chit7a5tat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 20:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660763": [
        {
            "ioc_value": "osh.chit7a5tat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 20:12:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660762": [
        {
            "ioc_value": "7tlu.chit7a5tat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 20:08:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660757": [
        {
            "ioc_value": "synergix.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-28 20:01:43",
            "last_seen_utc": "2025-11-28 23:00:32",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+synergix.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660756": [
        {
            "ioc_value": "zest.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-28 20:01:42",
            "last_seen_utc": "2025-11-28 23:00:32",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+zest.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660755": [
        {
            "ioc_value": "slantboardguy.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-28 20:01:41",
            "last_seen_utc": "2025-11-28 23:00:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+slantboardguy.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660745": [
        {
            "ioc_value": "5kmb.fie-1-dcl-0-se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:59:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660744": [
        {
            "ioc_value": "6uh.fie-1-dcl-0-se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:57:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660743": [
        {
            "ioc_value": "33ys.fie-1-dcl-0-se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:51:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660742": [
        {
            "ioc_value": "rjcy.fie-1-dcl-0-se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:47:07",
            "last_seen_utc": "2025-11-28 19:48:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660741": [
        {
            "ioc_value": "3yj.chit-7-a-5-tat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:40:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660740": [
        {
            "ioc_value": "field.chit-7-a-5-tat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:37:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660739": [
        {
            "ioc_value": "gate.chit-7-a-5-tat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:27:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660736": [
        {
            "ioc_value": "year8.chit-7-a-5-tat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660735": [
        {
            "ioc_value": "commit8.lu7hichma7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:16:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660732": [
        {
            "ioc_value": "bk0hq.lu7hichma7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 19:07:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660726": [
        {
            "ioc_value": "5z5e.lu7hichma7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660724": [
        {
            "ioc_value": "dxv.lu7hichma7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:49:37",
            "last_seen_utc": "2025-11-28 18:53:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660710": [
        {
            "ioc_value": "61.lu-7-hichma-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:43:01",
            "last_seen_utc": "2025-11-28 18:48:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660709": [
        {
            "ioc_value": "6dze.lu-7-hichma-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:34:45",
            "last_seen_utc": "2025-11-28 18:39:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660708": [
        {
            "ioc_value": "pulse.lu-7-hichma-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:31:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660707": [
        {
            "ioc_value": "51ev.lu-7-hichma-7-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660706": [
        {
            "ioc_value": "ridge.gethe4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:18:39",
            "last_seen_utc": "2025-11-28 18:23:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660705": [
        {
            "ioc_value": "qsa.gethe4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:11:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660704": [
        {
            "ioc_value": "x7.gethe4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:04:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660703": [
        {
            "ioc_value": "ak67ocpsrqlw.share.zrok.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-28 18:01:24",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251128-qfed7awjfn",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660702": [
        {
            "ioc_value": "layer.gethe4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 18:01:16",
            "last_seen_utc": "2025-11-28 18:01:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660701": [
        {
            "ioc_value": "supportedbk.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-28 18:01:12",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251128-t7vf9svjdv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660700": [
        {
            "ioc_value": "supported.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-28 18:01:11",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251128-t7vf9svjdv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660698": [
        {
            "ioc_value": "56og2.luc7y5nub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 17:55:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660697": [
        {
            "ioc_value": "7n.luc7y5nub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 17:50:12",
            "last_seen_utc": "2025-11-28 17:55:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660696": [
        {
            "ioc_value": "echo.luc7y5nub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 17:44:01",
            "last_seen_utc": "2025-11-28 17:46:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660693": [
        {
            "ioc_value": "core9.luc7y5nub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 17:37:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660690": [
        {
            "ioc_value": "xo.a8ain4unt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 17:22:50",
            "last_seen_utc": "2025-11-28 17:34:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660688": [
        {
            "ioc_value": "gate2.a8ain4unt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 17:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660687": [
        {
            "ioc_value": "simple.a8ain4unt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 17:09:50",
            "last_seen_utc": "2025-11-28 17:16:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660686": [
        {
            "ioc_value": "ne.a8ain4unt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 17:04:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660685": [
        {
            "ioc_value": "db5.f2na7under.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 17:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660683": [
        {
            "ioc_value": "alqb.f2na7under.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:51:54",
            "last_seen_utc": "2025-11-28 16:55:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660682": [
        {
            "ioc_value": "layer3.f2na7under.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:48:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660681": [
        {
            "ioc_value": "ridge1.f2na7under.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:41:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660680": [
        {
            "ioc_value": "xzil.d7un4recid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:36:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660679": [
        {
            "ioc_value": "delta.d7un4recid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:33:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660678": [
        {
            "ioc_value": "base7.d7un4recid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:28:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660677": [
        {
            "ioc_value": "tg0y.d7un4recid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:24:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660676": [
        {
            "ioc_value": "iq.f-2-na-7-under.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660675": [
        {
            "ioc_value": "ca.f-2-na-7-under.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:15:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660674": [
        {
            "ioc_value": "n8p.f-2-na-7-under.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:12:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660673": [
        {
            "ioc_value": "oktobetroliohaser.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-28 16:09:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.242.72",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660672": [
        {
            "ioc_value": "malikodjonsbastoliosd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-28 16:08:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.208.81",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660671": [
        {
            "ioc_value": "dasloikjerihpmawer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-28 16:07:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.242.68",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660670": [
        {
            "ioc_value": "stack8.f-2-na-7-under.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:05:58",
            "last_seen_utc": "2025-11-28 16:08:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660669": [
        {
            "ioc_value": "huxukintredert.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-28 16:05:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1624298/",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660668": [
        {
            "ioc_value": "mrflowsticoertomy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-28 16:03:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.85",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660667": [
        {
            "ioc_value": "bqwolokardinodolkad.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-28 16:02:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.84",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660662": [
        {
            "ioc_value": "falkonstertikololas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-28 16:01:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.83",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660658": [
        {
            "ioc_value": "gaganuavtokilometrobusa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-28 16:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.50",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660657": [
        {
            "ioc_value": "0ty.a-8-ain-4-unt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 16:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660655": [
        {
            "ioc_value": "3t6.a-8-ain-4-unt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 15:45:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660654": [
        {
            "ioc_value": "zny1.a-8-ain-4-unt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 15:41:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660410": [
        {
            "ioc_value": "uad8d.a-8-ain-4-unt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 15:30:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660409": [
        {
            "ioc_value": "commit0.gethe-4-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 15:27:40",
            "last_seen_utc": "2025-11-28 15:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660408": [
        {
            "ioc_value": "ec.gethe-4-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 15:11:11",
            "last_seen_utc": "2025-11-28 15:17:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660407": [
        {
            "ioc_value": "simple6.gethe-4-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 14:54:16",
            "last_seen_utc": "2025-11-28 15:09:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660406": [
        {
            "ioc_value": "rope5.gethe-4-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 14:46:03",
            "last_seen_utc": "2025-11-28 14:50:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660405": [
        {
            "ioc_value": "ar.luc-7-y-5-nub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 14:43:21",
            "last_seen_utc": "2025-11-28 14:46:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660404": [
        {
            "ioc_value": "4d6.luc-7-y-5-nub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 14:36:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660403": [
        {
            "ioc_value": "prime.luc-7-y-5-nub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 14:32:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660402": [
        {
            "ioc_value": "4wmi.luc-7-y-5-nub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 14:27:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660401": [
        {
            "ioc_value": "vni.l0ngprope1l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 14:17:43",
            "last_seen_utc": "2025-11-28 14:19:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660400": [
        {
            "ioc_value": "h9j.l0ngprope1l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 14:07:44",
            "last_seen_utc": "2025-11-28 14:08:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660391": [
        {
            "ioc_value": "silent-api.onrender.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 14:04:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/0cdb2630-9da0-479e-8f1d-f6b218c359d8",
            "tags": "stealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1660399": [
        {
            "ioc_value": "again.l0ngprope1l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 13:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660398": [
        {
            "ioc_value": "long.l0ngprope1l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 13:46:38",
            "last_seen_utc": "2025-11-28 13:54:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660396": [
        {
            "ioc_value": "d1d.ga-1-e-7-ajudush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 13:39:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660395": [
        {
            "ioc_value": "lyy.ga-1-e-7-ajudush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 13:34:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660393": [
        {
            "ioc_value": "lg.ga-1-e-7-ajudush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 13:27:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660392": [
        {
            "ioc_value": "commit.ga-1-e-7-ajudush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 13:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660389": [
        {
            "ioc_value": "vale9.fal-1-ow-7-an.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 13:15:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660375": [
        {
            "ioc_value": "ssl.bapiyat727.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-11-28 13:11:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1660380": [
        {
            "ioc_value": "ggh5e4h54.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-11-28 13:11:10",
            "last_seen_utc": "2025-12-14 12:00:17",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/ggh5e4h54.cc/relations",
            "tags": "stealc",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1660385": [
        {
            "ioc_value": "dmicn.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-28 13:11:10",
            "last_seen_utc": "2025-11-28 13:06:00",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115627468728773629",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1660388": [
        {
            "ioc_value": "layer9.fal-1-ow-7-an.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 13:07:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660383": [
        {
            "ioc_value": "learn5.fal-1-ow-7-an.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 12:59:43",
            "last_seen_utc": "2025-11-28 13:02:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660382": [
        {
            "ioc_value": "data.fal-1-ow-7-an.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 12:55:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660379": [
        {
            "ioc_value": "flux9.l1ghtflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 12:40:43",
            "last_seen_utc": "2025-11-28 12:49:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660378": [
        {
            "ioc_value": "rk3.l1ghtflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 12:34:17",
            "last_seen_utc": "2025-11-28 12:39:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660377": [
        {
            "ioc_value": "nova.l1ghtflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 12:25:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660376": [
        {
            "ioc_value": "s8.l1ghtflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 12:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660374": [
        {
            "ioc_value": "gl1m.0rbishade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 12:08:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660369": [
        {
            "ioc_value": "v4n.0rbishade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 12:03:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660364": [
        {
            "ioc_value": "ratmainz.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-28 12:01:11",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251128-jt2nbaymgw",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660363": [
        {
            "ioc_value": "americanmechineries.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-28 12:01:10",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251128-kecw3syqb1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660361": [
        {
            "ioc_value": "hard-remembered.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-28 12:00:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251128-njyk5acr2x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1660358": [
        {
            "ioc_value": "ember.0rbishade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 12:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660357": [
        {
            "ioc_value": "qk9.0rbishade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 11:55:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660356": [
        {
            "ioc_value": "tide4.oceandrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 11:45:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660355": [
        {
            "ioc_value": "m2q.oceandrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 11:42:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660354": [
        {
            "ioc_value": "brisk.oceandrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 11:32:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660353": [
        {
            "ioc_value": "x7.oceandrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 11:28:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660351": [
        {
            "ioc_value": "tgx.aud1mi5s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 11:14:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660350": [
        {
            "ioc_value": "m3pv.po-1-ba-8-esett.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 11:07:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660349": [
        {
            "ioc_value": "data8.po-1-ba-8-esett.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 11:04:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660348": [
        {
            "ioc_value": "drop.crysta1drop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 11:02:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660321": [
        {
            "ioc_value": "road.crysta1drop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660320": [
        {
            "ioc_value": "fire3.crysta1drop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:53:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660318": [
        {
            "ioc_value": "storm6.snowbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:52:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660316": [
        {
            "ioc_value": "ns2.googleclouds.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-28 10:50:17",
            "last_seen_utc": "2025-12-14 11:48:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1660315": [
        {
            "ioc_value": "ns1.googleclouds.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-28 10:50:14",
            "last_seen_utc": "2025-12-14 11:48:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1660314": [
        {
            "ioc_value": "lake2.snowbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:48:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660313": [
        {
            "ioc_value": "7ms.snowbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:42:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660312": [
        {
            "ioc_value": "iud.snowbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:37:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660296": [
        {
            "ioc_value": "say2me.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660297": [
        {
            "ioc_value": "levar-viewer.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660298": [
        {
            "ioc_value": "gtisstorage.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660299": [
        {
            "ioc_value": "cdn-chromos.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660300": [
        {
            "ioc_value": "ballour.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660301": [
        {
            "ioc_value": "the-mentor.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660302": [
        {
            "ioc_value": "live-360.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660303": [
        {
            "ioc_value": "anc-media.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660304": [
        {
            "ioc_value": "check.learnstore.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660305": [
        {
            "ioc_value": "music.learnstore.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660306": [
        {
            "ioc_value": "update.learnstore.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660307": [
        {
            "ioc_value": "api.learnstore.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660308": [
        {
            "ioc_value": "video-dev.learnstore.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660309": [
        {
            "ioc_value": "api-dev.learnstore.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660310": [
        {
            "ioc_value": "music-dev.learnstore.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660311": [
        {
            "ioc_value": "check-dev.learnstore.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660289": [
        {
            "ioc_value": "django-server.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660290": [
        {
            "ioc_value": "omnileadzdev.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660291": [
        {
            "ioc_value": "spyne-test.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660292": [
        {
            "ioc_value": "kia-almotores.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660293": [
        {
            "ioc_value": "devscout.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660294": [
        {
            "ioc_value": "tnegadge.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660295": [
        {
            "ioc_value": "gaadhi.s3.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.krustyloader",
            "malware_alias": null,
            "malware_printable": "KrustyLoader",
            "first_seen_utc": "2025-11-28 10:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1660288": [
        {
            "ioc_value": "kcjdc.c1earway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:33:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660230": [
        {
            "ioc_value": "1tpe.c1earway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:26:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660229": [
        {
            "ioc_value": "ilf4a.c1earway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660228": [
        {
            "ioc_value": "bright9.c1earway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:15:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660227": [
        {
            "ioc_value": "crystal2.shadowtrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660226": [
        {
            "ioc_value": "lake9.shadowtrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 10:05:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660225": [
        {
            "ioc_value": "echo6.shadowtrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:56:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660223": [
        {
            "ioc_value": "lake.shadowtrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:46:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660222": [
        {
            "ioc_value": "breaker1.br1ghtzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:42:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660221": [
        {
            "ioc_value": "snow.br1ghtzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:40:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660204": [
        {
            "ioc_value": "totalav.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-28 09:38:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660207": [
        {
            "ioc_value": "bandbsmengine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-28 09:38:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1660220": [
        {
            "ioc_value": "breaker.br1ghtzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:31:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660219": [
        {
            "ioc_value": "crystal.br1ghtzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:23:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660218": [
        {
            "ioc_value": "hill2.h1ddenlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660217": [
        {
            "ioc_value": "fu4.h1ddenlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:10:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660216": [
        {
            "ioc_value": "0kon.h1ddenlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:05:34",
            "last_seen_utc": "2025-11-28 09:06:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660215": [
        {
            "ioc_value": "6z4.h1ddenlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 09:00:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660197": [
        {
            "ioc_value": "road6.wildh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660194": [
        {
            "ioc_value": "kpx.tokiejegedefoundation.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-28 08:56:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1660195": [
        {
            "ioc_value": "fir.itermed.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-28 08:56:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1660196": [
        {
            "ioc_value": "fir.thesmarthustle.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-28 08:56:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1660185": [
        {
            "ioc_value": "path.wildh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:51:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660183": [
        {
            "ioc_value": "yub.wildh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:48:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660180": [
        {
            "ioc_value": "xlomm.wildh1ll.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:43:11",
            "last_seen_utc": "2025-11-28 08:46:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660179": [
        {
            "ioc_value": "42y.1-nyearbo-0-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:39:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1660169": [
        {
            "ioc_value": "tl.reluxiy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660170": [
        {
            "ioc_value": "tl.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660171": [
        {
            "ioc_value": "tla.gr1tmodule.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660172": [
        {
            "ioc_value": "tla.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660173": [
        {
            "ioc_value": "tn.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660174": [
        {
            "ioc_value": "tn.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660175": [
        {
            "ioc_value": "tn.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660176": [
        {
            "ioc_value": "tn.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660177": [
        {
            "ioc_value": "tn.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660178": [
        {
            "ioc_value": "tne.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660157": [
        {
            "ioc_value": "tiq.stormglade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660158": [
        {
            "ioc_value": "tir.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660159": [
        {
            "ioc_value": "tirohua7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660160": [
        {
            "ioc_value": "tisub.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660161": [
        {
            "ioc_value": "tiw6q.cioudriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660162": [
        {
            "ioc_value": "tiwahyi6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660163": [
        {
            "ioc_value": "tj.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660164": [
        {
            "ioc_value": "tj.waveb0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660165": [
        {
            "ioc_value": "tk.ht-if.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660166": [
        {
            "ioc_value": "tk.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660167": [
        {
            "ioc_value": "tl.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660168": [
        {
            "ioc_value": "tl.pihp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:36",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660146": [
        {
            "ioc_value": "ti1.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660147": [
        {
            "ioc_value": "tibamyi7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660148": [
        {
            "ioc_value": "tic.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660149": [
        {
            "ioc_value": "tid4l.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660150": [
        {
            "ioc_value": "tidalschatten.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660151": [
        {
            "ioc_value": "tide9r.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660152": [
        {
            "ioc_value": "tiger.ta11y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660153": [
        {
            "ioc_value": "tiger.tigerzaun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660154": [
        {
            "ioc_value": "tiny.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660155": [
        {
            "ioc_value": "tip.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660156": [
        {
            "ioc_value": "tip.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:35",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660136": [
        {
            "ioc_value": "thistletal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660137": [
        {
            "ioc_value": "thorn.sh4d0wmere.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660138": [
        {
            "ioc_value": "thorn.stormharrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660139": [
        {
            "ioc_value": "thunderforst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660140": [
        {
            "ioc_value": "thvs.glitchpact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660141": [
        {
            "ioc_value": "thy.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660142": [
        {
            "ioc_value": "ti.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660143": [
        {
            "ioc_value": "ti.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660144": [
        {
            "ioc_value": "ti.tfba6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660145": [
        {
            "ioc_value": "ti.xvqy-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:34",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660125": [
        {
            "ioc_value": "tewupoe02.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660126": [
        {
            "ioc_value": "tfba-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660127": [
        {
            "ioc_value": "tfba6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660128": [
        {
            "ioc_value": "tfc.nufypiy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660129": [
        {
            "ioc_value": "tfy.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660130": [
        {
            "ioc_value": "tgj.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660131": [
        {
            "ioc_value": "tgx.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660132": [
        {
            "ioc_value": "th.h-73-n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660133": [
        {
            "ioc_value": "thaw9r.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660134": [
        {
            "ioc_value": "then.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660135": [
        {
            "ioc_value": "they.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:33",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660113": [
        {
            "ioc_value": "te.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660114": [
        {
            "ioc_value": "te.migyvya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660115": [
        {
            "ioc_value": "te.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660116": [
        {
            "ioc_value": "te.x73r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660117": [
        {
            "ioc_value": "te7ap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660118": [
        {
            "ioc_value": "tea.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660119": [
        {
            "ioc_value": "tea.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660120": [
        {
            "ioc_value": "teb.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660121": [
        {
            "ioc_value": "teloxee1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660122": [
        {
            "ioc_value": "ten.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660123": [
        {
            "ioc_value": "tepud.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660124": [
        {
            "ioc_value": "tess3l.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:32",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660100": [
        {
            "ioc_value": "tbi.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660101": [
        {
            "ioc_value": "tc.527w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660102": [
        {
            "ioc_value": "tc.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660103": [
        {
            "ioc_value": "tc.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660104": [
        {
            "ioc_value": "tc.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660105": [
        {
            "ioc_value": "tc.lake-spry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660106": [
        {
            "ioc_value": "tc.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660107": [
        {
            "ioc_value": "tci.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660108": [
        {
            "ioc_value": "td.cedarwinkel5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660109": [
        {
            "ioc_value": "td.ede-1-g-0-rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660110": [
        {
            "ioc_value": "tdz.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660111": [
        {
            "ioc_value": "te.ember-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660112": [
        {
            "ioc_value": "te.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:31",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660088": [
        {
            "ioc_value": "tau.steelpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660089": [
        {
            "ioc_value": "tau.stormfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660090": [
        {
            "ioc_value": "tau.storml1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660091": [
        {
            "ioc_value": "tau.stormlaterne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660092": [
        {
            "ioc_value": "tau.swiftgasse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660093": [
        {
            "ioc_value": "tau.titanbirch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660094": [
        {
            "ioc_value": "tau.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660095": [
        {
            "ioc_value": "tau1.kick5ubs4ance.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660096": [
        {
            "ioc_value": "tau3.kab1spr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660097": [
        {
            "ioc_value": "tau3ig.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660098": [
        {
            "ioc_value": "tb.f42s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660099": [
        {
            "ioc_value": "tbck.quartz-leaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:30",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660075": [
        {
            "ioc_value": "tau.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660076": [
        {
            "ioc_value": "tau.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660077": [
        {
            "ioc_value": "tau.netit0c0rec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660078": [
        {
            "ioc_value": "tau.oceantrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660079": [
        {
            "ioc_value": "tau.polarhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660080": [
        {
            "ioc_value": "tau.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660081": [
        {
            "ioc_value": "tau.sagehollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660082": [
        {
            "ioc_value": "tau.silberhain9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660083": [
        {
            "ioc_value": "tau.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660084": [
        {
            "ioc_value": "tau.softl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660085": [
        {
            "ioc_value": "tau.sprigkompass.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660086": [
        {
            "ioc_value": "tau.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660087": [
        {
            "ioc_value": "tau.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:29",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660063": [
        {
            "ioc_value": "tau.bluecr4ft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660064": [
        {
            "ioc_value": "tau.br0adtemp1ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660065": [
        {
            "ioc_value": "tau.cobaltspore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660066": [
        {
            "ioc_value": "tau.dawnforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660067": [
        {
            "ioc_value": "tau.ec0nomyfl0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660068": [
        {
            "ioc_value": "tau.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660069": [
        {
            "ioc_value": "tau.elmfalter.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660070": [
        {
            "ioc_value": "tau.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660071": [
        {
            "ioc_value": "tau.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660072": [
        {
            "ioc_value": "tau.ibexweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660073": [
        {
            "ioc_value": "tau.ironweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660074": [
        {
            "ioc_value": "tau.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:28",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660051": [
        {
            "ioc_value": "tal2.ele-6-tricmul-1-ed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660052": [
        {
            "ioc_value": "tal2.safebl0ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660053": [
        {
            "ioc_value": "tal9en.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660054": [
        {
            "ioc_value": "tall.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660055": [
        {
            "ioc_value": "tall.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660056": [
        {
            "ioc_value": "tally.t1ger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660057": [
        {
            "ioc_value": "talon4.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660058": [
        {
            "ioc_value": "tap.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660059": [
        {
            "ioc_value": "tap6.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660060": [
        {
            "ioc_value": "tas.frostmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660061": [
        {
            "ioc_value": "tasig.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660062": [
        {
            "ioc_value": "tau.0ceanleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:27",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660035": [
        {
            "ioc_value": "tal.hum-2-nk-0-str.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660036": [
        {
            "ioc_value": "tal.lindenarc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660037": [
        {
            "ioc_value": "tal.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660038": [
        {
            "ioc_value": "tal.nightf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660039": [
        {
            "ioc_value": "tal.p0lys5pear.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660040": [
        {
            "ioc_value": "tal.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660041": [
        {
            "ioc_value": "tal.s0ftwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660042": [
        {
            "ioc_value": "tal.silvanbruch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660043": [
        {
            "ioc_value": "tal.starl1nq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660044": [
        {
            "ioc_value": "tal.stormpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660045": [
        {
            "ioc_value": "tal.w1ldgate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660046": [
        {
            "ioc_value": "tal.wlnd5hore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660047": [
        {
            "ioc_value": "tal.xenonridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660048": [
        {
            "ioc_value": "tal1.l1necloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660049": [
        {
            "ioc_value": "tal1.st0nepath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660050": [
        {
            "ioc_value": "tal2.deepstream.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:26",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660020": [
        {
            "ioc_value": "taiga.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660021": [
        {
            "ioc_value": "taiga.flintpaddle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660022": [
        {
            "ioc_value": "taiga.iunarblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660023": [
        {
            "ioc_value": "tal.c1oudmap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660024": [
        {
            "ioc_value": "tal.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660025": [
        {
            "ioc_value": "tal.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660026": [
        {
            "ioc_value": "tal.cedarquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660027": [
        {
            "ioc_value": "tal.clouddrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660028": [
        {
            "ioc_value": "tal.cobaltquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660029": [
        {
            "ioc_value": "tal.darkspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660030": [
        {
            "ioc_value": "tal.dinfectt-0-rs-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660031": [
        {
            "ioc_value": "tal.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660032": [
        {
            "ioc_value": "tal.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660033": [
        {
            "ioc_value": "tal.frostweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660034": [
        {
            "ioc_value": "tal.heatherpass.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:25",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660005": [
        {
            "ioc_value": "ta.skym0tion.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660006": [
        {
            "ioc_value": "ta.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660007": [
        {
            "ioc_value": "ta.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660008": [
        {
            "ioc_value": "ta.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660009": [
        {
            "ioc_value": "ta.xe-1r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:59:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660010": [
        {
            "ioc_value": "ta.xyc0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660011": [
        {
            "ioc_value": "ta5.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660012": [
        {
            "ioc_value": "tab.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660013": [
        {
            "ioc_value": "tab.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660014": [
        {
            "ioc_value": "tafemuo5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660015": [
        {
            "ioc_value": "tafoz.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660016": [
        {
            "ioc_value": "tag-b-s3.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660017": [
        {
            "ioc_value": "tag.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660018": [
        {
            "ioc_value": "tahip.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660019": [
        {
            "ioc_value": "taiga.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:24",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659990": [
        {
            "ioc_value": "t7.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659991": [
        {
            "ioc_value": "t7.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659992": [
        {
            "ioc_value": "t7q2.redm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659993": [
        {
            "ioc_value": "t7x.stormcairn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659994": [
        {
            "ioc_value": "t7z.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659995": [
        {
            "ioc_value": "t80.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659996": [
        {
            "ioc_value": "t84.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659997": [
        {
            "ioc_value": "t9.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659998": [
        {
            "ioc_value": "t9d.rivermote.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659999": [
        {
            "ioc_value": "t9f.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660000": [
        {
            "ioc_value": "t9f.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660001": [
        {
            "ioc_value": "t9k.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660002": [
        {
            "ioc_value": "ta.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660003": [
        {
            "ioc_value": "ta.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1660004": [
        {
            "ioc_value": "ta.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:23",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659977": [
        {
            "ioc_value": "t4au.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659978": [
        {
            "ioc_value": "t4c6yx8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659979": [
        {
            "ioc_value": "t5.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659980": [
        {
            "ioc_value": "t5.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659981": [
        {
            "ioc_value": "t5.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659982": [
        {
            "ioc_value": "t5h.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659983": [
        {
            "ioc_value": "t6.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659984": [
        {
            "ioc_value": "t6.81dm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659985": [
        {
            "ioc_value": "t6c.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659986": [
        {
            "ioc_value": "t6e1x9a.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659987": [
        {
            "ioc_value": "t6s.icymoth.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659988": [
        {
            "ioc_value": "t6z0q8.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659989": [
        {
            "ioc_value": "t7.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:22",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659962": [
        {
            "ioc_value": "t1v.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659963": [
        {
            "ioc_value": "t1v.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659964": [
        {
            "ioc_value": "t1v.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659965": [
        {
            "ioc_value": "t1v.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659966": [
        {
            "ioc_value": "t1v.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659967": [
        {
            "ioc_value": "t1v.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659968": [
        {
            "ioc_value": "t1v.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659969": [
        {
            "ioc_value": "t1v.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659970": [
        {
            "ioc_value": "t1v.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:59:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659971": [
        {
            "ioc_value": "t2.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659972": [
        {
            "ioc_value": "t3.sn0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659973": [
        {
            "ioc_value": "t3k.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659974": [
        {
            "ioc_value": "t3q.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659975": [
        {
            "ioc_value": "t3s.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659976": [
        {
            "ioc_value": "t4.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:21",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659948": [
        {
            "ioc_value": "t1.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659949": [
        {
            "ioc_value": "t1.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659950": [
        {
            "ioc_value": "t1.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659951": [
        {
            "ioc_value": "t1.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:59:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659952": [
        {
            "ioc_value": "t1.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659953": [
        {
            "ioc_value": "t1mze9.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659954": [
        {
            "ioc_value": "t1n.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659955": [
        {
            "ioc_value": "t1n.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659956": [
        {
            "ioc_value": "t1n.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659957": [
        {
            "ioc_value": "t1n.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659958": [
        {
            "ioc_value": "t1n.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659959": [
        {
            "ioc_value": "t1n.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659960": [
        {
            "ioc_value": "t1n.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659961": [
        {
            "ioc_value": "t1n.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:20",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659932": [
        {
            "ioc_value": "t0.emberglade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659933": [
        {
            "ioc_value": "t0.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659934": [
        {
            "ioc_value": "t0.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659935": [
        {
            "ioc_value": "t0.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659936": [
        {
            "ioc_value": "t1.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659937": [
        {
            "ioc_value": "t1.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659938": [
        {
            "ioc_value": "t1.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659939": [
        {
            "ioc_value": "t1.4kl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659940": [
        {
            "ioc_value": "t1.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659941": [
        {
            "ioc_value": "t1.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659942": [
        {
            "ioc_value": "t1.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659943": [
        {
            "ioc_value": "t1.cobaltwolke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659944": [
        {
            "ioc_value": "t1.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659945": [
        {
            "ioc_value": "t1.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659946": [
        {
            "ioc_value": "t1.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659947": [
        {
            "ioc_value": "t1.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:19",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659916": [
        {
            "ioc_value": "t.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659917": [
        {
            "ioc_value": "t.3u1y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659918": [
        {
            "ioc_value": "t.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659919": [
        {
            "ioc_value": "t.d8w6l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659920": [
        {
            "ioc_value": "t.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659921": [
        {
            "ioc_value": "t.gug7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659922": [
        {
            "ioc_value": "t.h8y0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659923": [
        {
            "ioc_value": "t.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659924": [
        {
            "ioc_value": "t.kilut4ou8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659925": [
        {
            "ioc_value": "t.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659926": [
        {
            "ioc_value": "t.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659927": [
        {
            "ioc_value": "t.qute3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659928": [
        {
            "ioc_value": "t.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659929": [
        {
            "ioc_value": "t.r3j5c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659930": [
        {
            "ioc_value": "t.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:59:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659931": [
        {
            "ioc_value": "t.yo11.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659902": [
        {
            "ioc_value": "sxw.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659903": [
        {
            "ioc_value": "sxyz.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659904": [
        {
            "ioc_value": "syburei3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659905": [
        {
            "ioc_value": "syl.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659906": [
        {
            "ioc_value": "sylaj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659907": [
        {
            "ioc_value": "sylph8.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659908": [
        {
            "ioc_value": "synentpbgd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659909": [
        {
            "ioc_value": "syvuk.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659910": [
        {
            "ioc_value": "syxevao7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659911": [
        {
            "ioc_value": "sz.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659912": [
        {
            "ioc_value": "sz.n-96-f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659913": [
        {
            "ioc_value": "szh.saqehyo1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659914": [
        {
            "ioc_value": "szo.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659915": [
        {
            "ioc_value": "t-dgf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:17",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659888": [
        {
            "ioc_value": "suv.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659889": [
        {
            "ioc_value": "suvw.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659890": [
        {
            "ioc_value": "suz.mirage-pad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659891": [
        {
            "ioc_value": "suzapuo0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659892": [
        {
            "ioc_value": "sv.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659893": [
        {
            "ioc_value": "sv.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659894": [
        {
            "ioc_value": "svc.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659895": [
        {
            "ioc_value": "svzzv.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659896": [
        {
            "ioc_value": "sw.njur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659897": [
        {
            "ioc_value": "sw.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659898": [
        {
            "ioc_value": "swa.silversummit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659899": [
        {
            "ioc_value": "switch.ventrill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659900": [
        {
            "ioc_value": "swm5.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659901": [
        {
            "ioc_value": "sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:16",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659876": [
        {
            "ioc_value": "sun.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659877": [
        {
            "ioc_value": "sun.drift-bay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659878": [
        {
            "ioc_value": "sun.firetrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659879": [
        {
            "ioc_value": "sun.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659880": [
        {
            "ioc_value": "sun.homohay31.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659881": [
        {
            "ioc_value": "sun.pobinei39.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659882": [
        {
            "ioc_value": "sun.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659883": [
        {
            "ioc_value": "sun.silverpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659884": [
        {
            "ioc_value": "sun2.sun0rbit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659885": [
        {
            "ioc_value": "surf9a.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659886": [
        {
            "ioc_value": "susedey1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659887": [
        {
            "ioc_value": "susudoi52.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:15",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659868": [
        {
            "ioc_value": "su.dunn0en7el.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:14",
            "last_seen_utc": "2025-11-29 09:58:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659869": [
        {
            "ioc_value": "suboluo0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:14",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659870": [
        {
            "ioc_value": "sucile.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:14",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659871": [
        {
            "ioc_value": "suit.tatyziu58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:14",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659872": [
        {
            "ioc_value": "sumer.brightden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:14",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659873": [
        {
            "ioc_value": "sumpf.heatherquell.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:14",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659874": [
        {
            "ioc_value": "sun.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:14",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659875": [
        {
            "ioc_value": "sun.b1uespark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:14",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659855": [
        {
            "ioc_value": "sturm.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659856": [
        {
            "ioc_value": "sturm.cedarberg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659857": [
        {
            "ioc_value": "sturm.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659858": [
        {
            "ioc_value": "sturm.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659859": [
        {
            "ioc_value": "sturm.dustycode.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659860": [
        {
            "ioc_value": "sturm.glaciergrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659861": [
        {
            "ioc_value": "sturm.gladecrown.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659862": [
        {
            "ioc_value": "sturm.granitebach.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659863": [
        {
            "ioc_value": "sturm.in-ha-4-it-mu-1-ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659864": [
        {
            "ioc_value": "sturm.obsidianufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659865": [
        {
            "ioc_value": "sturm.payc0medy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659866": [
        {
            "ioc_value": "sturm.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659867": [
        {
            "ioc_value": "sturm.rainrad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659845": [
        {
            "ioc_value": "stormcradle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659846": [
        {
            "ioc_value": "stormharrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659847": [
        {
            "ioc_value": "stormoak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659848": [
        {
            "ioc_value": "stormy.storm-ripple.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659849": [
        {
            "ioc_value": "strand.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659850": [
        {
            "ioc_value": "strm9a.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659851": [
        {
            "ioc_value": "strom.graniteweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659852": [
        {
            "ioc_value": "strom2.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659853": [
        {
            "ioc_value": "strom2.granitehaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659854": [
        {
            "ioc_value": "stu.lysyrei3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:12",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659835": [
        {
            "ioc_value": "stone.skybl1ss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659836": [
        {
            "ioc_value": "stone.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659837": [
        {
            "ioc_value": "stone0.frostwalk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659838": [
        {
            "ioc_value": "stop.m0rning.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659839": [
        {
            "ioc_value": "storm-cradle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659840": [
        {
            "ioc_value": "storm.a5t1gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659841": [
        {
            "ioc_value": "storm.amberkliff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659842": [
        {
            "ioc_value": "storm.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659843": [
        {
            "ioc_value": "storm.silverr0ot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659844": [
        {
            "ioc_value": "storm.st0rmleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:11",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659819": [
        {
            "ioc_value": "stern.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659820": [
        {
            "ioc_value": "stern.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659821": [
        {
            "ioc_value": "stern.starl1nq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659822": [
        {
            "ioc_value": "stern.willowsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659823": [
        {
            "ioc_value": "stern.willowufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659824": [
        {
            "ioc_value": "stern.wolkenhof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659825": [
        {
            "ioc_value": "stern1.alderquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659826": [
        {
            "ioc_value": "stern1.netit0c0rec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659827": [
        {
            "ioc_value": "steyn4.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659828": [
        {
            "ioc_value": "sth.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659829": [
        {
            "ioc_value": "stoat.stoatgasse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659830": [
        {
            "ioc_value": "stone.1nyearbo0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659831": [
        {
            "ioc_value": "stone.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659832": [
        {
            "ioc_value": "stone.frostwalk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659833": [
        {
            "ioc_value": "stone.m1stbird.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659834": [
        {
            "ioc_value": "stone.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:10",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659804": [
        {
            "ioc_value": "stern.hum-2-nk-0-str.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659805": [
        {
            "ioc_value": "stern.kab-1-spr-0-tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659806": [
        {
            "ioc_value": "stern.l1ghtcloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659807": [
        {
            "ioc_value": "stern.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659808": [
        {
            "ioc_value": "stern.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659809": [
        {
            "ioc_value": "stern.maplerand.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659810": [
        {
            "ioc_value": "stern.med1aflow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659811": [
        {
            "ioc_value": "stern.oceanbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659812": [
        {
            "ioc_value": "stern.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659813": [
        {
            "ioc_value": "stern.pixelbuche.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659814": [
        {
            "ioc_value": "stern.platinumvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659815": [
        {
            "ioc_value": "stern.prairiewolf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659816": [
        {
            "ioc_value": "stern.quartzhain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659817": [
        {
            "ioc_value": "stern.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659818": [
        {
            "ioc_value": "stern.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:09",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659789": [
        {
            "ioc_value": "stern.atlasufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659790": [
        {
            "ioc_value": "stern.aurora1hain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659791": [
        {
            "ioc_value": "stern.brinewald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659792": [
        {
            "ioc_value": "stern.c0dehawk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659793": [
        {
            "ioc_value": "stern.cometlinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659794": [
        {
            "ioc_value": "stern.copperalpen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659795": [
        {
            "ioc_value": "stern.dawnforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659796": [
        {
            "ioc_value": "stern.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659797": [
        {
            "ioc_value": "stern.emberkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659798": [
        {
            "ioc_value": "stern.emberweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659799": [
        {
            "ioc_value": "stern.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659800": [
        {
            "ioc_value": "stern.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659801": [
        {
            "ioc_value": "stern.glimmerstrand.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659802": [
        {
            "ioc_value": "stern.glimmerufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659803": [
        {
            "ioc_value": "stern.hearthwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:08",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659775": [
        {
            "ioc_value": "steig.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659776": [
        {
            "ioc_value": "stein.anvilklee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659777": [
        {
            "ioc_value": "stein.badgerfels.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659778": [
        {
            "ioc_value": "stein.boulderfield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659779": [
        {
            "ioc_value": "stein.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659780": [
        {
            "ioc_value": "stein.flintwerder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659781": [
        {
            "ioc_value": "stein.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659782": [
        {
            "ioc_value": "stel5a.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659783": [
        {
            "ioc_value": "stellarblick.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659784": [
        {
            "ioc_value": "stem.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659785": [
        {
            "ioc_value": "stemm7.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659786": [
        {
            "ioc_value": "sterm.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659787": [
        {
            "ioc_value": "sterm.st0nedrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659788": [
        {
            "ioc_value": "stern.1ittleriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:07",
            "last_seen_utc": "2025-11-29 09:57:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659767": [
        {
            "ioc_value": "st6.quartzflip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:06",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659768": [
        {
            "ioc_value": "stack.suf-1-nau-8-h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:06",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659769": [
        {
            "ioc_value": "stahl.goldtalon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:06",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659770": [
        {
            "ioc_value": "star.cofidyu58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:06",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659771": [
        {
            "ioc_value": "star.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:06",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659772": [
        {
            "ioc_value": "star.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:06",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659773": [
        {
            "ioc_value": "star.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:06",
            "last_seen_utc": "2025-11-29 09:58:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659774": [
        {
            "ioc_value": "starmarkt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:06",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659762": [
        {
            "ioc_value": "st0rmx.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:05",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659763": [
        {
            "ioc_value": "st0urm.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:05",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659764": [
        {
            "ioc_value": "st1ern.bil1sun8en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:05",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659765": [
        {
            "ioc_value": "st1ngcrate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:05",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659766": [
        {
            "ioc_value": "st3eg.aphrh1tc4h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:05",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659748": [
        {
            "ioc_value": "squall6.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:58:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659749": [
        {
            "ioc_value": "squib7.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659750": [
        {
            "ioc_value": "sr.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659751": [
        {
            "ioc_value": "sr7.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659752": [
        {
            "ioc_value": "srd.n0rthw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659753": [
        {
            "ioc_value": "srndp.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659754": [
        {
            "ioc_value": "srs01.sn0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659755": [
        {
            "ioc_value": "srst.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659756": [
        {
            "ioc_value": "ss.lakesp1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659757": [
        {
            "ioc_value": "ss.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659758": [
        {
            "ioc_value": "ss.razorplume.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659759": [
        {
            "ioc_value": "sstu.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659760": [
        {
            "ioc_value": "st.h73n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659761": [
        {
            "ioc_value": "st0ne.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:04",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659741": [
        {
            "ioc_value": "spruceinsel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:03",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659742": [
        {
            "ioc_value": "spur.quartzweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:03",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659743": [
        {
            "ioc_value": "spur8.emberhoehle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:03",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659744": [
        {
            "ioc_value": "spy.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:03",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659745": [
        {
            "ioc_value": "sq.d-09-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:03",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659746": [
        {
            "ioc_value": "sq.mizx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:03",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659747": [
        {
            "ioc_value": "sq.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:03",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659740": [
        {
            "ioc_value": "spruc5.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:02",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659732": [
        {
            "ioc_value": "spina3.mintsp1ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:01",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659733": [
        {
            "ioc_value": "spindle7.marbletug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:01",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659734": [
        {
            "ioc_value": "splash8.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:01",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659735": [
        {
            "ioc_value": "splo8s.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:01",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659736": [
        {
            "ioc_value": "spr1g.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:01",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659737": [
        {
            "ioc_value": "spr1gg.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:01",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659738": [
        {
            "ioc_value": "spray.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:01",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659739": [
        {
            "ioc_value": "sprout.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:01",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659717": [
        {
            "ioc_value": "spark5.b1uespark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659718": [
        {
            "ioc_value": "spark6.raven-flux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659719": [
        {
            "ioc_value": "spark7.mistlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659720": [
        {
            "ioc_value": "spark7.sm0kewood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659721": [
        {
            "ioc_value": "spark8.f1rewall.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659722": [
        {
            "ioc_value": "spark8.kn-1-fecast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659723": [
        {
            "ioc_value": "spark8.stonem1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659724": [
        {
            "ioc_value": "spark9.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659725": [
        {
            "ioc_value": "sparkle.c0sm1cweld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659726": [
        {
            "ioc_value": "sparkle.mirthcap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659727": [
        {
            "ioc_value": "sparkle.twistnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659728": [
        {
            "ioc_value": "sparkle3.tanglehook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659729": [
        {
            "ioc_value": "sparkle6.j1gglestone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659730": [
        {
            "ioc_value": "sparkle7.sn-0-rtling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659731": [
        {
            "ioc_value": "sparkle9.ma-shrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:38:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659701": [
        {
            "ioc_value": "spark.flintwerder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659702": [
        {
            "ioc_value": "spark.glimmerstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659703": [
        {
            "ioc_value": "spark.m-0-on-forger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659704": [
        {
            "ioc_value": "spark.pen1sp7edef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659705": [
        {
            "ioc_value": "spark.spindle-way.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659706": [
        {
            "ioc_value": "spark.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659707": [
        {
            "ioc_value": "spark.warpclutch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659708": [
        {
            "ioc_value": "spark.wild0ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659709": [
        {
            "ioc_value": "spark.y0ur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659710": [
        {
            "ioc_value": "spark0.cioudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659711": [
        {
            "ioc_value": "spark0.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659712": [
        {
            "ioc_value": "spark1.br1ghtwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659713": [
        {
            "ioc_value": "spark2.c0deroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659714": [
        {
            "ioc_value": "spark2.silverklamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659715": [
        {
            "ioc_value": "spark3.primurib1er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659716": [
        {
            "ioc_value": "spark3.shadowsun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:59",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659685": [
        {
            "ioc_value": "solve.zexd.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:59:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659686": [
        {
            "ioc_value": "solve.zyde.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659687": [
        {
            "ioc_value": "soniccobalt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659688": [
        {
            "ioc_value": "sonne.frostgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659689": [
        {
            "ioc_value": "sora.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659690": [
        {
            "ioc_value": "soreb.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659691": [
        {
            "ioc_value": "sotod2ao6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659692": [
        {
            "ioc_value": "sourc3.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659693": [
        {
            "ioc_value": "sp.htif.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659694": [
        {
            "ioc_value": "sp.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659695": [
        {
            "ioc_value": "sp.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:59:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659696": [
        {
            "ioc_value": "sp1.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659697": [
        {
            "ioc_value": "sp1rel.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659698": [
        {
            "ioc_value": "sp4rkx.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659699": [
        {
            "ioc_value": "sp5.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659700": [
        {
            "ioc_value": "spark.clearspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:58",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659667": [
        {
            "ioc_value": "solve.lzmb.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659668": [
        {
            "ioc_value": "solve.nkve.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659669": [
        {
            "ioc_value": "solve.nohz.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659670": [
        {
            "ioc_value": "solve.nrxk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659671": [
        {
            "ioc_value": "solve.porw.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659672": [
        {
            "ioc_value": "solve.pvsu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659673": [
        {
            "ioc_value": "solve.qabi.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659674": [
        {
            "ioc_value": "solve.reqy.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659675": [
        {
            "ioc_value": "solve.rlvw.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659676": [
        {
            "ioc_value": "solve.rywi.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659677": [
        {
            "ioc_value": "solve.uayy.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:58:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659678": [
        {
            "ioc_value": "solve.vjgh.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:58:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659679": [
        {
            "ioc_value": "solve.vyzu.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:58:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659680": [
        {
            "ioc_value": "solve.wbth.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659681": [
        {
            "ioc_value": "solve.wyji.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:59:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659682": [
        {
            "ioc_value": "solve.xclb.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:59:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659683": [
        {
            "ioc_value": "solve.xfzz.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:59:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659684": [
        {
            "ioc_value": "solve.xtxy.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:57",
            "last_seen_utc": "2025-11-29 09:59:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659652": [
        {
            "ioc_value": "sog.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659653": [
        {
            "ioc_value": "sokowao4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659654": [
        {
            "ioc_value": "sol1.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659655": [
        {
            "ioc_value": "solarfracht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659656": [
        {
            "ioc_value": "solarviolet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659657": [
        {
            "ioc_value": "solis.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659658": [
        {
            "ioc_value": "solve.bogx.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659659": [
        {
            "ioc_value": "solve.dpqx.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659660": [
        {
            "ioc_value": "solve.eiui.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659661": [
        {
            "ioc_value": "solve.feqy.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659662": [
        {
            "ioc_value": "solve.gesz.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659663": [
        {
            "ioc_value": "solve.hhxe.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659664": [
        {
            "ioc_value": "solve.jrqr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659665": [
        {
            "ioc_value": "solve.kxlv.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659666": [
        {
            "ioc_value": "solve.lnww.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:56",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659637": [
        {
            "ioc_value": "so.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659638": [
        {
            "ioc_value": "so.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659639": [
        {
            "ioc_value": "so.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659640": [
        {
            "ioc_value": "so.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659641": [
        {
            "ioc_value": "so.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659642": [
        {
            "ioc_value": "so.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659643": [
        {
            "ioc_value": "so.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659644": [
        {
            "ioc_value": "so.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659645": [
        {
            "ioc_value": "socu.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659646": [
        {
            "ioc_value": "sod.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659647": [
        {
            "ioc_value": "soft.cl0udmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659648": [
        {
            "ioc_value": "soft.stormbiend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659649": [
        {
            "ioc_value": "soft.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659650": [
        {
            "ioc_value": "soft2.rockwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659651": [
        {
            "ioc_value": "softe5.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:55",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659623": [
        {
            "ioc_value": "snh.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:59:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659624": [
        {
            "ioc_value": "snow.ju-4-en-pare-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659625": [
        {
            "ioc_value": "snow5.sm-0-kewood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659626": [
        {
            "ioc_value": "snow7y.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659627": [
        {
            "ioc_value": "snuff.gr0ssgar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659628": [
        {
            "ioc_value": "snuffglo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659629": [
        {
            "ioc_value": "so.cawyfie51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659630": [
        {
            "ioc_value": "so.ciqe8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659631": [
        {
            "ioc_value": "so.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659632": [
        {
            "ioc_value": "so.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659633": [
        {
            "ioc_value": "so.ixy9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659634": [
        {
            "ioc_value": "so.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659635": [
        {
            "ioc_value": "so.myda4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659636": [
        {
            "ioc_value": "so.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:54",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659612": [
        {
            "ioc_value": "sl.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659613": [
        {
            "ioc_value": "sl3etx.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659614": [
        {
            "ioc_value": "slash.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659615": [
        {
            "ioc_value": "slow.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659616": [
        {
            "ioc_value": "slush5.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659617": [
        {
            "ioc_value": "sm.t65p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659618": [
        {
            "ioc_value": "sm.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659619": [
        {
            "ioc_value": "sm.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659620": [
        {
            "ioc_value": "smtp.wtan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659621": [
        {
            "ioc_value": "sn.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659622": [
        {
            "ioc_value": "sn0wy7.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:53",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659599": [
        {
            "ioc_value": "skid9x.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659600": [
        {
            "ioc_value": "sky.badejie69.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659601": [
        {
            "ioc_value": "sky.dihijio22.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659602": [
        {
            "ioc_value": "sky.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659603": [
        {
            "ioc_value": "sky.m1ntflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659604": [
        {
            "ioc_value": "sky.nylykuu40.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659605": [
        {
            "ioc_value": "sky.sn0rtling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659606": [
        {
            "ioc_value": "sky.softm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659607": [
        {
            "ioc_value": "sky.wildm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659608": [
        {
            "ioc_value": "sky3.softm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659609": [
        {
            "ioc_value": "sky7.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659610": [
        {
            "ioc_value": "skybur5t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659611": [
        {
            "ioc_value": "skz.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:52",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659584": [
        {
            "ioc_value": "sit.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659585": [
        {
            "ioc_value": "six.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659586": [
        {
            "ioc_value": "six.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659587": [
        {
            "ioc_value": "sj.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659588": [
        {
            "ioc_value": "sj.f-05-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659589": [
        {
            "ioc_value": "sj.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659590": [
        {
            "ioc_value": "sj6b.ic0n1cvalley.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659591": [
        {
            "ioc_value": "sjef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659592": [
        {
            "ioc_value": "sji.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:59:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659593": [
        {
            "ioc_value": "sjld.cog-whittle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659594": [
        {
            "ioc_value": "sjoh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659595": [
        {
            "ioc_value": "sk.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659596": [
        {
            "ioc_value": "skeld7.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659597": [
        {
            "ioc_value": "sketch.zeromint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659598": [
        {
            "ioc_value": "ski.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:51",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659574": [
        {
            "ioc_value": "silver2.prariehafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659575": [
        {
            "ioc_value": "silver9.fro5tlane.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659576": [
        {
            "ioc_value": "silver9.w1ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659577": [
        {
            "ioc_value": "simple.simp7euna3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659578": [
        {
            "ioc_value": "simple3.simp-7-euna-3-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659579": [
        {
            "ioc_value": "sip.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659580": [
        {
            "ioc_value": "sip.run-c-you.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659581": [
        {
            "ioc_value": "sipejou7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659582": [
        {
            "ioc_value": "siq.gr1tmodule.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659583": [
        {
            "ioc_value": "siradyo1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:50",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659561": [
        {
            "ioc_value": "sih4.ravenflux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659562": [
        {
            "ioc_value": "silb3r.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659563": [
        {
            "ioc_value": "silem.s0ftvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659564": [
        {
            "ioc_value": "silent-grove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659565": [
        {
            "ioc_value": "silent-harvest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659566": [
        {
            "ioc_value": "silentharvest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659567": [
        {
            "ioc_value": "silicon-moss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659568": [
        {
            "ioc_value": "siliconmoss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659569": [
        {
            "ioc_value": "silt9x.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659570": [
        {
            "ioc_value": "silver.br1ghtwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659571": [
        {
            "ioc_value": "silver.cioudnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659572": [
        {
            "ioc_value": "silver.emberglade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659573": [
        {
            "ioc_value": "silver0.b1tzdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:49",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659546": [
        {
            "ioc_value": "shine.w1de.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659547": [
        {
            "ioc_value": "shivr5.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659548": [
        {
            "ioc_value": "shoal.crysta1shore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659549": [
        {
            "ioc_value": "shop.s1lver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659550": [
        {
            "ioc_value": "shop0.l0ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659551": [
        {
            "ioc_value": "shore.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659552": [
        {
            "ioc_value": "shore.sunm0tion.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659553": [
        {
            "ioc_value": "showypresume.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659554": [
        {
            "ioc_value": "shy.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659555": [
        {
            "ioc_value": "shy.vudujiu33.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659556": [
        {
            "ioc_value": "shy.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659557": [
        {
            "ioc_value": "si.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659558": [
        {
            "ioc_value": "si.ljat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659559": [
        {
            "ioc_value": "si.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659560": [
        {
            "ioc_value": "si.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:48",
            "last_seen_utc": "2025-11-29 09:59:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659530": [
        {
            "ioc_value": "shard.kos-0-ltyu-4-etey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659531": [
        {
            "ioc_value": "shard.marble-tug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659532": [
        {
            "ioc_value": "shard.morrowplug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659533": [
        {
            "ioc_value": "shard6.kos-0-ltyu-4-etey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659534": [
        {
            "ioc_value": "shard7.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659535": [
        {
            "ioc_value": "sheh-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659536": [
        {
            "ioc_value": "shield.hre-9-in-7-mamma.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659537": [
        {
            "ioc_value": "shift.bash-glider.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659538": [
        {
            "ioc_value": "shift.comp-0-tsab-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659539": [
        {
            "ioc_value": "shift.dup1ic4ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659540": [
        {
            "ioc_value": "shift.gyrodesk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659541": [
        {
            "ioc_value": "shift.oddkraken.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659542": [
        {
            "ioc_value": "shift.wildm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659543": [
        {
            "ioc_value": "shift2.glitchpact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659544": [
        {
            "ioc_value": "shift4.plasm-about.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659545": [
        {
            "ioc_value": "shine.mintspr1ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:47",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659517": [
        {
            "ioc_value": "sh.wqix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659518": [
        {
            "ioc_value": "sh.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659519": [
        {
            "ioc_value": "sh2keng1neer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659520": [
        {
            "ioc_value": "shade.fr0stharrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659521": [
        {
            "ioc_value": "shade.s0ftfern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659522": [
        {
            "ioc_value": "shade8.shad0wdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659523": [
        {
            "ioc_value": "shadow.suncrest0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659524": [
        {
            "ioc_value": "shadow2.r0ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659525": [
        {
            "ioc_value": "shadow6.st0nepeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659526": [
        {
            "ioc_value": "shadowb1t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659527": [
        {
            "ioc_value": "shadowpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659528": [
        {
            "ioc_value": "shady.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659529": [
        {
            "ioc_value": "shamr4.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:46",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659501": [
        {
            "ioc_value": "sekegyu6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659502": [
        {
            "ioc_value": "selene8.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659503": [
        {
            "ioc_value": "selva.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659504": [
        {
            "ioc_value": "set.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659505": [
        {
            "ioc_value": "sew.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659506": [
        {
            "ioc_value": "sewekae8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659507": [
        {
            "ioc_value": "sewumoa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659508": [
        {
            "ioc_value": "sgd.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659509": [
        {
            "ioc_value": "sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659510": [
        {
            "ioc_value": "sghi.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659511": [
        {
            "ioc_value": "sgy.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659512": [
        {
            "ioc_value": "sh-2-keng-1-neer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659513": [
        {
            "ioc_value": "sh.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659514": [
        {
            "ioc_value": "sh.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659515": [
        {
            "ioc_value": "sh.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659516": [
        {
            "ioc_value": "sh.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:45",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659484": [
        {
            "ioc_value": "se3.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659485": [
        {
            "ioc_value": "sea.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659486": [
        {
            "ioc_value": "sea.badejie69.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659487": [
        {
            "ioc_value": "sea.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659488": [
        {
            "ioc_value": "sea.dihijio22.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659489": [
        {
            "ioc_value": "sea.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659490": [
        {
            "ioc_value": "sea.homohay31.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659491": [
        {
            "ioc_value": "sea.nylykuu40.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659492": [
        {
            "ioc_value": "seb.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659493": [
        {
            "ioc_value": "sec.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:59:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659494": [
        {
            "ioc_value": "see.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659495": [
        {
            "ioc_value": "see.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659496": [
        {
            "ioc_value": "seed.wild0ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659497": [
        {
            "ioc_value": "sefefuy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659498": [
        {
            "ioc_value": "sefudao2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659499": [
        {
            "ioc_value": "segel.pumaschiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659500": [
        {
            "ioc_value": "seheli.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:44",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659469": [
        {
            "ioc_value": "schiff.pumaschiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659470": [
        {
            "ioc_value": "schild.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659471": [
        {
            "ioc_value": "schirm.ironweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659472": [
        {
            "ioc_value": "schlu7.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659473": [
        {
            "ioc_value": "schlucht.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659474": [
        {
            "ioc_value": "schne8.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659475": [
        {
            "ioc_value": "scramble3.orbitling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659476": [
        {
            "ioc_value": "sd.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659477": [
        {
            "ioc_value": "sd.mjef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659478": [
        {
            "ioc_value": "sd.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659479": [
        {
            "ioc_value": "sdg.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659480": [
        {
            "ioc_value": "sdh3a.knotberry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659481": [
        {
            "ioc_value": "sdjyu.m-0-on-forger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659482": [
        {
            "ioc_value": "se.phpa-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659483": [
        {
            "ioc_value": "se.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:43",
            "last_seen_utc": "2025-11-29 09:58:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659454": [
        {
            "ioc_value": "sas.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659455": [
        {
            "ioc_value": "savenay2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659456": [
        {
            "ioc_value": "say.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659457": [
        {
            "ioc_value": "sb.fjot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659458": [
        {
            "ioc_value": "sb.v0xelmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:58:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659459": [
        {
            "ioc_value": "sbeo.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659460": [
        {
            "ioc_value": "sbh.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659461": [
        {
            "ioc_value": "sbsq.liner-9-ick.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659462": [
        {
            "ioc_value": "sbv.gevicii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659463": [
        {
            "ioc_value": "sbx.op76.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659464": [
        {
            "ioc_value": "sc.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659465": [
        {
            "ioc_value": "sc.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659466": [
        {
            "ioc_value": "sc.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:59:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659467": [
        {
            "ioc_value": "scg7.st0nepeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659468": [
        {
            "ioc_value": "scher4.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:42",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659442": [
        {
            "ioc_value": "saffronzip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659443": [
        {
            "ioc_value": "sage.emberiake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659444": [
        {
            "ioc_value": "sage.m-1-dnightr-0-ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659445": [
        {
            "ioc_value": "sage8.cioudnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659446": [
        {
            "ioc_value": "saguviu5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659447": [
        {
            "ioc_value": "sajov.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659448": [
        {
            "ioc_value": "sak.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659449": [
        {
            "ioc_value": "sakicoe3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659450": [
        {
            "ioc_value": "samyfiy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659451": [
        {
            "ioc_value": "sap.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659452": [
        {
            "ioc_value": "sap.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659453": [
        {
            "ioc_value": "saqehyo1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:41",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659432": [
        {
            "ioc_value": "s9.l-ly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659433": [
        {
            "ioc_value": "s9555o.qute-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659434": [
        {
            "ioc_value": "s9n.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:59:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659435": [
        {
            "ioc_value": "s9p.driftmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659436": [
        {
            "ioc_value": "sa3.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659437": [
        {
            "ioc_value": "sab.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659438": [
        {
            "ioc_value": "sable.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659439": [
        {
            "ioc_value": "sacyd.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659440": [
        {
            "ioc_value": "saffron-zip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659441": [
        {
            "ioc_value": "saffron.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:40",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659421": [
        {
            "ioc_value": "s5.inktrap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659422": [
        {
            "ioc_value": "s5.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659423": [
        {
            "ioc_value": "s5x8jq1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659424": [
        {
            "ioc_value": "s6.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659425": [
        {
            "ioc_value": "s622.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659426": [
        {
            "ioc_value": "s7.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659427": [
        {
            "ioc_value": "s7u.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659428": [
        {
            "ioc_value": "s8.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659429": [
        {
            "ioc_value": "s8l.bray-circuit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659430": [
        {
            "ioc_value": "s9.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659431": [
        {
            "ioc_value": "s9.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:39",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659412": [
        {
            "ioc_value": "s1.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:38",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659413": [
        {
            "ioc_value": "s11.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:38",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659414": [
        {
            "ioc_value": "s16.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:38",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659415": [
        {
            "ioc_value": "s1l.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:38",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659416": [
        {
            "ioc_value": "s1lverpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:38",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659417": [
        {
            "ioc_value": "s2.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:38",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659418": [
        {
            "ioc_value": "s3.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:38",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659419": [
        {
            "ioc_value": "s4.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:38",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659420": [
        {
            "ioc_value": "s4f.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:38",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659399": [
        {
            "ioc_value": "s.sproutkraft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659400": [
        {
            "ioc_value": "s.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659401": [
        {
            "ioc_value": "s.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659402": [
        {
            "ioc_value": "s.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659403": [
        {
            "ioc_value": "s.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659404": [
        {
            "ioc_value": "s.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:58:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659405": [
        {
            "ioc_value": "s.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:58:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659406": [
        {
            "ioc_value": "s.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659407": [
        {
            "ioc_value": "s.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659408": [
        {
            "ioc_value": "s.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659409": [
        {
            "ioc_value": "s.zms-u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659410": [
        {
            "ioc_value": "s0.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659411": [
        {
            "ioc_value": "s04.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:37",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659383": [
        {
            "ioc_value": "s.cloverschnee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659384": [
        {
            "ioc_value": "s.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659385": [
        {
            "ioc_value": "s.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659386": [
        {
            "ioc_value": "s.f0z1n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659387": [
        {
            "ioc_value": "s.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659388": [
        {
            "ioc_value": "s.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659389": [
        {
            "ioc_value": "s.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659390": [
        {
            "ioc_value": "s.ie45.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659391": [
        {
            "ioc_value": "s.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659392": [
        {
            "ioc_value": "s.kilut4ou8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659393": [
        {
            "ioc_value": "s.kuq5g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659394": [
        {
            "ioc_value": "s.n9t6m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659395": [
        {
            "ioc_value": "s.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659396": [
        {
            "ioc_value": "s.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659397": [
        {
            "ioc_value": "s.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659398": [
        {
            "ioc_value": "s.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:36",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659372": [
        {
            "ioc_value": "s.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659373": [
        {
            "ioc_value": "s.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659374": [
        {
            "ioc_value": "s.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659375": [
        {
            "ioc_value": "s.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659376": [
        {
            "ioc_value": "s.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659377": [
        {
            "ioc_value": "s.802d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659378": [
        {
            "ioc_value": "s.8oryn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659379": [
        {
            "ioc_value": "s.91-7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659380": [
        {
            "ioc_value": "s.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659381": [
        {
            "ioc_value": "s.byq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659382": [
        {
            "ioc_value": "s.c2y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:35",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659360": [
        {
            "ioc_value": "ryqyn.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659361": [
        {
            "ioc_value": "rysaryo0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659362": [
        {
            "ioc_value": "rysesao8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659363": [
        {
            "ioc_value": "rywi.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659364": [
        {
            "ioc_value": "rz.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659365": [
        {
            "ioc_value": "rz.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:59:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659366": [
        {
            "ioc_value": "rz4.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659367": [
        {
            "ioc_value": "rzie8.ravenklause.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659368": [
        {
            "ioc_value": "s.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659369": [
        {
            "ioc_value": "s.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659370": [
        {
            "ioc_value": "s.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659371": [
        {
            "ioc_value": "s.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:34",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659347": [
        {
            "ioc_value": "rv4sh.frost-fox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659348": [
        {
            "ioc_value": "rv6324.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659349": [
        {
            "ioc_value": "rvni-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659350": [
        {
            "ioc_value": "rw.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659351": [
        {
            "ioc_value": "rw.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659352": [
        {
            "ioc_value": "rwz.tweakmire.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659353": [
        {
            "ioc_value": "rx6cd.cliffwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659354": [
        {
            "ioc_value": "rxe.526r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659355": [
        {
            "ioc_value": "ry.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659356": [
        {
            "ioc_value": "ry.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659357": [
        {
            "ioc_value": "ry.zelojue1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:59:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659358": [
        {
            "ioc_value": "rye.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659359": [
        {
            "ioc_value": "rye.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:33",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659332": [
        {
            "ioc_value": "rune.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659333": [
        {
            "ioc_value": "rune.silentwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659334": [
        {
            "ioc_value": "rune.spruce5moor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659335": [
        {
            "ioc_value": "rune.walnutsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659336": [
        {
            "ioc_value": "rune.zephyrquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659337": [
        {
            "ioc_value": "rune4.kab-1-spr-0-tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659338": [
        {
            "ioc_value": "rune5.st0nebird.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659339": [
        {
            "ioc_value": "runesonne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659340": [
        {
            "ioc_value": "runiloe2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659341": [
        {
            "ioc_value": "rur.qenogia7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659342": [
        {
            "ioc_value": "rut.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659343": [
        {
            "ioc_value": "rutaw.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659344": [
        {
            "ioc_value": "rv.h-73-n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659345": [
        {
            "ioc_value": "rv.j-0-tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659346": [
        {
            "ioc_value": "rv.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:32",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659317": [
        {
            "ioc_value": "rune.b1ue5pr1lng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659318": [
        {
            "ioc_value": "rune.brightf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659319": [
        {
            "ioc_value": "rune.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659320": [
        {
            "ioc_value": "rune.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659321": [
        {
            "ioc_value": "rune.flintquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659322": [
        {
            "ioc_value": "rune.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659323": [
        {
            "ioc_value": "rune.ic0n1cforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659324": [
        {
            "ioc_value": "rune.immigrant5p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659325": [
        {
            "ioc_value": "rune.jasperhain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659326": [
        {
            "ioc_value": "rune.l2-1-w2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659327": [
        {
            "ioc_value": "rune.lindenarc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659328": [
        {
            "ioc_value": "rune.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659329": [
        {
            "ioc_value": "rune.netit-0-c-0-rec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659330": [
        {
            "ioc_value": "rune.oakensiegel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659331": [
        {
            "ioc_value": "rune.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:31",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659302": [
        {
            "ioc_value": "rugyg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659303": [
        {
            "ioc_value": "rum.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659304": [
        {
            "ioc_value": "rumba6.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659305": [
        {
            "ioc_value": "rumbl3.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659306": [
        {
            "ioc_value": "rumbl5.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659307": [
        {
            "ioc_value": "run-c-you.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659308": [
        {
            "ioc_value": "run.bavyzeo47.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659309": [
        {
            "ioc_value": "run.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659310": [
        {
            "ioc_value": "run.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659311": [
        {
            "ioc_value": "run.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659312": [
        {
            "ioc_value": "run.shadowsun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659313": [
        {
            "ioc_value": "run1.firetrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659314": [
        {
            "ioc_value": "rune.5ilverm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659315": [
        {
            "ioc_value": "rune.acornhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659316": [
        {
            "ioc_value": "rune.auricfluss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:30",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659288": [
        {
            "ioc_value": "rr.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659289": [
        {
            "ioc_value": "rsht.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659290": [
        {
            "ioc_value": "rsm.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659291": [
        {
            "ioc_value": "rst.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659292": [
        {
            "ioc_value": "rsw.g0b1ncore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659293": [
        {
            "ioc_value": "rt.lobd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659294": [
        {
            "ioc_value": "rt.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659295": [
        {
            "ioc_value": "rto.codecog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659296": [
        {
            "ioc_value": "ru.nzki-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659297": [
        {
            "ioc_value": "ru.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659298": [
        {
            "ioc_value": "rub.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659299": [
        {
            "ioc_value": "rub.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659300": [
        {
            "ioc_value": "rubalyi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659301": [
        {
            "ioc_value": "ruby.rubyraum.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:29",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659276": [
        {
            "ioc_value": "rock3.st0nebird.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659277": [
        {
            "ioc_value": "root.le3nsnet7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659278": [
        {
            "ioc_value": "root.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659279": [
        {
            "ioc_value": "root4x.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659280": [
        {
            "ioc_value": "root4y.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659281": [
        {
            "ioc_value": "root7.ju-4-en-pare-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659282": [
        {
            "ioc_value": "rot.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659283": [
        {
            "ioc_value": "rp.frost-fox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659284": [
        {
            "ioc_value": "rps7g.windbarrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659285": [
        {
            "ioc_value": "rq.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659286": [
        {
            "ioc_value": "rq.mufabui4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659287": [
        {
            "ioc_value": "rq8.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:28",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659262": [
        {
            "ioc_value": "rl.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659263": [
        {
            "ioc_value": "rl.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659264": [
        {
            "ioc_value": "rl1.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659265": [
        {
            "ioc_value": "rlvw.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659266": [
        {
            "ioc_value": "rm-6-a-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659267": [
        {
            "ioc_value": "rm.h73n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659268": [
        {
            "ioc_value": "rmb.y0ur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659269": [
        {
            "ioc_value": "rn.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659270": [
        {
            "ioc_value": "rn.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:59:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659271": [
        {
            "ioc_value": "rnxgc.bashglider.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659272": [
        {
            "ioc_value": "ro4646623165ck.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659273": [
        {
            "ioc_value": "road.m0rning.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659274": [
        {
            "ioc_value": "road7.cleardrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659275": [
        {
            "ioc_value": "rock.skyb1end.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:27",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659249": [
        {
            "ioc_value": "rinde.willowgrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659250": [
        {
            "ioc_value": "ring.7willowkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659251": [
        {
            "ioc_value": "ring.c0ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659252": [
        {
            "ioc_value": "ring.gofumoo29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659253": [
        {
            "ioc_value": "rise.fl0wstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659254": [
        {
            "ioc_value": "rise.st0negate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659255": [
        {
            "ioc_value": "risk.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659256": [
        {
            "ioc_value": "riv3t.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659257": [
        {
            "ioc_value": "river4.r1ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659258": [
        {
            "ioc_value": "rivul.0akstream.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659259": [
        {
            "ioc_value": "rj.ttif.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659260": [
        {
            "ioc_value": "rj8h.m1stbird.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659261": [
        {
            "ioc_value": "rka7q.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:26",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659236": [
        {
            "ioc_value": "rift5.kos-0-ltyu-4-etey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659237": [
        {
            "ioc_value": "rift5.torque-bud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659238": [
        {
            "ioc_value": "rift7.quibsnare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659239": [
        {
            "ioc_value": "rig.bit-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659240": [
        {
            "ioc_value": "rig.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659241": [
        {
            "ioc_value": "rihuwuo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659242": [
        {
            "ioc_value": "rill.fl0wbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659243": [
        {
            "ioc_value": "rill.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659244": [
        {
            "ioc_value": "rill.nightspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659245": [
        {
            "ioc_value": "rill.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659246": [
        {
            "ioc_value": "rill1.nightf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659247": [
        {
            "ioc_value": "rime.frostwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659248": [
        {
            "ioc_value": "rime.gl0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:25",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659221": [
        {
            "ioc_value": "ridge.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659222": [
        {
            "ioc_value": "ridge3.le-3-nsnet-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659223": [
        {
            "ioc_value": "ridge4.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659224": [
        {
            "ioc_value": "ridge9.mistv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659225": [
        {
            "ioc_value": "ridinyo9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659226": [
        {
            "ioc_value": "rifagey7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659227": [
        {
            "ioc_value": "rift.cioudharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659228": [
        {
            "ioc_value": "rift.nib-snap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659229": [
        {
            "ioc_value": "rift.primurib1er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659230": [
        {
            "ioc_value": "rift.riftcog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659231": [
        {
            "ioc_value": "rift.st-1-lt-forge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659232": [
        {
            "ioc_value": "rift.st0nesurge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659233": [
        {
            "ioc_value": "rift.waveretch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659234": [
        {
            "ioc_value": "rift.zapkinetic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659235": [
        {
            "ioc_value": "rift.zenith-snap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:24",
            "last_seen_utc": "2025-11-29 09:59:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659207": [
        {
            "ioc_value": "rh6.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659208": [
        {
            "ioc_value": "rhein.c1oudmap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659209": [
        {
            "ioc_value": "ri.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659210": [
        {
            "ioc_value": "rib.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659211": [
        {
            "ioc_value": "rice.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659212": [
        {
            "ioc_value": "rice.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659213": [
        {
            "ioc_value": "rich.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659214": [
        {
            "ioc_value": "rid.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659215": [
        {
            "ioc_value": "rid.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659216": [
        {
            "ioc_value": "ridge.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659217": [
        {
            "ioc_value": "ridge.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659218": [
        {
            "ioc_value": "ridge.lakesp1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659219": [
        {
            "ioc_value": "ridge.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659220": [
        {
            "ioc_value": "ridge.rapidst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:23",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659195": [
        {
            "ioc_value": "rezag.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659196": [
        {
            "ioc_value": "rezufaa4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659197": [
        {
            "ioc_value": "rfrz.emberharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659198": [
        {
            "ioc_value": "rg.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659199": [
        {
            "ioc_value": "rg.frostlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659200": [
        {
            "ioc_value": "rg.jorx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659201": [
        {
            "ioc_value": "rg.m33h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659202": [
        {
            "ioc_value": "rg.mysticdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659203": [
        {
            "ioc_value": "rg.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659204": [
        {
            "ioc_value": "rg7.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659205": [
        {
            "ioc_value": "rgu.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659206": [
        {
            "ioc_value": "rh.vgof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:22",
            "last_seen_utc": "2025-11-29 09:57:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659184": [
        {
            "ioc_value": "red7.a5t1gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659185": [
        {
            "ioc_value": "red9.mistlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659186": [
        {
            "ioc_value": "redfern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659187": [
        {
            "ioc_value": "reef.0ceanleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659188": [
        {
            "ioc_value": "reef.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659189": [
        {
            "ioc_value": "reef.sunm0tion.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659190": [
        {
            "ioc_value": "reef2.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659191": [
        {
            "ioc_value": "reef5y.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659192": [
        {
            "ioc_value": "regen7.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659193": [
        {
            "ioc_value": "reluxiy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659194": [
        {
            "ioc_value": "reqy.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:21",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659171": [
        {
            "ioc_value": "rd7.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:58:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659172": [
        {
            "ioc_value": "re.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659173": [
        {
            "ioc_value": "re.qacacoe3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659174": [
        {
            "ioc_value": "re.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659175": [
        {
            "ioc_value": "re.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659176": [
        {
            "ioc_value": "re.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659177": [
        {
            "ioc_value": "re.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659178": [
        {
            "ioc_value": "re.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659179": [
        {
            "ioc_value": "re.xxos.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:59:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659180": [
        {
            "ioc_value": "rea.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659181": [
        {
            "ioc_value": "reckonzlay.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659182": [
        {
            "ioc_value": "red.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659183": [
        {
            "ioc_value": "red.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:20",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659158": [
        {
            "ioc_value": "raw.fix-fg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659159": [
        {
            "ioc_value": "raw.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659160": [
        {
            "ioc_value": "raxen3.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659161": [
        {
            "ioc_value": "raxeniy5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659162": [
        {
            "ioc_value": "ray.pobinei39.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659163": [
        {
            "ioc_value": "rb.3u1y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659164": [
        {
            "ioc_value": "rb.d42n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659165": [
        {
            "ioc_value": "rb2.5t0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659166": [
        {
            "ioc_value": "rbg.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659167": [
        {
            "ioc_value": "rchh0.stormcairn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659168": [
        {
            "ioc_value": "rd.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659169": [
        {
            "ioc_value": "rd.vbof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659170": [
        {
            "ioc_value": "rd.x73r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:19",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659150": [
        {
            "ioc_value": "rauch2.emberbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:18",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659151": [
        {
            "ioc_value": "rauch4.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:18",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659152": [
        {
            "ioc_value": "raum.rubyraum.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:18",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659153": [
        {
            "ioc_value": "rava7n.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:18",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659154": [
        {
            "ioc_value": "raven.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:18",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659155": [
        {
            "ioc_value": "raven.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:18",
            "last_seen_utc": "2025-11-29 09:58:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659156": [
        {
            "ioc_value": "raven3.shad0wdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:18",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659157": [
        {
            "ioc_value": "ravenwehr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:18",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659135": [
        {
            "ioc_value": "rauch.f1rst5rup.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659136": [
        {
            "ioc_value": "rauch.flintwerder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659137": [
        {
            "ioc_value": "rauch.hearthwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659138": [
        {
            "ioc_value": "rauch.ironwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659139": [
        {
            "ioc_value": "rauch.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659140": [
        {
            "ioc_value": "rauch.mintstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659141": [
        {
            "ioc_value": "rauch.nebulaquelle3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659142": [
        {
            "ioc_value": "rauch.neonbuche.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659143": [
        {
            "ioc_value": "rauch.nimbusforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659144": [
        {
            "ioc_value": "rauch.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659145": [
        {
            "ioc_value": "rauch.st0nedrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659146": [
        {
            "ioc_value": "rauch.steelpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659147": [
        {
            "ioc_value": "rauch.stoneharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659148": [
        {
            "ioc_value": "rauch.swiftgasse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659149": [
        {
            "ioc_value": "rauch.thistleforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:17",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659122": [
        {
            "ioc_value": "ram.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659123": [
        {
            "ioc_value": "ran.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659124": [
        {
            "ioc_value": "rap.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659125": [
        {
            "ioc_value": "rapid.brightridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659126": [
        {
            "ioc_value": "rat.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659127": [
        {
            "ioc_value": "rat.vudujiu33.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:58:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659128": [
        {
            "ioc_value": "rat.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:59:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659129": [
        {
            "ioc_value": "rauch.2tannenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659130": [
        {
            "ioc_value": "rauch.ashriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659131": [
        {
            "ioc_value": "rauch.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659132": [
        {
            "ioc_value": "rauch.co0peratre4er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659133": [
        {
            "ioc_value": "rauch.darkspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659134": [
        {
            "ioc_value": "rauch.dis5h7gien.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:16",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659112": [
        {
            "ioc_value": "racy5n.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659113": [
        {
            "ioc_value": "racypue5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659114": [
        {
            "ioc_value": "rad.rainrad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659115": [
        {
            "ioc_value": "rag.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659116": [
        {
            "ioc_value": "rag8lo.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659117": [
        {
            "ioc_value": "rah.scramblehub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659118": [
        {
            "ioc_value": "rain.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659119": [
        {
            "ioc_value": "rain.br-0-ad-temp-1-ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659120": [
        {
            "ioc_value": "rain.rainrad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659121": [
        {
            "ioc_value": "rain7x.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:15",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659098": [
        {
            "ioc_value": "r8.xyc0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:59:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659099": [
        {
            "ioc_value": "r8qv1m.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659100": [
        {
            "ioc_value": "r9.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659101": [
        {
            "ioc_value": "r9.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659102": [
        {
            "ioc_value": "r9.cobaltwolke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659103": [
        {
            "ioc_value": "r9.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659104": [
        {
            "ioc_value": "r9.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659105": [
        {
            "ioc_value": "r9.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659106": [
        {
            "ioc_value": "r9.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659107": [
        {
            "ioc_value": "r9.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659108": [
        {
            "ioc_value": "r9.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659109": [
        {
            "ioc_value": "r9.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659110": [
        {
            "ioc_value": "r91.b1tzdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659111": [
        {
            "ioc_value": "r9m.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:14",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659085": [
        {
            "ioc_value": "r5.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659086": [
        {
            "ioc_value": "r54v.qu1rkfuse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659087": [
        {
            "ioc_value": "r58.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659088": [
        {
            "ioc_value": "r7.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659089": [
        {
            "ioc_value": "r7.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659090": [
        {
            "ioc_value": "r7.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659091": [
        {
            "ioc_value": "r7.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659092": [
        {
            "ioc_value": "r7.uz-k9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659093": [
        {
            "ioc_value": "r7.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659094": [
        {
            "ioc_value": "r767b.stormmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659095": [
        {
            "ioc_value": "r7h0g4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659096": [
        {
            "ioc_value": "r7mc8.primurib1er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659097": [
        {
            "ioc_value": "r7va.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:13",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659072": [
        {
            "ioc_value": "r3.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659073": [
        {
            "ioc_value": "r3.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659074": [
        {
            "ioc_value": "r3.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659075": [
        {
            "ioc_value": "r3.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659076": [
        {
            "ioc_value": "r3.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659077": [
        {
            "ioc_value": "r349.lakespry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659078": [
        {
            "ioc_value": "r3k.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659079": [
        {
            "ioc_value": "r3v.v9542.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659080": [
        {
            "ioc_value": "r4a.h-0-bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659081": [
        {
            "ioc_value": "r4rx.plasm-about.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659082": [
        {
            "ioc_value": "r4t.storm-ripple.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659083": [
        {
            "ioc_value": "r5.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659084": [
        {
            "ioc_value": "r5.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:12",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659061": [
        {
            "ioc_value": "r1.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659062": [
        {
            "ioc_value": "r1.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659063": [
        {
            "ioc_value": "r2.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659064": [
        {
            "ioc_value": "r2cw.1nyearbo0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659065": [
        {
            "ioc_value": "r2m.glimmerstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659066": [
        {
            "ioc_value": "r2q6vm.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659067": [
        {
            "ioc_value": "r3.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659068": [
        {
            "ioc_value": "r3.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659069": [
        {
            "ioc_value": "r3.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659070": [
        {
            "ioc_value": "r3.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659071": [
        {
            "ioc_value": "r3.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:11",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659046": [
        {
            "ioc_value": "r.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659047": [
        {
            "ioc_value": "r.81dm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659048": [
        {
            "ioc_value": "r.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659049": [
        {
            "ioc_value": "r.gwut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659050": [
        {
            "ioc_value": "r.p2j4k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659051": [
        {
            "ioc_value": "r.q8e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659052": [
        {
            "ioc_value": "r.t3m3d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659053": [
        {
            "ioc_value": "r02.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659054": [
        {
            "ioc_value": "r0c.opalhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659055": [
        {
            "ioc_value": "r0f.skybr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659056": [
        {
            "ioc_value": "r0q.brambleholt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659057": [
        {
            "ioc_value": "r0sebioom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659058": [
        {
            "ioc_value": "r1.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659059": [
        {
            "ioc_value": "r1.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659060": [
        {
            "ioc_value": "r1.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:10",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659030": [
        {
            "ioc_value": "qy.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659031": [
        {
            "ioc_value": "qyfojiu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659032": [
        {
            "ioc_value": "qyhux.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659033": [
        {
            "ioc_value": "qyvu.cl1ffwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659034": [
        {
            "ioc_value": "qyzoz.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659035": [
        {
            "ioc_value": "qz.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659036": [
        {
            "ioc_value": "qz.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659037": [
        {
            "ioc_value": "qz.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659038": [
        {
            "ioc_value": "qz.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659039": [
        {
            "ioc_value": "qz.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659040": [
        {
            "ioc_value": "qz.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659041": [
        {
            "ioc_value": "qz.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659042": [
        {
            "ioc_value": "qz.w30g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659043": [
        {
            "ioc_value": "qz.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659044": [
        {
            "ioc_value": "qzq.zenith-snap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659045": [
        {
            "ioc_value": "qzz.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:09",
            "last_seen_utc": "2025-11-29 09:58:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659016": [
        {
            "ioc_value": "quel7e.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659017": [
        {
            "ioc_value": "quick.m0tor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659018": [
        {
            "ioc_value": "quietwhite.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659019": [
        {
            "ioc_value": "quill-fret.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659020": [
        {
            "ioc_value": "quillfret.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659021": [
        {
            "ioc_value": "qunohei5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659022": [
        {
            "ioc_value": "quxap.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659023": [
        {
            "ioc_value": "quzem.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659024": [
        {
            "ioc_value": "qv.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659025": [
        {
            "ioc_value": "qvc.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659026": [
        {
            "ioc_value": "qvm.z1ncspike.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659027": [
        {
            "ioc_value": "qw59f3d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659028": [
        {
            "ioc_value": "qx.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659029": [
        {
            "ioc_value": "qx.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:08",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659004": [
        {
            "ioc_value": "quark1.rumblekin.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659005": [
        {
            "ioc_value": "quark5.glitch-pact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659006": [
        {
            "ioc_value": "quark7.tundraflip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659007": [
        {
            "ioc_value": "quartz.mossgrotte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659008": [
        {
            "ioc_value": "quartz.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659009": [
        {
            "ioc_value": "quartz3.quartz-flip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659010": [
        {
            "ioc_value": "quartzdamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659011": [
        {
            "ioc_value": "quartzraven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659012": [
        {
            "ioc_value": "quarz.ashenkrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659013": [
        {
            "ioc_value": "quarz.basaltwisp9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659014": [
        {
            "ioc_value": "quarz.crysta1shore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659015": [
        {
            "ioc_value": "quee54949646642n.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:07",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658989": [
        {
            "ioc_value": "qt.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658990": [
        {
            "ioc_value": "qtf.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658991": [
        {
            "ioc_value": "qty.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658992": [
        {
            "ioc_value": "qu.mistv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658993": [
        {
            "ioc_value": "qu1arz.aphrh1tc4h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658994": [
        {
            "ioc_value": "qu1ckr.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658995": [
        {
            "ioc_value": "quak3r.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658996": [
        {
            "ioc_value": "quantumrinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658997": [
        {
            "ioc_value": "quark.braycircuit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658998": [
        {
            "ioc_value": "quark.morrow-plug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658999": [
        {
            "ioc_value": "quark.papervolt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659000": [
        {
            "ioc_value": "quark.pr0wldrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659001": [
        {
            "ioc_value": "quark.waveretch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659002": [
        {
            "ioc_value": "quark.wavermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1659003": [
        {
            "ioc_value": "quark0.razor-plume.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:06",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658972": [
        {
            "ioc_value": "qph.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658973": [
        {
            "ioc_value": "qpiy0.skybr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658974": [
        {
            "ioc_value": "qpn.ember-glade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658975": [
        {
            "ioc_value": "qq.hap7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658976": [
        {
            "ioc_value": "qq.m33h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658977": [
        {
            "ioc_value": "qqc.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658978": [
        {
            "ioc_value": "qr.nelypuu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658979": [
        {
            "ioc_value": "qra.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:58:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658980": [
        {
            "ioc_value": "qrczb.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658981": [
        {
            "ioc_value": "qrk.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658982": [
        {
            "ioc_value": "qrow-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658983": [
        {
            "ioc_value": "qs.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658984": [
        {
            "ioc_value": "qs.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658985": [
        {
            "ioc_value": "qs.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658986": [
        {
            "ioc_value": "qs.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658987": [
        {
            "ioc_value": "qsa1.stormbioom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658988": [
        {
            "ioc_value": "qt.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:05",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658955": [
        {
            "ioc_value": "qkund.gleamspan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658956": [
        {
            "ioc_value": "qlpb.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658957": [
        {
            "ioc_value": "qm.j-0-tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658958": [
        {
            "ioc_value": "qm.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658959": [
        {
            "ioc_value": "qm.stonecl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658960": [
        {
            "ioc_value": "qm0.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658961": [
        {
            "ioc_value": "qnbtu.quartz-leaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658962": [
        {
            "ioc_value": "qo.subozaa7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658963": [
        {
            "ioc_value": "qoc.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658964": [
        {
            "ioc_value": "qokikau4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658965": [
        {
            "ioc_value": "qolun.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658966": [
        {
            "ioc_value": "qon.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658967": [
        {
            "ioc_value": "qonit.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658968": [
        {
            "ioc_value": "qopup.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658969": [
        {
            "ioc_value": "qoze.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658970": [
        {
            "ioc_value": "qp.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658971": [
        {
            "ioc_value": "qp1.stonemist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:04",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658948": [
        {
            "ioc_value": "qidra5.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:03",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658949": [
        {
            "ioc_value": "qifokya5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:03",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658950": [
        {
            "ioc_value": "qisoz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:03",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658951": [
        {
            "ioc_value": "qje.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:03",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658952": [
        {
            "ioc_value": "qk.tem5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:03",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658953": [
        {
            "ioc_value": "qke.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:03",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658954": [
        {
            "ioc_value": "qki.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:03",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658947": [
        {
            "ioc_value": "qi.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:02",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658934": [
        {
            "ioc_value": "qg.mjef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658935": [
        {
            "ioc_value": "qg.tyjysoe0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658936": [
        {
            "ioc_value": "qg2j3.sn-0-rtling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658937": [
        {
            "ioc_value": "qg3q2.knotberry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658938": [
        {
            "ioc_value": "qg8.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658939": [
        {
            "ioc_value": "qgb.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658940": [
        {
            "ioc_value": "qh.crju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658941": [
        {
            "ioc_value": "qh.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:59:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658942": [
        {
            "ioc_value": "qhnjc.aucti-0-nz-7-ir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658943": [
        {
            "ioc_value": "qi.br1ghtmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658944": [
        {
            "ioc_value": "qi.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658945": [
        {
            "ioc_value": "qi.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658946": [
        {
            "ioc_value": "qi.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:01",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658921": [
        {
            "ioc_value": "qe.mzvo-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658922": [
        {
            "ioc_value": "qegikua9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658923": [
        {
            "ioc_value": "qegyx.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658924": [
        {
            "ioc_value": "qepegao9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658925": [
        {
            "ioc_value": "qepucyy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658926": [
        {
            "ioc_value": "qeqek.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658927": [
        {
            "ioc_value": "qevibye4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658928": [
        {
            "ioc_value": "qf.7-gb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658929": [
        {
            "ioc_value": "qf.byq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658930": [
        {
            "ioc_value": "qfe.znx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658931": [
        {
            "ioc_value": "qfl.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658932": [
        {
            "ioc_value": "qg.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658933": [
        {
            "ioc_value": "qg.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:37:00",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658904": [
        {
            "ioc_value": "qb.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658905": [
        {
            "ioc_value": "qb.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658906": [
        {
            "ioc_value": "qb.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658907": [
        {
            "ioc_value": "qb.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658908": [
        {
            "ioc_value": "qb.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658909": [
        {
            "ioc_value": "qb.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658910": [
        {
            "ioc_value": "qb.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658911": [
        {
            "ioc_value": "qb.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658912": [
        {
            "ioc_value": "qb.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:59:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658913": [
        {
            "ioc_value": "qb.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658914": [
        {
            "ioc_value": "qbd.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658915": [
        {
            "ioc_value": "qc.vwof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658916": [
        {
            "ioc_value": "qcn6.oak-ember.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658917": [
        {
            "ioc_value": "qcq8.pulse-knob.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658918": [
        {
            "ioc_value": "qcv.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658919": [
        {
            "ioc_value": "qd.g-04-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658920": [
        {
            "ioc_value": "qd.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:59",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658889": [
        {
            "ioc_value": "qa.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658890": [
        {
            "ioc_value": "qa.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658891": [
        {
            "ioc_value": "qa.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658892": [
        {
            "ioc_value": "qa.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658893": [
        {
            "ioc_value": "qabi.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658894": [
        {
            "ioc_value": "qace.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658895": [
        {
            "ioc_value": "qacijoy3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658896": [
        {
            "ioc_value": "qacupue8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658897": [
        {
            "ioc_value": "qahodey5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658898": [
        {
            "ioc_value": "qak.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658899": [
        {
            "ioc_value": "qartz7.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658900": [
        {
            "ioc_value": "qawimii0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658901": [
        {
            "ioc_value": "qaxib.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658902": [
        {
            "ioc_value": "qaz7er.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658903": [
        {
            "ioc_value": "qb.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:58",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658873": [
        {
            "ioc_value": "q8s9.fl0wstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658874": [
        {
            "ioc_value": "q8x.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658875": [
        {
            "ioc_value": "q9.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658876": [
        {
            "ioc_value": "q9.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658877": [
        {
            "ioc_value": "q9.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658878": [
        {
            "ioc_value": "q9.hovermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658879": [
        {
            "ioc_value": "q9.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658880": [
        {
            "ioc_value": "q9.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658881": [
        {
            "ioc_value": "q9.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658882": [
        {
            "ioc_value": "q9.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658883": [
        {
            "ioc_value": "q9.zpozu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658884": [
        {
            "ioc_value": "q9a.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658885": [
        {
            "ioc_value": "q9b1v.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658886": [
        {
            "ioc_value": "q9p4.meltquark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658887": [
        {
            "ioc_value": "qa.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658888": [
        {
            "ioc_value": "qa.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:57",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658857": [
        {
            "ioc_value": "q7.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658858": [
        {
            "ioc_value": "q7.ror6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658859": [
        {
            "ioc_value": "q7.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658860": [
        {
            "ioc_value": "q7.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658861": [
        {
            "ioc_value": "q7.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658862": [
        {
            "ioc_value": "q7.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:58:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658863": [
        {
            "ioc_value": "q7.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:59:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658864": [
        {
            "ioc_value": "q73.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658865": [
        {
            "ioc_value": "q77.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:59:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658866": [
        {
            "ioc_value": "q780.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658867": [
        {
            "ioc_value": "q7dj.zimloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658868": [
        {
            "ioc_value": "q7m.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658869": [
        {
            "ioc_value": "q7m.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658870": [
        {
            "ioc_value": "q7z.opalhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658871": [
        {
            "ioc_value": "q8.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658872": [
        {
            "ioc_value": "q88.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:56",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658842": [
        {
            "ioc_value": "q54.br1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658843": [
        {
            "ioc_value": "q5ct.hover-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658844": [
        {
            "ioc_value": "q5x.crystalcavern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658845": [
        {
            "ioc_value": "q5z.nob0dy5yabky.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658846": [
        {
            "ioc_value": "q6.brightsage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658847": [
        {
            "ioc_value": "q6k.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658848": [
        {
            "ioc_value": "q6lhy.glitchpact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658849": [
        {
            "ioc_value": "q7.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658850": [
        {
            "ioc_value": "q7.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658851": [
        {
            "ioc_value": "q7.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658852": [
        {
            "ioc_value": "q7.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658853": [
        {
            "ioc_value": "q7.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658854": [
        {
            "ioc_value": "q7.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658855": [
        {
            "ioc_value": "q7.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658856": [
        {
            "ioc_value": "q7.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:55",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658827": [
        {
            "ioc_value": "q4.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658828": [
        {
            "ioc_value": "q4.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658829": [
        {
            "ioc_value": "q4.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658830": [
        {
            "ioc_value": "q4.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658831": [
        {
            "ioc_value": "q4.evermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658832": [
        {
            "ioc_value": "q4.falconhimmel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658833": [
        {
            "ioc_value": "q4.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658834": [
        {
            "ioc_value": "q4.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658835": [
        {
            "ioc_value": "q4.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658836": [
        {
            "ioc_value": "q4.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658837": [
        {
            "ioc_value": "q4.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658838": [
        {
            "ioc_value": "q4.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658839": [
        {
            "ioc_value": "q40eo.quant-melt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658840": [
        {
            "ioc_value": "q4p.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658841": [
        {
            "ioc_value": "q5.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:54",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658811": [
        {
            "ioc_value": "q1n.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658812": [
        {
            "ioc_value": "q1n.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658813": [
        {
            "ioc_value": "q1r.emberfrontier.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658814": [
        {
            "ioc_value": "q2.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658815": [
        {
            "ioc_value": "q2.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658816": [
        {
            "ioc_value": "q2.embergarten.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658817": [
        {
            "ioc_value": "q2.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658818": [
        {
            "ioc_value": "q2.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658819": [
        {
            "ioc_value": "q2.wlh84.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658820": [
        {
            "ioc_value": "q2k.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658821": [
        {
            "ioc_value": "q2k.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658822": [
        {
            "ioc_value": "q2q.joltberry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658823": [
        {
            "ioc_value": "q2v.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658824": [
        {
            "ioc_value": "q3.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658825": [
        {
            "ioc_value": "q3.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658826": [
        {
            "ioc_value": "q3kz.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:53",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658796": [
        {
            "ioc_value": "q.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658797": [
        {
            "ioc_value": "q0ck.dripanchor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658798": [
        {
            "ioc_value": "q0w9e3.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658799": [
        {
            "ioc_value": "q1.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658800": [
        {
            "ioc_value": "q1.259ox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658801": [
        {
            "ioc_value": "q1.dl3zd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658802": [
        {
            "ioc_value": "q1.if-p4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658803": [
        {
            "ioc_value": "q1.onyxmorgen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658804": [
        {
            "ioc_value": "q1.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658805": [
        {
            "ioc_value": "q1.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658806": [
        {
            "ioc_value": "q1.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658807": [
        {
            "ioc_value": "q14.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658808": [
        {
            "ioc_value": "q1f1p.twist-nova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658809": [
        {
            "ioc_value": "q1h.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658810": [
        {
            "ioc_value": "q1n.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:52",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658779": [
        {
            "ioc_value": "q.d1a8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658780": [
        {
            "ioc_value": "q.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658781": [
        {
            "ioc_value": "q.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658782": [
        {
            "ioc_value": "q.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658783": [
        {
            "ioc_value": "q.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658784": [
        {
            "ioc_value": "q.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658785": [
        {
            "ioc_value": "q.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658786": [
        {
            "ioc_value": "q.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658787": [
        {
            "ioc_value": "q.mwop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658788": [
        {
            "ioc_value": "q.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658789": [
        {
            "ioc_value": "q.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658790": [
        {
            "ioc_value": "q.n9t6m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658791": [
        {
            "ioc_value": "q.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658792": [
        {
            "ioc_value": "q.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658793": [
        {
            "ioc_value": "q.v4h3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658794": [
        {
            "ioc_value": "q.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658795": [
        {
            "ioc_value": "q.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:51",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658764": [
        {
            "ioc_value": "pz.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658765": [
        {
            "ioc_value": "pz.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658766": [
        {
            "ioc_value": "pz.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658767": [
        {
            "ioc_value": "pz.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658768": [
        {
            "ioc_value": "pz8ux.mistlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658769": [
        {
            "ioc_value": "pzi.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658770": [
        {
            "ioc_value": "pzy.sewedau.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658771": [
        {
            "ioc_value": "q.0f78.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658772": [
        {
            "ioc_value": "q.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658773": [
        {
            "ioc_value": "q.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658774": [
        {
            "ioc_value": "q.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658775": [
        {
            "ioc_value": "q.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658776": [
        {
            "ioc_value": "q.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658777": [
        {
            "ioc_value": "q.bvqu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658778": [
        {
            "ioc_value": "q.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:50",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658751": [
        {
            "ioc_value": "pvsu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658752": [
        {
            "ioc_value": "pvzi-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658753": [
        {
            "ioc_value": "pw.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:59:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658754": [
        {
            "ioc_value": "pwmt.embertrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658755": [
        {
            "ioc_value": "px.gr1tmodule.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658756": [
        {
            "ioc_value": "py.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658757": [
        {
            "ioc_value": "py.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658758": [
        {
            "ioc_value": "py.mzvo-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658759": [
        {
            "ioc_value": "py.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658760": [
        {
            "ioc_value": "pybal.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658761": [
        {
            "ioc_value": "pylohao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658762": [
        {
            "ioc_value": "pyo9.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658763": [
        {
            "ioc_value": "pypim.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:49",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658737": [
        {
            "ioc_value": "pv.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658738": [
        {
            "ioc_value": "pv.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658739": [
        {
            "ioc_value": "pv.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658740": [
        {
            "ioc_value": "pv.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658741": [
        {
            "ioc_value": "pv.focove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658742": [
        {
            "ioc_value": "pv.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658743": [
        {
            "ioc_value": "pv.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658744": [
        {
            "ioc_value": "pv.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658745": [
        {
            "ioc_value": "pv.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658746": [
        {
            "ioc_value": "pv.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658747": [
        {
            "ioc_value": "pv.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658748": [
        {
            "ioc_value": "pv.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658749": [
        {
            "ioc_value": "pv.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658750": [
        {
            "ioc_value": "pv.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:48",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658722": [
        {
            "ioc_value": "pulse6.r1verbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658723": [
        {
            "ioc_value": "pulse6.simp-7-euna-3-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658724": [
        {
            "ioc_value": "pulse7.w1de.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658725": [
        {
            "ioc_value": "pulse8.syrupdock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658726": [
        {
            "ioc_value": "pulse9.l1festone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658727": [
        {
            "ioc_value": "puma.pumaschiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658728": [
        {
            "ioc_value": "pun.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658729": [
        {
            "ioc_value": "pun.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658730": [
        {
            "ioc_value": "punta6.mintsp1ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658731": [
        {
            "ioc_value": "puqum.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658732": [
        {
            "ioc_value": "puvt.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658733": [
        {
            "ioc_value": "puwalyy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658734": [
        {
            "ioc_value": "puxup.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658735": [
        {
            "ioc_value": "pv.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658736": [
        {
            "ioc_value": "pv.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:47",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658708": [
        {
            "ioc_value": "pulse.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658709": [
        {
            "ioc_value": "pulse.mintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658710": [
        {
            "ioc_value": "pulse.papervolt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658711": [
        {
            "ioc_value": "pulse.scramblehub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658712": [
        {
            "ioc_value": "pulse.shevypro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658713": [
        {
            "ioc_value": "pulse.silverpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658714": [
        {
            "ioc_value": "pulse.st-0-y-70-renka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658715": [
        {
            "ioc_value": "pulse0.t1ger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658716": [
        {
            "ioc_value": "pulse1.redm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658717": [
        {
            "ioc_value": "pulse1.w1ldforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658718": [
        {
            "ioc_value": "pulse1.wild0ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658719": [
        {
            "ioc_value": "pulse2.st-0-y-70-renka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658720": [
        {
            "ioc_value": "pulse3.m1stzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658721": [
        {
            "ioc_value": "pulse5.mintflash.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:46",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658695": [
        {
            "ioc_value": "pt.pqix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658696": [
        {
            "ioc_value": "pt.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:58:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658697": [
        {
            "ioc_value": "pt.x-73-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658698": [
        {
            "ioc_value": "ptk.0-pal-summit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658699": [
        {
            "ioc_value": "pu.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658700": [
        {
            "ioc_value": "pu.khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658701": [
        {
            "ioc_value": "pu.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658702": [
        {
            "ioc_value": "pua4.spindleway.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658703": [
        {
            "ioc_value": "pub-1-icb-0-at.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658704": [
        {
            "ioc_value": "pub1icb0at.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658705": [
        {
            "ioc_value": "pufunyo3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658706": [
        {
            "ioc_value": "pul.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658707": [
        {
            "ioc_value": "pulse.harpswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:45",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658681": [
        {
            "ioc_value": "prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658682": [
        {
            "ioc_value": "prr.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658683": [
        {
            "ioc_value": "pru.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658684": [
        {
            "ioc_value": "pry.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658685": [
        {
            "ioc_value": "ps.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658686": [
        {
            "ioc_value": "pse.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658687": [
        {
            "ioc_value": "psm1e.ravenklause.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658688": [
        {
            "ioc_value": "pt.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658689": [
        {
            "ioc_value": "pt.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658690": [
        {
            "ioc_value": "pt.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658691": [
        {
            "ioc_value": "pt.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658692": [
        {
            "ioc_value": "pt.gyvivae7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658693": [
        {
            "ioc_value": "pt.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658694": [
        {
            "ioc_value": "pt.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:44",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658667": [
        {
            "ioc_value": "ppssl.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658668": [
        {
            "ioc_value": "pq.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658669": [
        {
            "ioc_value": "pq591.r1ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658670": [
        {
            "ioc_value": "pqhr.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658671": [
        {
            "ioc_value": "pqix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658672": [
        {
            "ioc_value": "pqr.hihijie3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658673": [
        {
            "ioc_value": "pqr.lysyrei3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658674": [
        {
            "ioc_value": "pqr.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658675": [
        {
            "ioc_value": "pr.ember-grove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658676": [
        {
            "ioc_value": "pr0wldrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658677": [
        {
            "ioc_value": "prair1e.wildb1ss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658678": [
        {
            "ioc_value": "prairie.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658679": [
        {
            "ioc_value": "primurib1er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658680": [
        {
            "ioc_value": "prismboden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:43",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658653": [
        {
            "ioc_value": "ponek.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658654": [
        {
            "ioc_value": "pool.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658655": [
        {
            "ioc_value": "pooun.acidwrench.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658656": [
        {
            "ioc_value": "pop.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658657": [
        {
            "ioc_value": "pop.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658658": [
        {
            "ioc_value": "pop.wtan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:59:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658659": [
        {
            "ioc_value": "poqh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658660": [
        {
            "ioc_value": "porn.zytv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658661": [
        {
            "ioc_value": "port.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658662": [
        {
            "ioc_value": "port2.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658663": [
        {
            "ioc_value": "porw.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658664": [
        {
            "ioc_value": "poveleo03.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658665": [
        {
            "ioc_value": "pox.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658666": [
        {
            "ioc_value": "ppd.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:42",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658637": [
        {
            "ioc_value": "pm.gjat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658638": [
        {
            "ioc_value": "pmu.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658639": [
        {
            "ioc_value": "pn.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658640": [
        {
            "ioc_value": "pn.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658641": [
        {
            "ioc_value": "pn.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658642": [
        {
            "ioc_value": "pn.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658643": [
        {
            "ioc_value": "pn.n-96-f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658644": [
        {
            "ioc_value": "pn.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:58:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658645": [
        {
            "ioc_value": "pn.vwof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:58:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658646": [
        {
            "ioc_value": "pn.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658647": [
        {
            "ioc_value": "pne.xe3ax.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658648": [
        {
            "ioc_value": "po.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658649": [
        {
            "ioc_value": "po.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658650": [
        {
            "ioc_value": "po0ed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658651": [
        {
            "ioc_value": "pocof.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658652": [
        {
            "ioc_value": "polyelwrbl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:41",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658626": [
        {
            "ioc_value": "pl.ht-if.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658627": [
        {
            "ioc_value": "pl.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658628": [
        {
            "ioc_value": "pl.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658629": [
        {
            "ioc_value": "pl.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:58:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658630": [
        {
            "ioc_value": "pl.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:58:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658631": [
        {
            "ioc_value": "pl1edo.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658632": [
        {
            "ioc_value": "plixhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658633": [
        {
            "ioc_value": "plug.plixhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658634": [
        {
            "ioc_value": "plume.vexlatch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658635": [
        {
            "ioc_value": "plume.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658636": [
        {
            "ioc_value": "pluv7x.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:40",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658612": [
        {
            "ioc_value": "pixe1tu1ip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658613": [
        {
            "ioc_value": "pixel-orbit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658614": [
        {
            "ioc_value": "pixelorbit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658615": [
        {
            "ioc_value": "pj9.m1stzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658616": [
        {
            "ioc_value": "pk.gyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658617": [
        {
            "ioc_value": "pk.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658618": [
        {
            "ioc_value": "pkc.r1mrock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658619": [
        {
            "ioc_value": "pkf.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658620": [
        {
            "ioc_value": "pkq.toludye0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658621": [
        {
            "ioc_value": "pkw.kos0ltyu4etey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658622": [
        {
            "ioc_value": "pl.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658623": [
        {
            "ioc_value": "pl.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658624": [
        {
            "ioc_value": "pl.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658625": [
        {
            "ioc_value": "pl.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:39",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658598": [
        {
            "ioc_value": "pike.ci2udforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658599": [
        {
            "ioc_value": "pimonoo9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658600": [
        {
            "ioc_value": "pin.cewyzui61.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658601": [
        {
            "ioc_value": "pin.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658602": [
        {
            "ioc_value": "pine.cioudharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658603": [
        {
            "ioc_value": "pinezirkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658604": [
        {
            "ioc_value": "pink.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658605": [
        {
            "ioc_value": "pink.l0ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658606": [
        {
            "ioc_value": "pink3.p1nk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658607": [
        {
            "ioc_value": "pink8.st0neflash.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658608": [
        {
            "ioc_value": "pisamya8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658609": [
        {
            "ioc_value": "pit.kuvuboa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658610": [
        {
            "ioc_value": "pit.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658611": [
        {
            "ioc_value": "pix3ly.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:38",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658586": [
        {
            "ioc_value": "pht.simp-7-euna-3-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658587": [
        {
            "ioc_value": "pi.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658588": [
        {
            "ioc_value": "pi.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658589": [
        {
            "ioc_value": "pi.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658590": [
        {
            "ioc_value": "pi.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658591": [
        {
            "ioc_value": "pi.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658592": [
        {
            "ioc_value": "pi1.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:59:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658593": [
        {
            "ioc_value": "pick.cewyzui61.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658594": [
        {
            "ioc_value": "pie.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658595": [
        {
            "ioc_value": "pig.fix-fg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658596": [
        {
            "ioc_value": "pigb.lake-spry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658597": [
        {
            "ioc_value": "pihuvio6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:37",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658572": [
        {
            "ioc_value": "ph.safofoe5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658573": [
        {
            "ioc_value": "phase.bash-glider.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658574": [
        {
            "ioc_value": "phase0.inktrap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658575": [
        {
            "ioc_value": "phase0.s0larbudge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658576": [
        {
            "ioc_value": "phase3.tundraflip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658577": [
        {
            "ioc_value": "phase4.brim-hopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658578": [
        {
            "ioc_value": "phase5.kairosmix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658579": [
        {
            "ioc_value": "phase6.sn0rtling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658580": [
        {
            "ioc_value": "phase7.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658581": [
        {
            "ioc_value": "phase7.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658582": [
        {
            "ioc_value": "phase7.zimloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658583": [
        {
            "ioc_value": "phd.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658584": [
        {
            "ioc_value": "phoninessglorious.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658585": [
        {
            "ioc_value": "phpa-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:36",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658558": [
        {
            "ioc_value": "pfad.zirconweg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:59:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658559": [
        {
            "ioc_value": "pfad2.brightf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658560": [
        {
            "ioc_value": "pfad2.rapidmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658561": [
        {
            "ioc_value": "pfad4.st0nebyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658562": [
        {
            "ioc_value": "pfed.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658563": [
        {
            "ioc_value": "pfm.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658564": [
        {
            "ioc_value": "pfote.cedarberg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658565": [
        {
            "ioc_value": "pfote.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658566": [
        {
            "ioc_value": "pfote.dustycode.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658567": [
        {
            "ioc_value": "pfote.obsidianufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658568": [
        {
            "ioc_value": "pfote.starcresting.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658569": [
        {
            "ioc_value": "pfth.mistytrai1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658570": [
        {
            "ioc_value": "pg.n96f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658571": [
        {
            "ioc_value": "ph.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:35",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658545": [
        {
            "ioc_value": "pfad.inha4itmu1ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658546": [
        {
            "ioc_value": "pfad.night0ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658547": [
        {
            "ioc_value": "pfad.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658548": [
        {
            "ioc_value": "pfad.payc0medy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658549": [
        {
            "ioc_value": "pfad.quartzfeder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658550": [
        {
            "ioc_value": "pfad.quartzstollen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658551": [
        {
            "ioc_value": "pfad.quartzweide4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658552": [
        {
            "ioc_value": "pfad.ravenkloster.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658553": [
        {
            "ioc_value": "pfad.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658554": [
        {
            "ioc_value": "pfad.stoatgasse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658555": [
        {
            "ioc_value": "pfad.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658556": [
        {
            "ioc_value": "pfad.thundergrove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658557": [
        {
            "ioc_value": "pfad.yewhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:34",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658532": [
        {
            "ioc_value": "pf4ad.dr0gaguaran.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658533": [
        {
            "ioc_value": "pf7ad.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658534": [
        {
            "ioc_value": "pfad.br1ght5tar.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658535": [
        {
            "ioc_value": "pfad.ciearbug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658536": [
        {
            "ioc_value": "pfad.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658537": [
        {
            "ioc_value": "pfad.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658538": [
        {
            "ioc_value": "pfad.crimsonwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658539": [
        {
            "ioc_value": "pfad.crystalrun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658540": [
        {
            "ioc_value": "pfad.darkfeather.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658541": [
        {
            "ioc_value": "pfad.dis5h7gien.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658542": [
        {
            "ioc_value": "pfad.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658543": [
        {
            "ioc_value": "pfad.elmquarry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658544": [
        {
            "ioc_value": "pfad.embertarn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:33",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658516": [
        {
            "ioc_value": "peak.stormblink.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658517": [
        {
            "ioc_value": "peak0.rockwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658518": [
        {
            "ioc_value": "peak7r.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658519": [
        {
            "ioc_value": "pearlkrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658520": [
        {
            "ioc_value": "pebeg.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658521": [
        {
            "ioc_value": "ped.r-1-mrock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658522": [
        {
            "ioc_value": "pegot.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658523": [
        {
            "ioc_value": "pen.luxemyy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658524": [
        {
            "ioc_value": "pepper.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658525": [
        {
            "ioc_value": "peridotgarten.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658526": [
        {
            "ioc_value": "pes.w1de.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658527": [
        {
            "ioc_value": "pet.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658528": [
        {
            "ioc_value": "petumau5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658529": [
        {
            "ioc_value": "pf.ljat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658530": [
        {
            "ioc_value": "pf.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:58:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658531": [
        {
            "ioc_value": "pf4.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:32",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658500": [
        {
            "ioc_value": "pd.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658501": [
        {
            "ioc_value": "pd.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658502": [
        {
            "ioc_value": "pdfs.ba5eq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658503": [
        {
            "ioc_value": "pdz.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658504": [
        {
            "ioc_value": "pe.dgod.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658505": [
        {
            "ioc_value": "pe.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658506": [
        {
            "ioc_value": "pe.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658507": [
        {
            "ioc_value": "pe.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658508": [
        {
            "ioc_value": "pe.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658509": [
        {
            "ioc_value": "pe.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658510": [
        {
            "ioc_value": "pe.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:58:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658511": [
        {
            "ioc_value": "pe.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:58:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658512": [
        {
            "ioc_value": "pe.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658513": [
        {
            "ioc_value": "pe5.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658514": [
        {
            "ioc_value": "peak.eaglekrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658515": [
        {
            "ioc_value": "peak.stormbiend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:31",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658483": [
        {
            "ioc_value": "pb.g-69-p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658484": [
        {
            "ioc_value": "pb.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658485": [
        {
            "ioc_value": "pc.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658486": [
        {
            "ioc_value": "pc.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658487": [
        {
            "ioc_value": "pc.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658488": [
        {
            "ioc_value": "pc.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658489": [
        {
            "ioc_value": "pc.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658490": [
        {
            "ioc_value": "pc.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658491": [
        {
            "ioc_value": "pc.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:58:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658492": [
        {
            "ioc_value": "pc.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:58:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658493": [
        {
            "ioc_value": "pc.velvetnebel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658494": [
        {
            "ioc_value": "pc.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:58:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658495": [
        {
            "ioc_value": "pc.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:59:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658496": [
        {
            "ioc_value": "pc4.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658497": [
        {
            "ioc_value": "pc4.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658498": [
        {
            "ioc_value": "pcd.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658499": [
        {
            "ioc_value": "pcz.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:30",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658469": [
        {
            "ioc_value": "pai.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658470": [
        {
            "ioc_value": "palid.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658471": [
        {
            "ioc_value": "pan.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658472": [
        {
            "ioc_value": "pan.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658473": [
        {
            "ioc_value": "pap.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658474": [
        {
            "ioc_value": "par.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658475": [
        {
            "ioc_value": "past.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658476": [
        {
            "ioc_value": "pat.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:58:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658477": [
        {
            "ioc_value": "patch7.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658478": [
        {
            "ioc_value": "path.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658479": [
        {
            "ioc_value": "path.frostlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658480": [
        {
            "ioc_value": "patt3r.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658481": [
        {
            "ioc_value": "pau.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658482": [
        {
            "ioc_value": "paw.bit-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:29",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658455": [
        {
            "ioc_value": "p9.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658456": [
        {
            "ioc_value": "p9.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658457": [
        {
            "ioc_value": "p9.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658458": [
        {
            "ioc_value": "p9.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658459": [
        {
            "ioc_value": "p9.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658460": [
        {
            "ioc_value": "p9.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658461": [
        {
            "ioc_value": "p9.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658462": [
        {
            "ioc_value": "p9.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:59:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658463": [
        {
            "ioc_value": "p9e.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658464": [
        {
            "ioc_value": "pa.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658465": [
        {
            "ioc_value": "pa.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658466": [
        {
            "ioc_value": "pa.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658467": [
        {
            "ioc_value": "pad.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658468": [
        {
            "ioc_value": "pad.st1ltforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:28",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658441": [
        {
            "ioc_value": "p3.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658442": [
        {
            "ioc_value": "p38md1r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658443": [
        {
            "ioc_value": "p3hkv8.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658444": [
        {
            "ioc_value": "p4p.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658445": [
        {
            "ioc_value": "p4r.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658446": [
        {
            "ioc_value": "p5.manual1sa1yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658447": [
        {
            "ioc_value": "p5.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658448": [
        {
            "ioc_value": "p5k.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658449": [
        {
            "ioc_value": "p5yx.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658450": [
        {
            "ioc_value": "p6b.plum-wav-ru.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658451": [
        {
            "ioc_value": "p7.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658452": [
        {
            "ioc_value": "p7e2x.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658453": [
        {
            "ioc_value": "p7w2c9.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658454": [
        {
            "ioc_value": "p81s.stonem1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:27",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658427": [
        {
            "ioc_value": "p1.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658428": [
        {
            "ioc_value": "p1.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658429": [
        {
            "ioc_value": "p1.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658430": [
        {
            "ioc_value": "p19.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658431": [
        {
            "ioc_value": "p1k.storm-ripple.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658432": [
        {
            "ioc_value": "p1nefour.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658433": [
        {
            "ioc_value": "p2.nibsnap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658434": [
        {
            "ioc_value": "p2.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658435": [
        {
            "ioc_value": "p2bf9.sp1remoss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658436": [
        {
            "ioc_value": "p2k.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658437": [
        {
            "ioc_value": "p2n.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658438": [
        {
            "ioc_value": "p2n.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658439": [
        {
            "ioc_value": "p2n.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658440": [
        {
            "ioc_value": "p2q.opal-hollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:26",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658412": [
        {
            "ioc_value": "p0.brightvoyage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658413": [
        {
            "ioc_value": "p0.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658414": [
        {
            "ioc_value": "p0.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658415": [
        {
            "ioc_value": "p0.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658416": [
        {
            "ioc_value": "p0.paradeabend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658417": [
        {
            "ioc_value": "p0.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658418": [
        {
            "ioc_value": "p0.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658419": [
        {
            "ioc_value": "p0.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658420": [
        {
            "ioc_value": "p0.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658421": [
        {
            "ioc_value": "p0.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658422": [
        {
            "ioc_value": "p0.yf-l3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658423": [
        {
            "ioc_value": "p0dlocket.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658424": [
        {
            "ioc_value": "p0t.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658425": [
        {
            "ioc_value": "p0x.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658426": [
        {
            "ioc_value": "p0x.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:25",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658396": [
        {
            "ioc_value": "p.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658397": [
        {
            "ioc_value": "p.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658398": [
        {
            "ioc_value": "p.ljat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658399": [
        {
            "ioc_value": "p.m7e4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658400": [
        {
            "ioc_value": "p.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658401": [
        {
            "ioc_value": "p.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658402": [
        {
            "ioc_value": "p.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658403": [
        {
            "ioc_value": "p.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658404": [
        {
            "ioc_value": "p.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658405": [
        {
            "ioc_value": "p.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658406": [
        {
            "ioc_value": "p.t2w3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658407": [
        {
            "ioc_value": "p.t4c5d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658408": [
        {
            "ioc_value": "p.van1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:58:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658409": [
        {
            "ioc_value": "p0.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658410": [
        {
            "ioc_value": "p0.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658411": [
        {
            "ioc_value": "p0.71290.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:24",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658381": [
        {
            "ioc_value": "oz.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658382": [
        {
            "ioc_value": "oz.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658383": [
        {
            "ioc_value": "oz.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658384": [
        {
            "ioc_value": "ozxg5.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658385": [
        {
            "ioc_value": "p.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658386": [
        {
            "ioc_value": "p.259ox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658387": [
        {
            "ioc_value": "p.526r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658388": [
        {
            "ioc_value": "p.595-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658389": [
        {
            "ioc_value": "p.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658390": [
        {
            "ioc_value": "p.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658391": [
        {
            "ioc_value": "p.dl3zd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658392": [
        {
            "ioc_value": "p.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658393": [
        {
            "ioc_value": "p.harborfreund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658394": [
        {
            "ioc_value": "p.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658395": [
        {
            "ioc_value": "p.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:23",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658365": [
        {
            "ioc_value": "ox.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658366": [
        {
            "ioc_value": "ox.sgdi6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658367": [
        {
            "ioc_value": "ox.tfpe-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658368": [
        {
            "ioc_value": "ox.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658369": [
        {
            "ioc_value": "ox.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658370": [
        {
            "ioc_value": "ox1i.mintforest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658371": [
        {
            "ioc_value": "oxiw.manual1sa1yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658372": [
        {
            "ioc_value": "oxt.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658373": [
        {
            "ioc_value": "oxy7.joy-2-way.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658374": [
        {
            "ioc_value": "oy.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658375": [
        {
            "ioc_value": "oy.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658376": [
        {
            "ioc_value": "oy.sgdi6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658377": [
        {
            "ioc_value": "oy.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658378": [
        {
            "ioc_value": "oy.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658379": [
        {
            "ioc_value": "oyeo.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658380": [
        {
            "ioc_value": "oz.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:22",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658350": [
        {
            "ioc_value": "ov.pxys.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658351": [
        {
            "ioc_value": "ov.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658352": [
        {
            "ioc_value": "ov6.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658353": [
        {
            "ioc_value": "ovs.amberr-0-ck-et.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658354": [
        {
            "ioc_value": "ow.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658355": [
        {
            "ioc_value": "ow.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658356": [
        {
            "ioc_value": "ow.sgdi6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658357": [
        {
            "ioc_value": "ow.tfpe-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658358": [
        {
            "ioc_value": "ow.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658359": [
        {
            "ioc_value": "ow.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658360": [
        {
            "ioc_value": "owa.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658361": [
        {
            "ioc_value": "owa.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658362": [
        {
            "ioc_value": "ox.fix-fg.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658363": [
        {
            "ioc_value": "ox.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658364": [
        {
            "ioc_value": "ox.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:21",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658336": [
        {
            "ioc_value": "os.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658337": [
        {
            "ioc_value": "os.t65p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658338": [
        {
            "ioc_value": "os.tfpe-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658339": [
        {
            "ioc_value": "os.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658340": [
        {
            "ioc_value": "os.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658341": [
        {
            "ioc_value": "os.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:59:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658342": [
        {
            "ioc_value": "os0.pooflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658343": [
        {
            "ioc_value": "os2rz.br1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658344": [
        {
            "ioc_value": "otter.otterweg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658345": [
        {
            "ioc_value": "ou.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658346": [
        {
            "ioc_value": "our.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658347": [
        {
            "ioc_value": "out.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658348": [
        {
            "ioc_value": "out.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658349": [
        {
            "ioc_value": "ov.kijx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:20",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658322": [
        {
            "ioc_value": "orb.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658323": [
        {
            "ioc_value": "orbit.br1ghtwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658324": [
        {
            "ioc_value": "orbit.odd-kraken.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658325": [
        {
            "ioc_value": "orbit.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658326": [
        {
            "ioc_value": "orbit.quartzflip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658327": [
        {
            "ioc_value": "orbit0.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658328": [
        {
            "ioc_value": "orbit1.miragepad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658329": [
        {
            "ioc_value": "orbit2.turbo-tap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658330": [
        {
            "ioc_value": "orbit5.starf0ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658331": [
        {
            "ioc_value": "orbit8.dup-1-ic-4-ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658332": [
        {
            "ioc_value": "orbit9.warpclutch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658333": [
        {
            "ioc_value": "orbitkamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658334": [
        {
            "ioc_value": "ore.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658335": [
        {
            "ioc_value": "os.j-7m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:19",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658313": [
        {
            "ioc_value": "op.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:18",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658314": [
        {
            "ioc_value": "op.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:18",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658315": [
        {
            "ioc_value": "op.rvni2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:18",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658316": [
        {
            "ioc_value": "op.tfpe-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:18",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658317": [
        {
            "ioc_value": "oq.p-93-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:18",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658318": [
        {
            "ioc_value": "oql.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:18",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658319": [
        {
            "ioc_value": "or.sgdi6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658320": [
        {
            "ioc_value": "or1ona.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:18",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658321": [
        {
            "ioc_value": "orb.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:18",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658301": [
        {
            "ioc_value": "one.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658302": [
        {
            "ioc_value": "one.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658303": [
        {
            "ioc_value": "one.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658304": [
        {
            "ioc_value": "one.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658305": [
        {
            "ioc_value": "onyx.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658306": [
        {
            "ioc_value": "onyx5a.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658307": [
        {
            "ioc_value": "onz.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658308": [
        {
            "ioc_value": "oo.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658309": [
        {
            "ioc_value": "ooeu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658310": [
        {
            "ioc_value": "ooia.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658311": [
        {
            "ioc_value": "oos.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658312": [
        {
            "ioc_value": "ooyu.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658287": [
        {
            "ioc_value": "ok.rvni2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658288": [
        {
            "ioc_value": "oka.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658289": [
        {
            "ioc_value": "ol.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658290": [
        {
            "ioc_value": "ol.p-93-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658291": [
        {
            "ioc_value": "ol.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658292": [
        {
            "ioc_value": "ol.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658293": [
        {
            "ioc_value": "old.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658294": [
        {
            "ioc_value": "olf.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658295": [
        {
            "ioc_value": "om.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658296": [
        {
            "ioc_value": "om.rvni2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658297": [
        {
            "ioc_value": "om.xrxo-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658298": [
        {
            "ioc_value": "om17w.rockwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658299": [
        {
            "ioc_value": "om7.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658300": [
        {
            "ioc_value": "omg.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:16",
            "last_seen_utc": "2025-11-29 09:57:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658271": [
        {
            "ioc_value": "oh.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658272": [
        {
            "ioc_value": "oh.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658273": [
        {
            "ioc_value": "oh.xrxo-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658274": [
        {
            "ioc_value": "ohsp.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658275": [
        {
            "ioc_value": "oi.plasm-about.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658276": [
        {
            "ioc_value": "oi.rvni2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658277": [
        {
            "ioc_value": "oi.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658278": [
        {
            "ioc_value": "oi.vgof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658279": [
        {
            "ioc_value": "oi.xrxo-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658280": [
        {
            "ioc_value": "oio.tanglehook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658281": [
        {
            "ioc_value": "oixp.aucti0nz7ir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658282": [
        {
            "ioc_value": "oj.f05t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658283": [
        {
            "ioc_value": "ojt.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658284": [
        {
            "ioc_value": "ojxk.r0ckveil.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658285": [
        {
            "ioc_value": "ok.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658286": [
        {
            "ioc_value": "ok.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:15",
            "last_seen_utc": "2025-11-29 09:57:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658258": [
        {
            "ioc_value": "oe.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658259": [
        {
            "ioc_value": "oe723.b-3-aconz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658260": [
        {
            "ioc_value": "of.xrxo-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658261": [
        {
            "ioc_value": "of2.qute-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658262": [
        {
            "ioc_value": "of33333.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658263": [
        {
            "ioc_value": "off.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658264": [
        {
            "ioc_value": "oft.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658265": [
        {
            "ioc_value": "ogg.migyvya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658266": [
        {
            "ioc_value": "ogj.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658267": [
        {
            "ioc_value": "oh.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658268": [
        {
            "ioc_value": "oh.ko-8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658269": [
        {
            "ioc_value": "oh.pvzi1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658270": [
        {
            "ioc_value": "oh.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:14",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658244": [
        {
            "ioc_value": "ock.turbotap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658245": [
        {
            "ioc_value": "oct.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658246": [
        {
            "ioc_value": "ocx.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658247": [
        {
            "ioc_value": "od.jzak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658248": [
        {
            "ioc_value": "od.pvzi1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658249": [
        {
            "ioc_value": "od.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658250": [
        {
            "ioc_value": "odd.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658251": [
        {
            "ioc_value": "odd.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658252": [
        {
            "ioc_value": "odpt.frostwalk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658253": [
        {
            "ioc_value": "oe.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658254": [
        {
            "ioc_value": "oe.pvzi1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658255": [
        {
            "ioc_value": "oe.s1lver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658256": [
        {
            "ioc_value": "oe.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658257": [
        {
            "ioc_value": "oe.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:13",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658232": [
        {
            "ioc_value": "oak2.br1ghtwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658233": [
        {
            "ioc_value": "oakensiegel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658234": [
        {
            "ioc_value": "oasisfuchs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658235": [
        {
            "ioc_value": "oatcakobuw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658236": [
        {
            "ioc_value": "ob1.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658237": [
        {
            "ioc_value": "obi.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658238": [
        {
            "ioc_value": "obte.dripanchor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658239": [
        {
            "ioc_value": "oc.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658240": [
        {
            "ioc_value": "oc.f-42-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658241": [
        {
            "ioc_value": "oc6.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658242": [
        {
            "ioc_value": "ocdfg.mossgrotte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658243": [
        {
            "ioc_value": "ocean.oceanshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:12",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658216": [
        {
            "ioc_value": "o5b.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658217": [
        {
            "ioc_value": "o5r.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658218": [
        {
            "ioc_value": "o6.fl-0-wbud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658219": [
        {
            "ioc_value": "o6.skylintap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658220": [
        {
            "ioc_value": "o6v.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658221": [
        {
            "ioc_value": "o7.tanglehook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658222": [
        {
            "ioc_value": "o78qu.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658223": [
        {
            "ioc_value": "o7oz.rockwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658224": [
        {
            "ioc_value": "o9.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658225": [
        {
            "ioc_value": "o9.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658226": [
        {
            "ioc_value": "o97r.qute-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658227": [
        {
            "ioc_value": "o9n.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658228": [
        {
            "ioc_value": "oa.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658229": [
        {
            "ioc_value": "oak.0palsummit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658230": [
        {
            "ioc_value": "oak.1ittleriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658231": [
        {
            "ioc_value": "oak.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:11",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658200": [
        {
            "ioc_value": "o.s7z7r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658201": [
        {
            "ioc_value": "o.t4a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658202": [
        {
            "ioc_value": "o.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:59:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658203": [
        {
            "ioc_value": "o1.ju4enpare1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658204": [
        {
            "ioc_value": "o11.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658205": [
        {
            "ioc_value": "o29.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658206": [
        {
            "ioc_value": "o2v9c4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658207": [
        {
            "ioc_value": "o3b.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658208": [
        {
            "ioc_value": "o3n.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658209": [
        {
            "ioc_value": "o3xz6.quartzleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658210": [
        {
            "ioc_value": "o4.4qo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658211": [
        {
            "ioc_value": "o4.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658212": [
        {
            "ioc_value": "o4089.marbletug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658213": [
        {
            "ioc_value": "o4k.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658214": [
        {
            "ioc_value": "o4ro.m0tor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658215": [
        {
            "ioc_value": "o5.z1ncspike.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:10",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658185": [
        {
            "ioc_value": "nybypuy2.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658186": [
        {
            "ioc_value": "nyd.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658187": [
        {
            "ioc_value": "nygek.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658188": [
        {
            "ioc_value": "nylykuu40.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658189": [
        {
            "ioc_value": "nync.g0ldnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658190": [
        {
            "ioc_value": "nynoj.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658191": [
        {
            "ioc_value": "nyq.orbitalnip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658192": [
        {
            "ioc_value": "nz.echozig.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658193": [
        {
            "ioc_value": "nz.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658194": [
        {
            "ioc_value": "nzjmf.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658195": [
        {
            "ioc_value": "nzki-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658196": [
        {
            "ioc_value": "nzs.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658197": [
        {
            "ioc_value": "o.hwke4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658198": [
        {
            "ioc_value": "o.j1g3k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658199": [
        {
            "ioc_value": "o.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:09",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658170": [
        {
            "ioc_value": "nve.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658171": [
        {
            "ioc_value": "nvgt8.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658172": [
        {
            "ioc_value": "nvk.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658173": [
        {
            "ioc_value": "nw.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658174": [
        {
            "ioc_value": "nw.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658175": [
        {
            "ioc_value": "nx.qenogia7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658176": [
        {
            "ioc_value": "nxc.moss-owl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658177": [
        {
            "ioc_value": "nxe.ci2udforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658178": [
        {
            "ioc_value": "nxys.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658179": [
        {
            "ioc_value": "nxz.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658180": [
        {
            "ioc_value": "ny.g-04-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658181": [
        {
            "ioc_value": "ny.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658182": [
        {
            "ioc_value": "ny.khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658183": [
        {
            "ioc_value": "ny.tygilyo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658184": [
        {
            "ioc_value": "nybypuy-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:08",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658154": [
        {
            "ioc_value": "ns2.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658155": [
        {
            "ioc_value": "nsi.cioudnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658156": [
        {
            "ioc_value": "nu.fenod.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658157": [
        {
            "ioc_value": "nu.n2-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658158": [
        {
            "ioc_value": "nu.pvzi1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658159": [
        {
            "ioc_value": "nu.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658160": [
        {
            "ioc_value": "nu.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658161": [
        {
            "ioc_value": "nu.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658162": [
        {
            "ioc_value": "nubil3.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658163": [
        {
            "ioc_value": "nulymoo1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658164": [
        {
            "ioc_value": "nuqotya6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658165": [
        {
            "ioc_value": "nut.jaxdrill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658166": [
        {
            "ioc_value": "nuu.qacacoe3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658167": [
        {
            "ioc_value": "nuwof.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658168": [
        {
            "ioc_value": "nuxul.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658169": [
        {
            "ioc_value": "nv.v-96-g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:07",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658139": [
        {
            "ioc_value": "nq.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658140": [
        {
            "ioc_value": "nq.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658141": [
        {
            "ioc_value": "nq.vjef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:58:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658142": [
        {
            "ioc_value": "nq.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658143": [
        {
            "ioc_value": "nq5.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658144": [
        {
            "ioc_value": "nqi.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:59:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658145": [
        {
            "ioc_value": "nqpv.simp7euna3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658146": [
        {
            "ioc_value": "nr.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658147": [
        {
            "ioc_value": "nr.le3nsnet7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658148": [
        {
            "ioc_value": "nr.migyvya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658149": [
        {
            "ioc_value": "nr.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658150": [
        {
            "ioc_value": "nr1.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658151": [
        {
            "ioc_value": "nrxk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658152": [
        {
            "ioc_value": "ns1.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658153": [
        {
            "ioc_value": "ns1.symad.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:06",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658124": [
        {
            "ioc_value": "nova1.gr1tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658125": [
        {
            "ioc_value": "nova1.l1festone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658126": [
        {
            "ioc_value": "nova1.st3elflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658127": [
        {
            "ioc_value": "nova1.starf0ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658128": [
        {
            "ioc_value": "nova2.quartzleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658129": [
        {
            "ioc_value": "nova4.silverr0ot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658130": [
        {
            "ioc_value": "nova7.polywhiz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658131": [
        {
            "ioc_value": "nova8.hazebinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658132": [
        {
            "ioc_value": "nova9.jump3r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658133": [
        {
            "ioc_value": "noxil7.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658134": [
        {
            "ioc_value": "noxymiy3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658135": [
        {
            "ioc_value": "np.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658136": [
        {
            "ioc_value": "npimr.simp7euna3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658137": [
        {
            "ioc_value": "npl.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658138": [
        {
            "ioc_value": "npo.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:05",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658108": [
        {
            "ioc_value": "nord.amberkliff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658109": [
        {
            "ioc_value": "nordiq4.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658110": [
        {
            "ioc_value": "north.m-1-dnightr-0-ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658111": [
        {
            "ioc_value": "north5.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658112": [
        {
            "ioc_value": "nosux.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658113": [
        {
            "ioc_value": "note7.stonem1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658114": [
        {
            "ioc_value": "nova.5h0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658115": [
        {
            "ioc_value": "nova.aucti0nz7ir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658116": [
        {
            "ioc_value": "nova.brimhopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658117": [
        {
            "ioc_value": "nova.h0bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658118": [
        {
            "ioc_value": "nova.kalmykvic0te.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658119": [
        {
            "ioc_value": "nova.m1ntflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658120": [
        {
            "ioc_value": "nova.r1verbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658121": [
        {
            "ioc_value": "nova.st-0-bepress.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658122": [
        {
            "ioc_value": "nova.st-1-lt-forge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658123": [
        {
            "ioc_value": "nova.zenithsnap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:04",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658095": [
        {
            "ioc_value": "noct4.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658096": [
        {
            "ioc_value": "nod.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658097": [
        {
            "ioc_value": "node.bray-circuit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658098": [
        {
            "ioc_value": "node.digncbe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658099": [
        {
            "ioc_value": "node.vorticeye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658100": [
        {
            "ioc_value": "node0.cog-whittle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658101": [
        {
            "ioc_value": "node3.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658102": [
        {
            "ioc_value": "node3.sketch-loom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658103": [
        {
            "ioc_value": "nohz.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658104": [
        {
            "ioc_value": "noir4.darksun5et.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658105": [
        {
            "ioc_value": "nojatii4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658106": [
        {
            "ioc_value": "nojucua1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658107": [
        {
            "ioc_value": "nor73df.bas9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:03",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658085": [
        {
            "ioc_value": "no.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658086": [
        {
            "ioc_value": "no.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658087": [
        {
            "ioc_value": "no.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658088": [
        {
            "ioc_value": "no.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658089": [
        {
            "ioc_value": "no.v-96-g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658090": [
        {
            "ioc_value": "no.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658091": [
        {
            "ioc_value": "no.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658092": [
        {
            "ioc_value": "no.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658093": [
        {
            "ioc_value": "no.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658094": [
        {
            "ioc_value": "no555.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:01",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658069": [
        {
            "ioc_value": "nln7n.kos-0-ltyu-4-etey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658070": [
        {
            "ioc_value": "nmv40.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658071": [
        {
            "ioc_value": "nn.d42n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658072": [
        {
            "ioc_value": "nn.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658073": [
        {
            "ioc_value": "nn.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658074": [
        {
            "ioc_value": "nn.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658075": [
        {
            "ioc_value": "nn15s.sun-hill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658076": [
        {
            "ioc_value": "nn3.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658077": [
        {
            "ioc_value": "no.bavyzeo47.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658078": [
        {
            "ioc_value": "no.buno8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658079": [
        {
            "ioc_value": "no.de-6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658080": [
        {
            "ioc_value": "no.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658081": [
        {
            "ioc_value": "no.ixy9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658082": [
        {
            "ioc_value": "no.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658083": [
        {
            "ioc_value": "no.muqu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658084": [
        {
            "ioc_value": "no.net-0-prosa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:36:00",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658055": [
        {
            "ioc_value": "nigax-41-ou-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658056": [
        {
            "ioc_value": "nigax41ou6.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658057": [
        {
            "ioc_value": "nigax41ou6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658058": [
        {
            "ioc_value": "nikys.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658059": [
        {
            "ioc_value": "nimbus6.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658060": [
        {
            "ioc_value": "nis.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:59:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658061": [
        {
            "ioc_value": "nival3.snowdr1ft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658062": [
        {
            "ioc_value": "nj.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658063": [
        {
            "ioc_value": "nj.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658064": [
        {
            "ioc_value": "njv.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658065": [
        {
            "ioc_value": "nkv.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658066": [
        {
            "ioc_value": "nkve.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658067": [
        {
            "ioc_value": "nl.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658068": [
        {
            "ioc_value": "nl.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:59",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658042": [
        {
            "ioc_value": "new.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658043": [
        {
            "ioc_value": "nf.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658044": [
        {
            "ioc_value": "nf.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658045": [
        {
            "ioc_value": "nf0g.shad0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658046": [
        {
            "ioc_value": "ng.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658047": [
        {
            "ioc_value": "ng.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658048": [
        {
            "ioc_value": "ngytp.iunarpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658049": [
        {
            "ioc_value": "nh.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658050": [
        {
            "ioc_value": "ni5.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658051": [
        {
            "ioc_value": "nib-snap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658052": [
        {
            "ioc_value": "nib.pulseknob.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658053": [
        {
            "ioc_value": "nibum.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658054": [
        {
            "ioc_value": "nice.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:58",
            "last_seen_utc": "2025-11-29 09:59:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658030": [
        {
            "ioc_value": "nejyd.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658031": [
        {
            "ioc_value": "neon.mintforest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658032": [
        {
            "ioc_value": "neonheide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658033": [
        {
            "ioc_value": "nest.ravenbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658034": [
        {
            "ioc_value": "nest.s0ftwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658035": [
        {
            "ioc_value": "nest.safebl0ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658036": [
        {
            "ioc_value": "nest1.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658037": [
        {
            "ioc_value": "nest5.windfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658038": [
        {
            "ioc_value": "net-0-prosa.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658039": [
        {
            "ioc_value": "net.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658040": [
        {
            "ioc_value": "net.tatyziu58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:58:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658041": [
        {
            "ioc_value": "netsup.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:57",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658016": [
        {
            "ioc_value": "nebe7l.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658017": [
        {
            "ioc_value": "nebel.acornhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658018": [
        {
            "ioc_value": "nebel.driftkrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658019": [
        {
            "ioc_value": "nebel.eiderquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658020": [
        {
            "ioc_value": "nebel.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658021": [
        {
            "ioc_value": "nebel.prairiewolf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658022": [
        {
            "ioc_value": "nebel.quartzfeder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658023": [
        {
            "ioc_value": "nebel.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658024": [
        {
            "ioc_value": "nebel.starcresting.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658025": [
        {
            "ioc_value": "nebel.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658026": [
        {
            "ioc_value": "nebel.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658027": [
        {
            "ioc_value": "nebel.zephyrquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658028": [
        {
            "ioc_value": "nebl4e.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658029": [
        {
            "ioc_value": "nebu7la.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:56",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658002": [
        {
            "ioc_value": "nb.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658003": [
        {
            "ioc_value": "nc.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658004": [
        {
            "ioc_value": "nd.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658005": [
        {
            "ioc_value": "nd9eh.kn-1-fecast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658006": [
        {
            "ioc_value": "ndgpt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658007": [
        {
            "ioc_value": "ndy.yw9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658008": [
        {
            "ioc_value": "ne.h73n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658009": [
        {
            "ioc_value": "ne.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658010": [
        {
            "ioc_value": "ne.suf-1-nau-8-h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658011": [
        {
            "ioc_value": "ne.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658012": [
        {
            "ioc_value": "ne.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658013": [
        {
            "ioc_value": "ne1bel.nar7owsized.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658014": [
        {
            "ioc_value": "ne9.ede1g0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658015": [
        {
            "ioc_value": "neat.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:55",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657985": [
        {
            "ioc_value": "nacht.owlflug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657986": [
        {
            "ioc_value": "nacht.quartzfuchs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657987": [
        {
            "ioc_value": "nacht.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657988": [
        {
            "ioc_value": "nacht.shadowmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657989": [
        {
            "ioc_value": "nacht.shadowtal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657990": [
        {
            "ioc_value": "nacht.stormgrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657991": [
        {
            "ioc_value": "nacht.yewhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:59:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657992": [
        {
            "ioc_value": "nag.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657993": [
        {
            "ioc_value": "nagyg.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657994": [
        {
            "ioc_value": "namenyo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657995": [
        {
            "ioc_value": "nap.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657996": [
        {
            "ioc_value": "napgh.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657997": [
        {
            "ioc_value": "napiv.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657998": [
        {
            "ioc_value": "nav5is.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657999": [
        {
            "ioc_value": "nawym.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658000": [
        {
            "ioc_value": "nay.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1658001": [
        {
            "ioc_value": "nb.brambleforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:54",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657968": [
        {
            "ioc_value": "n8.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657969": [
        {
            "ioc_value": "n84.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657970": [
        {
            "ioc_value": "n8u.v0xelspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657971": [
        {
            "ioc_value": "n8x.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657972": [
        {
            "ioc_value": "n9.527w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657973": [
        {
            "ioc_value": "n9.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657974": [
        {
            "ioc_value": "n9i.oqtx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657975": [
        {
            "ioc_value": "n9v.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657976": [
        {
            "ioc_value": "na.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657977": [
        {
            "ioc_value": "na.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657978": [
        {
            "ioc_value": "na.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657979": [
        {
            "ioc_value": "na.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657980": [
        {
            "ioc_value": "nacht.cedarsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657981": [
        {
            "ioc_value": "nacht.m00nweaver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657982": [
        {
            "ioc_value": "nacht.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657983": [
        {
            "ioc_value": "nacht.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657984": [
        {
            "ioc_value": "nacht.night0ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:53",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657954": [
        {
            "ioc_value": "n5.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657955": [
        {
            "ioc_value": "n5.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657956": [
        {
            "ioc_value": "n5.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657957": [
        {
            "ioc_value": "n5.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657958": [
        {
            "ioc_value": "n5.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657959": [
        {
            "ioc_value": "n5.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657960": [
        {
            "ioc_value": "n5h2.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657961": [
        {
            "ioc_value": "n5i.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657962": [
        {
            "ioc_value": "n61i1.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657963": [
        {
            "ioc_value": "n6r.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657964": [
        {
            "ioc_value": "n7.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657965": [
        {
            "ioc_value": "n7.cobaltwolke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657966": [
        {
            "ioc_value": "n7y.drift-meadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657967": [
        {
            "ioc_value": "n8.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:52",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657940": [
        {
            "ioc_value": "n4.13-yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657941": [
        {
            "ioc_value": "n4.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657942": [
        {
            "ioc_value": "n4.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657943": [
        {
            "ioc_value": "n4.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657944": [
        {
            "ioc_value": "n4.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657945": [
        {
            "ioc_value": "n4s.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657946": [
        {
            "ioc_value": "n4s.rivermote.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657947": [
        {
            "ioc_value": "n4y.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657948": [
        {
            "ioc_value": "n5.1ronpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657949": [
        {
            "ioc_value": "n5.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657950": [
        {
            "ioc_value": "n5.9715w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657951": [
        {
            "ioc_value": "n5.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657952": [
        {
            "ioc_value": "n5.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657953": [
        {
            "ioc_value": "n5.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657923": [
        {
            "ioc_value": "n3.bvqu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657924": [
        {
            "ioc_value": "n3.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657925": [
        {
            "ioc_value": "n3.focove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657926": [
        {
            "ioc_value": "n3.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657927": [
        {
            "ioc_value": "n3.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657928": [
        {
            "ioc_value": "n3.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657929": [
        {
            "ioc_value": "n3.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657930": [
        {
            "ioc_value": "n3.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657931": [
        {
            "ioc_value": "n3.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657932": [
        {
            "ioc_value": "n3.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657933": [
        {
            "ioc_value": "n3.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:58:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657934": [
        {
            "ioc_value": "n3.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657935": [
        {
            "ioc_value": "n3.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:59:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657936": [
        {
            "ioc_value": "n3.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:59:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657937": [
        {
            "ioc_value": "n3.yo11.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:59:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657938": [
        {
            "ioc_value": "n3p9sle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657939": [
        {
            "ioc_value": "n4.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:50",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657908": [
        {
            "ioc_value": "n0.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657909": [
        {
            "ioc_value": "n0.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657910": [
        {
            "ioc_value": "n00.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657911": [
        {
            "ioc_value": "n0w.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657912": [
        {
            "ioc_value": "n1s8y0w.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657913": [
        {
            "ioc_value": "n2.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657914": [
        {
            "ioc_value": "n2.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657915": [
        {
            "ioc_value": "n2.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657916": [
        {
            "ioc_value": "n2ag.stormmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657917": [
        {
            "ioc_value": "n3.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657918": [
        {
            "ioc_value": "n3.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657919": [
        {
            "ioc_value": "n3.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657920": [
        {
            "ioc_value": "n3.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657921": [
        {
            "ioc_value": "n3.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657922": [
        {
            "ioc_value": "n3.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:49",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657893": [
        {
            "ioc_value": "n.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657894": [
        {
            "ioc_value": "n.c2y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657895": [
        {
            "ioc_value": "n.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657896": [
        {
            "ioc_value": "n.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657897": [
        {
            "ioc_value": "n.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657898": [
        {
            "ioc_value": "n.p2j4k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657899": [
        {
            "ioc_value": "n.v1n4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657900": [
        {
            "ioc_value": "n.w30g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:58:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657901": [
        {
            "ioc_value": "n.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657902": [
        {
            "ioc_value": "n.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:58:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657903": [
        {
            "ioc_value": "n.wuk0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657904": [
        {
            "ioc_value": "n.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657905": [
        {
            "ioc_value": "n.xxos.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657906": [
        {
            "ioc_value": "n.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657907": [
        {
            "ioc_value": "n0.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:48",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657882": [
        {
            "ioc_value": "my.xe-1r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657883": [
        {
            "ioc_value": "my.znx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657884": [
        {
            "ioc_value": "myda4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657885": [
        {
            "ioc_value": "mykutea4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657886": [
        {
            "ioc_value": "mylan.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657887": [
        {
            "ioc_value": "mypah.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657888": [
        {
            "ioc_value": "myqareu9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657889": [
        {
            "ioc_value": "mysyv.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657890": [
        {
            "ioc_value": "mz.n-44-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657891": [
        {
            "ioc_value": "mzvo-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657892": [
        {
            "ioc_value": "n-96-f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:47",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657866": [
        {
            "ioc_value": "mw.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657867": [
        {
            "ioc_value": "mw.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657868": [
        {
            "ioc_value": "mw9k.t1nystar.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657869": [
        {
            "ioc_value": "mwop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657870": [
        {
            "ioc_value": "mx.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657871": [
        {
            "ioc_value": "mx.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657872": [
        {
            "ioc_value": "my.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657873": [
        {
            "ioc_value": "my.f-05-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657874": [
        {
            "ioc_value": "my.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657875": [
        {
            "ioc_value": "my.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657876": [
        {
            "ioc_value": "my.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657877": [
        {
            "ioc_value": "my.p2-om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657878": [
        {
            "ioc_value": "my.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657879": [
        {
            "ioc_value": "my.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657880": [
        {
            "ioc_value": "my.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657881": [
        {
            "ioc_value": "my.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:46",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657850": [
        {
            "ioc_value": "mto.gi-0-wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657851": [
        {
            "ioc_value": "mu.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657852": [
        {
            "ioc_value": "mu.nelypuu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657853": [
        {
            "ioc_value": "mu.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657854": [
        {
            "ioc_value": "mu.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:57:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657855": [
        {
            "ioc_value": "mu.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:58:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657856": [
        {
            "ioc_value": "mubub.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657857": [
        {
            "ioc_value": "mud.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657858": [
        {
            "ioc_value": "mufabui4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657859": [
        {
            "ioc_value": "muhoj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657860": [
        {
            "ioc_value": "muj.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:59:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657861": [
        {
            "ioc_value": "munyw.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657862": [
        {
            "ioc_value": "murmuringramrod.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657863": [
        {
            "ioc_value": "musicoo1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657864": [
        {
            "ioc_value": "mv.m33h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657865": [
        {
            "ioc_value": "mv.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:45",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657834": [
        {
            "ioc_value": "mox.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657835": [
        {
            "ioc_value": "mp.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657836": [
        {
            "ioc_value": "mq.z99l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657837": [
        {
            "ioc_value": "mq3.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657838": [
        {
            "ioc_value": "mr.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657839": [
        {
            "ioc_value": "mr.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657840": [
        {
            "ioc_value": "mr1.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657841": [
        {
            "ioc_value": "mr5.fogmap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657842": [
        {
            "ioc_value": "mri.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657843": [
        {
            "ioc_value": "mrj.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657844": [
        {
            "ioc_value": "mrryq.hover-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657845": [
        {
            "ioc_value": "ms.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657846": [
        {
            "ioc_value": "ms.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657847": [
        {
            "ioc_value": "mt.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657848": [
        {
            "ioc_value": "mt.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657849": [
        {
            "ioc_value": "mta11.bestffriend.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:44",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657820": [
        {
            "ioc_value": "mooss.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657821": [
        {
            "ioc_value": "mopoj.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657822": [
        {
            "ioc_value": "morning.5h0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657823": [
        {
            "ioc_value": "morning1.cleardrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657824": [
        {
            "ioc_value": "morrow.torque-bud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657825": [
        {
            "ioc_value": "moss.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657826": [
        {
            "ioc_value": "moss6.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657827": [
        {
            "ioc_value": "mossufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657828": [
        {
            "ioc_value": "mossy.0akstream.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657829": [
        {
            "ioc_value": "most.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657830": [
        {
            "ioc_value": "mote5r.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657831": [
        {
            "ioc_value": "motor.m0tor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657832": [
        {
            "ioc_value": "motor0.qu1ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657833": [
        {
            "ioc_value": "mow.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:43",
            "last_seen_utc": "2025-11-29 09:58:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657803": [
        {
            "ioc_value": "moos.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657804": [
        {
            "ioc_value": "moos.echohang.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657805": [
        {
            "ioc_value": "moos.embertarn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657806": [
        {
            "ioc_value": "moos.flintquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657807": [
        {
            "ioc_value": "moos.granitebach.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657808": [
        {
            "ioc_value": "moos.ivyvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657809": [
        {
            "ioc_value": "moos.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657810": [
        {
            "ioc_value": "moos.ny4lp8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657811": [
        {
            "ioc_value": "moos.prismgrau.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657812": [
        {
            "ioc_value": "moos.quartzstollen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657813": [
        {
            "ioc_value": "moos.rap1d5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657814": [
        {
            "ioc_value": "moos.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657815": [
        {
            "ioc_value": "moos.swiftgasse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657816": [
        {
            "ioc_value": "moos.thrushmere.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657817": [
        {
            "ioc_value": "moos.thundergrove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657818": [
        {
            "ioc_value": "moos.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657819": [
        {
            "ioc_value": "moos.willowufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:42",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657785": [
        {
            "ioc_value": "moor.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657786": [
        {
            "ioc_value": "moor.saffronhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657787": [
        {
            "ioc_value": "moor.sageufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657788": [
        {
            "ioc_value": "moor.sparrowdock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657789": [
        {
            "ioc_value": "moor.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657790": [
        {
            "ioc_value": "moor.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657791": [
        {
            "ioc_value": "moor.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657792": [
        {
            "ioc_value": "moor.willowgrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657793": [
        {
            "ioc_value": "moor1.ciearforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657794": [
        {
            "ioc_value": "moor3.w1ndstorm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657795": [
        {
            "ioc_value": "moor4.dinfectt0rs0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657796": [
        {
            "ioc_value": "moos.aurora1hain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657797": [
        {
            "ioc_value": "moos.auroralinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657798": [
        {
            "ioc_value": "moos.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657799": [
        {
            "ioc_value": "moos.cairnsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657800": [
        {
            "ioc_value": "moos.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657801": [
        {
            "ioc_value": "moos.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657802": [
        {
            "ioc_value": "moos.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:41",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657768": [
        {
            "ioc_value": "moor.darkfeather.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657769": [
        {
            "ioc_value": "moor.darkr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657770": [
        {
            "ioc_value": "moor.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657771": [
        {
            "ioc_value": "moor.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657772": [
        {
            "ioc_value": "moor.frostgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657773": [
        {
            "ioc_value": "moor.g0ldmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657774": [
        {
            "ioc_value": "moor.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657775": [
        {
            "ioc_value": "moor.hum2nk0str.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657776": [
        {
            "ioc_value": "moor.immigrant5p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657777": [
        {
            "ioc_value": "moor.inha4itmu1ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657778": [
        {
            "ioc_value": "moor.jasperhain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657779": [
        {
            "ioc_value": "moor.kick-5-ubs-4-ance.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657780": [
        {
            "ioc_value": "moor.knollhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657781": [
        {
            "ioc_value": "moor.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657782": [
        {
            "ioc_value": "moor.neonkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657783": [
        {
            "ioc_value": "moor.netit0c0rec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657784": [
        {
            "ioc_value": "moor.platinumvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:40",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657753": [
        {
            "ioc_value": "mond.starfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657754": [
        {
            "ioc_value": "mond.stoneharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657755": [
        {
            "ioc_value": "mond.stormfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657756": [
        {
            "ioc_value": "money.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657757": [
        {
            "ioc_value": "moon.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657758": [
        {
            "ioc_value": "moon.le-3-nsnet-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657759": [
        {
            "ioc_value": "moor.argonbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657760": [
        {
            "ioc_value": "moor.atlasufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657761": [
        {
            "ioc_value": "moor.awreti3uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657762": [
        {
            "ioc_value": "moor.beechmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657763": [
        {
            "ioc_value": "moor.brinewald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657764": [
        {
            "ioc_value": "moor.c0dehawk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657765": [
        {
            "ioc_value": "moor.ci2udforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657766": [
        {
            "ioc_value": "moor.ciearbug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657767": [
        {
            "ioc_value": "moor.copperalpen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:39",
            "last_seen_utc": "2025-11-29 09:56:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657737": [
        {
            "ioc_value": "mns.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657738": [
        {
            "ioc_value": "mnt3ak.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657739": [
        {
            "ioc_value": "mo.phpa3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657740": [
        {
            "ioc_value": "mo.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:58:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657741": [
        {
            "ioc_value": "mo.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657742": [
        {
            "ioc_value": "mo0or.dr0gaguaran.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657743": [
        {
            "ioc_value": "mo2or.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657744": [
        {
            "ioc_value": "mob.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657745": [
        {
            "ioc_value": "module7.viberspan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657746": [
        {
            "ioc_value": "mogixyu9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657747": [
        {
            "ioc_value": "mom.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657748": [
        {
            "ioc_value": "mon.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657749": [
        {
            "ioc_value": "mond.cometlinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657750": [
        {
            "ioc_value": "mond.cometpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657751": [
        {
            "ioc_value": "mond.m00nweaver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657752": [
        {
            "ioc_value": "mond.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:38",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657719": [
        {
            "ioc_value": "mk.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657720": [
        {
            "ioc_value": "mkqtw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657721": [
        {
            "ioc_value": "mkt.97jt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657722": [
        {
            "ioc_value": "ml.gleamspan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657723": [
        {
            "ioc_value": "ml.n-44-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657724": [
        {
            "ioc_value": "mlo.j-7m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657725": [
        {
            "ioc_value": "mlq1.ic0n1cbrook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657726": [
        {
            "ioc_value": "mm.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657727": [
        {
            "ioc_value": "mm.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657728": [
        {
            "ioc_value": "mmd.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657729": [
        {
            "ioc_value": "mmw.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657730": [
        {
            "ioc_value": "mmxbx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657731": [
        {
            "ioc_value": "mn.deltasync.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657732": [
        {
            "ioc_value": "mn.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657733": [
        {
            "ioc_value": "mn.xxos.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657734": [
        {
            "ioc_value": "mnho.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657735": [
        {
            "ioc_value": "mno.winenoy5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657736": [
        {
            "ioc_value": "mnp.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:37",
            "last_seen_utc": "2025-11-29 09:56:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657707": [
        {
            "ioc_value": "mist7.sm0kewood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657708": [
        {
            "ioc_value": "mist7y.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657709": [
        {
            "ioc_value": "mist8.oceanshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657710": [
        {
            "ioc_value": "mist8.rapidst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657711": [
        {
            "ioc_value": "mistgraben.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657712": [
        {
            "ioc_value": "mityxyo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657713": [
        {
            "ioc_value": "mix.cofidyu58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657714": [
        {
            "ioc_value": "mizu.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657715": [
        {
            "ioc_value": "mizx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657716": [
        {
            "ioc_value": "mje.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657717": [
        {
            "ioc_value": "mjef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657718": [
        {
            "ioc_value": "mjjt.jam-crest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:36",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657694": [
        {
            "ioc_value": "miq.toludye0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657695": [
        {
            "ioc_value": "miro2n.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657696": [
        {
            "ioc_value": "mist.1ittleriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657697": [
        {
            "ioc_value": "mist.5t0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657698": [
        {
            "ioc_value": "mist.mossgrotte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657699": [
        {
            "ioc_value": "mist.opal-hollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657700": [
        {
            "ioc_value": "mist.rockbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657701": [
        {
            "ioc_value": "mist.st0nebyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657702": [
        {
            "ioc_value": "mist.st0rmleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657703": [
        {
            "ioc_value": "mist.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657704": [
        {
            "ioc_value": "mist0.icy-moth.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657705": [
        {
            "ioc_value": "mist3.driftl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657706": [
        {
            "ioc_value": "mist4y.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:35",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657684": [
        {
            "ioc_value": "mimyfai0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657685": [
        {
            "ioc_value": "mint.cioudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657686": [
        {
            "ioc_value": "mint.cog-whittle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657687": [
        {
            "ioc_value": "mint.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657688": [
        {
            "ioc_value": "mint.pen1sp7edef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657689": [
        {
            "ioc_value": "mint.st0nefield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657690": [
        {
            "ioc_value": "mint3.silverr0ot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657691": [
        {
            "ioc_value": "mintcrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657692": [
        {
            "ioc_value": "mintnord.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657693": [
        {
            "ioc_value": "minty7.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:34",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657672": [
        {
            "ioc_value": "mhk.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657673": [
        {
            "ioc_value": "mi.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657674": [
        {
            "ioc_value": "mi.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657675": [
        {
            "ioc_value": "mi.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657676": [
        {
            "ioc_value": "mi.gug7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657677": [
        {
            "ioc_value": "mi.phpa3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657678": [
        {
            "ioc_value": "mi.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657679": [
        {
            "ioc_value": "mi.turbo-tap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657680": [
        {
            "ioc_value": "mi.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657681": [
        {
            "ioc_value": "mi5st.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657682": [
        {
            "ioc_value": "mica.frostwilder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657683": [
        {
            "ioc_value": "micuh.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:33",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657660": [
        {
            "ioc_value": "medow.rainv1sta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657661": [
        {
            "ioc_value": "meer.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657662": [
        {
            "ioc_value": "meer6.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657663": [
        {
            "ioc_value": "menta2.mintsp1ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657664": [
        {
            "ioc_value": "mesaweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657665": [
        {
            "ioc_value": "mesh.papervolt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657666": [
        {
            "ioc_value": "mesh.s0apthorn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657667": [
        {
            "ioc_value": "mesh.s0larbudge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657668": [
        {
            "ioc_value": "mezom.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657669": [
        {
            "ioc_value": "mg.k7t0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657670": [
        {
            "ioc_value": "mgc.nufypiy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657671": [
        {
            "ioc_value": "mhb.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:32",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657645": [
        {
            "ioc_value": "me.phpa3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657646": [
        {
            "ioc_value": "me.pobinei39.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657647": [
        {
            "ioc_value": "me.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657648": [
        {
            "ioc_value": "me.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657649": [
        {
            "ioc_value": "me.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657650": [
        {
            "ioc_value": "me.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657651": [
        {
            "ioc_value": "me.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:59:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657652": [
        {
            "ioc_value": "me1.qute3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657653": [
        {
            "ioc_value": "me8.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657654": [
        {
            "ioc_value": "mead.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657655": [
        {
            "ioc_value": "meadow.driftmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657656": [
        {
            "ioc_value": "meadow.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657657": [
        {
            "ioc_value": "meadow0.ic0n1cbrook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657658": [
        {
            "ioc_value": "mebejaa7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657659": [
        {
            "ioc_value": "mebwg.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:31",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657630": [
        {
            "ioc_value": "mc.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657631": [
        {
            "ioc_value": "mcb.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657632": [
        {
            "ioc_value": "mcp.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657633": [
        {
            "ioc_value": "mcyz-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657634": [
        {
            "ioc_value": "mcz.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657635": [
        {
            "ioc_value": "md.cykugeu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657636": [
        {
            "ioc_value": "md.gazecoe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657637": [
        {
            "ioc_value": "md.jaxusoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657638": [
        {
            "ioc_value": "mde.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657639": [
        {
            "ioc_value": "me.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657640": [
        {
            "ioc_value": "me.buno8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657641": [
        {
            "ioc_value": "me.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657642": [
        {
            "ioc_value": "me.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657643": [
        {
            "ioc_value": "me.gify1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657644": [
        {
            "ioc_value": "me.muqu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:30",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657616": [
        {
            "ioc_value": "marble5.spindleway.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657617": [
        {
            "ioc_value": "mark.jump3r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657618": [
        {
            "ioc_value": "marsh.embercross.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657619": [
        {
            "ioc_value": "marten.martenhain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657620": [
        {
            "ioc_value": "mast.hawkmast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657621": [
        {
            "ioc_value": "mat.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657622": [
        {
            "ioc_value": "mat.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657623": [
        {
            "ioc_value": "matur.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657624": [
        {
            "ioc_value": "maxoxio6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657625": [
        {
            "ioc_value": "may.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657626": [
        {
            "ioc_value": "mb.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657627": [
        {
            "ioc_value": "mb3.acidwrench.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657628": [
        {
            "ioc_value": "mbc.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657629": [
        {
            "ioc_value": "mbwr5.j0tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:29",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657604": [
        {
            "ioc_value": "made.gofumoo29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657605": [
        {
            "ioc_value": "mahud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657606": [
        {
            "ioc_value": "mail.4sa.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657607": [
        {
            "ioc_value": "mail.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657608": [
        {
            "ioc_value": "make.nugawye78.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657609": [
        {
            "ioc_value": "mang0x.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657610": [
        {
            "ioc_value": "map1e.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657611": [
        {
            "ioc_value": "mapl3e.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657612": [
        {
            "ioc_value": "maple.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657613": [
        {
            "ioc_value": "maplequelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657614": [
        {
            "ioc_value": "mar3na.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657615": [
        {
            "ioc_value": "marble.tundra-flip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:28",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657588": [
        {
            "ioc_value": "m9y.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657589": [
        {
            "ioc_value": "ma.bo-x2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657590": [
        {
            "ioc_value": "ma.f-42-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657591": [
        {
            "ioc_value": "ma.fenod.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:57:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657592": [
        {
            "ioc_value": "ma.ko-8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657593": [
        {
            "ioc_value": "ma.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657594": [
        {
            "ioc_value": "ma.phpa3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657595": [
        {
            "ioc_value": "ma.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657596": [
        {
            "ioc_value": "ma.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657597": [
        {
            "ioc_value": "ma.r0ckveil.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657598": [
        {
            "ioc_value": "ma.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657599": [
        {
            "ioc_value": "ma.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657600": [
        {
            "ioc_value": "ma.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657601": [
        {
            "ioc_value": "ma.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657602": [
        {
            "ioc_value": "ma4.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657603": [
        {
            "ioc_value": "mabugiy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:27",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657573": [
        {
            "ioc_value": "m8o.cloudw1re.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657574": [
        {
            "ioc_value": "m8q.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657575": [
        {
            "ioc_value": "m8q.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657576": [
        {
            "ioc_value": "m9.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657577": [
        {
            "ioc_value": "m9.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657578": [
        {
            "ioc_value": "m9.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657579": [
        {
            "ioc_value": "m9.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657580": [
        {
            "ioc_value": "m9.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657581": [
        {
            "ioc_value": "m9.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657582": [
        {
            "ioc_value": "m9.tem5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657583": [
        {
            "ioc_value": "m9.u-na5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657584": [
        {
            "ioc_value": "m9.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657585": [
        {
            "ioc_value": "m9p.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657586": [
        {
            "ioc_value": "m9q.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657587": [
        {
            "ioc_value": "m9x.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:26",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657558": [
        {
            "ioc_value": "m8.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657559": [
        {
            "ioc_value": "m8.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657560": [
        {
            "ioc_value": "m8.ew-w3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657561": [
        {
            "ioc_value": "m8.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657562": [
        {
            "ioc_value": "m8.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657563": [
        {
            "ioc_value": "m8.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657564": [
        {
            "ioc_value": "m8.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657565": [
        {
            "ioc_value": "m8.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657566": [
        {
            "ioc_value": "m8.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657567": [
        {
            "ioc_value": "m8.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657568": [
        {
            "ioc_value": "m8.velvetnebel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657569": [
        {
            "ioc_value": "m8.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657570": [
        {
            "ioc_value": "m8.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657571": [
        {
            "ioc_value": "m8.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657572": [
        {
            "ioc_value": "m8d4.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:25",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657544": [
        {
            "ioc_value": "m7.embergarten.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657545": [
        {
            "ioc_value": "m7.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657546": [
        {
            "ioc_value": "m7.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657547": [
        {
            "ioc_value": "m7.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657548": [
        {
            "ioc_value": "m7.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657549": [
        {
            "ioc_value": "m7x.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657550": [
        {
            "ioc_value": "m7yq2p.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657551": [
        {
            "ioc_value": "m8.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657552": [
        {
            "ioc_value": "m8.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657553": [
        {
            "ioc_value": "m8.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657554": [
        {
            "ioc_value": "m8.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657555": [
        {
            "ioc_value": "m8.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657556": [
        {
            "ioc_value": "m8.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657557": [
        {
            "ioc_value": "m8.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:24",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657531": [
        {
            "ioc_value": "m3p.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657532": [
        {
            "ioc_value": "m4.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657533": [
        {
            "ioc_value": "m4.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657534": [
        {
            "ioc_value": "m4rj.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657535": [
        {
            "ioc_value": "m4rloq.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657536": [
        {
            "ioc_value": "m5.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657537": [
        {
            "ioc_value": "m5k.st0nesurge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657538": [
        {
            "ioc_value": "m5n.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657539": [
        {
            "ioc_value": "m5o.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657540": [
        {
            "ioc_value": "m6.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657541": [
        {
            "ioc_value": "m6.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657542": [
        {
            "ioc_value": "m7.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657543": [
        {
            "ioc_value": "m7.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:23",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657517": [
        {
            "ioc_value": "m2.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657518": [
        {
            "ioc_value": "m2.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657519": [
        {
            "ioc_value": "m21.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657520": [
        {
            "ioc_value": "m2f.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657521": [
        {
            "ioc_value": "m2m8.silverrun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657522": [
        {
            "ioc_value": "m2n.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657523": [
        {
            "ioc_value": "m2n.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657524": [
        {
            "ioc_value": "m2q.storm-ripple.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657525": [
        {
            "ioc_value": "m3.b8c90.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657526": [
        {
            "ioc_value": "m3.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657527": [
        {
            "ioc_value": "m3.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657528": [
        {
            "ioc_value": "m3.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657529": [
        {
            "ioc_value": "m3.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657530": [
        {
            "ioc_value": "m3.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:22",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657500": [
        {
            "ioc_value": "m2.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657501": [
        {
            "ioc_value": "m2.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657502": [
        {
            "ioc_value": "m2.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657503": [
        {
            "ioc_value": "m2.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657504": [
        {
            "ioc_value": "m2.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657505": [
        {
            "ioc_value": "m2.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657506": [
        {
            "ioc_value": "m2.hap7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657507": [
        {
            "ioc_value": "m2.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657508": [
        {
            "ioc_value": "m2.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657509": [
        {
            "ioc_value": "m2.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657510": [
        {
            "ioc_value": "m2.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657511": [
        {
            "ioc_value": "m2.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:58:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657512": [
        {
            "ioc_value": "m2.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:58:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657513": [
        {
            "ioc_value": "m2.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657514": [
        {
            "ioc_value": "m2.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657515": [
        {
            "ioc_value": "m2.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657516": [
        {
            "ioc_value": "m2.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:21",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657489": [
        {
            "ioc_value": "m1d8g4hf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657490": [
        {
            "ioc_value": "m1f.fid1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657491": [
        {
            "ioc_value": "m1n.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657492": [
        {
            "ioc_value": "m1ntf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657493": [
        {
            "ioc_value": "m1qv9p.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657494": [
        {
            "ioc_value": "m1r3.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657495": [
        {
            "ioc_value": "m1s.van1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657496": [
        {
            "ioc_value": "m1sty.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657497": [
        {
            "ioc_value": "m1stzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657498": [
        {
            "ioc_value": "m2.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657499": [
        {
            "ioc_value": "m2.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:20",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657476": [
        {
            "ioc_value": "m.g3w2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657477": [
        {
            "ioc_value": "m.j2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657478": [
        {
            "ioc_value": "m.k5b2q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657479": [
        {
            "ioc_value": "m.kdesu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657480": [
        {
            "ioc_value": "m.nugawye78.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657481": [
        {
            "ioc_value": "m0.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657482": [
        {
            "ioc_value": "m0.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657483": [
        {
            "ioc_value": "m0ma.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657484": [
        {
            "ioc_value": "m0q8.mintcraft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657485": [
        {
            "ioc_value": "m0saik.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657486": [
        {
            "ioc_value": "m0thlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657487": [
        {
            "ioc_value": "m0untainveil.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657488": [
        {
            "ioc_value": "m1.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:19",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657461": [
        {
            "ioc_value": "lyjydau5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657462": [
        {
            "ioc_value": "lynxdelta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657463": [
        {
            "ioc_value": "lyqej.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657464": [
        {
            "ioc_value": "lysez.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657465": [
        {
            "ioc_value": "lysys.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657466": [
        {
            "ioc_value": "lysyz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657467": [
        {
            "ioc_value": "lyy.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657468": [
        {
            "ioc_value": "lz.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657469": [
        {
            "ioc_value": "lz.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657470": [
        {
            "ioc_value": "lz3y.gl1tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657471": [
        {
            "ioc_value": "lzmb.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657472": [
        {
            "ioc_value": "m-1-dnightr-0-ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657473": [
        {
            "ioc_value": "m.017fk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657474": [
        {
            "ioc_value": "m.5v05.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657475": [
        {
            "ioc_value": "m.8-fr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:18",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657444": [
        {
            "ioc_value": "lvo.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657445": [
        {
            "ioc_value": "lvory7.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657446": [
        {
            "ioc_value": "lvu.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657447": [
        {
            "ioc_value": "lw.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657448": [
        {
            "ioc_value": "lw.wildsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657449": [
        {
            "ioc_value": "lwch.iunarpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657450": [
        {
            "ioc_value": "lwhkr.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657451": [
        {
            "ioc_value": "lx.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657452": [
        {
            "ioc_value": "lx6.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657453": [
        {
            "ioc_value": "lx88w.fireciiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657454": [
        {
            "ioc_value": "ly.drip-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657455": [
        {
            "ioc_value": "ly.khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657456": [
        {
            "ioc_value": "lydm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657457": [
        {
            "ioc_value": "lyg.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657458": [
        {
            "ioc_value": "lygal.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657459": [
        {
            "ioc_value": "lygep.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657460": [
        {
            "ioc_value": "lyh.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:17",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657429": [
        {
            "ioc_value": "lum3na.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657430": [
        {
            "ioc_value": "lumen.0palsummit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657431": [
        {
            "ioc_value": "lumen.sh4d0wmere.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657432": [
        {
            "ioc_value": "lumyx6.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657433": [
        {
            "ioc_value": "luna1.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657434": [
        {
            "ioc_value": "lupuj.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657435": [
        {
            "ioc_value": "lupus7.wildb1ss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657436": [
        {
            "ioc_value": "lurup.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657437": [
        {
            "ioc_value": "lusoboa3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657438": [
        {
            "ioc_value": "luv-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657439": [
        {
            "ioc_value": "luzazai5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657440": [
        {
            "ioc_value": "lv.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657441": [
        {
            "ioc_value": "lv.w30g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657442": [
        {
            "ioc_value": "lv.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657443": [
        {
            "ioc_value": "lv5j.l0ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:16",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657411": [
        {
            "ioc_value": "lp.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657412": [
        {
            "ioc_value": "lp.skybr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657413": [
        {
            "ioc_value": "lp.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657414": [
        {
            "ioc_value": "lpx.st0nefield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657415": [
        {
            "ioc_value": "lq.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657416": [
        {
            "ioc_value": "lq.k25q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657417": [
        {
            "ioc_value": "lq.ljat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657418": [
        {
            "ioc_value": "lq.pymh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657419": [
        {
            "ioc_value": "lqsvi.inktrap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657420": [
        {
            "ioc_value": "lqwt.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657421": [
        {
            "ioc_value": "lr.stonecl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657422": [
        {
            "ioc_value": "lr.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657423": [
        {
            "ioc_value": "lr.znx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:59:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657424": [
        {
            "ioc_value": "lr9kw.c0rkpr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657425": [
        {
            "ioc_value": "ls.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657426": [
        {
            "ioc_value": "lu.khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657427": [
        {
            "ioc_value": "luck.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657428": [
        {
            "ioc_value": "ludatae4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:15",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657395": [
        {
            "ioc_value": "loom.m-0-on-forger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657396": [
        {
            "ioc_value": "loom.n0v0se1prew.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657397": [
        {
            "ioc_value": "loom.quartzflip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657398": [
        {
            "ioc_value": "loom.suf-1-nau-8-h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657399": [
        {
            "ioc_value": "loom.vorticeye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:58:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657400": [
        {
            "ioc_value": "loom3.fr0gpulse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657401": [
        {
            "ioc_value": "loom5.rumblekin.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657402": [
        {
            "ioc_value": "loom7.fr0gpulse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657403": [
        {
            "ioc_value": "loop6.gr0ssgar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657404": [
        {
            "ioc_value": "lot.cofidyu58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657405": [
        {
            "ioc_value": "lot.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657406": [
        {
            "ioc_value": "lot.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657407": [
        {
            "ioc_value": "lotioniron.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657408": [
        {
            "ioc_value": "lou.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657409": [
        {
            "ioc_value": "love.zytv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:59:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657410": [
        {
            "ioc_value": "lover.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:14",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657380": [
        {
            "ioc_value": "ln.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657381": [
        {
            "ioc_value": "lnq.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657382": [
        {
            "ioc_value": "lnww.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657383": [
        {
            "ioc_value": "lo.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657384": [
        {
            "ioc_value": "lo.pgka9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657385": [
        {
            "ioc_value": "lo.pl-8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657386": [
        {
            "ioc_value": "lo.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657387": [
        {
            "ioc_value": "lo.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657388": [
        {
            "ioc_value": "lo.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:59:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657389": [
        {
            "ioc_value": "lohagoo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657390": [
        {
            "ioc_value": "lolora.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657391": [
        {
            "ioc_value": "lomqa7.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657392": [
        {
            "ioc_value": "long.wildsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657393": [
        {
            "ioc_value": "loom.acidwrench.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657394": [
        {
            "ioc_value": "loom.deltasync.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:13",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657365": [
        {
            "ioc_value": "ljy.r0ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657366": [
        {
            "ioc_value": "lk.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657367": [
        {
            "ioc_value": "lkyb.fr0stp1llar.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657368": [
        {
            "ioc_value": "ll.bxof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657369": [
        {
            "ioc_value": "ll.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657370": [
        {
            "ioc_value": "llb.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:59:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657371": [
        {
            "ioc_value": "lm.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657372": [
        {
            "ioc_value": "lm.rogosie4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657373": [
        {
            "ioc_value": "lm.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657374": [
        {
            "ioc_value": "lmage.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657375": [
        {
            "ioc_value": "lmg.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657376": [
        {
            "ioc_value": "lmh.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657377": [
        {
            "ioc_value": "lmn.bl1nkswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657378": [
        {
            "ioc_value": "lmtdb.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657379": [
        {
            "ioc_value": "lmy0.clear-fog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:12",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657348": [
        {
            "ioc_value": "line2.driftl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657349": [
        {
            "ioc_value": "ling7o.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657350": [
        {
            "ioc_value": "lio.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657351": [
        {
            "ioc_value": "lip.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657352": [
        {
            "ioc_value": "lipog.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657353": [
        {
            "ioc_value": "lisir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657354": [
        {
            "ioc_value": "live.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657355": [
        {
            "ioc_value": "liwamye6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657356": [
        {
            "ioc_value": "lizyf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657357": [
        {
            "ioc_value": "lj.g0sslamp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657358": [
        {
            "ioc_value": "lj.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657359": [
        {
            "ioc_value": "lj.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657360": [
        {
            "ioc_value": "lj.st0rmleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657361": [
        {
            "ioc_value": "lj.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657362": [
        {
            "ioc_value": "lj.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:59:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657363": [
        {
            "ioc_value": "ljat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657364": [
        {
            "ioc_value": "ljh.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:11",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657333": [
        {
            "ioc_value": "licht.oryxbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657334": [
        {
            "ioc_value": "licht.s0ftwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657335": [
        {
            "ioc_value": "licht.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657336": [
        {
            "ioc_value": "licht.silberhain9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657337": [
        {
            "ioc_value": "licht.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657338": [
        {
            "ioc_value": "licht.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657339": [
        {
            "ioc_value": "licht2.c1earwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657340": [
        {
            "ioc_value": "licht2.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657341": [
        {
            "ioc_value": "licht2.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657342": [
        {
            "ioc_value": "licth.crysta1shore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657343": [
        {
            "ioc_value": "lie.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657344": [
        {
            "ioc_value": "life1.l1festone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657345": [
        {
            "ioc_value": "light.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657346": [
        {
            "ioc_value": "lilacdorn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657347": [
        {
            "ioc_value": "limpingmagnitude.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:10",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657317": [
        {
            "ioc_value": "licht.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657318": [
        {
            "ioc_value": "licht.c0nsiumpond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657319": [
        {
            "ioc_value": "licht.cioudbr1nk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657320": [
        {
            "ioc_value": "licht.citrinewald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657321": [
        {
            "ioc_value": "licht.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657322": [
        {
            "ioc_value": "licht.cobaltweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657323": [
        {
            "ioc_value": "licht.cou10sheaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657324": [
        {
            "ioc_value": "licht.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657325": [
        {
            "ioc_value": "licht.darkr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657326": [
        {
            "ioc_value": "licht.dinfectt-0-rs-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657327": [
        {
            "ioc_value": "licht.frostweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657328": [
        {
            "ioc_value": "licht.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657329": [
        {
            "ioc_value": "licht.nebulaquelle3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657330": [
        {
            "ioc_value": "licht.nightspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657331": [
        {
            "ioc_value": "licht.obsidianufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657332": [
        {
            "ioc_value": "licht.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:09",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657303": [
        {
            "ioc_value": "lh.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657304": [
        {
            "ioc_value": "lhf.g0ldenspire.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657305": [
        {
            "ioc_value": "lhf6.mintflash.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657306": [
        {
            "ioc_value": "li.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657307": [
        {
            "ioc_value": "li.pgka9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657308": [
        {
            "ioc_value": "li.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657309": [
        {
            "ioc_value": "li2cht.aphrh1tc4h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657310": [
        {
            "ioc_value": "li90.b1tzdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657311": [
        {
            "ioc_value": "libin5ya3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657312": [
        {
            "ioc_value": "licht.argonbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657313": [
        {
            "ioc_value": "licht.boulderfield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657314": [
        {
            "ioc_value": "licht.brackenloft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657315": [
        {
            "ioc_value": "licht.bramblequell.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657316": [
        {
            "ioc_value": "licht.breezef0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:08",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657293": [
        {
            "ioc_value": "left.kuvuboa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657294": [
        {
            "ioc_value": "lega1.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657295": [
        {
            "ioc_value": "let.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657296": [
        {
            "ioc_value": "let.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657297": [
        {
            "ioc_value": "lf.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657298": [
        {
            "ioc_value": "lf8.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657299": [
        {
            "ioc_value": "lft5.silverklamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657300": [
        {
            "ioc_value": "lg.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657301": [
        {
            "ioc_value": "lg.x73r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:59:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657302": [
        {
            "ioc_value": "lga.5g-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:07",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657281": [
        {
            "ioc_value": "ldx.fireciiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657282": [
        {
            "ioc_value": "le-3-nsnet-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657283": [
        {
            "ioc_value": "le.htif.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657284": [
        {
            "ioc_value": "le.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657285": [
        {
            "ioc_value": "le.t-65-p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657286": [
        {
            "ioc_value": "le6ec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657287": [
        {
            "ioc_value": "leaf.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657288": [
        {
            "ioc_value": "leaf.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657289": [
        {
            "ioc_value": "leaf7y.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657290": [
        {
            "ioc_value": "lean.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657291": [
        {
            "ioc_value": "led.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:59:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657292": [
        {
            "ioc_value": "ledax.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:06",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657269": [
        {
            "ioc_value": "law.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657270": [
        {
            "ioc_value": "laxajia3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657271": [
        {
            "ioc_value": "laz7ee.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657272": [
        {
            "ioc_value": "lb.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657273": [
        {
            "ioc_value": "lb.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657274": [
        {
            "ioc_value": "lbgxn.m0onforger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657275": [
        {
            "ioc_value": "lbs.windfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:58:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657276": [
        {
            "ioc_value": "lc.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657277": [
        {
            "ioc_value": "lc.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657278": [
        {
            "ioc_value": "lc.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657279": [
        {
            "ioc_value": "ld.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657280": [
        {
            "ioc_value": "ldl.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:05",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657267": [
        {
            "ioc_value": "lasxz.drift-shad-0-w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:02",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657268": [
        {
            "ioc_value": "laub.7willowkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:02",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657255": [
        {
            "ioc_value": "lago.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657256": [
        {
            "ioc_value": "laid.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657257": [
        {
            "ioc_value": "lake.snowr1se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657258": [
        {
            "ioc_value": "lake.stormbioom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657259": [
        {
            "ioc_value": "lake2.a5t1gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657260": [
        {
            "ioc_value": "lake5.mistlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657261": [
        {
            "ioc_value": "lake8.miststone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657262": [
        {
            "ioc_value": "lane7.emberiake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657263": [
        {
            "ioc_value": "lap-0-tout-1-ook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657264": [
        {
            "ioc_value": "lap.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657265": [
        {
            "ioc_value": "lap0tout1ook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657266": [
        {
            "ioc_value": "laser1.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:01",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657244": [
        {
            "ioc_value": "la.v-96-g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:58:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657245": [
        {
            "ioc_value": "lab.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657246": [
        {
            "ioc_value": "lab.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657247": [
        {
            "ioc_value": "labs.cogwhittle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657248": [
        {
            "ioc_value": "labs.gr1tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657249": [
        {
            "ioc_value": "labs.quibsnare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657250": [
        {
            "ioc_value": "labs.spryvolt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657251": [
        {
            "ioc_value": "labs0.tweak-mire.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657252": [
        {
            "ioc_value": "lacyfae9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657253": [
        {
            "ioc_value": "lag.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657254": [
        {
            "ioc_value": "lag.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:35:00",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657231": [
        {
            "ioc_value": "l4.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657232": [
        {
            "ioc_value": "l5.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657233": [
        {
            "ioc_value": "l5.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657234": [
        {
            "ioc_value": "l51.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657235": [
        {
            "ioc_value": "l5sd.gl1tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657236": [
        {
            "ioc_value": "l66-v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657237": [
        {
            "ioc_value": "l7ks5.brahtr0phy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657238": [
        {
            "ioc_value": "l8.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657239": [
        {
            "ioc_value": "l8lp.kn-1-fecast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657240": [
        {
            "ioc_value": "l8q.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657241": [
        {
            "ioc_value": "l9.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657242": [
        {
            "ioc_value": "l9.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657243": [
        {
            "ioc_value": "l93r.foamswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:59",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657216": [
        {
            "ioc_value": "l1.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657217": [
        {
            "ioc_value": "l1e.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657218": [
        {
            "ioc_value": "l1festone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657219": [
        {
            "ioc_value": "l1ghtcascade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657220": [
        {
            "ioc_value": "l1t.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657221": [
        {
            "ioc_value": "l2-1-w2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657222": [
        {
            "ioc_value": "l2.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657223": [
        {
            "ioc_value": "l2b9nzt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657224": [
        {
            "ioc_value": "l2u.opalhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657225": [
        {
            "ioc_value": "l2v.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657226": [
        {
            "ioc_value": "l2v.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657227": [
        {
            "ioc_value": "l3.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657228": [
        {
            "ioc_value": "l3.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657229": [
        {
            "ioc_value": "l3.sm0kewood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657230": [
        {
            "ioc_value": "l32.cloudw1re.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:58",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657200": [
        {
            "ioc_value": "kzw.lakeray.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657201": [
        {
            "ioc_value": "l-1-ghtcascade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657202": [
        {
            "ioc_value": "l.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657203": [
        {
            "ioc_value": "l.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657204": [
        {
            "ioc_value": "l.k9u1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657205": [
        {
            "ioc_value": "l.r0z8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657206": [
        {
            "ioc_value": "l.r2h7m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657207": [
        {
            "ioc_value": "l.w-30-g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657208": [
        {
            "ioc_value": "l.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657209": [
        {
            "ioc_value": "l0.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657210": [
        {
            "ioc_value": "l0.simp-7-euna-3-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657211": [
        {
            "ioc_value": "l0.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657212": [
        {
            "ioc_value": "l0a.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657213": [
        {
            "ioc_value": "l0ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657214": [
        {
            "ioc_value": "l0v.driftmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657215": [
        {
            "ioc_value": "l0wer.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:57",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657186": [
        {
            "ioc_value": "kxlv.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657187": [
        {
            "ioc_value": "ky.nxno-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657188": [
        {
            "ioc_value": "kycaj.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657189": [
        {
            "ioc_value": "kyf.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:59:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657190": [
        {
            "ioc_value": "kyjej.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657191": [
        {
            "ioc_value": "kywuzeo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657192": [
        {
            "ioc_value": "kyxuriy8.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657193": [
        {
            "ioc_value": "kz.d-09-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657194": [
        {
            "ioc_value": "kz.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657195": [
        {
            "ioc_value": "kz.gwut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657196": [
        {
            "ioc_value": "kz.harborfreund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657197": [
        {
            "ioc_value": "kz17u.spry-volt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657198": [
        {
            "ioc_value": "kz6t3.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657199": [
        {
            "ioc_value": "kzg.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:56",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657172": [
        {
            "ioc_value": "kujywii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657173": [
        {
            "ioc_value": "kul.ta11y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657174": [
        {
            "ioc_value": "kuqob.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657175": [
        {
            "ioc_value": "kuqogaa4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657176": [
        {
            "ioc_value": "kuvuboa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657177": [
        {
            "ioc_value": "kv.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657178": [
        {
            "ioc_value": "kv5k7.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657179": [
        {
            "ioc_value": "kvt.gl1nterbay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657180": [
        {
            "ioc_value": "kw.digncbe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657181": [
        {
            "ioc_value": "kw.h-73-n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657182": [
        {
            "ioc_value": "kwi.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657183": [
        {
            "ioc_value": "kwk.burydyu0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657184": [
        {
            "ioc_value": "kwxwi.lakeray.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657185": [
        {
            "ioc_value": "kx.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:55",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657156": [
        {
            "ioc_value": "krone.kick5ubs4ance.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657157": [
        {
            "ioc_value": "krone.slatefalke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657158": [
        {
            "ioc_value": "krone.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657159": [
        {
            "ioc_value": "krone.wlnd5hore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657160": [
        {
            "ioc_value": "krone3.wolspfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657161": [
        {
            "ioc_value": "ks.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657162": [
        {
            "ioc_value": "kt.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657163": [
        {
            "ioc_value": "kt.7-fd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657164": [
        {
            "ioc_value": "kt.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657165": [
        {
            "ioc_value": "kt.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657166": [
        {
            "ioc_value": "ktox-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657167": [
        {
            "ioc_value": "ku3.brimhopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657168": [
        {
            "ioc_value": "kuc.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657169": [
        {
            "ioc_value": "kuest5.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657170": [
        {
            "ioc_value": "kugavai4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657171": [
        {
            "ioc_value": "kujim.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:54",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657140": [
        {
            "ioc_value": "kraut.maplerand.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657141": [
        {
            "ioc_value": "kraut.nightf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657142": [
        {
            "ioc_value": "kraut2.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657143": [
        {
            "ioc_value": "kreis.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657144": [
        {
            "ioc_value": "kreis.cloudkreis.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657145": [
        {
            "ioc_value": "kreis.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657146": [
        {
            "ioc_value": "kres8t.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657147": [
        {
            "ioc_value": "kri.xe3ax.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:59:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657148": [
        {
            "ioc_value": "krimp8.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657149": [
        {
            "ioc_value": "krk.halfquark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657150": [
        {
            "ioc_value": "krone.argonbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657151": [
        {
            "ioc_value": "krone.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657152": [
        {
            "ioc_value": "krone.eaglekrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657153": [
        {
            "ioc_value": "krone.echohang.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657154": [
        {
            "ioc_value": "krone.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657155": [
        {
            "ioc_value": "krone.frostweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657125": [
        {
            "ioc_value": "kp.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657126": [
        {
            "ioc_value": "kp.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657127": [
        {
            "ioc_value": "kp.sn-0-wmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657128": [
        {
            "ioc_value": "kp.vbof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657129": [
        {
            "ioc_value": "kp.z99l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:59:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657130": [
        {
            "ioc_value": "kp1.wildsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657131": [
        {
            "ioc_value": "kpow.kn1fecast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657132": [
        {
            "ioc_value": "kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657133": [
        {
            "ioc_value": "kqa.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657134": [
        {
            "ioc_value": "kqwrv.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657135": [
        {
            "ioc_value": "kr.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657136": [
        {
            "ioc_value": "kr1llo.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657137": [
        {
            "ioc_value": "kra2ut.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657138": [
        {
            "ioc_value": "kran7z.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657139": [
        {
            "ioc_value": "kraut.clouddrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:52",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657121": [
        {
            "ioc_value": "korn3.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:51",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657122": [
        {
            "ioc_value": "korn7.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:51",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657123": [
        {
            "ioc_value": "korvo5.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:51",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657124": [
        {
            "ioc_value": "kos-0-ltyu-4-etey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657120": [
        {
            "ioc_value": "kenkeszowo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:47",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657119": [
        {
            "ioc_value": "kamm.in-ha-4-it-mu-1-ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:46",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657118": [
        {
            "ioc_value": "kamm.driftklause.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:45",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657117": [
        {
            "ioc_value": "jat.suf1nau8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:38",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657116": [
        {
            "ioc_value": "hjfng.wavermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:24",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657115": [
        {
            "ioc_value": "hain.cou10sheaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:19",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657114": [
        {
            "ioc_value": "gusty.rainv1sta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:13",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657113": [
        {
            "ioc_value": "geist.spruce5moor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:34:01",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657111": [
        {
            "ioc_value": "g4k.hre-9-in-7-mamma.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:59",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657112": [
        {
            "ioc_value": "ga1e7ajudush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:59",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657110": [
        {
            "ioc_value": "fjord.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:48",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657109": [
        {
            "ioc_value": "fa3lke.nar7owsized.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:43",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657108": [
        {
            "ioc_value": "flow8.1-nyearbo-0-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1657107": [
        {
            "ioc_value": "enrichjtpw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:38",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657106": [
        {
            "ioc_value": "email.shevypro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:37",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657104": [
        {
            "ioc_value": "eiche.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:35",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657105": [
        {
            "ioc_value": "eiche.guan0mesca.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:35",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657102": [
        {
            "ioc_value": "drift.rapidst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:26",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657103": [
        {
            "ioc_value": "drift8.skybl1ss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:26",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657101": [
        {
            "ioc_value": "d17.w1ldforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:15",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657100": [
        {
            "ioc_value": "commi5sfa7t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:33:10",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657099": [
        {
            "ioc_value": "bv.fro5tlane.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:32:51",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657098": [
        {
            "ioc_value": "bruke.s1lvergate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:32:49",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657097": [
        {
            "ioc_value": "bj1s.shad0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:32:42",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657096": [
        {
            "ioc_value": "bach.lindenarc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:32:36",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657095": [
        {
            "ioc_value": "aa.evermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:32:20",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657094": [
        {
            "ioc_value": "6xnq.suncrest0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:32:04",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657093": [
        {
            "ioc_value": "1e8.stonecl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:31:40",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657092": [
        {
            "ioc_value": "ridge.1-nyearbo-0-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1656658": [
        {
            "ioc_value": "modestopowerwashing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 08:24:45",
            "last_seen_utc": "2025-11-28 08:01:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "odyssey",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1657055": [
        {
            "ioc_value": "solidgate8.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 08:22:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Odyssey",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1657056": [
        {
            "ioc_value": "boostbiotics.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 08:22:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Odyssey",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1657058": [
        {
            "ioc_value": "cryptotradesolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 08:22:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Odyssey",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1657059": [
        {
            "ioc_value": "downloamacos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 08:22:57",
            "last_seen_utc": "2025-11-28 08:04:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "Odyssey",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1657061": [
        {
            "ioc_value": "formals.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 08:22:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Odyssey",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1657069": [
        {
            "ioc_value": "bankmantap.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 08:22:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Odyssey",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1657086": [
        {
            "ioc_value": "downmacos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 08:22:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Odyssey",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1657087": [
        {
            "ioc_value": "restaurantdelivery.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-28 08:22:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Odyssey",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1657091": [
        {
            "ioc_value": "ak.1-nyearbo-0-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:17:48",
            "last_seen_utc": "2025-11-28 08:25:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1657090": [
        {
            "ioc_value": "xc2xq.pen-1-sp-7-edef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:13:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1657088": [
        {
            "ioc_value": "trail2.pen-1-sp-7-edef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:05:47",
            "last_seen_utc": "2025-11-28 08:06:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1657067": [
        {
            "ioc_value": "nova5.pen-1-sp-7-edef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 08:01:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1657057": [
        {
            "ioc_value": "d2.pen-1-sp-7-edef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:57:26",
            "last_seen_utc": "2025-11-28 07:58:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1657041": [
        {
            "ioc_value": "korn.hum2nk0str.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657042": [
        {
            "ioc_value": "korn.kab1spr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657043": [
        {
            "ioc_value": "korn.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657044": [
        {
            "ioc_value": "korn.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657045": [
        {
            "ioc_value": "korn.neonbuche.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657046": [
        {
            "ioc_value": "korn.rapidmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657047": [
        {
            "ioc_value": "korn.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657048": [
        {
            "ioc_value": "korn.safebl0ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657049": [
        {
            "ioc_value": "korn.sagehollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657050": [
        {
            "ioc_value": "korn.w1ndmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657051": [
        {
            "ioc_value": "korn.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657052": [
        {
            "ioc_value": "korn.wolkenkueste.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:59:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657053": [
        {
            "ioc_value": "korn1.shadowmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:44",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657027": [
        {
            "ioc_value": "kn5.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657028": [
        {
            "ioc_value": "kna.bl1nkswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657029": [
        {
            "ioc_value": "knot.st1rlingpad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657030": [
        {
            "ioc_value": "ko-8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657031": [
        {
            "ioc_value": "ko.nxno-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657032": [
        {
            "ioc_value": "ko0um.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657033": [
        {
            "ioc_value": "kodulue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657034": [
        {
            "ioc_value": "kogexau9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657035": [
        {
            "ioc_value": "koh2.frostfox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657036": [
        {
            "ioc_value": "koq-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657037": [
        {
            "ioc_value": "korn.ashriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657038": [
        {
            "ioc_value": "korn.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657039": [
        {
            "ioc_value": "korn.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657040": [
        {
            "ioc_value": "korn.f1rst5rup.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:43",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657011": [
        {
            "ioc_value": "klee.ravenquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657012": [
        {
            "ioc_value": "klee.saffronhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657013": [
        {
            "ioc_value": "klee.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657014": [
        {
            "ioc_value": "klee.thistleforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657015": [
        {
            "ioc_value": "klee.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657016": [
        {
            "ioc_value": "klee.walnutsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657017": [
        {
            "ioc_value": "klee3.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657018": [
        {
            "ioc_value": "klee5.co0peratre4er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657019": [
        {
            "ioc_value": "kleea.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657020": [
        {
            "ioc_value": "kleea.st0nedrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657021": [
        {
            "ioc_value": "klif.hollow7ridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657022": [
        {
            "ioc_value": "klippe.ravenbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657023": [
        {
            "ioc_value": "kls.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657024": [
        {
            "ioc_value": "kmg.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657025": [
        {
            "ioc_value": "kn-1-fecast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-28 08:34:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657026": [
        {
            "ioc_value": "kn3.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:42",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656993": [
        {
            "ioc_value": "klee.cometpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656994": [
        {
            "ioc_value": "klee.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656995": [
        {
            "ioc_value": "klee.crystalrun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656996": [
        {
            "ioc_value": "klee.dinfectt0rs0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656997": [
        {
            "ioc_value": "klee.embertarn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656998": [
        {
            "ioc_value": "klee.f1anerchan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656999": [
        {
            "ioc_value": "klee.g0ldmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657000": [
        {
            "ioc_value": "klee.goldtalon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657001": [
        {
            "ioc_value": "klee.grin5cra7ers.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657002": [
        {
            "ioc_value": "klee.heatherpass.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657003": [
        {
            "ioc_value": "klee.ironweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657004": [
        {
            "ioc_value": "klee.ironwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657005": [
        {
            "ioc_value": "klee.kab-1-spr-0-tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657006": [
        {
            "ioc_value": "klee.mintstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657007": [
        {
            "ioc_value": "klee.orionfeld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657008": [
        {
            "ioc_value": "klee.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657009": [
        {
            "ioc_value": "klee.quartzweide4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1657010": [
        {
            "ioc_value": "klee.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:41",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656975": [
        {
            "ioc_value": "kimono.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656976": [
        {
            "ioc_value": "kimybae5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656977": [
        {
            "ioc_value": "kinkbellow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656978": [
        {
            "ioc_value": "kit.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656979": [
        {
            "ioc_value": "kitty58.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656980": [
        {
            "ioc_value": "kiwivey0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656981": [
        {
            "ioc_value": "kizav.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656982": [
        {
            "ioc_value": "kj.rapidst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656983": [
        {
            "ioc_value": "kj.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656984": [
        {
            "ioc_value": "kji.sun0rbit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656985": [
        {
            "ioc_value": "kjyx-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656986": [
        {
            "ioc_value": "kk.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656987": [
        {
            "ioc_value": "kl.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656988": [
        {
            "ioc_value": "kl.xoreniu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656989": [
        {
            "ioc_value": "kld.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656990": [
        {
            "ioc_value": "klee.5ilverm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656991": [
        {
            "ioc_value": "klee.b1ue5pr1lng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656992": [
        {
            "ioc_value": "klee.brassgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:40",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656960": [
        {
            "ioc_value": "kfko-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656961": [
        {
            "ioc_value": "kfko3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656962": [
        {
            "ioc_value": "kfy.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656963": [
        {
            "ioc_value": "kh.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656964": [
        {
            "ioc_value": "kh.z15d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656965": [
        {
            "ioc_value": "khg2e.kos0ltyu4etey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656966": [
        {
            "ioc_value": "khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-28 08:34:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656967": [
        {
            "ioc_value": "khsl.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656968": [
        {
            "ioc_value": "ki.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656969": [
        {
            "ioc_value": "ki.n44s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656970": [
        {
            "ioc_value": "ki.nd-ox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656971": [
        {
            "ioc_value": "ki.pgka9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656972": [
        {
            "ioc_value": "kib.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656973": [
        {
            "ioc_value": "kilnberg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656974": [
        {
            "ioc_value": "kilupya0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:39",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656943": [
        {
            "ioc_value": "keen.vudeh0ae3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656944": [
        {
            "ioc_value": "keeniy8.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656945": [
        {
            "ioc_value": "keenly0.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656946": [
        {
            "ioc_value": "ken.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656947": [
        {
            "ioc_value": "ken.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656948": [
        {
            "ioc_value": "keno1.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656949": [
        {
            "ioc_value": "kenut.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656950": [
        {
            "ioc_value": "kerubuo3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656951": [
        {
            "ioc_value": "kerwp.vexlatch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:58:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656952": [
        {
            "ioc_value": "kestrelwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656953": [
        {
            "ioc_value": "key.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656954": [
        {
            "ioc_value": "key.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656955": [
        {
            "ioc_value": "keyz.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656956": [
        {
            "ioc_value": "kf.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656957": [
        {
            "ioc_value": "kf.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656958": [
        {
            "ioc_value": "kf.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656959": [
        {
            "ioc_value": "kf2.evermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:38",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656929": [
        {
            "ioc_value": "kamm2.br1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656930": [
        {
            "ioc_value": "kamm2.st0necloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656931": [
        {
            "ioc_value": "kamm2.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656932": [
        {
            "ioc_value": "kamm3.m1stwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656933": [
        {
            "ioc_value": "kans.s1nkflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656934": [
        {
            "ioc_value": "kar-2-ku-1-unbuck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656935": [
        {
            "ioc_value": "kar2ku1unbuck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656936": [
        {
            "ioc_value": "kas.orbitalnip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656937": [
        {
            "ioc_value": "kc.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656938": [
        {
            "ioc_value": "kd1.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656939": [
        {
            "ioc_value": "ke.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656940": [
        {
            "ioc_value": "ke.nxno-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656941": [
        {
            "ioc_value": "ke0.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656942": [
        {
            "ioc_value": "ke0.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:37",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656912": [
        {
            "ioc_value": "kamm.br0adtemp1ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656913": [
        {
            "ioc_value": "kamm.darkr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656914": [
        {
            "ioc_value": "kamm.gulag1emur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656915": [
        {
            "ioc_value": "kamm.knollhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656916": [
        {
            "ioc_value": "kamm.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656917": [
        {
            "ioc_value": "kamm.quartzfeder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656918": [
        {
            "ioc_value": "kamm.quartzfuchs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656919": [
        {
            "ioc_value": "kamm.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656920": [
        {
            "ioc_value": "kamm.solarpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656921": [
        {
            "ioc_value": "kamm.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656922": [
        {
            "ioc_value": "kamm.starfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656923": [
        {
            "ioc_value": "kamm.stoneharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656924": [
        {
            "ioc_value": "kamm.titanbirch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656925": [
        {
            "ioc_value": "kamm.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:58:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656926": [
        {
            "ioc_value": "kamm.w1ndstorm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656927": [
        {
            "ioc_value": "kamm.xenonridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656928": [
        {
            "ioc_value": "kamm1.iunarblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:36",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656898": [
        {
            "ioc_value": "k9jc.n-0-rthw-1-nd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656899": [
        {
            "ioc_value": "k9k.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:59:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656900": [
        {
            "ioc_value": "k9r2.drift-bay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656901": [
        {
            "ioc_value": "ka.do-k3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656902": [
        {
            "ioc_value": "ka.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656903": [
        {
            "ioc_value": "ka.pgka9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656904": [
        {
            "ioc_value": "ka.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656905": [
        {
            "ioc_value": "ka.xvqy8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656906": [
        {
            "ioc_value": "ka.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656907": [
        {
            "ioc_value": "kab-1-spr-0-tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-28 08:34:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656908": [
        {
            "ioc_value": "kaf.c0sm1cweld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656909": [
        {
            "ioc_value": "kajec.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656910": [
        {
            "ioc_value": "kalm3m.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656911": [
        {
            "ioc_value": "kamm.awreti3uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:35",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656881": [
        {
            "ioc_value": "k7x.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656882": [
        {
            "ioc_value": "k8.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656883": [
        {
            "ioc_value": "k8.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656884": [
        {
            "ioc_value": "k8.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656885": [
        {
            "ioc_value": "k8.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656886": [
        {
            "ioc_value": "k8.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656887": [
        {
            "ioc_value": "k8.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656888": [
        {
            "ioc_value": "k8.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656889": [
        {
            "ioc_value": "k8.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656890": [
        {
            "ioc_value": "k8.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656891": [
        {
            "ioc_value": "k8jv1m2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656892": [
        {
            "ioc_value": "k8u.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656893": [
        {
            "ioc_value": "k9.3u1y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656894": [
        {
            "ioc_value": "k9.6vwj8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656895": [
        {
            "ioc_value": "k9.7n28r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656896": [
        {
            "ioc_value": "k9.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656897": [
        {
            "ioc_value": "k9.yy88.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:34",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656867": [
        {
            "ioc_value": "k2m.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656868": [
        {
            "ioc_value": "k2v.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656869": [
        {
            "ioc_value": "k2w9e7a.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656870": [
        {
            "ioc_value": "k3.wuk0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656871": [
        {
            "ioc_value": "k3.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656872": [
        {
            "ioc_value": "k32.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656873": [
        {
            "ioc_value": "k4.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656874": [
        {
            "ioc_value": "k4.torque-bud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656875": [
        {
            "ioc_value": "k4nz.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656876": [
        {
            "ioc_value": "k5.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656877": [
        {
            "ioc_value": "k5h.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656878": [
        {
            "ioc_value": "k7.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656879": [
        {
            "ioc_value": "k7t.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656880": [
        {
            "ioc_value": "k7t0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:33",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656850": [
        {
            "ioc_value": "k0.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656851": [
        {
            "ioc_value": "k0.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656852": [
        {
            "ioc_value": "k0n.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656853": [
        {
            "ioc_value": "k0n.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656854": [
        {
            "ioc_value": "k0n.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656855": [
        {
            "ioc_value": "k0n.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656856": [
        {
            "ioc_value": "k0n.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656857": [
        {
            "ioc_value": "k0n.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656859": [
        {
            "ioc_value": "k0n.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656860": [
        {
            "ioc_value": "red0.mor-5-tud-1-es.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1656861": [
        {
            "ioc_value": "k0n.xyc0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656862": [
        {
            "ioc_value": "k0w2j.skyaxe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656863": [
        {
            "ioc_value": "k1.t1ger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656864": [
        {
            "ioc_value": "k17.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656865": [
        {
            "ioc_value": "k1m.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656866": [
        {
            "ioc_value": "k1m7c.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:32",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656832": [
        {
            "ioc_value": "jys.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656833": [
        {
            "ioc_value": "jz.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656834": [
        {
            "ioc_value": "jz.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656835": [
        {
            "ioc_value": "jzs48.plasm-about.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656836": [
        {
            "ioc_value": "jzyc.mintburst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656837": [
        {
            "ioc_value": "k.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656838": [
        {
            "ioc_value": "k.97qm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656839": [
        {
            "ioc_value": "k.j2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656840": [
        {
            "ioc_value": "k.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656841": [
        {
            "ioc_value": "k.r3j5c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656842": [
        {
            "ioc_value": "k.r3l1x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656843": [
        {
            "ioc_value": "k.s836.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656844": [
        {
            "ioc_value": "k0-16.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656845": [
        {
            "ioc_value": "k0.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656846": [
        {
            "ioc_value": "k0.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656847": [
        {
            "ioc_value": "k0.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656848": [
        {
            "ioc_value": "k0.pixelstern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656849": [
        {
            "ioc_value": "k0.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:31",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656813": [
        {
            "ioc_value": "juhx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656814": [
        {
            "ioc_value": "jujg2.br1ghtmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656815": [
        {
            "ioc_value": "jumivue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656816": [
        {
            "ioc_value": "jump2.r1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656817": [
        {
            "ioc_value": "jumpy.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656818": [
        {
            "ioc_value": "jungle.bqet-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656819": [
        {
            "ioc_value": "junm.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656820": [
        {
            "ioc_value": "junyk.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656821": [
        {
            "ioc_value": "jusev.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656822": [
        {
            "ioc_value": "jv.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656823": [
        {
            "ioc_value": "jw.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656824": [
        {
            "ioc_value": "jw.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656825": [
        {
            "ioc_value": "jw.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656826": [
        {
            "ioc_value": "jwr.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656827": [
        {
            "ioc_value": "jx7y.quibsnare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656828": [
        {
            "ioc_value": "jy.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656829": [
        {
            "ioc_value": "jyjev.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656830": [
        {
            "ioc_value": "jyn.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656831": [
        {
            "ioc_value": "jys.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:30",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656799": [
        {
            "ioc_value": "jqp.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656800": [
        {
            "ioc_value": "jrqr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656801": [
        {
            "ioc_value": "js.driftshad0w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656802": [
        {
            "ioc_value": "js.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656803": [
        {
            "ioc_value": "js.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656804": [
        {
            "ioc_value": "jsm.mosatiy4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656805": [
        {
            "ioc_value": "jss.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656806": [
        {
            "ioc_value": "jt.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656807": [
        {
            "ioc_value": "jt.n96f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656808": [
        {
            "ioc_value": "jta2v.nob0dy5yabky.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656809": [
        {
            "ioc_value": "jtd.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656810": [
        {
            "ioc_value": "ju.j-0-tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656811": [
        {
            "ioc_value": "jug.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656812": [
        {
            "ioc_value": "juhup.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:29",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656781": [
        {
            "ioc_value": "jo.xvqy8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656782": [
        {
            "ioc_value": "jo.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656783": [
        {
            "ioc_value": "jog.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656784": [
        {
            "ioc_value": "joneroa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656785": [
        {
            "ioc_value": "jov.cl1ppleap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656786": [
        {
            "ioc_value": "joy-2-way.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656787": [
        {
            "ioc_value": "joy.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656788": [
        {
            "ioc_value": "joy.fucirai75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656789": [
        {
            "ioc_value": "joy.sacyzie58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656790": [
        {
            "ioc_value": "joy.sypyguu85.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656791": [
        {
            "ioc_value": "joy.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656792": [
        {
            "ioc_value": "joy.tydubyo66.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656793": [
        {
            "ioc_value": "jp.braycircuit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656794": [
        {
            "ioc_value": "jp.walowue2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:58:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656795": [
        {
            "ioc_value": "jp.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656796": [
        {
            "ioc_value": "jp6.ic0n1cshore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656797": [
        {
            "ioc_value": "jq.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656798": [
        {
            "ioc_value": "jqk.ravenklause.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:28",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656765": [
        {
            "ioc_value": "jjl.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656766": [
        {
            "ioc_value": "jk.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656767": [
        {
            "ioc_value": "jk.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656768": [
        {
            "ioc_value": "jk.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656769": [
        {
            "ioc_value": "jk.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656770": [
        {
            "ioc_value": "jkf2.gl1nterbay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656771": [
        {
            "ioc_value": "jm.bxof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656772": [
        {
            "ioc_value": "jm.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:58:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656773": [
        {
            "ioc_value": "jn.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656774": [
        {
            "ioc_value": "jnfe1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656775": [
        {
            "ioc_value": "jo.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656776": [
        {
            "ioc_value": "jo.nzki7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656777": [
        {
            "ioc_value": "jo.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656778": [
        {
            "ioc_value": "jo.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656779": [
        {
            "ioc_value": "jo.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656780": [
        {
            "ioc_value": "jo.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:27",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656749": [
        {
            "ioc_value": "jet.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656750": [
        {
            "ioc_value": "jet.zimloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:59:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656751": [
        {
            "ioc_value": "jet8.liner-9-ick.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656752": [
        {
            "ioc_value": "jevun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656753": [
        {
            "ioc_value": "jezyq.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656754": [
        {
            "ioc_value": "jfn.sun-hill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656755": [
        {
            "ioc_value": "jg.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656756": [
        {
            "ioc_value": "jhab.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656757": [
        {
            "ioc_value": "jhk.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656758": [
        {
            "ioc_value": "ji.lkci-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656759": [
        {
            "ioc_value": "jiduh.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656760": [
        {
            "ioc_value": "jijeruy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656761": [
        {
            "ioc_value": "jiky7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656762": [
        {
            "ioc_value": "jiriwia8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656763": [
        {
            "ioc_value": "jix-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656764": [
        {
            "ioc_value": "jjis.qute3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:26",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656736": [
        {
            "ioc_value": "jcr.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656737": [
        {
            "ioc_value": "jcw.nob0dy5yabky.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656738": [
        {
            "ioc_value": "jd.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656739": [
        {
            "ioc_value": "jd.gjat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656740": [
        {
            "ioc_value": "jdiw5.mintflash.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656741": [
        {
            "ioc_value": "jdv.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656742": [
        {
            "ioc_value": "je.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656743": [
        {
            "ioc_value": "je.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656744": [
        {
            "ioc_value": "je5w.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656745": [
        {
            "ioc_value": "je6.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656746": [
        {
            "ioc_value": "jefy.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656747": [
        {
            "ioc_value": "jelif.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656748": [
        {
            "ioc_value": "jet.bash-glider.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:25",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656722": [
        {
            "ioc_value": "jag.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656723": [
        {
            "ioc_value": "jakacea2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656724": [
        {
            "ioc_value": "jam.cr1mpoint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656725": [
        {
            "ioc_value": "jam.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656726": [
        {
            "ioc_value": "jar.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656727": [
        {
            "ioc_value": "jar.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656728": [
        {
            "ioc_value": "jar.zen-and.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:59:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656729": [
        {
            "ioc_value": "jatrophizt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656730": [
        {
            "ioc_value": "jaxusoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656731": [
        {
            "ioc_value": "jb.k25q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656732": [
        {
            "ioc_value": "jb.wtan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656733": [
        {
            "ioc_value": "jbp.icetap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656734": [
        {
            "ioc_value": "jc7.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656735": [
        {
            "ioc_value": "jcof-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:24",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656707": [
        {
            "ioc_value": "j4.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656708": [
        {
            "ioc_value": "j5.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656709": [
        {
            "ioc_value": "j5.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656710": [
        {
            "ioc_value": "j5.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656711": [
        {
            "ioc_value": "j5a.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656712": [
        {
            "ioc_value": "j60.ic0n1cvalley.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656713": [
        {
            "ioc_value": "j68.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656714": [
        {
            "ioc_value": "j6b.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656715": [
        {
            "ioc_value": "j6wk.gyrodesk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656716": [
        {
            "ioc_value": "j83.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656717": [
        {
            "ioc_value": "j8e.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656718": [
        {
            "ioc_value": "ja.lkci-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656719": [
        {
            "ioc_value": "jab.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656720": [
        {
            "ioc_value": "jacket.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656721": [
        {
            "ioc_value": "jade.jadeecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:23",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656695": [
        {
            "ioc_value": "j-6208u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656696": [
        {
            "ioc_value": "j.29rs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656697": [
        {
            "ioc_value": "j.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656698": [
        {
            "ioc_value": "j.c8i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656699": [
        {
            "ioc_value": "j.w6n2t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:58:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656700": [
        {
            "ioc_value": "j0.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656701": [
        {
            "ioc_value": "j0.b3aconz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656702": [
        {
            "ioc_value": "j0e.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656703": [
        {
            "ioc_value": "j0gxn.t1nkerbay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656704": [
        {
            "ioc_value": "j0h.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656705": [
        {
            "ioc_value": "j0n.br1arwild.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656706": [
        {
            "ioc_value": "j2.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:22",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656679": [
        {
            "ioc_value": "ivory.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656680": [
        {
            "ioc_value": "ivs.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656681": [
        {
            "ioc_value": "iw.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656682": [
        {
            "ioc_value": "iw.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656683": [
        {
            "ioc_value": "ix.n0vaharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656684": [
        {
            "ioc_value": "ix.wuhp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656685": [
        {
            "ioc_value": "ixa.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656686": [
        {
            "ioc_value": "ixo.brambleforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656687": [
        {
            "ioc_value": "ixy9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656688": [
        {
            "ioc_value": "iyuu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656689": [
        {
            "ioc_value": "iyw.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656690": [
        {
            "ioc_value": "iz.ede1g0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656691": [
        {
            "ioc_value": "iz.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656692": [
        {
            "ioc_value": "iz.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656693": [
        {
            "ioc_value": "iz.toludye0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656694": [
        {
            "ioc_value": "izw.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:21",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656667": [
        {
            "ioc_value": "it.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-28 08:37:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656668": [
        {
            "ioc_value": "it4.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656669": [
        {
            "ioc_value": "itd.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656670": [
        {
            "ioc_value": "ithc4.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656671": [
        {
            "ioc_value": "its.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656672": [
        {
            "ioc_value": "itz.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656673": [
        {
            "ioc_value": "iu.g69p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656674": [
        {
            "ioc_value": "iu.ht-if.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656675": [
        {
            "ioc_value": "iua.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656676": [
        {
            "ioc_value": "iv.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656677": [
        {
            "ioc_value": "iv.qehucuu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656678": [
        {
            "ioc_value": "iv.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:20",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656659": [
        {
            "ioc_value": "ironweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:19",
            "last_seen_utc": "2025-11-28 08:34:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656660": [
        {
            "ioc_value": "ironwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:19",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656661": [
        {
            "ioc_value": "iru.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:19",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656662": [
        {
            "ioc_value": "is.xvqy8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:19",
            "last_seen_utc": "2025-11-29 09:59:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656663": [
        {
            "ioc_value": "iso.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:19",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656664": [
        {
            "ioc_value": "issue.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:19",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656665": [
        {
            "ioc_value": "isv.cr1mpoint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:19",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656666": [
        {
            "ioc_value": "it.muqu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:19",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656643": [
        {
            "ioc_value": "ioa.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656644": [
        {
            "ioc_value": "ion.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656645": [
        {
            "ioc_value": "ion.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656646": [
        {
            "ioc_value": "ion.v3sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656647": [
        {
            "ioc_value": "ioy.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656648": [
        {
            "ioc_value": "ip.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656649": [
        {
            "ioc_value": "ip1.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656650": [
        {
            "ioc_value": "ipl.dunn0en7el.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656651": [
        {
            "ioc_value": "ipu.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656652": [
        {
            "ioc_value": "iq.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656653": [
        {
            "ioc_value": "iqht.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:59:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656654": [
        {
            "ioc_value": "ircq.brambleholt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656655": [
        {
            "ioc_value": "iro.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656656": [
        {
            "ioc_value": "irodx.embercross.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656657": [
        {
            "ioc_value": "ironbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:18",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656632": [
        {
            "ioc_value": "ikx.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656633": [
        {
            "ioc_value": "in9.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656634": [
        {
            "ioc_value": "indigowelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656635": [
        {
            "ioc_value": "info.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656636": [
        {
            "ioc_value": "inha4itmu1ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656637": [
        {
            "ioc_value": "injj8.kink-bellow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656638": [
        {
            "ioc_value": "ink.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656639": [
        {
            "ioc_value": "inn.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656640": [
        {
            "ioc_value": "inomp.ci6ef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656641": [
        {
            "ioc_value": "inr.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656642": [
        {
            "ioc_value": "io8.oqtx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:17",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656616": [
        {
            "ioc_value": "ig.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656617": [
        {
            "ioc_value": "igf.embertrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656618": [
        {
            "ioc_value": "ignite.gyro-desk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656619": [
        {
            "ioc_value": "ignite6.rumblekin.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656620": [
        {
            "ioc_value": "ih.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656621": [
        {
            "ioc_value": "iha.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:59:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656622": [
        {
            "ioc_value": "ihx.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656623": [
        {
            "ioc_value": "ii.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656624": [
        {
            "ioc_value": "ii.w-30-g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:58:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656625": [
        {
            "ioc_value": "iid.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656626": [
        {
            "ioc_value": "iightcre5t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656627": [
        {
            "ioc_value": "iiu.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656628": [
        {
            "ioc_value": "ij.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656629": [
        {
            "ioc_value": "ik.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656630": [
        {
            "ioc_value": "ik.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656631": [
        {
            "ioc_value": "ik.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:16",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656599": [
        {
            "ioc_value": "id.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656600": [
        {
            "ioc_value": "id.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656601": [
        {
            "ioc_value": "id.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656602": [
        {
            "ioc_value": "id.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656603": [
        {
            "ioc_value": "idb.p1nk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656604": [
        {
            "ioc_value": "ideai55.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656605": [
        {
            "ioc_value": "ie.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656606": [
        {
            "ioc_value": "ie45.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656607": [
        {
            "ioc_value": "ieqs.waveretch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:58:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656608": [
        {
            "ioc_value": "if.boku-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656609": [
        {
            "ioc_value": "if.gify1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656610": [
        {
            "ioc_value": "if.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656611": [
        {
            "ioc_value": "if.lage-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656612": [
        {
            "ioc_value": "if.nzki7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656613": [
        {
            "ioc_value": "if.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656614": [
        {
            "ioc_value": "if.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656615": [
        {
            "ioc_value": "if.xrxo2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:15",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656588": [
        {
            "ioc_value": "ic3.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656589": [
        {
            "ioc_value": "ic3hill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656590": [
        {
            "ioc_value": "ice.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656591": [
        {
            "ioc_value": "ice.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656592": [
        {
            "ioc_value": "ice.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656593": [
        {
            "ioc_value": "ice.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656594": [
        {
            "ioc_value": "icell3.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656595": [
        {
            "ioc_value": "icetap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656596": [
        {
            "ioc_value": "icethornridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656597": [
        {
            "ioc_value": "icey4x.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656598": [
        {
            "ioc_value": "id.madicoo3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:14",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656575": [
        {
            "ioc_value": "ia.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656576": [
        {
            "ioc_value": "ia.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656577": [
        {
            "ioc_value": "ia.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656578": [
        {
            "ioc_value": "ia.wuhp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656579": [
        {
            "ioc_value": "iaz.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656580": [
        {
            "ioc_value": "ib.codecog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656581": [
        {
            "ioc_value": "ib.lakespry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656582": [
        {
            "ioc_value": "ib.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656583": [
        {
            "ioc_value": "ib.stormglade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656584": [
        {
            "ioc_value": "ib.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656585": [
        {
            "ioc_value": "ib.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:58:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656586": [
        {
            "ioc_value": "ibzr2.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656587": [
        {
            "ioc_value": "ic.f-42-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:13",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656563": [
        {
            "ioc_value": "i5.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:58:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656564": [
        {
            "ioc_value": "i5013.kink-bellow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656565": [
        {
            "ioc_value": "i6.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656566": [
        {
            "ioc_value": "i6gx6.s0ftfern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656567": [
        {
            "ioc_value": "i6y.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656568": [
        {
            "ioc_value": "i7b3x8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656569": [
        {
            "ioc_value": "i8.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656570": [
        {
            "ioc_value": "i8.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656571": [
        {
            "ioc_value": "i8.spindle-way.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656572": [
        {
            "ioc_value": "i9.diab4uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656573": [
        {
            "ioc_value": "i987.frostlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656574": [
        {
            "ioc_value": "ia.fjot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:12",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656553": [
        {
            "ioc_value": "i.xqix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656554": [
        {
            "ioc_value": "i0.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656555": [
        {
            "ioc_value": "i0g1ci0tu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656556": [
        {
            "ioc_value": "i10r.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656557": [
        {
            "ioc_value": "i2.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656558": [
        {
            "ioc_value": "i2.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656559": [
        {
            "ioc_value": "i21.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656560": [
        {
            "ioc_value": "i3.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656561": [
        {
            "ioc_value": "i4j.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656562": [
        {
            "ioc_value": "i5.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:11",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656540": [
        {
            "ioc_value": "hx.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656541": [
        {
            "ioc_value": "hx.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656542": [
        {
            "ioc_value": "hx.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656543": [
        {
            "ioc_value": "hx.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656544": [
        {
            "ioc_value": "hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-28 08:34:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656545": [
        {
            "ioc_value": "hyhiqaa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656546": [
        {
            "ioc_value": "hylyqoo2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656547": [
        {
            "ioc_value": "hym.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656548": [
        {
            "ioc_value": "hypyh.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656549": [
        {
            "ioc_value": "hyvin.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656550": [
        {
            "ioc_value": "hyvur.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656551": [
        {
            "ioc_value": "hz.gjat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656552": [
        {
            "ioc_value": "hzr.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:10",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656529": [
        {
            "ioc_value": "hw.3u-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656530": [
        {
            "ioc_value": "hw.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656531": [
        {
            "ioc_value": "hwj.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656532": [
        {
            "ioc_value": "hwke-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656533": [
        {
            "ioc_value": "hwv.rumble-kin.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656534": [
        {
            "ioc_value": "hx.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656535": [
        {
            "ioc_value": "hx.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656536": [
        {
            "ioc_value": "hx.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656537": [
        {
            "ioc_value": "hx.mashrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656538": [
        {
            "ioc_value": "hx.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656539": [
        {
            "ioc_value": "hx.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:09",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656518": [
        {
            "ioc_value": "hv.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656519": [
        {
            "ioc_value": "hv.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656520": [
        {
            "ioc_value": "hv.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656521": [
        {
            "ioc_value": "hv.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656522": [
        {
            "ioc_value": "hv.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656523": [
        {
            "ioc_value": "hv.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656524": [
        {
            "ioc_value": "hv.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656525": [
        {
            "ioc_value": "hv3.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656526": [
        {
            "ioc_value": "hv3.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656527": [
        {
            "ioc_value": "hv4.comp0tsab3e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656528": [
        {
            "ioc_value": "hvg.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:08",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656506": [
        {
            "ioc_value": "hulak.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656507": [
        {
            "ioc_value": "huliq.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656508": [
        {
            "ioc_value": "hum-2-nk-0-str.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656509": [
        {
            "ioc_value": "hum.hop-g3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656510": [
        {
            "ioc_value": "hum.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656511": [
        {
            "ioc_value": "human98.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656512": [
        {
            "ioc_value": "huquw.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656513": [
        {
            "ioc_value": "hush5.bl1zpond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656514": [
        {
            "ioc_value": "husygya3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656515": [
        {
            "ioc_value": "hv.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656516": [
        {
            "ioc_value": "hv.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656517": [
        {
            "ioc_value": "hv.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:07",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656497": [
        {
            "ioc_value": "hspmj.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:06",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656498": [
        {
            "ioc_value": "hu.jnfe-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:06",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656499": [
        {
            "ioc_value": "hu.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:06",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656500": [
        {
            "ioc_value": "hu.storm-harrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:06",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656501": [
        {
            "ioc_value": "hu.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:06",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656502": [
        {
            "ioc_value": "hu.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:06",
            "last_seen_utc": "2025-11-29 09:58:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656503": [
        {
            "ioc_value": "hu41o.ever-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:06",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656504": [
        {
            "ioc_value": "hub.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:06",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656505": [
        {
            "ioc_value": "hue.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:06",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656489": [
        {
            "ioc_value": "hr5.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:05",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656490": [
        {
            "ioc_value": "hrhzf.miststone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:05",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656491": [
        {
            "ioc_value": "hrtf3.clipmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:05",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656492": [
        {
            "ioc_value": "hs.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:05",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656493": [
        {
            "ioc_value": "hs7.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:05",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656494": [
        {
            "ioc_value": "hsd.migyvya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:05",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656495": [
        {
            "ioc_value": "hsew.m1stwander.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:05",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656496": [
        {
            "ioc_value": "hsk.dup1ic4ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:05",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656481": [
        {
            "ioc_value": "hpc.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:04",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656482": [
        {
            "ioc_value": "hpd.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:04",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656483": [
        {
            "ioc_value": "hpqr.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:04",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656484": [
        {
            "ioc_value": "hq.m33h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:04",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656485": [
        {
            "ioc_value": "hqk4.silverrun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:04",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656486": [
        {
            "ioc_value": "hr.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:04",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656487": [
        {
            "ioc_value": "hr.crju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:04",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656488": [
        {
            "ioc_value": "hr3lb.f0rce.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:04",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656480": [
        {
            "ioc_value": "hp.f42s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:03",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656478": [
        {
            "ioc_value": "hp.5g-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:02",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656479": [
        {
            "ioc_value": "hp.8-fr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:02",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656466": [
        {
            "ioc_value": "hop-g3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656467": [
        {
            "ioc_value": "hop.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656468": [
        {
            "ioc_value": "hope.cewyzui61.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656469": [
        {
            "ioc_value": "hot.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656470": [
        {
            "ioc_value": "hover.cl0udvex.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656471": [
        {
            "ioc_value": "hover.fr0stciiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656472": [
        {
            "ioc_value": "hover.st0bepress.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656473": [
        {
            "ioc_value": "hover3.g-0-ss-lamp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656474": [
        {
            "ioc_value": "hover4.ember-trail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656475": [
        {
            "ioc_value": "hovera.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656476": [
        {
            "ioc_value": "hovopuy9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656477": [
        {
            "ioc_value": "hoy.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:01",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656449": [
        {
            "ioc_value": "ho.n2-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656450": [
        {
            "ioc_value": "ho.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656451": [
        {
            "ioc_value": "ho.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656452": [
        {
            "ioc_value": "ho.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656453": [
        {
            "ioc_value": "ho.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656454": [
        {
            "ioc_value": "ho.xrxo2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656455": [
        {
            "ioc_value": "ho.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:59:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656456": [
        {
            "ioc_value": "hobx.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656457": [
        {
            "ioc_value": "hocn9.0palsummit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656458": [
        {
            "ioc_value": "hodef.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656459": [
        {
            "ioc_value": "hodyl.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656460": [
        {
            "ioc_value": "hof.cometlinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656461": [
        {
            "ioc_value": "hokofau92.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656462": [
        {
            "ioc_value": "hollow.softm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656463": [
        {
            "ioc_value": "home.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656464": [
        {
            "ioc_value": "hop-g-3.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656465": [
        {
            "ioc_value": "hop-g3.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:45:00",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656434": [
        {
            "ioc_value": "hl.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656435": [
        {
            "ioc_value": "hl.oqtx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656436": [
        {
            "ioc_value": "hl.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656437": [
        {
            "ioc_value": "hl5n.cl0ckmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656438": [
        {
            "ioc_value": "hlp.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656439": [
        {
            "ioc_value": "hm.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656440": [
        {
            "ioc_value": "hm.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656441": [
        {
            "ioc_value": "hm.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656442": [
        {
            "ioc_value": "hmd.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656443": [
        {
            "ioc_value": "hmn.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656444": [
        {
            "ioc_value": "hmno.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656445": [
        {
            "ioc_value": "hn.silverklamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656446": [
        {
            "ioc_value": "hnaq-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656447": [
        {
            "ioc_value": "hnz.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656448": [
        {
            "ioc_value": "ho.do-k3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:59",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656418": [
        {
            "ioc_value": "hill.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656419": [
        {
            "ioc_value": "hill.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656420": [
        {
            "ioc_value": "him.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656421": [
        {
            "ioc_value": "hip.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656422": [
        {
            "ioc_value": "his.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:59:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656423": [
        {
            "ioc_value": "hit.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656424": [
        {
            "ioc_value": "hiv8.polywhiz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656425": [
        {
            "ioc_value": "hj.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656426": [
        {
            "ioc_value": "hjfct.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656427": [
        {
            "ioc_value": "hk.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656428": [
        {
            "ioc_value": "hk.pymh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656429": [
        {
            "ioc_value": "hk.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656430": [
        {
            "ioc_value": "hkl.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656431": [
        {
            "ioc_value": "hkngj.spindleway.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656432": [
        {
            "ioc_value": "hkz.cieardrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656433": [
        {
            "ioc_value": "hl.bwag.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:58",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656401": [
        {
            "ioc_value": "hhcd.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656402": [
        {
            "ioc_value": "hhxe.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656403": [
        {
            "ioc_value": "hi.dihijio22.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656404": [
        {
            "ioc_value": "hi.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656405": [
        {
            "ioc_value": "hi.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656406": [
        {
            "ioc_value": "hi.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656407": [
        {
            "ioc_value": "hi.n2-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656408": [
        {
            "ioc_value": "hi.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656409": [
        {
            "ioc_value": "hi.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656410": [
        {
            "ioc_value": "hi.sacyzie58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656411": [
        {
            "ioc_value": "hi.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656412": [
        {
            "ioc_value": "hi.xrxo2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656413": [
        {
            "ioc_value": "hid.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656414": [
        {
            "ioc_value": "hid.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656415": [
        {
            "ioc_value": "hid.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656416": [
        {
            "ioc_value": "hifaboa2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656417": [
        {
            "ioc_value": "high.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:57",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656385": [
        {
            "ioc_value": "helij.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656386": [
        {
            "ioc_value": "hen.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656387": [
        {
            "ioc_value": "her.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656388": [
        {
            "ioc_value": "herandhis.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656389": [
        {
            "ioc_value": "herb5.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656390": [
        {
            "ioc_value": "herb5x.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656391": [
        {
            "ioc_value": "herb6x.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656392": [
        {
            "ioc_value": "hew.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656393": [
        {
            "ioc_value": "hexoluy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656394": [
        {
            "ioc_value": "hf.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656395": [
        {
            "ioc_value": "hf.yw9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:59:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656396": [
        {
            "ioc_value": "hfcv.gi-0-wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656397": [
        {
            "ioc_value": "hg.quartz-flip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656398": [
        {
            "ioc_value": "hg.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656399": [
        {
            "ioc_value": "hg.wqix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:59:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656400": [
        {
            "ioc_value": "hh6-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:56",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656370": [
        {
            "ioc_value": "he.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656371": [
        {
            "ioc_value": "he.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656372": [
        {
            "ioc_value": "he.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656373": [
        {
            "ioc_value": "he.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656374": [
        {
            "ioc_value": "he.visa-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:58:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656375": [
        {
            "ioc_value": "he.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656376": [
        {
            "ioc_value": "he2.g-0-ss-lamp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656377": [
        {
            "ioc_value": "heath.beechmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656378": [
        {
            "ioc_value": "heather9.silverklamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656379": [
        {
            "ioc_value": "heaven.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656380": [
        {
            "ioc_value": "heavy.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656381": [
        {
            "ioc_value": "heavy40.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656382": [
        {
            "ioc_value": "heck.qlkwr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656383": [
        {
            "ioc_value": "hel1o.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656384": [
        {
            "ioc_value": "hel9ix.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:55",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656354": [
        {
            "ioc_value": "hck.spindle-way.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656355": [
        {
            "ioc_value": "hd.1nyearbo0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656356": [
        {
            "ioc_value": "hd.n-44-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656357": [
        {
            "ioc_value": "hd.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:59:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656358": [
        {
            "ioc_value": "hd1p.r1mrock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656359": [
        {
            "ioc_value": "hdn.qacacoe3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656360": [
        {
            "ioc_value": "hdxy.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656361": [
        {
            "ioc_value": "he.boku-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656362": [
        {
            "ioc_value": "he.devy-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656363": [
        {
            "ioc_value": "he.fy-7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656364": [
        {
            "ioc_value": "he.harekae65.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656365": [
        {
            "ioc_value": "he.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656366": [
        {
            "ioc_value": "he.lage-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656367": [
        {
            "ioc_value": "he.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656368": [
        {
            "ioc_value": "he.nugawye78.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656369": [
        {
            "ioc_value": "he.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:54",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656340": [
        {
            "ioc_value": "hay.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656341": [
        {
            "ioc_value": "hay.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656342": [
        {
            "ioc_value": "haz3lo.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656343": [
        {
            "ioc_value": "haze.c1earwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656344": [
        {
            "ioc_value": "haze.gl0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656345": [
        {
            "ioc_value": "haze.m1stwander.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656346": [
        {
            "ioc_value": "hazel.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656347": [
        {
            "ioc_value": "hb.cioudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656348": [
        {
            "ioc_value": "hb.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656349": [
        {
            "ioc_value": "hb3.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656350": [
        {
            "ioc_value": "hb9.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656351": [
        {
            "ioc_value": "hbo8.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656352": [
        {
            "ioc_value": "hbr.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656353": [
        {
            "ioc_value": "hc.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:53",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656327": [
        {
            "ioc_value": "harz.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656328": [
        {
            "ioc_value": "harz.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656329": [
        {
            "ioc_value": "harz.ferretpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656330": [
        {
            "ioc_value": "harz.ironklippe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656331": [
        {
            "ioc_value": "harz7a.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656332": [
        {
            "ioc_value": "has.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656333": [
        {
            "ioc_value": "has.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656334": [
        {
            "ioc_value": "hasyzio6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656335": [
        {
            "ioc_value": "hat.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656336": [
        {
            "ioc_value": "haust5.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656337": [
        {
            "ioc_value": "haven.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656338": [
        {
            "ioc_value": "havn3x.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656339": [
        {
            "ioc_value": "hawk.hawkmast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656315": [
        {
            "ioc_value": "halo9r.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656316": [
        {
            "ioc_value": "halox5.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656317": [
        {
            "ioc_value": "ham.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656318": [
        {
            "ioc_value": "hammer.granitekamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656319": [
        {
            "ioc_value": "hammer.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656320": [
        {
            "ioc_value": "hand.gofumoo29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656321": [
        {
            "ioc_value": "handprintobnoxious.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656322": [
        {
            "ioc_value": "hang.glimmerufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656323": [
        {
            "ioc_value": "harbor.mossgrotte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656324": [
        {
            "ioc_value": "harbr.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656325": [
        {
            "ioc_value": "hare.harewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656326": [
        {
            "ioc_value": "harekae65.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:51",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656298": [
        {
            "ioc_value": "hafen.r1verbend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656299": [
        {
            "ioc_value": "hafen.ravenbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656300": [
        {
            "ioc_value": "hafen.rowanstead.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656301": [
        {
            "ioc_value": "hafen.wrenhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:59:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656302": [
        {
            "ioc_value": "hafen2.dinfectt-0-rs-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656303": [
        {
            "ioc_value": "hag.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656304": [
        {
            "ioc_value": "hain.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656305": [
        {
            "ioc_value": "hain.boargrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656306": [
        {
            "ioc_value": "hain.brackenloft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656307": [
        {
            "ioc_value": "hain.cobaltweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656308": [
        {
            "ioc_value": "hain.f1anerchan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656309": [
        {
            "ioc_value": "hain.maplerand.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656310": [
        {
            "ioc_value": "hain.martenhain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656311": [
        {
            "ioc_value": "hain.ravensteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656312": [
        {
            "ioc_value": "hain.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656313": [
        {
            "ioc_value": "hain2.w1ldgate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656314": [
        {
            "ioc_value": "hain3.netit-0-c-0-rec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:50",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656284": [
        {
            "ioc_value": "ha1in.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656285": [
        {
            "ioc_value": "ha2fen.bil1sun8en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656286": [
        {
            "ioc_value": "habyg.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656287": [
        {
            "ioc_value": "had.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656288": [
        {
            "ioc_value": "haf3en.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656289": [
        {
            "ioc_value": "hafen.auricfluss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656290": [
        {
            "ioc_value": "hafen.breezef0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656291": [
        {
            "ioc_value": "hafen.brinewald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656292": [
        {
            "ioc_value": "hafen.dovemantel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656293": [
        {
            "ioc_value": "hafen.emberbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656294": [
        {
            "ioc_value": "hafen.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656295": [
        {
            "ioc_value": "hafen.m1stwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656296": [
        {
            "ioc_value": "hafen.med1aflow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656297": [
        {
            "ioc_value": "hafen.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:49",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656272": [
        {
            "ioc_value": "h9m.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656273": [
        {
            "ioc_value": "h9m.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656274": [
        {
            "ioc_value": "h9m.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656275": [
        {
            "ioc_value": "h9m.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656276": [
        {
            "ioc_value": "h9u.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656277": [
        {
            "ioc_value": "ha.amin0mer3ges.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656278": [
        {
            "ioc_value": "ha.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656279": [
        {
            "ioc_value": "ha.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656280": [
        {
            "ioc_value": "ha.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656281": [
        {
            "ioc_value": "ha.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656282": [
        {
            "ioc_value": "ha.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656283": [
        {
            "ioc_value": "ha.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:48",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656258": [
        {
            "ioc_value": "h9.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:58:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656259": [
        {
            "ioc_value": "h9.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656260": [
        {
            "ioc_value": "h9.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656261": [
        {
            "ioc_value": "h93.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656262": [
        {
            "ioc_value": "h9l.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656263": [
        {
            "ioc_value": "h9m.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656264": [
        {
            "ioc_value": "h9m.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656265": [
        {
            "ioc_value": "h9m.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656266": [
        {
            "ioc_value": "h9m.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656267": [
        {
            "ioc_value": "h9m.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656268": [
        {
            "ioc_value": "h9m.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656269": [
        {
            "ioc_value": "h9m.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656270": [
        {
            "ioc_value": "h9m.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656271": [
        {
            "ioc_value": "h9m.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:47",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656244": [
        {
            "ioc_value": "h79.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656245": [
        {
            "ioc_value": "h7m.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656246": [
        {
            "ioc_value": "h7m.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656247": [
        {
            "ioc_value": "h7m.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656248": [
        {
            "ioc_value": "h7x.glimmerstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656249": [
        {
            "ioc_value": "h8.l-5228.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656250": [
        {
            "ioc_value": "h8jc.cloud5eed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656251": [
        {
            "ioc_value": "h9.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656252": [
        {
            "ioc_value": "h9.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656253": [
        {
            "ioc_value": "h9.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656254": [
        {
            "ioc_value": "h9.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656255": [
        {
            "ioc_value": "h9.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656256": [
        {
            "ioc_value": "h9.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656257": [
        {
            "ioc_value": "h9.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:46",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656227": [
        {
            "ioc_value": "h7.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656228": [
        {
            "ioc_value": "h7.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656229": [
        {
            "ioc_value": "h7.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656230": [
        {
            "ioc_value": "h7.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656231": [
        {
            "ioc_value": "h7.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656232": [
        {
            "ioc_value": "h7.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656233": [
        {
            "ioc_value": "h7.focove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656234": [
        {
            "ioc_value": "h7.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656235": [
        {
            "ioc_value": "h7.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656236": [
        {
            "ioc_value": "h7.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656237": [
        {
            "ioc_value": "h7.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656238": [
        {
            "ioc_value": "h7.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656239": [
        {
            "ioc_value": "h7.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:57:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656240": [
        {
            "ioc_value": "h7.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656241": [
        {
            "ioc_value": "h7.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656242": [
        {
            "ioc_value": "h7.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656243": [
        {
            "ioc_value": "h7.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:45",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656211": [
        {
            "ioc_value": "h3u.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656212": [
        {
            "ioc_value": "h3z2m8b.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656213": [
        {
            "ioc_value": "h4.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656214": [
        {
            "ioc_value": "h4n.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656215": [
        {
            "ioc_value": "h4ptx9.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656216": [
        {
            "ioc_value": "h5.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656217": [
        {
            "ioc_value": "h5.dew-root.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656218": [
        {
            "ioc_value": "h5.vem4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656219": [
        {
            "ioc_value": "h5r.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656220": [
        {
            "ioc_value": "h5z.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656221": [
        {
            "ioc_value": "h6.3u-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656222": [
        {
            "ioc_value": "h6.5h0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656223": [
        {
            "ioc_value": "h6f.wolkenspur3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656224": [
        {
            "ioc_value": "h7.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656225": [
        {
            "ioc_value": "h7.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656226": [
        {
            "ioc_value": "h7.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:44",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656194": [
        {
            "ioc_value": "h2.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656195": [
        {
            "ioc_value": "h27.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656196": [
        {
            "ioc_value": "h28.4qo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656197": [
        {
            "ioc_value": "h2p.rivermote.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656198": [
        {
            "ioc_value": "h2qf.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656199": [
        {
            "ioc_value": "h3.0f78.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656200": [
        {
            "ioc_value": "h3.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656201": [
        {
            "ioc_value": "h3.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656202": [
        {
            "ioc_value": "h3.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656203": [
        {
            "ioc_value": "h3.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656204": [
        {
            "ioc_value": "h3.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656205": [
        {
            "ioc_value": "h3.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656206": [
        {
            "ioc_value": "h3.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656207": [
        {
            "ioc_value": "h3.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656208": [
        {
            "ioc_value": "h3.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656209": [
        {
            "ioc_value": "h3.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656210": [
        {
            "ioc_value": "h3.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:43",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656176": [
        {
            "ioc_value": "h1u.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656177": [
        {
            "ioc_value": "h2.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656178": [
        {
            "ioc_value": "h2.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656179": [
        {
            "ioc_value": "h2.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656180": [
        {
            "ioc_value": "h2.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656181": [
        {
            "ioc_value": "h2.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656182": [
        {
            "ioc_value": "h2.cloverschnee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656183": [
        {
            "ioc_value": "h2.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656184": [
        {
            "ioc_value": "h2.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656185": [
        {
            "ioc_value": "h2.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656186": [
        {
            "ioc_value": "h2.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656187": [
        {
            "ioc_value": "h2.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656188": [
        {
            "ioc_value": "h2.kuq5g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656189": [
        {
            "ioc_value": "h2.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656190": [
        {
            "ioc_value": "h2.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656191": [
        {
            "ioc_value": "h2.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656192": [
        {
            "ioc_value": "h2.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656193": [
        {
            "ioc_value": "h2.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:42",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656158": [
        {
            "ioc_value": "h1.802d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656159": [
        {
            "ioc_value": "h1.8oryn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656160": [
        {
            "ioc_value": "h1.byq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656161": [
        {
            "ioc_value": "h1.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656162": [
        {
            "ioc_value": "h1.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656163": [
        {
            "ioc_value": "h1.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656164": [
        {
            "ioc_value": "h1.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:57:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656165": [
        {
            "ioc_value": "h1.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656166": [
        {
            "ioc_value": "h1.sproutkraft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656167": [
        {
            "ioc_value": "h1.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656168": [
        {
            "ioc_value": "h1.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656169": [
        {
            "ioc_value": "h1.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656170": [
        {
            "ioc_value": "h1.zms-u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:59:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656171": [
        {
            "ioc_value": "h18u.manual-1-sa-1-yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656172": [
        {
            "ioc_value": "h1d.m1dnightr0ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656173": [
        {
            "ioc_value": "h1n.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656174": [
        {
            "ioc_value": "h1p.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656175": [
        {
            "ioc_value": "h1p.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:41",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656141": [
        {
            "ioc_value": "gzt.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656142": [
        {
            "ioc_value": "gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-28 08:34:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656143": [
        {
            "ioc_value": "h-73-n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-28 08:34:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656144": [
        {
            "ioc_value": "h.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656145": [
        {
            "ioc_value": "h.b8a2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656146": [
        {
            "ioc_value": "h.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656147": [
        {
            "ioc_value": "h.g3w2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656148": [
        {
            "ioc_value": "h.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656149": [
        {
            "ioc_value": "h.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656150": [
        {
            "ioc_value": "h.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656151": [
        {
            "ioc_value": "h.t-nin.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656152": [
        {
            "ioc_value": "h.w2r1k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656153": [
        {
            "ioc_value": "h07.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656154": [
        {
            "ioc_value": "h0p.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656155": [
        {
            "ioc_value": "h0p9.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656156": [
        {
            "ioc_value": "h1.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656157": [
        {
            "ioc_value": "h1.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:40",
            "last_seen_utc": "2025-11-29 09:55:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656127": [
        {
            "ioc_value": "gy.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656128": [
        {
            "ioc_value": "gy9.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656129": [
        {
            "ioc_value": "gybivey8.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656130": [
        {
            "ioc_value": "gyke.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656131": [
        {
            "ioc_value": "gynar.twist-nova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656132": [
        {
            "ioc_value": "gypuq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656133": [
        {
            "ioc_value": "gyr.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:58:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656134": [
        {
            "ioc_value": "gysehiy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656135": [
        {
            "ioc_value": "gytat.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656136": [
        {
            "ioc_value": "gytovao5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656137": [
        {
            "ioc_value": "gyvivae7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656138": [
        {
            "ioc_value": "gz.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656139": [
        {
            "ioc_value": "gz.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656140": [
        {
            "ioc_value": "gz.w-30-g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:39",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656110": [
        {
            "ioc_value": "guhv.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656111": [
        {
            "ioc_value": "guket.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656112": [
        {
            "ioc_value": "gum.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:58:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656113": [
        {
            "ioc_value": "gun4.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656114": [
        {
            "ioc_value": "guq.mosatiy4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656115": [
        {
            "ioc_value": "gusex.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656116": [
        {
            "ioc_value": "gust5y.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656117": [
        {
            "ioc_value": "guu.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656118": [
        {
            "ioc_value": "guvytuy5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656119": [
        {
            "ioc_value": "gv8.knackquill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656120": [
        {
            "ioc_value": "gvh.b-3-aconz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656121": [
        {
            "ioc_value": "gw.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656122": [
        {
            "ioc_value": "gw.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656123": [
        {
            "ioc_value": "gw3.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656124": [
        {
            "ioc_value": "gx.braycircuit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656125": [
        {
            "ioc_value": "gxc.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656126": [
        {
            "ioc_value": "gxy.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:38",
            "last_seen_utc": "2025-11-29 09:58:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656095": [
        {
            "ioc_value": "gruen.jadeecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656096": [
        {
            "ioc_value": "gs.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656097": [
        {
            "ioc_value": "gs.f-42-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656098": [
        {
            "ioc_value": "gs.gyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656099": [
        {
            "ioc_value": "gs.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656100": [
        {
            "ioc_value": "gs.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656101": [
        {
            "ioc_value": "gsd.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656102": [
        {
            "ioc_value": "gsj.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656103": [
        {
            "ioc_value": "gstu.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656104": [
        {
            "ioc_value": "gt.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656105": [
        {
            "ioc_value": "gtl.hover-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656106": [
        {
            "ioc_value": "gty6.stonem1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656107": [
        {
            "ioc_value": "gu.p93z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656108": [
        {
            "ioc_value": "gu5.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656109": [
        {
            "ioc_value": "guard.aucti-0-nz-7-ir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:37",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656079": [
        {
            "ioc_value": "greet09.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656080": [
        {
            "ioc_value": "greet4.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656081": [
        {
            "ioc_value": "grid.bash-glider.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656082": [
        {
            "ioc_value": "grid.digncbe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656083": [
        {
            "ioc_value": "grid.joltberry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656084": [
        {
            "ioc_value": "grid.plasmabout.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656085": [
        {
            "ioc_value": "grid.v0rt3xlab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656086": [
        {
            "ioc_value": "grid6.wreckly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656087": [
        {
            "ioc_value": "grizzle.razorplume.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656088": [
        {
            "ioc_value": "grot8o.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656089": [
        {
            "ioc_value": "grotto4.glacialufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656090": [
        {
            "ioc_value": "grotto8.cedarwinkel5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656091": [
        {
            "ioc_value": "grove.hollow7ridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656092": [
        {
            "ioc_value": "grove.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656093": [
        {
            "ioc_value": "grovebach.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656094": [
        {
            "ioc_value": "grst.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:36",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656064": [
        {
            "ioc_value": "grat.cl0udnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656065": [
        {
            "ioc_value": "grat.crimsonwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656066": [
        {
            "ioc_value": "grat.dinfectt-0-rs-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656067": [
        {
            "ioc_value": "grat.dovemantel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656068": [
        {
            "ioc_value": "grat.guan0mesca.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656069": [
        {
            "ioc_value": "grat.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656070": [
        {
            "ioc_value": "grat.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656071": [
        {
            "ioc_value": "grat.stormpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656072": [
        {
            "ioc_value": "grat.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656073": [
        {
            "ioc_value": "grat.w1ndstorm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656074": [
        {
            "ioc_value": "grat4.hum2nk0str.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656075": [
        {
            "ioc_value": "grat5.mintzone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656076": [
        {
            "ioc_value": "grau.driftklause.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656077": [
        {
            "ioc_value": "grau5.stormfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656078": [
        {
            "ioc_value": "grau5e.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:35",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656053": [
        {
            "ioc_value": "gqu3.brightvoyage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656054": [
        {
            "ioc_value": "gr.d-09-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656055": [
        {
            "ioc_value": "gr1nd.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656056": [
        {
            "ioc_value": "gr1tmodule.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-28 08:34:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656057": [
        {
            "ioc_value": "grand.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656058": [
        {
            "ioc_value": "grani-tope.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656059": [
        {
            "ioc_value": "granitehaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656060": [
        {
            "ioc_value": "granitope.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656061": [
        {
            "ioc_value": "grat.aurorafels.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656062": [
        {
            "ioc_value": "grat.brightv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656063": [
        {
            "ioc_value": "grat.citrinewald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:34",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656037": [
        {
            "ioc_value": "go.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:58:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656038": [
        {
            "ioc_value": "go.v7h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656039": [
        {
            "ioc_value": "go.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656040": [
        {
            "ioc_value": "gold.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656041": [
        {
            "ioc_value": "gold.vudujiu33.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656042": [
        {
            "ioc_value": "goldtalon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656043": [
        {
            "ioc_value": "gomocya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656044": [
        {
            "ioc_value": "good.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656045": [
        {
            "ioc_value": "good.tatyziu58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656046": [
        {
            "ioc_value": "gozog.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656047": [
        {
            "ioc_value": "gp.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656048": [
        {
            "ioc_value": "gp3.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656049": [
        {
            "ioc_value": "gq.tundraflip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656050": [
        {
            "ioc_value": "gq.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656051": [
        {
            "ioc_value": "gq9.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656052": [
        {
            "ioc_value": "gqj.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:33",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656020": [
        {
            "ioc_value": "gm.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656021": [
        {
            "ioc_value": "gm.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656022": [
        {
            "ioc_value": "gn.tweak-mire.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656023": [
        {
            "ioc_value": "gnbe2.stoner0ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656024": [
        {
            "ioc_value": "gne.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656025": [
        {
            "ioc_value": "go.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656026": [
        {
            "ioc_value": "go.badejie69.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656027": [
        {
            "ioc_value": "go.boku-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656028": [
        {
            "ioc_value": "go.devy-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656029": [
        {
            "ioc_value": "go.dihijio22.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656030": [
        {
            "ioc_value": "go.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656031": [
        {
            "ioc_value": "go.lage-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656032": [
        {
            "ioc_value": "go.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656033": [
        {
            "ioc_value": "go.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656034": [
        {
            "ioc_value": "go.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656035": [
        {
            "ioc_value": "go.sacyzie58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656036": [
        {
            "ioc_value": "go.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:32",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656004": [
        {
            "ioc_value": "gloww.brightden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656005": [
        {
            "ioc_value": "glu.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656006": [
        {
            "ioc_value": "glue.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656007": [
        {
            "ioc_value": "glut.ashenkrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656008": [
        {
            "ioc_value": "glut.cobaltweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656009": [
        {
            "ioc_value": "glut.eiderquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656010": [
        {
            "ioc_value": "glut.emberbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656011": [
        {
            "ioc_value": "glut.emberkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656012": [
        {
            "ioc_value": "glut.emberweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656013": [
        {
            "ioc_value": "glut.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656014": [
        {
            "ioc_value": "glut.quartzhain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656015": [
        {
            "ioc_value": "glut.ravenkamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656016": [
        {
            "ioc_value": "glut.ravensteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656017": [
        {
            "ioc_value": "glut.saffronhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656018": [
        {
            "ioc_value": "glv7.marble-tug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656019": [
        {
            "ioc_value": "glyphsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:31",
            "last_seen_utc": "2025-11-29 09:55:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655988": [
        {
            "ioc_value": "glimmerufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655989": [
        {
            "ioc_value": "glint.basaltwisp9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655990": [
        {
            "ioc_value": "glint5.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655991": [
        {
            "ioc_value": "glitchpact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-28 08:34:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655992": [
        {
            "ioc_value": "glow.br0adtemp1ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655993": [
        {
            "ioc_value": "glow.gulag1emur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655994": [
        {
            "ioc_value": "glow.rubyraum.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655995": [
        {
            "ioc_value": "glow.starfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655996": [
        {
            "ioc_value": "glow.stargl0w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655997": [
        {
            "ioc_value": "glow.wind-barrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655998": [
        {
            "ioc_value": "glow1.night0ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655999": [
        {
            "ioc_value": "glow1.sunm0tion.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656000": [
        {
            "ioc_value": "glow2.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656001": [
        {
            "ioc_value": "glow2.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656002": [
        {
            "ioc_value": "glowe.aurora1hain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1656003": [
        {
            "ioc_value": "glowe.c1earpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:30",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655974": [
        {
            "ioc_value": "gleis.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655975": [
        {
            "ioc_value": "gleis.neonbuche.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655976": [
        {
            "ioc_value": "gleis.neonkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655977": [
        {
            "ioc_value": "gleis.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655978": [
        {
            "ioc_value": "gleis2.starl1nq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655979": [
        {
            "ioc_value": "gleis3.l1ghtcloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655980": [
        {
            "ioc_value": "gleis3.oceanbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655981": [
        {
            "ioc_value": "glen.g0ldenspire.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655982": [
        {
            "ioc_value": "glide.brim-hopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655983": [
        {
            "ioc_value": "glide.cr1mpoint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655984": [
        {
            "ioc_value": "glide.gl1nterbay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655985": [
        {
            "ioc_value": "glide.twistnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655986": [
        {
            "ioc_value": "glide2.vexlatch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655987": [
        {
            "ioc_value": "glim8r.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:29",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655958": [
        {
            "ioc_value": "gleem.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655959": [
        {
            "ioc_value": "gleis.atlasufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655960": [
        {
            "ioc_value": "gleis.auroralinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655961": [
        {
            "ioc_value": "gleis.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655962": [
        {
            "ioc_value": "gleis.ciearforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655963": [
        {
            "ioc_value": "gleis.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655964": [
        {
            "ioc_value": "gleis.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655965": [
        {
            "ioc_value": "gleis.cometlinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655966": [
        {
            "ioc_value": "gleis.cometpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655967": [
        {
            "ioc_value": "gleis.dawnforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655968": [
        {
            "ioc_value": "gleis.driftklause.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655969": [
        {
            "ioc_value": "gleis.driftkrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655970": [
        {
            "ioc_value": "gleis.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655971": [
        {
            "ioc_value": "gleis.hearthwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655972": [
        {
            "ioc_value": "gleis.ivyvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655973": [
        {
            "ioc_value": "gleis.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:28",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655943": [
        {
            "ioc_value": "gle.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655944": [
        {
            "ioc_value": "gle2is.pr0p0sedtact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655945": [
        {
            "ioc_value": "gleam.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655946": [
        {
            "ioc_value": "gleam.cl1ppleap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655947": [
        {
            "ioc_value": "gleam.crystalcavern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655948": [
        {
            "ioc_value": "gleam.inktrap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655949": [
        {
            "ioc_value": "gleam.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655950": [
        {
            "ioc_value": "gleam.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655951": [
        {
            "ioc_value": "gleam.obsidianpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655952": [
        {
            "ioc_value": "gleam.p0lys5pear.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655953": [
        {
            "ioc_value": "gleam.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655954": [
        {
            "ioc_value": "gleam.st0bepress.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655955": [
        {
            "ioc_value": "gleam.starcresting.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655956": [
        {
            "ioc_value": "gleam.xenonridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:59:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655957": [
        {
            "ioc_value": "gleem.2tannenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:27",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655925": [
        {
            "ioc_value": "glanz.harmfu1tw0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655926": [
        {
            "ioc_value": "glanz.ibexweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655927": [
        {
            "ioc_value": "glanz.kick5ubs4ance.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655928": [
        {
            "ioc_value": "glanz.l1necloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655929": [
        {
            "ioc_value": "glanz.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655930": [
        {
            "ioc_value": "glanz.quartzweide4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655931": [
        {
            "ioc_value": "glanz.quirkforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655932": [
        {
            "ioc_value": "glanz.ravenquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655933": [
        {
            "ioc_value": "glanz.safebl0ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655934": [
        {
            "ioc_value": "glanz.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655935": [
        {
            "ioc_value": "glanz.silvanbruch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655936": [
        {
            "ioc_value": "glanz.silverbirke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655937": [
        {
            "ioc_value": "glanz.st0nebyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655938": [
        {
            "ioc_value": "glanz.stormlaterne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655939": [
        {
            "ioc_value": "glanz.titanbirch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655940": [
        {
            "ioc_value": "glanz5.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655941": [
        {
            "ioc_value": "glanz7.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655942": [
        {
            "ioc_value": "glaug.v1b3forge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:26",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655908": [
        {
            "ioc_value": "glade.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655909": [
        {
            "ioc_value": "glade.night-bloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655910": [
        {
            "ioc_value": "glade.nimbusforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655911": [
        {
            "ioc_value": "glade.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655912": [
        {
            "ioc_value": "glade.shadowmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655913": [
        {
            "ioc_value": "glade.skyblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655914": [
        {
            "ioc_value": "glade.st0necloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655915": [
        {
            "ioc_value": "glade2.bluecr4ft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655916": [
        {
            "ioc_value": "glade2.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655917": [
        {
            "ioc_value": "glade4.clearpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655918": [
        {
            "ioc_value": "gladeeiche.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655919": [
        {
            "ioc_value": "glanz.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655920": [
        {
            "ioc_value": "glanz.c0ldwater.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655921": [
        {
            "ioc_value": "glanz.c1oudmap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655922": [
        {
            "ioc_value": "glanz.cl0udnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655923": [
        {
            "ioc_value": "glanz.co0peratre4er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655924": [
        {
            "ioc_value": "glanz.fl0wbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:25",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655895": [
        {
            "ioc_value": "glaci5.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655896": [
        {
            "ioc_value": "glacial.cedarwinkel5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655897": [
        {
            "ioc_value": "glacial1.glacialufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655898": [
        {
            "ioc_value": "glade.aurorafels.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655899": [
        {
            "ioc_value": "glade.awreti3uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655900": [
        {
            "ioc_value": "glade.br1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655901": [
        {
            "ioc_value": "glade.brightstep.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655902": [
        {
            "ioc_value": "glade.c0dehawk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655903": [
        {
            "ioc_value": "glade.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655904": [
        {
            "ioc_value": "glade.hollow7ridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655905": [
        {
            "ioc_value": "glade.immigrant5p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655906": [
        {
            "ioc_value": "glade.iunarblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655907": [
        {
            "ioc_value": "glade.kab1spr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:24",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655882": [
        {
            "ioc_value": "gjat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-28 08:34:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655883": [
        {
            "ioc_value": "gjin.ever-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655884": [
        {
            "ioc_value": "gk.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655885": [
        {
            "ioc_value": "gk.quartz-leaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655886": [
        {
            "ioc_value": "gk.silversummit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655887": [
        {
            "ioc_value": "gk0.bl1zpond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655888": [
        {
            "ioc_value": "gl.ember-trail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655889": [
        {
            "ioc_value": "gl.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655890": [
        {
            "ioc_value": "gl.w30g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655891": [
        {
            "ioc_value": "gl0ow.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655892": [
        {
            "ioc_value": "gl1mra.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655893": [
        {
            "ioc_value": "gl1nto.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655894": [
        {
            "ioc_value": "gl4ut.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:23",
            "last_seen_utc": "2025-11-29 09:57:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655866": [
        {
            "ioc_value": "gi.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655867": [
        {
            "ioc_value": "gi.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655868": [
        {
            "ioc_value": "gi0x.aucti-0-nz-7-ir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655869": [
        {
            "ioc_value": "gicaz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655870": [
        {
            "ioc_value": "gicomao33.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655871": [
        {
            "ioc_value": "gift.embertrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655872": [
        {
            "ioc_value": "gify1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655873": [
        {
            "ioc_value": "gig.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655874": [
        {
            "ioc_value": "gig.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655875": [
        {
            "ioc_value": "giga.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655876": [
        {
            "ioc_value": "gihiv.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655877": [
        {
            "ioc_value": "gin.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655878": [
        {
            "ioc_value": "gin.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655879": [
        {
            "ioc_value": "ginger.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655880": [
        {
            "ioc_value": "giowrust.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655881": [
        {
            "ioc_value": "gj.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:22",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655851": [
        {
            "ioc_value": "gf.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655852": [
        {
            "ioc_value": "gfddx.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655853": [
        {
            "ioc_value": "gg.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655854": [
        {
            "ioc_value": "gg.f1rewall.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655855": [
        {
            "ioc_value": "gg.z15d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:59:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655856": [
        {
            "ioc_value": "gg6.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655857": [
        {
            "ioc_value": "ggww.c-0-sm-1-cweld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655858": [
        {
            "ioc_value": "gh.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655859": [
        {
            "ioc_value": "gh.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655860": [
        {
            "ioc_value": "ghc.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655861": [
        {
            "ioc_value": "ghi.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655862": [
        {
            "ioc_value": "ghi.ritenoo3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655863": [
        {
            "ioc_value": "ghsi.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655864": [
        {
            "ioc_value": "ghu.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655865": [
        {
            "ioc_value": "gi.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:21",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655837": [
        {
            "ioc_value": "geist.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655838": [
        {
            "ioc_value": "geist.grin5cra7ers.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655839": [
        {
            "ioc_value": "geist.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655840": [
        {
            "ioc_value": "geist.quillwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655841": [
        {
            "ioc_value": "geist.rap1d5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655842": [
        {
            "ioc_value": "geneqey6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655843": [
        {
            "ioc_value": "gepinui5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655844": [
        {
            "ioc_value": "gesamiu2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655845": [
        {
            "ioc_value": "geskw.silversummit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655846": [
        {
            "ioc_value": "gesz.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655847": [
        {
            "ioc_value": "get.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655848": [
        {
            "ioc_value": "get.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655849": [
        {
            "ioc_value": "gevicii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655850": [
        {
            "ioc_value": "gevujya5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:20",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655824": [
        {
            "ioc_value": "gd.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655825": [
        {
            "ioc_value": "gd.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655826": [
        {
            "ioc_value": "gdfm0.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655827": [
        {
            "ioc_value": "gdk.f1rewall.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655828": [
        {
            "ioc_value": "ge-s4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655829": [
        {
            "ioc_value": "ge.jnfe-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655830": [
        {
            "ioc_value": "ge.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655831": [
        {
            "ioc_value": "ge.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655832": [
        {
            "ioc_value": "ge1.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655833": [
        {
            "ioc_value": "gee.c0ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655834": [
        {
            "ioc_value": "gef.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:58:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655835": [
        {
            "ioc_value": "gefof6ua3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655836": [
        {
            "ioc_value": "geist.cioudbr1nk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:19",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655813": [
        {
            "ioc_value": "gas.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655814": [
        {
            "ioc_value": "gas.v3sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655815": [
        {
            "ioc_value": "gas3en.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655816": [
        {
            "ioc_value": "gasse.stoatgasse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655817": [
        {
            "ioc_value": "gate5.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:59:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655818": [
        {
            "ioc_value": "gate8.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655819": [
        {
            "ioc_value": "gazecoe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655820": [
        {
            "ioc_value": "gb.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655821": [
        {
            "ioc_value": "gb.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655822": [
        {
            "ioc_value": "gb.t-65-p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655823": [
        {
            "ioc_value": "gci.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:18",
            "last_seen_utc": "2025-11-29 09:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655801": [
        {
            "ioc_value": "gab.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655802": [
        {
            "ioc_value": "gab.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655803": [
        {
            "ioc_value": "gad.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655804": [
        {
            "ioc_value": "gag.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655805": [
        {
            "ioc_value": "gale.m00nweaver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655806": [
        {
            "ioc_value": "gale2.rock-bay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655807": [
        {
            "ioc_value": "gale7x.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655808": [
        {
            "ioc_value": "gap.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655809": [
        {
            "ioc_value": "gap.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655810": [
        {
            "ioc_value": "gaquh6ee7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655811": [
        {
            "ioc_value": "garnetschmiede.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655812": [
        {
            "ioc_value": "gas.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:17",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655789": [
        {
            "ioc_value": "g6ur4.zenbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655790": [
        {
            "ioc_value": "g7.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655791": [
        {
            "ioc_value": "g7.mossowl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655792": [
        {
            "ioc_value": "g70.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655793": [
        {
            "ioc_value": "g74n.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655794": [
        {
            "ioc_value": "g8f.opal-hollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655795": [
        {
            "ioc_value": "g8p.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655796": [
        {
            "ioc_value": "g8z.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655797": [
        {
            "ioc_value": "g9.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655798": [
        {
            "ioc_value": "ga.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655799": [
        {
            "ioc_value": "ga.nqju-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655800": [
        {
            "ioc_value": "ga9.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:16",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655774": [
        {
            "ioc_value": "g3.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655775": [
        {
            "ioc_value": "g3i6.tanglehook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655776": [
        {
            "ioc_value": "g4.cogwhittle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655777": [
        {
            "ioc_value": "g4.hovermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655778": [
        {
            "ioc_value": "g42.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655779": [
        {
            "ioc_value": "g46dfgdf65h.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655780": [
        {
            "ioc_value": "g4h.clearfog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655781": [
        {
            "ioc_value": "g4j.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655782": [
        {
            "ioc_value": "g4v.glimmerstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655783": [
        {
            "ioc_value": "g5.onyxmorgen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655784": [
        {
            "ioc_value": "g5.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655785": [
        {
            "ioc_value": "g5ph.morrowplug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655786": [
        {
            "ioc_value": "g60.1ronpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655787": [
        {
            "ioc_value": "g69p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655788": [
        {
            "ioc_value": "g6u.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:15",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655761": [
        {
            "ioc_value": "g0.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655762": [
        {
            "ioc_value": "g0.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655763": [
        {
            "ioc_value": "g04s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655764": [
        {
            "ioc_value": "g0pv.saffronjet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655765": [
        {
            "ioc_value": "g1.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655766": [
        {
            "ioc_value": "g1.s1lver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655767": [
        {
            "ioc_value": "g1l6m9p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655768": [
        {
            "ioc_value": "g1s.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655769": [
        {
            "ioc_value": "g2.j0tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655770": [
        {
            "ioc_value": "g2.sn-0-wmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655771": [
        {
            "ioc_value": "g2p4n8.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655772": [
        {
            "ioc_value": "g3.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655773": [
        {
            "ioc_value": "g3.plasmabout.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:14",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655744": [
        {
            "ioc_value": "g.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655745": [
        {
            "ioc_value": "g.l9a5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655746": [
        {
            "ioc_value": "g.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655747": [
        {
            "ioc_value": "g.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655748": [
        {
            "ioc_value": "g.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655749": [
        {
            "ioc_value": "g.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655750": [
        {
            "ioc_value": "g.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655751": [
        {
            "ioc_value": "g.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655752": [
        {
            "ioc_value": "g.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655753": [
        {
            "ioc_value": "g.t4g9w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655754": [
        {
            "ioc_value": "g.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655755": [
        {
            "ioc_value": "g.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655756": [
        {
            "ioc_value": "g.x8q0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655757": [
        {
            "ioc_value": "g.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655758": [
        {
            "ioc_value": "g.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655759": [
        {
            "ioc_value": "g.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655760": [
        {
            "ioc_value": "g0.de-6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:13",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655729": [
        {
            "ioc_value": "g.3u1y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655730": [
        {
            "ioc_value": "g.527w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655731": [
        {
            "ioc_value": "g.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655732": [
        {
            "ioc_value": "g.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655733": [
        {
            "ioc_value": "g.9715w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655734": [
        {
            "ioc_value": "g.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655735": [
        {
            "ioc_value": "g.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655736": [
        {
            "ioc_value": "g.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655737": [
        {
            "ioc_value": "g.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655738": [
        {
            "ioc_value": "g.falconhimmel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655739": [
        {
            "ioc_value": "g.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655740": [
        {
            "ioc_value": "g.fid1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655741": [
        {
            "ioc_value": "g.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655742": [
        {
            "ioc_value": "g.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655743": [
        {
            "ioc_value": "g.kilut4ou8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:12",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655714": [
        {
            "ioc_value": "fx3r.mor5tud1es.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655715": [
        {
            "ioc_value": "fxh.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655716": [
        {
            "ioc_value": "fy.c0deroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655717": [
        {
            "ioc_value": "fyh-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655718": [
        {
            "ioc_value": "fyi67.fr0gpulse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655719": [
        {
            "ioc_value": "fyp.glitch-pact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655720": [
        {
            "ioc_value": "fyqup.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655721": [
        {
            "ioc_value": "fytytii7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655722": [
        {
            "ioc_value": "fywuk.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655723": [
        {
            "ioc_value": "fz.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655724": [
        {
            "ioc_value": "fz.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655725": [
        {
            "ioc_value": "fz7.zpozu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:59:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655726": [
        {
            "ioc_value": "g-0-ss-lamp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655727": [
        {
            "ioc_value": "g.13-yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655728": [
        {
            "ioc_value": "g.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:11",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655695": [
        {
            "ioc_value": "funke.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655696": [
        {
            "ioc_value": "funke5.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655697": [
        {
            "ioc_value": "fur.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655698": [
        {
            "ioc_value": "fut.cioudriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655699": [
        {
            "ioc_value": "fv.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655700": [
        {
            "ioc_value": "fv.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655701": [
        {
            "ioc_value": "fv.xx-os.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:59:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655702": [
        {
            "ioc_value": "fv5.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655703": [
        {
            "ioc_value": "fvb.ci6ef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655704": [
        {
            "ioc_value": "fvfsf.meltquark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655705": [
        {
            "ioc_value": "fvz.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655706": [
        {
            "ioc_value": "fw.r1ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655707": [
        {
            "ioc_value": "fwi.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655708": [
        {
            "ioc_value": "fwwls.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655709": [
        {
            "ioc_value": "fx.plx5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655710": [
        {
            "ioc_value": "fx.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655711": [
        {
            "ioc_value": "fx.sn0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655712": [
        {
            "ioc_value": "fx.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:58:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655713": [
        {
            "ioc_value": "fx.z15d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:10",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655679": [
        {
            "ioc_value": "fsrm.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655680": [
        {
            "ioc_value": "fst.fl0wstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655681": [
        {
            "ioc_value": "ftb.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655682": [
        {
            "ioc_value": "fth.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655683": [
        {
            "ioc_value": "ftp.wtan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655684": [
        {
            "ioc_value": "fu.nqju-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655685": [
        {
            "ioc_value": "fucirai75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655686": [
        {
            "ioc_value": "fujacya3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655687": [
        {
            "ioc_value": "fukuq.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655688": [
        {
            "ioc_value": "full.cofidyu58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655689": [
        {
            "ioc_value": "fumet3.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655690": [
        {
            "ioc_value": "fun.cawyfie51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655691": [
        {
            "ioc_value": "fun.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655692": [
        {
            "ioc_value": "fun.fucirai75.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655693": [
        {
            "ioc_value": "fun.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655694": [
        {
            "ioc_value": "fun.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:09",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655665": [
        {
            "ioc_value": "frost7.shadowf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655666": [
        {
            "ioc_value": "frost7.st0y70renka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655667": [
        {
            "ioc_value": "frost8.silverr0ot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655668": [
        {
            "ioc_value": "frost9.snowdr1ft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655669": [
        {
            "ioc_value": "frostindigo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655670": [
        {
            "ioc_value": "frostweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-28 08:33:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655671": [
        {
            "ioc_value": "froz7y.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655672": [
        {
            "ioc_value": "frqyt.gl-1-tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655673": [
        {
            "ioc_value": "frt.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655674": [
        {
            "ioc_value": "fry.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655675": [
        {
            "ioc_value": "fs.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655676": [
        {
            "ioc_value": "fs.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655677": [
        {
            "ioc_value": "fs.glacialufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655678": [
        {
            "ioc_value": "fs.xx-os.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:08",
            "last_seen_utc": "2025-11-29 09:55:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655648": [
        {
            "ioc_value": "fr0stx.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655649": [
        {
            "ioc_value": "fr3sha.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655650": [
        {
            "ioc_value": "frakt8.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655651": [
        {
            "ioc_value": "free.homohay31.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655652": [
        {
            "ioc_value": "free.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655653": [
        {
            "ioc_value": "fresh.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655654": [
        {
            "ioc_value": "fresh1.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655655": [
        {
            "ioc_value": "frilldash.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655656": [
        {
            "ioc_value": "fro.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655657": [
        {
            "ioc_value": "fro5tlane.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655658": [
        {
            "ioc_value": "front95.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655659": [
        {
            "ioc_value": "frost-wilder.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655660": [
        {
            "ioc_value": "frost.dovemantel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655661": [
        {
            "ioc_value": "frost.ede1g0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655662": [
        {
            "ioc_value": "frost.icylotus.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655663": [
        {
            "ioc_value": "frost2.oceanshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655664": [
        {
            "ioc_value": "frost5.clearspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:07",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655635": [
        {
            "ioc_value": "foxa3n.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655636": [
        {
            "ioc_value": "foxklippe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655637": [
        {
            "ioc_value": "fp.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655638": [
        {
            "ioc_value": "fpqr.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655639": [
        {
            "ioc_value": "fpzu.ic0n1cvalley.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655640": [
        {
            "ioc_value": "fq.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655641": [
        {
            "ioc_value": "fq8.r1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655642": [
        {
            "ioc_value": "fr.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655643": [
        {
            "ioc_value": "fr.d42n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655644": [
        {
            "ioc_value": "fr.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655645": [
        {
            "ioc_value": "fr.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655646": [
        {
            "ioc_value": "fr.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655647": [
        {
            "ioc_value": "fr.wuhp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:06",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655620": [
        {
            "ioc_value": "forest.heatherkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655621": [
        {
            "ioc_value": "forest.stormbiend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655622": [
        {
            "ioc_value": "forest1.waveb0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655623": [
        {
            "ioc_value": "forest2.waveb0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:58:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655624": [
        {
            "ioc_value": "forge.joltberry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655625": [
        {
            "ioc_value": "forge.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655626": [
        {
            "ioc_value": "forge4.cl0udvex.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655627": [
        {
            "ioc_value": "forge7.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655628": [
        {
            "ioc_value": "forge9.codecog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655629": [
        {
            "ioc_value": "forty.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655630": [
        {
            "ioc_value": "forward.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655631": [
        {
            "ioc_value": "four.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655632": [
        {
            "ioc_value": "fox.0-pal-summit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655633": [
        {
            "ioc_value": "fox.c1earwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655634": [
        {
            "ioc_value": "fox3den.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:05",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655607": [
        {
            "ioc_value": "fo.nqju-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655608": [
        {
            "ioc_value": "foam.t1nkerbay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655609": [
        {
            "ioc_value": "focu546.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655610": [
        {
            "ioc_value": "focus.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655611": [
        {
            "ioc_value": "foggy.mistytrai1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655612": [
        {
            "ioc_value": "foggy6.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655613": [
        {
            "ioc_value": "fohf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655614": [
        {
            "ioc_value": "fola.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655615": [
        {
            "ioc_value": "folew.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655616": [
        {
            "ioc_value": "fop.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655617": [
        {
            "ioc_value": "foqin.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655618": [
        {
            "ioc_value": "forest.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655619": [
        {
            "ioc_value": "forest.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:04",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655600": [
        {
            "ioc_value": "flx.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:03",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655601": [
        {
            "ioc_value": "fm.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:03",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655602": [
        {
            "ioc_value": "fn.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:03",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655603": [
        {
            "ioc_value": "fnnl.windowl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:03",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655604": [
        {
            "ioc_value": "fnw9.n-0-rthw-1-nd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:03",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655605": [
        {
            "ioc_value": "fo.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:03",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655606": [
        {
            "ioc_value": "fo.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:03",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655599": [
        {
            "ioc_value": "flux3.t1nkerbay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:02",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655586": [
        {
            "ioc_value": "fluss.br-0-ad-temp-1-ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655587": [
        {
            "ioc_value": "fluss.granitekamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655588": [
        {
            "ioc_value": "fluss.nickelweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655589": [
        {
            "ioc_value": "fluss.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655590": [
        {
            "ioc_value": "fluss.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655591": [
        {
            "ioc_value": "fluss.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655592": [
        {
            "ioc_value": "fluss8.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655593": [
        {
            "ioc_value": "flux.brahtr0phy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655594": [
        {
            "ioc_value": "flux.drip-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655595": [
        {
            "ioc_value": "flux.flint-zoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655596": [
        {
            "ioc_value": "flux.j0tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655597": [
        {
            "ioc_value": "flux.qu1rkfuse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655598": [
        {
            "ioc_value": "flux0.quant-melt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:01",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655572": [
        {
            "ioc_value": "flc.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655573": [
        {
            "ioc_value": "flint-zoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655574": [
        {
            "ioc_value": "flint.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655575": [
        {
            "ioc_value": "flintwerder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-28 08:33:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655576": [
        {
            "ioc_value": "flintwiese.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655577": [
        {
            "ioc_value": "flip.tundra-flip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655578": [
        {
            "ioc_value": "flour.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655579": [
        {
            "ioc_value": "flow.drift-meadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655580": [
        {
            "ioc_value": "flow2.st-0-y-70-renka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655581": [
        {
            "ioc_value": "flp3.st1ltforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655582": [
        {
            "ioc_value": "flug.cranezeit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655583": [
        {
            "ioc_value": "flug.owlflug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655584": [
        {
            "ioc_value": "flurr6.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655585": [
        {
            "ioc_value": "fluss.1ittleriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:44:00",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655556": [
        {
            "ioc_value": "fl.h73n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655557": [
        {
            "ioc_value": "fl0wbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655558": [
        {
            "ioc_value": "fl3uss.test6yvarn1sh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655559": [
        {
            "ioc_value": "fl9.hre-9-in-7-mamma.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655560": [
        {
            "ioc_value": "fla5h.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655561": [
        {
            "ioc_value": "flair.firer1dge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655562": [
        {
            "ioc_value": "flak8e.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655563": [
        {
            "ioc_value": "flar4e.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655564": [
        {
            "ioc_value": "flare.iunarpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655565": [
        {
            "ioc_value": "flare.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655566": [
        {
            "ioc_value": "flare.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655567": [
        {
            "ioc_value": "flare.suncrest0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655568": [
        {
            "ioc_value": "flare.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655569": [
        {
            "ioc_value": "flare9.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655570": [
        {
            "ioc_value": "flash.st0neflash.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655571": [
        {
            "ioc_value": "flash7.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:59",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655541": [
        {
            "ioc_value": "fjord.quillwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655542": [
        {
            "ioc_value": "fjord.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655543": [
        {
            "ioc_value": "fjord.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655544": [
        {
            "ioc_value": "fjord.wolkenhof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655545": [
        {
            "ioc_value": "fjord3.in-ha-4-it-mu-1-ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655546": [
        {
            "ioc_value": "fjord6.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655547": [
        {
            "ioc_value": "fjord7a.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655548": [
        {
            "ioc_value": "fjordkante.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655549": [
        {
            "ioc_value": "fjot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655550": [
        {
            "ioc_value": "fk6.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655551": [
        {
            "ioc_value": "fk8.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655552": [
        {
            "ioc_value": "fkk.fireciiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655553": [
        {
            "ioc_value": "fkk4m.iunarpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655554": [
        {
            "ioc_value": "fkl7.redm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655555": [
        {
            "ioc_value": "fl.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655525": [
        {
            "ioc_value": "fjord.c0ldwater.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655526": [
        {
            "ioc_value": "fjord.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655527": [
        {
            "ioc_value": "fjord.cioudbr1nk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655528": [
        {
            "ioc_value": "fjord.co0peratre4er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655529": [
        {
            "ioc_value": "fjord.copperhang.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655530": [
        {
            "ioc_value": "fjord.elmquarry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655531": [
        {
            "ioc_value": "fjord.f1rst5rup.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655532": [
        {
            "ioc_value": "fjord.glimmerstrand.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655533": [
        {
            "ioc_value": "fjord.gulag1emur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655534": [
        {
            "ioc_value": "fjord.knollhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655535": [
        {
            "ioc_value": "fjord.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655536": [
        {
            "ioc_value": "fjord.maplerand.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655537": [
        {
            "ioc_value": "fjord.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655538": [
        {
            "ioc_value": "fjord.ny4lp8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655539": [
        {
            "ioc_value": "fjord.oceantrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655540": [
        {
            "ioc_value": "fjord.polarhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:57",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655510": [
        {
            "ioc_value": "fisop.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655511": [
        {
            "ioc_value": "fit.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655512": [
        {
            "ioc_value": "fit.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655513": [
        {
            "ioc_value": "fivel.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655514": [
        {
            "ioc_value": "fiwyj.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655515": [
        {
            "ioc_value": "fix-fg.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655516": [
        {
            "ioc_value": "fix-fg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655517": [
        {
            "ioc_value": "fix.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655518": [
        {
            "ioc_value": "fix.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655519": [
        {
            "ioc_value": "fj.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655520": [
        {
            "ioc_value": "fj.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655521": [
        {
            "ioc_value": "fjd.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655522": [
        {
            "ioc_value": "fjord.alderquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655523": [
        {
            "ioc_value": "fjord.ashriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655524": [
        {
            "ioc_value": "fjord.bluecr4ft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:56",
            "last_seen_utc": "2025-11-29 09:55:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655493": [
        {
            "ioc_value": "fidoqi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655494": [
        {
            "ioc_value": "fight.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655495": [
        {
            "ioc_value": "fih.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:58:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655496": [
        {
            "ioc_value": "fikp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655497": [
        {
            "ioc_value": "file.yy88.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:59:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655498": [
        {
            "ioc_value": "fimy5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655499": [
        {
            "ioc_value": "fin.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655500": [
        {
            "ioc_value": "fipuq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655501": [
        {
            "ioc_value": "fiqyg2oa3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655502": [
        {
            "ioc_value": "fire.4y3e4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655503": [
        {
            "ioc_value": "fire.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655504": [
        {
            "ioc_value": "fire.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655505": [
        {
            "ioc_value": "fire2.mintforest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655506": [
        {
            "ioc_value": "fire2.wildsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655507": [
        {
            "ioc_value": "firn.frostwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655508": [
        {
            "ioc_value": "firn2.snowdr1ft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655509": [
        {
            "ioc_value": "firn5a.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:55",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655479": [
        {
            "ioc_value": "fg.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655480": [
        {
            "ioc_value": "fg.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655481": [
        {
            "ioc_value": "fg7.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655482": [
        {
            "ioc_value": "fgq.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655483": [
        {
            "ioc_value": "fh.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655484": [
        {
            "ioc_value": "fh0.j935.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655485": [
        {
            "ioc_value": "fh6.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655486": [
        {
            "ioc_value": "fh9.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655487": [
        {
            "ioc_value": "fhp.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655488": [
        {
            "ioc_value": "fi.nqju-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655489": [
        {
            "ioc_value": "fi7em.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655490": [
        {
            "ioc_value": "fi9yr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655491": [
        {
            "ioc_value": "fiber.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655492": [
        {
            "ioc_value": "ficht4.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:54",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655465": [
        {
            "ioc_value": "fels2.awreti-3-uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655466": [
        {
            "ioc_value": "femar.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655467": [
        {
            "ioc_value": "feqy.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655468": [
        {
            "ioc_value": "feral4.wildb1ss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655469": [
        {
            "ioc_value": "fern.br-1-ar-wild.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655470": [
        {
            "ioc_value": "fern2.gl0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655471": [
        {
            "ioc_value": "fern2.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655472": [
        {
            "ioc_value": "feuer.emberkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655473": [
        {
            "ioc_value": "few.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655474": [
        {
            "ioc_value": "few.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655475": [
        {
            "ioc_value": "few.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655476": [
        {
            "ioc_value": "ff.gwut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655477": [
        {
            "ioc_value": "ff0.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:56:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655478": [
        {
            "ioc_value": "ffng5.qu1ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:53",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655451": [
        {
            "ioc_value": "fe.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655452": [
        {
            "ioc_value": "fe.xx-os.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655453": [
        {
            "ioc_value": "feld.harewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655454": [
        {
            "ioc_value": "fels.badgerfels.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655455": [
        {
            "ioc_value": "fels.brackenloft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655456": [
        {
            "ioc_value": "fels.bramblequell.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655457": [
        {
            "ioc_value": "fels.cobaltspore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655458": [
        {
            "ioc_value": "fels.glaciergrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655459": [
        {
            "ioc_value": "fels.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655460": [
        {
            "ioc_value": "fels.oryxbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655461": [
        {
            "ioc_value": "fels.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655462": [
        {
            "ioc_value": "fels.sageufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655463": [
        {
            "ioc_value": "fels.shadowtal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655464": [
        {
            "ioc_value": "fels.w1ndmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:52",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655434": [
        {
            "ioc_value": "far.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655435": [
        {
            "ioc_value": "farav.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655436": [
        {
            "ioc_value": "farm.gofumoo29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655437": [
        {
            "ioc_value": "farn.heatherquell.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655438": [
        {
            "ioc_value": "farn.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655439": [
        {
            "ioc_value": "fast.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655440": [
        {
            "ioc_value": "fat.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655441": [
        {
            "ioc_value": "fauna.driftkrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655442": [
        {
            "ioc_value": "favop.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655443": [
        {
            "ioc_value": "fb.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655444": [
        {
            "ioc_value": "fb.vbof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:58:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655445": [
        {
            "ioc_value": "fc.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655446": [
        {
            "ioc_value": "fcq.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655447": [
        {
            "ioc_value": "fd.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655448": [
        {
            "ioc_value": "fd.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655449": [
        {
            "ioc_value": "fe.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655450": [
        {
            "ioc_value": "fe.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:51",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655418": [
        {
            "ioc_value": "falke.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655419": [
        {
            "ioc_value": "falke.silvanbruch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655420": [
        {
            "ioc_value": "falke.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655421": [
        {
            "ioc_value": "falke.thrushmere.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655422": [
        {
            "ioc_value": "falke.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655423": [
        {
            "ioc_value": "falke.willowgrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655424": [
        {
            "ioc_value": "falke.wolspfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:59:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655425": [
        {
            "ioc_value": "falke1.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655426": [
        {
            "ioc_value": "falke1.starcresting.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655427": [
        {
            "ioc_value": "falke2.g0ldmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655428": [
        {
            "ioc_value": "falx.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655429": [
        {
            "ioc_value": "fapigya6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655430": [
        {
            "ioc_value": "faqyw.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655431": [
        {
            "ioc_value": "far.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655432": [
        {
            "ioc_value": "far.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655433": [
        {
            "ioc_value": "far.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655402": [
        {
            "ioc_value": "fa1se4.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655403": [
        {
            "ioc_value": "fab.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655404": [
        {
            "ioc_value": "fab.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655405": [
        {
            "ioc_value": "faberiy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655406": [
        {
            "ioc_value": "fad.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655407": [
        {
            "ioc_value": "fadoj.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655408": [
        {
            "ioc_value": "fairy.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655409": [
        {
            "ioc_value": "faith47.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655410": [
        {
            "ioc_value": "falke.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655411": [
        {
            "ioc_value": "falke.crystalrun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655412": [
        {
            "ioc_value": "falke.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655413": [
        {
            "ioc_value": "falke.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655414": [
        {
            "ioc_value": "falke.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655415": [
        {
            "ioc_value": "falke.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655416": [
        {
            "ioc_value": "falke.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655417": [
        {
            "ioc_value": "falke.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:49",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655388": [
        {
            "ioc_value": "f78.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655389": [
        {
            "ioc_value": "f7r3e.ember-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655390": [
        {
            "ioc_value": "f83w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655391": [
        {
            "ioc_value": "f8s.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655392": [
        {
            "ioc_value": "f8t.emberfrontier.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655393": [
        {
            "ioc_value": "f9.h-0-bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655394": [
        {
            "ioc_value": "f9r.v0rt3xlab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655395": [
        {
            "ioc_value": "fa.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655396": [
        {
            "ioc_value": "fa.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655397": [
        {
            "ioc_value": "fa.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655398": [
        {
            "ioc_value": "fa.silverpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655399": [
        {
            "ioc_value": "fa.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655400": [
        {
            "ioc_value": "fa.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655401": [
        {
            "ioc_value": "fa.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:48",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655371": [
        {
            "ioc_value": "f1g.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655372": [
        {
            "ioc_value": "f1o.twistnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655373": [
        {
            "ioc_value": "f1oor.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655374": [
        {
            "ioc_value": "f1rst5rup.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-28 08:33:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655375": [
        {
            "ioc_value": "f2a.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655376": [
        {
            "ioc_value": "f3.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655377": [
        {
            "ioc_value": "f3.orbitling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655378": [
        {
            "ioc_value": "f4.fr0stciiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655379": [
        {
            "ioc_value": "f42s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655380": [
        {
            "ioc_value": "f4gdp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655381": [
        {
            "ioc_value": "f4vc.clearfog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655382": [
        {
            "ioc_value": "f5.night-bloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655383": [
        {
            "ioc_value": "f5.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655384": [
        {
            "ioc_value": "f5e.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655385": [
        {
            "ioc_value": "f5rp.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655386": [
        {
            "ioc_value": "f6.b-18a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655387": [
        {
            "ioc_value": "f6.ce1im.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:47",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655356": [
        {
            "ioc_value": "eyuy.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655357": [
        {
            "ioc_value": "eyv.v0xelspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:58:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655358": [
        {
            "ioc_value": "ez.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655359": [
        {
            "ioc_value": "ez.tundraflip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655360": [
        {
            "ioc_value": "f-42-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-28 08:33:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655361": [
        {
            "ioc_value": "f.l8o6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655362": [
        {
            "ioc_value": "f.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655363": [
        {
            "ioc_value": "f.p2j4k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655364": [
        {
            "ioc_value": "f.r2h7m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655365": [
        {
            "ioc_value": "f0b.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655366": [
        {
            "ioc_value": "f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-28 08:33:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655367": [
        {
            "ioc_value": "f1.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655368": [
        {
            "ioc_value": "f1.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655369": [
        {
            "ioc_value": "f1.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655370": [
        {
            "ioc_value": "f15yw.cioudriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:46",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655338": [
        {
            "ioc_value": "ew-w3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655339": [
        {
            "ioc_value": "ew.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655340": [
        {
            "ioc_value": "ew3.crju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655341": [
        {
            "ioc_value": "ew4.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655342": [
        {
            "ioc_value": "ewd.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655343": [
        {
            "ioc_value": "ewgmd.patchvine.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655344": [
        {
            "ioc_value": "ewm.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655345": [
        {
            "ioc_value": "ewo.0fv1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655346": [
        {
            "ioc_value": "ex.de-6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655347": [
        {
            "ioc_value": "ex.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655348": [
        {
            "ioc_value": "ex.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655349": [
        {
            "ioc_value": "ex.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655350": [
        {
            "ioc_value": "ex.t65p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655351": [
        {
            "ioc_value": "ex.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655352": [
        {
            "ioc_value": "ex.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655353": [
        {
            "ioc_value": "ex1st.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655354": [
        {
            "ioc_value": "ex6.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655355": [
        {
            "ioc_value": "ey.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:45",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655321": [
        {
            "ioc_value": "essay8.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655322": [
        {
            "ioc_value": "et.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655323": [
        {
            "ioc_value": "et.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655324": [
        {
            "ioc_value": "et.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655325": [
        {
            "ioc_value": "et.ve1vet0rchid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655326": [
        {
            "ioc_value": "et.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655327": [
        {
            "ioc_value": "et.xrhu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655328": [
        {
            "ioc_value": "eu.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655329": [
        {
            "ioc_value": "eu.p93z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655330": [
        {
            "ioc_value": "eu.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655331": [
        {
            "ioc_value": "eu5.fogmap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655332": [
        {
            "ioc_value": "ev.r1ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655333": [
        {
            "ioc_value": "ev.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655334": [
        {
            "ioc_value": "event.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655335": [
        {
            "ioc_value": "event53.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655336": [
        {
            "ioc_value": "ever-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655337": [
        {
            "ioc_value": "evo.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:44",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655303": [
        {
            "ioc_value": "er.k25q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655304": [
        {
            "ioc_value": "er.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655305": [
        {
            "ioc_value": "er.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655306": [
        {
            "ioc_value": "er.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655307": [
        {
            "ioc_value": "er.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655308": [
        {
            "ioc_value": "er.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:57:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655309": [
        {
            "ioc_value": "er.xrhu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655310": [
        {
            "ioc_value": "era.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655311": [
        {
            "ioc_value": "erq.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655312": [
        {
            "ioc_value": "ers.logyvai.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655313": [
        {
            "ioc_value": "erz.nickelweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655314": [
        {
            "ioc_value": "es.fenod.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655315": [
        {
            "ioc_value": "es.jaxdrill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655316": [
        {
            "ioc_value": "es.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655317": [
        {
            "ioc_value": "es.xrhu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:59:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655318": [
        {
            "ioc_value": "es5.m0tor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655319": [
        {
            "ioc_value": "esa.spryvolt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655320": [
        {
            "ioc_value": "esf.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:43",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655286": [
        {
            "ioc_value": "enjoy.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655287": [
        {
            "ioc_value": "enjoy.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655288": [
        {
            "ioc_value": "enq.moss-owl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655289": [
        {
            "ioc_value": "ent.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655290": [
        {
            "ioc_value": "eo.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655291": [
        {
            "ioc_value": "ep.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655292": [
        {
            "ioc_value": "ep.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655293": [
        {
            "ioc_value": "ep.v96g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655294": [
        {
            "ioc_value": "epq8.t1decrystai.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655295": [
        {
            "ioc_value": "epw.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655296": [
        {
            "ioc_value": "eq.g-69-p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655297": [
        {
            "ioc_value": "eq.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655298": [
        {
            "ioc_value": "eq.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655299": [
        {
            "ioc_value": "eqt.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655300": [
        {
            "ioc_value": "eqwxe.heatherkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655301": [
        {
            "ioc_value": "er.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655302": [
        {
            "ioc_value": "er.hop-g-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:42",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655275": [
        {
            "ioc_value": "embergrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655276": [
        {
            "ioc_value": "emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-28 08:33:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655277": [
        {
            "ioc_value": "emberiake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655278": [
        {
            "ioc_value": "emberkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655279": [
        {
            "ioc_value": "emberkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-28 08:33:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655280": [
        {
            "ioc_value": "embertarn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-28 08:33:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655281": [
        {
            "ioc_value": "embertrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-28 08:33:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655282": [
        {
            "ioc_value": "emc.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655283": [
        {
            "ioc_value": "empty4.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655284": [
        {
            "ioc_value": "end.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655285": [
        {
            "ioc_value": "end.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:41",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655260": [
        {
            "ioc_value": "em.pl-8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655261": [
        {
            "ioc_value": "em.w-30-g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655262": [
        {
            "ioc_value": "em.xrhu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655263": [
        {
            "ioc_value": "em8ix.st0neflash.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655264": [
        {
            "ioc_value": "ember-cloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655265": [
        {
            "ioc_value": "ember-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655266": [
        {
            "ioc_value": "ember.basaltwisp9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655267": [
        {
            "ioc_value": "ember.emberfrontier.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655268": [
        {
            "ioc_value": "ember.sh4d0wmere.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655269": [
        {
            "ioc_value": "ember.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655270": [
        {
            "ioc_value": "ember.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655271": [
        {
            "ioc_value": "ember5.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655272": [
        {
            "ioc_value": "ember6.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655273": [
        {
            "ioc_value": "emberbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-28 08:33:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655274": [
        {
            "ioc_value": "embercloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:40",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655243": [
        {
            "ioc_value": "eiyxc.fl0wbud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655244": [
        {
            "ioc_value": "eju.ju-4-en-pare-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655245": [
        {
            "ioc_value": "ek.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655246": [
        {
            "ioc_value": "el.mxta6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655247": [
        {
            "ioc_value": "el.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655248": [
        {
            "ioc_value": "el.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655249": [
        {
            "ioc_value": "el.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655250": [
        {
            "ioc_value": "el4.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655251": [
        {
            "ioc_value": "elder77.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655252": [
        {
            "ioc_value": "elite.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655253": [
        {
            "ioc_value": "elk.yw9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655254": [
        {
            "ioc_value": "elmquarry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655255": [
        {
            "ioc_value": "els.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655256": [
        {
            "ioc_value": "eltw.p1nk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655257": [
        {
            "ioc_value": "em.cl0udmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655258": [
        {
            "ioc_value": "em.mxta6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655259": [
        {
            "ioc_value": "em.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:39",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655225": [
        {
            "ioc_value": "eiche.quartzhain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655226": [
        {
            "ioc_value": "eiche.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655227": [
        {
            "ioc_value": "eiche.starfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655228": [
        {
            "ioc_value": "eiche.wolkenhof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:59:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655229": [
        {
            "ioc_value": "eiche4.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655230": [
        {
            "ioc_value": "eiderquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655231": [
        {
            "ioc_value": "eis.c0nsiumpond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655232": [
        {
            "ioc_value": "eis.copperhang.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655233": [
        {
            "ioc_value": "eis.crimsonwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655234": [
        {
            "ioc_value": "eis.frostwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655235": [
        {
            "ioc_value": "eis.icylotus.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655236": [
        {
            "ioc_value": "eis.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655237": [
        {
            "ioc_value": "eis.nebulaquelle3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655238": [
        {
            "ioc_value": "eis.obsidianpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655239": [
        {
            "ioc_value": "eis.solarpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655240": [
        {
            "ioc_value": "eis.stormgrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655241": [
        {
            "ioc_value": "eis3en.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655242": [
        {
            "ioc_value": "eiui.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:38",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655207": [
        {
            "ioc_value": "ehu.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655208": [
        {
            "ioc_value": "ei.a-5-t-1-gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655209": [
        {
            "ioc_value": "ei.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655210": [
        {
            "ioc_value": "ei.sun-hill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655211": [
        {
            "ioc_value": "ei3.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655212": [
        {
            "ioc_value": "eich3e.nar7owsized.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655213": [
        {
            "ioc_value": "eiche.alderquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655214": [
        {
            "ioc_value": "eiche.boargrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655215": [
        {
            "ioc_value": "eiche.bramblequell.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655216": [
        {
            "ioc_value": "eiche.brassgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655217": [
        {
            "ioc_value": "eiche.brightf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655218": [
        {
            "ioc_value": "eiche.dustycode.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655219": [
        {
            "ioc_value": "eiche.harmfu1tw0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655220": [
        {
            "ioc_value": "eiche.ibexweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655221": [
        {
            "ioc_value": "eiche.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655222": [
        {
            "ioc_value": "eiche.neonkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655223": [
        {
            "ioc_value": "eiche.oryxbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655224": [
        {
            "ioc_value": "eiche.platinumvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:37",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655189": [
        {
            "ioc_value": "ef.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655190": [
        {
            "ioc_value": "ef.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655191": [
        {
            "ioc_value": "ef.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:59:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655192": [
        {
            "ioc_value": "efu.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655193": [
        {
            "ioc_value": "eg.bxof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655194": [
        {
            "ioc_value": "eg.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655195": [
        {
            "ioc_value": "eg.z-99-l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655196": [
        {
            "ioc_value": "egg.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655197": [
        {
            "ioc_value": "egg.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655198": [
        {
            "ioc_value": "ego.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655199": [
        {
            "ioc_value": "eh.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655200": [
        {
            "ioc_value": "eh.mxta6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655201": [
        {
            "ioc_value": "eh.p2-om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655202": [
        {
            "ioc_value": "eh.pl-8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655203": [
        {
            "ioc_value": "eh.s4-ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655204": [
        {
            "ioc_value": "eh.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655205": [
        {
            "ioc_value": "eh.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655206": [
        {
            "ioc_value": "ehgf.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:36",
            "last_seen_utc": "2025-11-29 09:55:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655173": [
        {
            "ioc_value": "echo9.r1verbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655174": [
        {
            "ioc_value": "echo9.snowr1se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655175": [
        {
            "ioc_value": "echo9.vorticeye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655176": [
        {
            "ioc_value": "echozauber.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655177": [
        {
            "ioc_value": "ecke.jadeecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655178": [
        {
            "ioc_value": "eclipsenebel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655179": [
        {
            "ioc_value": "ed.dgod.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655180": [
        {
            "ioc_value": "ed.lkci1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655181": [
        {
            "ioc_value": "ed.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:58:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655182": [
        {
            "ioc_value": "ed.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655183": [
        {
            "ioc_value": "ede1g0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-28 08:33:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655184": [
        {
            "ioc_value": "edh.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655185": [
        {
            "ioc_value": "ee2x.w1ldforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655186": [
        {
            "ioc_value": "eel.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655187": [
        {
            "ioc_value": "ef.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655188": [
        {
            "ioc_value": "ef.mxta6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:35",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655157": [
        {
            "ioc_value": "ebn.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655158": [
        {
            "ioc_value": "ebonyecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655159": [
        {
            "ioc_value": "ebrk.evermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655160": [
        {
            "ioc_value": "ec.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655161": [
        {
            "ioc_value": "ec.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655162": [
        {
            "ioc_value": "echo.cloudw1re.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655163": [
        {
            "ioc_value": "echo.embercross.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655164": [
        {
            "ioc_value": "echo.flintzoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655165": [
        {
            "ioc_value": "echo.galy8phony.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655166": [
        {
            "ioc_value": "echo.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655167": [
        {
            "ioc_value": "echo.m0rning.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655168": [
        {
            "ioc_value": "echo.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655169": [
        {
            "ioc_value": "echo.suf1nau8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655170": [
        {
            "ioc_value": "echo.vorticeye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655171": [
        {
            "ioc_value": "echo3.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655172": [
        {
            "ioc_value": "echo5.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:34",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655142": [
        {
            "ioc_value": "e7f.oqtx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655143": [
        {
            "ioc_value": "e8.gleamspan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655144": [
        {
            "ioc_value": "e8.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655145": [
        {
            "ioc_value": "e8.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655146": [
        {
            "ioc_value": "e8rgy.softm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655147": [
        {
            "ioc_value": "e9u.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655148": [
        {
            "ioc_value": "e9v.morrow-plug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655149": [
        {
            "ioc_value": "ea.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655150": [
        {
            "ioc_value": "ea.n44s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655151": [
        {
            "ioc_value": "eaa.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655152": [
        {
            "ioc_value": "eager.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655153": [
        {
            "ioc_value": "earth.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655154": [
        {
            "ioc_value": "earth48.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655155": [
        {
            "ioc_value": "easy57.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655156": [
        {
            "ioc_value": "eatery.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:33",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652007": [
        {
            "ioc_value": "secure-719-process-3384.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1655124": [
        {
            "ioc_value": "e0s.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655125": [
        {
            "ioc_value": "e1.lobd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655126": [
        {
            "ioc_value": "e15.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655127": [
        {
            "ioc_value": "e1is.aphrh1tc4h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655128": [
        {
            "ioc_value": "e2.97jt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655129": [
        {
            "ioc_value": "e2.neoniake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655130": [
        {
            "ioc_value": "e2h.s0ftmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655131": [
        {
            "ioc_value": "e31.stormblink.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655132": [
        {
            "ioc_value": "e4.fog-map.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655133": [
        {
            "ioc_value": "e4.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655134": [
        {
            "ioc_value": "e4e.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655135": [
        {
            "ioc_value": "e4r6k9l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655136": [
        {
            "ioc_value": "e5.paradeabend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655137": [
        {
            "ioc_value": "e5.skyaxe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655138": [
        {
            "ioc_value": "e5.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655139": [
        {
            "ioc_value": "e5ch1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655140": [
        {
            "ioc_value": "e5say.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655141": [
        {
            "ioc_value": "e6.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:32",
            "last_seen_utc": "2025-11-29 09:55:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655106": [
        {
            "ioc_value": "e.g0s1f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655107": [
        {
            "ioc_value": "e.hap7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655108": [
        {
            "ioc_value": "e.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655109": [
        {
            "ioc_value": "e.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655110": [
        {
            "ioc_value": "e.kilut4ou8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655111": [
        {
            "ioc_value": "e.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655112": [
        {
            "ioc_value": "e.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655113": [
        {
            "ioc_value": "e.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655114": [
        {
            "ioc_value": "e.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655115": [
        {
            "ioc_value": "e.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655116": [
        {
            "ioc_value": "e.s3i1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655117": [
        {
            "ioc_value": "e.t8g2w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655118": [
        {
            "ioc_value": "e.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655119": [
        {
            "ioc_value": "e.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655120": [
        {
            "ioc_value": "e.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655121": [
        {
            "ioc_value": "e.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655122": [
        {
            "ioc_value": "e.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:55:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655123": [
        {
            "ioc_value": "e0.meltquark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:31",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655091": [
        {
            "ioc_value": "dy1ov.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655092": [
        {
            "ioc_value": "dy6ap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655093": [
        {
            "ioc_value": "dygn8.ic0n1cshore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655094": [
        {
            "ioc_value": "dyy.raven-flux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655095": [
        {
            "ioc_value": "dz.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655096": [
        {
            "ioc_value": "dz.quartzweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655097": [
        {
            "ioc_value": "dzqz.waver-mint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:58:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655098": [
        {
            "ioc_value": "dzthj.dup-1-ic-4-ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655099": [
        {
            "ioc_value": "e.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655100": [
        {
            "ioc_value": "e.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655101": [
        {
            "ioc_value": "e.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655102": [
        {
            "ioc_value": "e.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655103": [
        {
            "ioc_value": "e.b8c90.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655104": [
        {
            "ioc_value": "e.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655105": [
        {
            "ioc_value": "e.focove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:30",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652012": [
        {
            "ioc_value": "auth-909-check-142-3895.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1655074": [
        {
            "ioc_value": "dusk1.darksun5et.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655075": [
        {
            "ioc_value": "duskpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655076": [
        {
            "ioc_value": "dusoxio1.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655077": [
        {
            "ioc_value": "dustycode.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-28 08:33:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655078": [
        {
            "ioc_value": "duwixoi9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655079": [
        {
            "ioc_value": "dv.kesogio6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:56:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655080": [
        {
            "ioc_value": "dv.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655081": [
        {
            "ioc_value": "dvi.1ronpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655082": [
        {
            "ioc_value": "dvwct.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655083": [
        {
            "ioc_value": "dw.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655084": [
        {
            "ioc_value": "dw.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655085": [
        {
            "ioc_value": "dwl.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655086": [
        {
            "ioc_value": "dwo.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655087": [
        {
            "ioc_value": "dwr.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655088": [
        {
            "ioc_value": "dy.mxta-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655089": [
        {
            "ioc_value": "dy.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655090": [
        {
            "ioc_value": "dy.z15d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:29",
            "last_seen_utc": "2025-11-29 09:55:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655057": [
        {
            "ioc_value": "dune.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655058": [
        {
            "ioc_value": "dune.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655059": [
        {
            "ioc_value": "dune.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655060": [
        {
            "ioc_value": "dune.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655061": [
        {
            "ioc_value": "dune.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655062": [
        {
            "ioc_value": "dune.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655063": [
        {
            "ioc_value": "dune.silentwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655064": [
        {
            "ioc_value": "dune.storm-harrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655065": [
        {
            "ioc_value": "dune.willowsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655066": [
        {
            "ioc_value": "dune.wolkenkueste.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655067": [
        {
            "ioc_value": "dune2.shad0wline.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655068": [
        {
            "ioc_value": "dune3.skyblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655069": [
        {
            "ioc_value": "dune3.softl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:57:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655070": [
        {
            "ioc_value": "dune3.storml1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655071": [
        {
            "ioc_value": "dune4.0ceanleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655072": [
        {
            "ioc_value": "dune4.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655073": [
        {
            "ioc_value": "dune4.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:28",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655039": [
        {
            "ioc_value": "dry.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655040": [
        {
            "ioc_value": "ds.c0deroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655041": [
        {
            "ioc_value": "ds.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655042": [
        {
            "ioc_value": "dsc.firetrail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655043": [
        {
            "ioc_value": "dskl.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655044": [
        {
            "ioc_value": "du.xe3ax.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655045": [
        {
            "ioc_value": "du2iv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655046": [
        {
            "ioc_value": "du5tly.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655047": [
        {
            "ioc_value": "dubyl.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655048": [
        {
            "ioc_value": "dud.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655049": [
        {
            "ioc_value": "due.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655050": [
        {
            "ioc_value": "dug.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655051": [
        {
            "ioc_value": "dug.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655052": [
        {
            "ioc_value": "dugem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655053": [
        {
            "ioc_value": "dugoreu2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655054": [
        {
            "ioc_value": "duhakau90.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655055": [
        {
            "ioc_value": "dune.c0ldwater.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655056": [
        {
            "ioc_value": "dune.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:27",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655021": [
        {
            "ioc_value": "drip1.shad0wdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655022": [
        {
            "ioc_value": "drip2.s1nkflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655023": [
        {
            "ioc_value": "drip7y.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655024": [
        {
            "ioc_value": "drizz.rainv1sta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655025": [
        {
            "ioc_value": "dro.g0b1ncore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655026": [
        {
            "ioc_value": "drop.br1ghtmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655027": [
        {
            "ioc_value": "drop.cieardrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655028": [
        {
            "ioc_value": "drop.w1de.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655029": [
        {
            "ioc_value": "drop1.cl0udrise.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655030": [
        {
            "ioc_value": "drop5y.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655031": [
        {
            "ioc_value": "drop7.st1rlingpad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655032": [
        {
            "ioc_value": "dropl7.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655033": [
        {
            "ioc_value": "drown86.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655034": [
        {
            "ioc_value": "drs.patchvine.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655035": [
        {
            "ioc_value": "drunk.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655036": [
        {
            "ioc_value": "dry.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655037": [
        {
            "ioc_value": "dry.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655038": [
        {
            "ioc_value": "dry.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:26",
            "last_seen_utc": "2025-11-29 09:55:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655006": [
        {
            "ioc_value": "drift.cioudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655007": [
        {
            "ioc_value": "drift.frost-wilder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655008": [
        {
            "ioc_value": "drift.frostfox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655009": [
        {
            "ioc_value": "drift.gi0wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655010": [
        {
            "ioc_value": "drift.gr0ssgar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655011": [
        {
            "ioc_value": "drift.h0bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655012": [
        {
            "ioc_value": "drift.hre9in7mamma.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655013": [
        {
            "ioc_value": "drift.sp1remoss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655014": [
        {
            "ioc_value": "drift.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655015": [
        {
            "ioc_value": "drift.wreckly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:59:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655016": [
        {
            "ioc_value": "drift8.braycircuit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655017": [
        {
            "ioc_value": "driftkrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-28 08:33:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655018": [
        {
            "ioc_value": "driftmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-28 08:33:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655019": [
        {
            "ioc_value": "driil93.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655020": [
        {
            "ioc_value": "drili61.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:25",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654991": [
        {
            "ioc_value": "dqb.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654992": [
        {
            "ioc_value": "dr.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654993": [
        {
            "ioc_value": "dr.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654994": [
        {
            "ioc_value": "dr5.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654995": [
        {
            "ioc_value": "drain5.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654996": [
        {
            "ioc_value": "drain8.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654997": [
        {
            "ioc_value": "drak0n.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654998": [
        {
            "ioc_value": "draw1.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654999": [
        {
            "ioc_value": "drb.amin0mer3ges.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655000": [
        {
            "ioc_value": "dream3.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655001": [
        {
            "ioc_value": "drg.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655002": [
        {
            "ioc_value": "driff7.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655003": [
        {
            "ioc_value": "drift-bay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655004": [
        {
            "ioc_value": "drift.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1655005": [
        {
            "ioc_value": "drift.brambleholt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:24",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654972": [
        {
            "ioc_value": "dorn.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654973": [
        {
            "ioc_value": "dorn.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654974": [
        {
            "ioc_value": "dorn.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654975": [
        {
            "ioc_value": "dorn.prismgrau.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654976": [
        {
            "ioc_value": "dorn.silverbirke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654977": [
        {
            "ioc_value": "dorn.slatefalke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654978": [
        {
            "ioc_value": "dorn.st0nebyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654979": [
        {
            "ioc_value": "dorn.steelpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654980": [
        {
            "ioc_value": "dorn2.stargl0w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654981": [
        {
            "ioc_value": "dorn4.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654982": [
        {
            "ioc_value": "dorn6.driftklause.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654983": [
        {
            "ioc_value": "dosyh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654984": [
        {
            "ioc_value": "dovemantel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654985": [
        {
            "ioc_value": "doz3er.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654986": [
        {
            "ioc_value": "dp.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654987": [
        {
            "ioc_value": "dp.plx5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654988": [
        {
            "ioc_value": "dp.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654989": [
        {
            "ioc_value": "dperw.ede-1-g-0-rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654990": [
        {
            "ioc_value": "dqay.ci6ef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:23",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654955": [
        {
            "ioc_value": "do.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654956": [
        {
            "ioc_value": "do.v7h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654957": [
        {
            "ioc_value": "do.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654958": [
        {
            "ioc_value": "do.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654959": [
        {
            "ioc_value": "do.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654960": [
        {
            "ioc_value": "do4rn.pr0p0sedtact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654961": [
        {
            "ioc_value": "doc.stonemist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654962": [
        {
            "ioc_value": "dock.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654963": [
        {
            "ioc_value": "dock.odd-kraken.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654964": [
        {
            "ioc_value": "dodan.mistv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654965": [
        {
            "ioc_value": "dodiquy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654966": [
        {
            "ioc_value": "dog.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654967": [
        {
            "ioc_value": "dolav.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654968": [
        {
            "ioc_value": "doll.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654969": [
        {
            "ioc_value": "doll.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654970": [
        {
            "ioc_value": "dorn.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654971": [
        {
            "ioc_value": "dorn.ironklippe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:22",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654938": [
        {
            "ioc_value": "dn.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654939": [
        {
            "ioc_value": "dn.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654940": [
        {
            "ioc_value": "dn.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654941": [
        {
            "ioc_value": "dn8z4.vexlatch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654942": [
        {
            "ioc_value": "dnb.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654943": [
        {
            "ioc_value": "dnek-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654944": [
        {
            "ioc_value": "dnm.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654945": [
        {
            "ioc_value": "do.boku-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654946": [
        {
            "ioc_value": "do.cawyfie51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654947": [
        {
            "ioc_value": "do.devy-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654948": [
        {
            "ioc_value": "do.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654949": [
        {
            "ioc_value": "do.gyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654950": [
        {
            "ioc_value": "do.lage2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654951": [
        {
            "ioc_value": "do.lkci1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:56:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654952": [
        {
            "ioc_value": "do.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654953": [
        {
            "ioc_value": "do.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654954": [
        {
            "ioc_value": "do.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:21",
            "last_seen_utc": "2025-11-29 09:54:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654921": [
        {
            "ioc_value": "dje.cleardrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654922": [
        {
            "ioc_value": "dk.mintspr1ng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654923": [
        {
            "ioc_value": "dk2fp.ju-4-en-pare-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654924": [
        {
            "ioc_value": "dkpfb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654925": [
        {
            "ioc_value": "dl.bxof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654926": [
        {
            "ioc_value": "dl.mijk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654927": [
        {
            "ioc_value": "dl.spindleway.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654928": [
        {
            "ioc_value": "dl.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654929": [
        {
            "ioc_value": "dl.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654930": [
        {
            "ioc_value": "dl3zd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654931": [
        {
            "ioc_value": "dlop3.skyb1end.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654932": [
        {
            "ioc_value": "dlr.ravenflux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654933": [
        {
            "ioc_value": "dm.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654934": [
        {
            "ioc_value": "dm.htif.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654935": [
        {
            "ioc_value": "dm.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654936": [
        {
            "ioc_value": "dm1.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654937": [
        {
            "ioc_value": "dmlfq.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:20",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654905": [
        {
            "ioc_value": "did.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654906": [
        {
            "ioc_value": "dig.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654907": [
        {
            "ioc_value": "digit37.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654908": [
        {
            "ioc_value": "dihijio22.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-28 08:33:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654909": [
        {
            "ioc_value": "dikatei5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654910": [
        {
            "ioc_value": "dimmergauntlet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654911": [
        {
            "ioc_value": "dinfectt-0-rs-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-28 08:33:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654912": [
        {
            "ioc_value": "dip.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654913": [
        {
            "ioc_value": "dip.net-0-prosa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654914": [
        {
            "ioc_value": "dip.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654915": [
        {
            "ioc_value": "diruroy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654916": [
        {
            "ioc_value": "dis5h7gien.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654917": [
        {
            "ioc_value": "divoc.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654918": [
        {
            "ioc_value": "diwavii6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654919": [
        {
            "ioc_value": "dizec.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654920": [
        {
            "ioc_value": "dj2op.rift-cog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:19",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654890": [
        {
            "ioc_value": "derivedscooter.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654891": [
        {
            "ioc_value": "dew.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654892": [
        {
            "ioc_value": "dew4ly.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654893": [
        {
            "ioc_value": "dewuhou7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654894": [
        {
            "ioc_value": "df.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654895": [
        {
            "ioc_value": "df.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654896": [
        {
            "ioc_value": "dfh.g0ldenspire.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654897": [
        {
            "ioc_value": "dfr.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654898": [
        {
            "ioc_value": "dh.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654899": [
        {
            "ioc_value": "dhst.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654900": [
        {
            "ioc_value": "dhy.wind-barrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654901": [
        {
            "ioc_value": "di.lkci1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654902": [
        {
            "ioc_value": "di.storm-harrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654903": [
        {
            "ioc_value": "di.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:59:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654904": [
        {
            "ioc_value": "di3.cog-whittle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:18",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654874": [
        {
            "ioc_value": "death.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654875": [
        {
            "ioc_value": "deb1t.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654876": [
        {
            "ioc_value": "dedyhao2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654877": [
        {
            "ioc_value": "deep.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654878": [
        {
            "ioc_value": "deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-28 08:33:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654879": [
        {
            "ioc_value": "deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-28 08:33:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654880": [
        {
            "ioc_value": "degresopok.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654881": [
        {
            "ioc_value": "dei.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654882": [
        {
            "ioc_value": "delay.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654883": [
        {
            "ioc_value": "delta.diab4uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654884": [
        {
            "ioc_value": "delta4.dup1ic4ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654885": [
        {
            "ioc_value": "delta6.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654886": [
        {
            "ioc_value": "deltasync.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654887": [
        {
            "ioc_value": "demuq.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654888": [
        {
            "ioc_value": "den.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654889": [
        {
            "ioc_value": "depth8.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:17",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654858": [
        {
            "ioc_value": "dc.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654859": [
        {
            "ioc_value": "dc.burydyu0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654860": [
        {
            "ioc_value": "dc.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654861": [
        {
            "ioc_value": "dc.nufypiy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654862": [
        {
            "ioc_value": "dc8.aucti0nz7ir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654863": [
        {
            "ioc_value": "dcd.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654864": [
        {
            "ioc_value": "dd.gwut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654865": [
        {
            "ioc_value": "dd.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654866": [
        {
            "ioc_value": "dd.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654867": [
        {
            "ioc_value": "ddc.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654868": [
        {
            "ioc_value": "ddo.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654869": [
        {
            "ioc_value": "de-6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-28 08:33:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654870": [
        {
            "ioc_value": "de7.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654871": [
        {
            "ioc_value": "deal.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654872": [
        {
            "ioc_value": "deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-28 08:33:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654873": [
        {
            "ioc_value": "dear.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:16",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654842": [
        {
            "ioc_value": "darksun5et.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654843": [
        {
            "ioc_value": "data.br1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654844": [
        {
            "ioc_value": "daw.gl-1-tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654845": [
        {
            "ioc_value": "dawn.emberfrontier.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654846": [
        {
            "ioc_value": "dawnanker.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654847": [
        {
            "ioc_value": "dawne.brightden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654848": [
        {
            "ioc_value": "dawnforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-28 08:33:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654849": [
        {
            "ioc_value": "day.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654850": [
        {
            "ioc_value": "day.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654851": [
        {
            "ioc_value": "day.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654852": [
        {
            "ioc_value": "day.sacyzie58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654853": [
        {
            "ioc_value": "day.sypyguu85.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654854": [
        {
            "ioc_value": "day.tydubyo66.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654855": [
        {
            "ioc_value": "day.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:58:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654856": [
        {
            "ioc_value": "db.f05t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:54:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654857": [
        {
            "ioc_value": "db8.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:15",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654827": [
        {
            "ioc_value": "d90.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654828": [
        {
            "ioc_value": "da.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654829": [
        {
            "ioc_value": "da.lkci1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654830": [
        {
            "ioc_value": "da.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654831": [
        {
            "ioc_value": "da.vwjy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654832": [
        {
            "ioc_value": "da.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654833": [
        {
            "ioc_value": "dabafuo6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654834": [
        {
            "ioc_value": "dabytea7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654835": [
        {
            "ioc_value": "dad.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654836": [
        {
            "ioc_value": "dafeq.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654837": [
        {
            "ioc_value": "daj.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654838": [
        {
            "ioc_value": "dampf.flintquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654839": [
        {
            "ioc_value": "dampf.frostgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654840": [
        {
            "ioc_value": "dap.ventrill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:58:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654841": [
        {
            "ioc_value": "dark.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:14",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654811": [
        {
            "ioc_value": "d4.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654812": [
        {
            "ioc_value": "d4.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654813": [
        {
            "ioc_value": "d4.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654814": [
        {
            "ioc_value": "d458f.miststone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654815": [
        {
            "ioc_value": "d48e9.shadowf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654816": [
        {
            "ioc_value": "d5.st-1-lt-forge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654817": [
        {
            "ioc_value": "d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-28 08:33:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654818": [
        {
            "ioc_value": "d6ksj.ic3gate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654819": [
        {
            "ioc_value": "d7.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654820": [
        {
            "ioc_value": "d7.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654821": [
        {
            "ioc_value": "d7mta.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654822": [
        {
            "ioc_value": "d7x.ember-grove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654823": [
        {
            "ioc_value": "d8.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:59:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654824": [
        {
            "ioc_value": "d8i.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654825": [
        {
            "ioc_value": "d8w6l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654826": [
        {
            "ioc_value": "d9.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:13",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654796": [
        {
            "ioc_value": "d.xyc0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654797": [
        {
            "ioc_value": "d0.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654798": [
        {
            "ioc_value": "d09r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654799": [
        {
            "ioc_value": "d0ugh7.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654800": [
        {
            "ioc_value": "d1.h934.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654801": [
        {
            "ioc_value": "d14.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654802": [
        {
            "ioc_value": "d1o.j935.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654803": [
        {
            "ioc_value": "d2.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654804": [
        {
            "ioc_value": "d29.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654805": [
        {
            "ioc_value": "d2l.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654806": [
        {
            "ioc_value": "d34.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654807": [
        {
            "ioc_value": "d4.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654808": [
        {
            "ioc_value": "d4.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654809": [
        {
            "ioc_value": "d4.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654810": [
        {
            "ioc_value": "d4.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:12",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654778": [
        {
            "ioc_value": "cx.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654779": [
        {
            "ioc_value": "cy.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654780": [
        {
            "ioc_value": "cy.mxta-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654781": [
        {
            "ioc_value": "cy6.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654782": [
        {
            "ioc_value": "cya.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654783": [
        {
            "ioc_value": "cyan9x.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654784": [
        {
            "ioc_value": "cyc.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:57:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654785": [
        {
            "ioc_value": "cykugeu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654786": [
        {
            "ioc_value": "cylud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654787": [
        {
            "ioc_value": "cyruh.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654788": [
        {
            "ioc_value": "cyxix.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654789": [
        {
            "ioc_value": "d.7-gb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654790": [
        {
            "ioc_value": "d.b3x1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654791": [
        {
            "ioc_value": "d.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654792": [
        {
            "ioc_value": "d.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654793": [
        {
            "ioc_value": "d.t4g9w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654794": [
        {
            "ioc_value": "d.wlh84.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:58:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654795": [
        {
            "ioc_value": "d.x0a3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:11",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654761": [
        {
            "ioc_value": "cugym0ea0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654762": [
        {
            "ioc_value": "cujob.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654763": [
        {
            "ioc_value": "cumutiu1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654764": [
        {
            "ioc_value": "cunon.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654765": [
        {
            "ioc_value": "cup.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654766": [
        {
            "ioc_value": "cup.tag-b-s3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:58:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654767": [
        {
            "ioc_value": "cupandhandle.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654768": [
        {
            "ioc_value": "curol.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654769": [
        {
            "ioc_value": "curux.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654770": [
        {
            "ioc_value": "cut.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654771": [
        {
            "ioc_value": "cute.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654772": [
        {
            "ioc_value": "cuxor.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654773": [
        {
            "ioc_value": "cuzavu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654774": [
        {
            "ioc_value": "cv.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654775": [
        {
            "ioc_value": "cwc.zapkinetic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:59:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654776": [
        {
            "ioc_value": "cwp.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:57:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654777": [
        {
            "ioc_value": "cwv2t.s0larbudge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:10",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654744": [
        {
            "ioc_value": "crystalrun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-28 08:33:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654745": [
        {
            "ioc_value": "cs.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654746": [
        {
            "ioc_value": "cs0.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654747": [
        {
            "ioc_value": "cs2bs.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654748": [
        {
            "ioc_value": "cs4.starforged.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654749": [
        {
            "ioc_value": "csju5.prariehafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654750": [
        {
            "ioc_value": "cso.burydyu0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654751": [
        {
            "ioc_value": "ct.jorx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654752": [
        {
            "ioc_value": "ctf.nibsnap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654753": [
        {
            "ioc_value": "ctpzd.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654754": [
        {
            "ioc_value": "ctr.hazebinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654755": [
        {
            "ioc_value": "cu.g-04-s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654756": [
        {
            "ioc_value": "cu.mxta-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654757": [
        {
            "ioc_value": "cu.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654758": [
        {
            "ioc_value": "cubuj.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654759": [
        {
            "ioc_value": "cudefoe9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654760": [
        {
            "ioc_value": "cuf.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:09",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654729": [
        {
            "ioc_value": "crest.stonemist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654730": [
        {
            "ioc_value": "crest.stormglade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654731": [
        {
            "ioc_value": "crest.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654732": [
        {
            "ioc_value": "crest.sunm0tion.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654733": [
        {
            "ioc_value": "crest.zenbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:59:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654734": [
        {
            "ioc_value": "crest.zeromint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:59:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654735": [
        {
            "ioc_value": "crest3.skybl1ss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654736": [
        {
            "ioc_value": "crest4.miragepad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654737": [
        {
            "ioc_value": "crest5.shad0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654738": [
        {
            "ioc_value": "crest7.mysticdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654739": [
        {
            "ioc_value": "crimsonwald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-28 08:33:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654740": [
        {
            "ioc_value": "cross.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:59:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654741": [
        {
            "ioc_value": "crys7a.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654742": [
        {
            "ioc_value": "crysta1shore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-28 08:33:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654743": [
        {
            "ioc_value": "crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:08",
            "last_seen_utc": "2025-11-28 08:33:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654712": [
        {
            "ioc_value": "cr.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654713": [
        {
            "ioc_value": "cr.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654714": [
        {
            "ioc_value": "cr.mistfaii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654715": [
        {
            "ioc_value": "cr.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654716": [
        {
            "ioc_value": "cr0.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654717": [
        {
            "ioc_value": "cr1mpoint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654718": [
        {
            "ioc_value": "craft.r1verbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654719": [
        {
            "ioc_value": "crane.cranezeit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654720": [
        {
            "ioc_value": "creek5.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654721": [
        {
            "ioc_value": "crest.bray-circuit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654722": [
        {
            "ioc_value": "crest.jamcrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654723": [
        {
            "ioc_value": "crest.lakesp1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654724": [
        {
            "ioc_value": "crest.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654725": [
        {
            "ioc_value": "crest.m1stwander.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654726": [
        {
            "ioc_value": "crest.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654727": [
        {
            "ioc_value": "crest.miragepad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654728": [
        {
            "ioc_value": "crest.st0nepeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:07",
            "last_seen_utc": "2025-11-29 09:54:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654696": [
        {
            "ioc_value": "copperwerft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654697": [
        {
            "ioc_value": "core.gl-1-tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654698": [
        {
            "ioc_value": "core.gyrodesk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654699": [
        {
            "ioc_value": "core.n0v0se1prew.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654700": [
        {
            "ioc_value": "core.s0apthorn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654701": [
        {
            "ioc_value": "core5.tweakmire.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654702": [
        {
            "ioc_value": "coxyz.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654703": [
        {
            "ioc_value": "coy.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654704": [
        {
            "ioc_value": "cp.skyaxe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654705": [
        {
            "ioc_value": "cpcontacts.wbth.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654706": [
        {
            "ioc_value": "cq.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654707": [
        {
            "ioc_value": "cq.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654708": [
        {
            "ioc_value": "cqf47.horizonbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654709": [
        {
            "ioc_value": "cqgj.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654710": [
        {
            "ioc_value": "cqi.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654711": [
        {
            "ioc_value": "cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654682": [
        {
            "ioc_value": "cohor.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654683": [
        {
            "ioc_value": "cokok.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654684": [
        {
            "ioc_value": "cold6.p1nk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654685": [
        {
            "ioc_value": "coletuo46.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654686": [
        {
            "ioc_value": "cometlinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-28 08:33:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654687": [
        {
            "ioc_value": "cometpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-28 08:33:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654688": [
        {
            "ioc_value": "comp.mor5tud1es.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654689": [
        {
            "ioc_value": "comp0.simp7euna3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654690": [
        {
            "ioc_value": "consolebriskly.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654691": [
        {
            "ioc_value": "cook.tatyziu58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654692": [
        {
            "ioc_value": "cool.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654693": [
        {
            "ioc_value": "cop.joy-2-way.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:56:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654694": [
        {
            "ioc_value": "copp3r.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654695": [
        {
            "ioc_value": "copperhang.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:05",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654667": [
        {
            "ioc_value": "co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-28 08:33:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654668": [
        {
            "ioc_value": "co.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654669": [
        {
            "ioc_value": "co0peratre4er.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654670": [
        {
            "ioc_value": "coast.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654671": [
        {
            "ioc_value": "coast0.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654672": [
        {
            "ioc_value": "cobalt.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654673": [
        {
            "ioc_value": "code.le3nsnet7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654674": [
        {
            "ioc_value": "code6.dunn0en7el.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654675": [
        {
            "ioc_value": "codecog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-28 08:33:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654676": [
        {
            "ioc_value": "cofepoi2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654677": [
        {
            "ioc_value": "cofidyu58.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-28 08:33:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654678": [
        {
            "ioc_value": "cog-whittle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-28 08:33:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654679": [
        {
            "ioc_value": "cog.gr1zzlepad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654680": [
        {
            "ioc_value": "cog.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654681": [
        {
            "ioc_value": "cogov.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:04",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654651": [
        {
            "ioc_value": "cm.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654652": [
        {
            "ioc_value": "cm.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654653": [
        {
            "ioc_value": "cm.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654654": [
        {
            "ioc_value": "cm.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654655": [
        {
            "ioc_value": "cm.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654656": [
        {
            "ioc_value": "cm.pixelstern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654657": [
        {
            "ioc_value": "cm.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654658": [
        {
            "ioc_value": "cm.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654659": [
        {
            "ioc_value": "cm.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654660": [
        {
            "ioc_value": "cm9.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654661": [
        {
            "ioc_value": "cmj3.h-0-bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654662": [
        {
            "ioc_value": "cmk.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654663": [
        {
            "ioc_value": "cms0c.st-0-bepress.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654664": [
        {
            "ioc_value": "cmv.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654665": [
        {
            "ioc_value": "cn8y.wildr0sehub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654666": [
        {
            "ioc_value": "cnp.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:03",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654644": [
        {
            "ioc_value": "clov3r.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:02",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654645": [
        {
            "ioc_value": "clov8r.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:02",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654646": [
        {
            "ioc_value": "clq.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:02",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654647": [
        {
            "ioc_value": "club.nugawye78.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:02",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654648": [
        {
            "ioc_value": "cm.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:02",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654649": [
        {
            "ioc_value": "cm.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:02",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654650": [
        {
            "ioc_value": "cm.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:02",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654642": [
        {
            "ioc_value": "cloud4.windfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:01",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654643": [
        {
            "ioc_value": "cloud8.st0nefield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:01",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654626": [
        {
            "ioc_value": "cliff7.st0nebird.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654627": [
        {
            "ioc_value": "cliffwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654628": [
        {
            "ioc_value": "clock.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654629": [
        {
            "ioc_value": "clock.st0negate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654630": [
        {
            "ioc_value": "clock1.cl0udrise.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654631": [
        {
            "ioc_value": "clock6.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654632": [
        {
            "ioc_value": "cloud.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654633": [
        {
            "ioc_value": "cloud.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654634": [
        {
            "ioc_value": "cloud.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654635": [
        {
            "ioc_value": "cloud.cl0udmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654636": [
        {
            "ioc_value": "cloud.cloudkreis.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654637": [
        {
            "ioc_value": "cloud.comp0tsab3e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654638": [
        {
            "ioc_value": "cloud.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654639": [
        {
            "ioc_value": "cloud.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654640": [
        {
            "ioc_value": "cloud.windfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654641": [
        {
            "ioc_value": "cloud2.mistfaii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:43:00",
            "last_seen_utc": "2025-11-29 09:56:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654612": [
        {
            "ioc_value": "clasp8.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654613": [
        {
            "ioc_value": "claw.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654614": [
        {
            "ioc_value": "claw.tigerzaun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654615": [
        {
            "ioc_value": "clean.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654616": [
        {
            "ioc_value": "clear1.ta11y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654617": [
        {
            "ioc_value": "clear2.r1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654618": [
        {
            "ioc_value": "clearfog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654619": [
        {
            "ioc_value": "clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-28 08:33:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654620": [
        {
            "ioc_value": "cliff.br-1-ar-wild.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654621": [
        {
            "ioc_value": "cliff.manual-1-sa-1-yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654622": [
        {
            "ioc_value": "cliff.stormbiend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654623": [
        {
            "ioc_value": "cliff0.manual-1-sa-1-yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654624": [
        {
            "ioc_value": "cliff4.dunn0en7el.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654625": [
        {
            "ioc_value": "cliff4.shadowsun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:59",
            "last_seen_utc": "2025-11-29 09:57:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654599": [
        {
            "ioc_value": "cj.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654600": [
        {
            "ioc_value": "cjq.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654601": [
        {
            "ioc_value": "ck.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654602": [
        {
            "ioc_value": "ck2x.mor5tud1es.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654603": [
        {
            "ioc_value": "ck3.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654604": [
        {
            "ioc_value": "cki.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654605": [
        {
            "ioc_value": "ckr.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654606": [
        {
            "ioc_value": "cl0ck7.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654607": [
        {
            "ioc_value": "cl0udnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654608": [
        {
            "ioc_value": "cl0udy.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654609": [
        {
            "ioc_value": "cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654610": [
        {
            "ioc_value": "clad0n.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654611": [
        {
            "ioc_value": "clap9t.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:58",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654583": [
        {
            "ioc_value": "cinder-bloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654584": [
        {
            "ioc_value": "cinderbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654585": [
        {
            "ioc_value": "cindertau.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654586": [
        {
            "ioc_value": "cindr.firer1dge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654587": [
        {
            "ioc_value": "cinomp.ci6ef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654588": [
        {
            "ioc_value": "cioudbr1nk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-28 08:33:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654589": [
        {
            "ioc_value": "cioudharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654590": [
        {
            "ioc_value": "cioudnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-28 08:33:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654591": [
        {
            "ioc_value": "cioudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-28 08:33:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654592": [
        {
            "ioc_value": "cioudriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-28 08:33:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654593": [
        {
            "ioc_value": "ciqe8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654594": [
        {
            "ioc_value": "circuit.gl1nterbay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654595": [
        {
            "ioc_value": "ciryjey8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654596": [
        {
            "ioc_value": "civo.gr1zzlepad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654597": [
        {
            "ioc_value": "ciy.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654598": [
        {
            "ioc_value": "cj.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:57",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654564": [
        {
            "ioc_value": "check.ysozim.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:59:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654565": [
        {
            "ioc_value": "check.zahyt.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:59:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654566": [
        {
            "ioc_value": "check.zaxys.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:59:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654567": [
        {
            "ioc_value": "check.zevyg.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:59:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654568": [
        {
            "ioc_value": "check.zymol.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:59:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654569": [
        {
            "ioc_value": "check.zynyx.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:59:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654570": [
        {
            "ioc_value": "cherubantacid.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654571": [
        {
            "ioc_value": "chest.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654572": [
        {
            "ioc_value": "chhd.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654573": [
        {
            "ioc_value": "chp.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654574": [
        {
            "ioc_value": "chu.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654575": [
        {
            "ioc_value": "ci.kmbo-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654576": [
        {
            "ioc_value": "ci0udmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654577": [
        {
            "ioc_value": "ci2udforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-28 08:33:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654578": [
        {
            "ioc_value": "ci6ef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654579": [
        {
            "ioc_value": "ciearbug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654580": [
        {
            "ioc_value": "ciearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654581": [
        {
            "ioc_value": "ciearforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654582": [
        {
            "ioc_value": "ciku.sn-0-rtling.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:56",
            "last_seen_utc": "2025-11-29 09:57:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654544": [
        {
            "ioc_value": "check.uzuqed.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:58:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654545": [
        {
            "ioc_value": "check.vased.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:58:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654546": [
        {
            "ioc_value": "check.vefim.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:58:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654547": [
        {
            "ioc_value": "check.voded.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:58:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654548": [
        {
            "ioc_value": "check.vosyr.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:54:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654549": [
        {
            "ioc_value": "check.vuces.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:58:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654550": [
        {
            "ioc_value": "check.vysub.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:58:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654551": [
        {
            "ioc_value": "check.wetad.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:58:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654552": [
        {
            "ioc_value": "check.wewum.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:58:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654553": [
        {
            "ioc_value": "check.wolum.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654554": [
        {
            "ioc_value": "check.wumih.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654555": [
        {
            "ioc_value": "check.wyham.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654556": [
        {
            "ioc_value": "check.wysaf.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654557": [
        {
            "ioc_value": "check.wyzof.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654558": [
        {
            "ioc_value": "check.xasad.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654559": [
        {
            "ioc_value": "check.xiwaj.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654560": [
        {
            "ioc_value": "check.xiwuc.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654561": [
        {
            "ioc_value": "check.xufam.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654562": [
        {
            "ioc_value": "check.xulap.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654563": [
        {
            "ioc_value": "check.yonuga.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:55",
            "last_seen_utc": "2025-11-29 09:59:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654525": [
        {
            "ioc_value": "check.quzis.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:54:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654526": [
        {
            "ioc_value": "check.revuq.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654527": [
        {
            "ioc_value": "check.rozox.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654528": [
        {
            "ioc_value": "check.rulix.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654529": [
        {
            "ioc_value": "check.sabyw.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654530": [
        {
            "ioc_value": "check.saguf.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654531": [
        {
            "ioc_value": "check.sesaf.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654532": [
        {
            "ioc_value": "check.sifum.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654533": [
        {
            "ioc_value": "check.sinyx.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654534": [
        {
            "ioc_value": "check.sipit.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654535": [
        {
            "ioc_value": "check.sipyf.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654536": [
        {
            "ioc_value": "check.smfd.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:54:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654537": [
        {
            "ioc_value": "check.symad.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654538": [
        {
            "ioc_value": "check.talup.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:58:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654539": [
        {
            "ioc_value": "check.taxaq.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654540": [
        {
            "ioc_value": "check.taxiz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654541": [
        {
            "ioc_value": "check.ticyb.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654542": [
        {
            "ioc_value": "check.tidag.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654543": [
        {
            "ioc_value": "check.ugarob.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:54",
            "last_seen_utc": "2025-11-29 09:58:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654506": [
        {
            "ioc_value": "check.novax.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:56:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654507": [
        {
            "ioc_value": "check.oegebo.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654508": [
        {
            "ioc_value": "check.ohuxah.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654509": [
        {
            "ioc_value": "check.oibupi.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654510": [
        {
            "ioc_value": "check.opie6.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654511": [
        {
            "ioc_value": "check.owacq.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:54:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654512": [
        {
            "ioc_value": "check.ozotuk.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654513": [
        {
            "ioc_value": "check.pawol.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654514": [
        {
            "ioc_value": "check.pedyg.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654515": [
        {
            "ioc_value": "check.pejel.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654516": [
        {
            "ioc_value": "check.pifos.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654517": [
        {
            "ioc_value": "check.pikip.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654518": [
        {
            "ioc_value": "check.pilod.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654519": [
        {
            "ioc_value": "check.pivum.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654520": [
        {
            "ioc_value": "check.qevub.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654521": [
        {
            "ioc_value": "check.qewid.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654522": [
        {
            "ioc_value": "check.qicon.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654523": [
        {
            "ioc_value": "check.qowot.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654524": [
        {
            "ioc_value": "check.qutyd.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:53",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654486": [
        {
            "ioc_value": "check.lemox.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654487": [
        {
            "ioc_value": "check.letoq.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654488": [
        {
            "ioc_value": "check.lezum.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:54:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654489": [
        {
            "ioc_value": "check.libij.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654490": [
        {
            "ioc_value": "check.ligaz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654491": [
        {
            "ioc_value": "check.lolp.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:54:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654492": [
        {
            "ioc_value": "check.lomac.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654493": [
        {
            "ioc_value": "check.lukus.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:54:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654494": [
        {
            "ioc_value": "check.mavew.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654495": [
        {
            "ioc_value": "check.mesen.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654496": [
        {
            "ioc_value": "check.mipak.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654497": [
        {
            "ioc_value": "check.mmjdh.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:54:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654498": [
        {
            "ioc_value": "check.mujan.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:54:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654499": [
        {
            "ioc_value": "check.mujf.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:54:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654500": [
        {
            "ioc_value": "check.mulaq.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654501": [
        {
            "ioc_value": "check.munen.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654502": [
        {
            "ioc_value": "check.nagec.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654503": [
        {
            "ioc_value": "check.napef.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654504": [
        {
            "ioc_value": "check.nejoc.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654505": [
        {
            "ioc_value": "check.nifom.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:52",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654467": [
        {
            "ioc_value": "check.fidec.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654468": [
        {
            "ioc_value": "check.firoc.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654469": [
        {
            "ioc_value": "check.foquh.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654470": [
        {
            "ioc_value": "check.gity.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654471": [
        {
            "ioc_value": "check.guqev.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654472": [
        {
            "ioc_value": "check.hacoj.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654473": [
        {
            "ioc_value": "check.hequf.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654474": [
        {
            "ioc_value": "check.higuh.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:54:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654475": [
        {
            "ioc_value": "check.hosam.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654476": [
        {
            "ioc_value": "check.hyjaz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:55:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654477": [
        {
            "ioc_value": "check.ioqoda.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:56:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654478": [
        {
            "ioc_value": "check.jehim.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654479": [
        {
            "ioc_value": "check.jexat.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654480": [
        {
            "ioc_value": "check.jexem.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654481": [
        {
            "ioc_value": "check.juket.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654482": [
        {
            "ioc_value": "check.kolac.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654483": [
        {
            "ioc_value": "check.kubab.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654484": [
        {
            "ioc_value": "check.kyrap.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654485": [
        {
            "ioc_value": "check.kyzog.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:51",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654445": [
        {
            "ioc_value": "check.colaj.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654446": [
        {
            "ioc_value": "check.comyk.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654447": [
        {
            "ioc_value": "check.cuved.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654448": [
        {
            "ioc_value": "check.cvdub.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654449": [
        {
            "ioc_value": "check.cybaf.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654450": [
        {
            "ioc_value": "check.debul.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654451": [
        {
            "ioc_value": "check.dehoz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654452": [
        {
            "ioc_value": "check.dejh.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654453": [
        {
            "ioc_value": "check.ditez.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654454": [
        {
            "ioc_value": "check.djtvx.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654455": [
        {
            "ioc_value": "check.dymab.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654456": [
        {
            "ioc_value": "check.dymyf.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654457": [
        {
            "ioc_value": "check.dypit.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654458": [
        {
            "ioc_value": "check.eezedu.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654459": [
        {
            "ioc_value": "check.eozusa.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654460": [
        {
            "ioc_value": "check.equcym.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654461": [
        {
            "ioc_value": "check.esscv.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654462": [
        {
            "ioc_value": "check.eucudo.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654463": [
        {
            "ioc_value": "check.faneg.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654464": [
        {
            "ioc_value": "check.farur.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654465": [
        {
            "ioc_value": "check.fegag.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654466": [
        {
            "ioc_value": "check.fepub.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:50",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654425": [
        {
            "ioc_value": "chamber.st-1-lt-forge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654426": [
        {
            "ioc_value": "chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-28 08:32:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654427": [
        {
            "ioc_value": "cheap8.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654428": [
        {
            "ioc_value": "check.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654429": [
        {
            "ioc_value": "check.alku.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654430": [
        {
            "ioc_value": "check.alosym.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654431": [
        {
            "ioc_value": "check.amda.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654432": [
        {
            "ioc_value": "check.aytuna.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654433": [
        {
            "ioc_value": "check.becyz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654434": [
        {
            "ioc_value": "check.bibyn.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654435": [
        {
            "ioc_value": "check.bogig.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654436": [
        {
            "ioc_value": "check.bopuc.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654437": [
        {
            "ioc_value": "check.boruq.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654438": [
        {
            "ioc_value": "check.bugyx.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654439": [
        {
            "ioc_value": "check.canez.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654440": [
        {
            "ioc_value": "check.carin.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654441": [
        {
            "ioc_value": "check.casog.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654442": [
        {
            "ioc_value": "check.cisyn.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654443": [
        {
            "ioc_value": "check.codux.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654444": [
        {
            "ioc_value": "check.cofat.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:49",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654409": [
        {
            "ioc_value": "cewyzui61.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-28 08:32:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654410": [
        {
            "ioc_value": "cfb.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654411": [
        {
            "ioc_value": "cfb8.ba5eq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654412": [
        {
            "ioc_value": "cg.plum-wav-ru.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654413": [
        {
            "ioc_value": "cg.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:58:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654414": [
        {
            "ioc_value": "cg.vgof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:58:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654415": [
        {
            "ioc_value": "cg.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654416": [
        {
            "ioc_value": "cgplk.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654417": [
        {
            "ioc_value": "ch.0-pal-summit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654418": [
        {
            "ioc_value": "ch.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654419": [
        {
            "ioc_value": "ch.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654420": [
        {
            "ioc_value": "ch.kmbo6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654421": [
        {
            "ioc_value": "ch.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654422": [
        {
            "ioc_value": "chafeocelot.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654423": [
        {
            "ioc_value": "chain7.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654424": [
        {
            "ioc_value": "chair.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:48",
            "last_seen_utc": "2025-11-29 09:54:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654392": [
        {
            "ioc_value": "cd.nejofea9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654393": [
        {
            "ioc_value": "cd.winenoy5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:58:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654394": [
        {
            "ioc_value": "cd.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654395": [
        {
            "ioc_value": "cdh.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654396": [
        {
            "ioc_value": "ce.tygilyo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654397": [
        {
            "ioc_value": "ce1im.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654398": [
        {
            "ioc_value": "cedar9.quartzweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654399": [
        {
            "ioc_value": "cedarberg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654400": [
        {
            "ioc_value": "cedarhafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654401": [
        {
            "ioc_value": "cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-28 08:32:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654402": [
        {
            "ioc_value": "cedarsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654403": [
        {
            "ioc_value": "cedro.amberkliff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654404": [
        {
            "ioc_value": "cedro4.mintsp1ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654405": [
        {
            "ioc_value": "celokya5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654406": [
        {
            "ioc_value": "cesik53oy8.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654407": [
        {
            "ioc_value": "cesik53oy8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654408": [
        {
            "ioc_value": "cevyfoy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:47",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654373": [
        {
            "ioc_value": "caqev2oo2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654374": [
        {
            "ioc_value": "car.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654375": [
        {
            "ioc_value": "car.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654376": [
        {
            "ioc_value": "carin.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654377": [
        {
            "ioc_value": "carve.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654378": [
        {
            "ioc_value": "casog.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654379": [
        {
            "ioc_value": "cat.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654380": [
        {
            "ioc_value": "cat.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654381": [
        {
            "ioc_value": "cause.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654382": [
        {
            "ioc_value": "cavehuy5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654383": [
        {
            "ioc_value": "cawyfie51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-28 08:32:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654384": [
        {
            "ioc_value": "cb.q6o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654385": [
        {
            "ioc_value": "cb.r3j5c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654386": [
        {
            "ioc_value": "cb3yh.ic3gate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654387": [
        {
            "ioc_value": "cbo.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654388": [
        {
            "ioc_value": "cc.riftcog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654389": [
        {
            "ioc_value": "ccd.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654390": [
        {
            "ioc_value": "ccheck.qlkwr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654391": [
        {
            "ioc_value": "cct.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:46",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654354": [
        {
            "ioc_value": "c9a.vem4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:58:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654355": [
        {
            "ioc_value": "c9b8v.b1tcrush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654356": [
        {
            "ioc_value": "ca.mijk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654357": [
        {
            "ioc_value": "ca.n6p5j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654358": [
        {
            "ioc_value": "ca.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654359": [
        {
            "ioc_value": "ca.x0a3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:59:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654360": [
        {
            "ioc_value": "cab.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654361": [
        {
            "ioc_value": "cabym.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654362": [
        {
            "ioc_value": "cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654363": [
        {
            "ioc_value": "calm.vudeh0ae3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:58:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654364": [
        {
            "ioc_value": "calm4y.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654365": [
        {
            "ioc_value": "calub.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654366": [
        {
            "ioc_value": "campsitegradually.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654367": [
        {
            "ioc_value": "can.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654368": [
        {
            "ioc_value": "canez.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654369": [
        {
            "ioc_value": "canyonsturm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654370": [
        {
            "ioc_value": "cap.j1gglestone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654371": [
        {
            "ioc_value": "cap.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654372": [
        {
            "ioc_value": "cap.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:45",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654335": [
        {
            "ioc_value": "c8.71290.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654336": [
        {
            "ioc_value": "c8.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654337": [
        {
            "ioc_value": "c8.harborfreund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654338": [
        {
            "ioc_value": "c8.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654339": [
        {
            "ioc_value": "c8.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654340": [
        {
            "ioc_value": "c8.paradeabend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654341": [
        {
            "ioc_value": "c8.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654342": [
        {
            "ioc_value": "c8.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654343": [
        {
            "ioc_value": "c8.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654344": [
        {
            "ioc_value": "c8.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654345": [
        {
            "ioc_value": "c8.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654346": [
        {
            "ioc_value": "c8.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654347": [
        {
            "ioc_value": "c8.yf-l3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:59:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654348": [
        {
            "ioc_value": "c8n.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654349": [
        {
            "ioc_value": "c8y4d.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654350": [
        {
            "ioc_value": "c9.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654351": [
        {
            "ioc_value": "c9.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654352": [
        {
            "ioc_value": "c9.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654353": [
        {
            "ioc_value": "c99.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:44",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654318": [
        {
            "ioc_value": "c3.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654319": [
        {
            "ioc_value": "c3r.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654320": [
        {
            "ioc_value": "c3r.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654321": [
        {
            "ioc_value": "c40znm.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654322": [
        {
            "ioc_value": "c45.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654323": [
        {
            "ioc_value": "c4n.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654324": [
        {
            "ioc_value": "c4n.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654325": [
        {
            "ioc_value": "c4u.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654326": [
        {
            "ioc_value": "c4v9.emberharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654327": [
        {
            "ioc_value": "c6.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654328": [
        {
            "ioc_value": "c6.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654329": [
        {
            "ioc_value": "c7.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654330": [
        {
            "ioc_value": "c7x5i.r0ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654331": [
        {
            "ioc_value": "c8.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654332": [
        {
            "ioc_value": "c8.526r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654333": [
        {
            "ioc_value": "c8.595-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654334": [
        {
            "ioc_value": "c8.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:43",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654301": [
        {
            "ioc_value": "c0u1d8.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654302": [
        {
            "ioc_value": "c1.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654303": [
        {
            "ioc_value": "c1earwind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654304": [
        {
            "ioc_value": "c1m.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654305": [
        {
            "ioc_value": "c1m.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654306": [
        {
            "ioc_value": "c1m.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654307": [
        {
            "ioc_value": "c1m.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654308": [
        {
            "ioc_value": "c1m.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654309": [
        {
            "ioc_value": "c1p7mx.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654310": [
        {
            "ioc_value": "c2.kdesu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654311": [
        {
            "ioc_value": "c2.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654312": [
        {
            "ioc_value": "c2.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654313": [
        {
            "ioc_value": "c2n.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654314": [
        {
            "ioc_value": "c2n.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654315": [
        {
            "ioc_value": "c2n.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654316": [
        {
            "ioc_value": "c2n.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654317": [
        {
            "ioc_value": "c2r.crystalcavern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:42",
            "last_seen_utc": "2025-11-29 09:54:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654286": [
        {
            "ioc_value": "bz.m5k1k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654287": [
        {
            "ioc_value": "bz.onyxmorgen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654288": [
        {
            "ioc_value": "bz.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654289": [
        {
            "ioc_value": "bzr.29rs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654290": [
        {
            "ioc_value": "c.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654291": [
        {
            "ioc_value": "c.l8o6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654292": [
        {
            "ioc_value": "c.v1n4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654293": [
        {
            "ioc_value": "c.v6z1q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:58:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654294": [
        {
            "ioc_value": "c.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654295": [
        {
            "ioc_value": "c0.echozig.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654296": [
        {
            "ioc_value": "c0.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654297": [
        {
            "ioc_value": "c0dehawk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-28 08:32:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654298": [
        {
            "ioc_value": "c0ldwater.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654299": [
        {
            "ioc_value": "c0nsiumpond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654300": [
        {
            "ioc_value": "c0p.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:41",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654266": [
        {
            "ioc_value": "byf.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654267": [
        {
            "ioc_value": "bynbv.ic0n1ctrove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654268": [
        {
            "ioc_value": "byq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-28 08:32:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654269": [
        {
            "ioc_value": "byt3rx.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654270": [
        {
            "ioc_value": "byte.jaxdrill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654271": [
        {
            "ioc_value": "byte.mintburst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654272": [
        {
            "ioc_value": "byte.rumble-kin.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654273": [
        {
            "ioc_value": "byte.syrupdock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654274": [
        {
            "ioc_value": "byte.wavermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:58:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654275": [
        {
            "ioc_value": "byte2.fluxcrate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654276": [
        {
            "ioc_value": "byte3.b1tcrush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654277": [
        {
            "ioc_value": "byte8.hazebinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:55:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654278": [
        {
            "ioc_value": "byv.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654279": [
        {
            "ioc_value": "byzyxii-6.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654280": [
        {
            "ioc_value": "byzyxii-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654281": [
        {
            "ioc_value": "byzyxii6.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654282": [
        {
            "ioc_value": "byzyxii6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654283": [
        {
            "ioc_value": "bz.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654284": [
        {
            "ioc_value": "bz.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654285": [
        {
            "ioc_value": "bz.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:40",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654250": [
        {
            "ioc_value": "bw9.ve1vet0rchid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654251": [
        {
            "ioc_value": "bwag.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654252": [
        {
            "ioc_value": "bwe.myga3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654253": [
        {
            "ioc_value": "bwj.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654254": [
        {
            "ioc_value": "bwp.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654255": [
        {
            "ioc_value": "bx.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654256": [
        {
            "ioc_value": "bx.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654257": [
        {
            "ioc_value": "bx.r2h7m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654258": [
        {
            "ioc_value": "bx.t4a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654259": [
        {
            "ioc_value": "bxl.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654260": [
        {
            "ioc_value": "bxof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654261": [
        {
            "ioc_value": "by.fenod.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-28 08:33:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654262": [
        {
            "ioc_value": "by.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-28 08:35:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654263": [
        {
            "ioc_value": "by.xe-1r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654264": [
        {
            "ioc_value": "by.xe3ax.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-28 08:32:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654265": [
        {
            "ioc_value": "by.yq-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:39",
            "last_seen_utc": "2025-11-29 09:59:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654234": [
        {
            "ioc_value": "but.vudujiu33.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654235": [
        {
            "ioc_value": "butizio6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654236": [
        {
            "ioc_value": "buvusio6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654237": [
        {
            "ioc_value": "buwyvo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654238": [
        {
            "ioc_value": "buxok2uu6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654239": [
        {
            "ioc_value": "buyer.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654240": [
        {
            "ioc_value": "bv.f0z1n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654241": [
        {
            "ioc_value": "bv.m7e4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:56:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654242": [
        {
            "ioc_value": "bv51.liner-9-ick.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654243": [
        {
            "ioc_value": "bv9.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654244": [
        {
            "ioc_value": "bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-28 08:32:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654245": [
        {
            "ioc_value": "bw.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654246": [
        {
            "ioc_value": "bw.l8o6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654247": [
        {
            "ioc_value": "bw.m5k1k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:56:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654248": [
        {
            "ioc_value": "bw.quartzflip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654249": [
        {
            "ioc_value": "bw.w20s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:38",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654214": [
        {
            "ioc_value": "bud.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654215": [
        {
            "ioc_value": "bud3le.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654216": [
        {
            "ioc_value": "bud4le.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654217": [
        {
            "ioc_value": "bufok.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654218": [
        {
            "ioc_value": "bug.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654219": [
        {
            "ioc_value": "bugix.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654220": [
        {
            "ioc_value": "bugyx.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654221": [
        {
            "ioc_value": "buno8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654222": [
        {
            "ioc_value": "buqoc.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654223": [
        {
            "ioc_value": "burst.mysticdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654224": [
        {
            "ioc_value": "burst.rift-cog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654225": [
        {
            "ioc_value": "burst.y0ur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:59:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654226": [
        {
            "ioc_value": "burst1.cleardrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654227": [
        {
            "ioc_value": "burst2.st0neflash.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654228": [
        {
            "ioc_value": "burst7.c0ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654229": [
        {
            "ioc_value": "burydyu0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-28 08:32:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654230": [
        {
            "ioc_value": "bus.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654231": [
        {
            "ioc_value": "bus.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654232": [
        {
            "ioc_value": "but.v3sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:58:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654233": [
        {
            "ioc_value": "but.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:37",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654195": [
        {
            "ioc_value": "brown6.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654196": [
        {
            "ioc_value": "brt.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654197": [
        {
            "ioc_value": "bru5h.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654198": [
        {
            "ioc_value": "bruke.0akstream.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654199": [
        {
            "ioc_value": "brun4n.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654200": [
        {
            "ioc_value": "bryz4a.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654201": [
        {
            "ioc_value": "bs.j1g3k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654202": [
        {
            "ioc_value": "bs.q8e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:57:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654203": [
        {
            "ioc_value": "bs.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654204": [
        {
            "ioc_value": "bt.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654205": [
        {
            "ioc_value": "bt.p9v7g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654206": [
        {
            "ioc_value": "bt.q6o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654207": [
        {
            "ioc_value": "bti.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654208": [
        {
            "ioc_value": "bu.kmbo-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654209": [
        {
            "ioc_value": "bu.l9a5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654210": [
        {
            "ioc_value": "bu.q5z9s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654211": [
        {
            "ioc_value": "bu.xoreniu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:59:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654212": [
        {
            "ioc_value": "bud.h0bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654213": [
        {
            "ioc_value": "bud.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:36",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654175": [
        {
            "ioc_value": "brise.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654176": [
        {
            "ioc_value": "brise.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654177": [
        {
            "ioc_value": "brise.payc0medy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654178": [
        {
            "ioc_value": "brise.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654179": [
        {
            "ioc_value": "brise.wlnd5hore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654180": [
        {
            "ioc_value": "brise4.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654181": [
        {
            "ioc_value": "brise5.kick-5-ubs-4-ance.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654182": [
        {
            "ioc_value": "brisk.brightden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654183": [
        {
            "ioc_value": "brisk.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654184": [
        {
            "ioc_value": "brivox5.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654185": [
        {
            "ioc_value": "brlef33.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654186": [
        {
            "ioc_value": "broad.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654187": [
        {
            "ioc_value": "bronze-wilder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654188": [
        {
            "ioc_value": "bronzewilder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654189": [
        {
            "ioc_value": "brook.cinderloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654190": [
        {
            "ioc_value": "brook.ember-glade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654191": [
        {
            "ioc_value": "brook.frostfox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654192": [
        {
            "ioc_value": "brook.gl0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654193": [
        {
            "ioc_value": "brook.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:54:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654194": [
        {
            "ioc_value": "brook.willowsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:35",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654161": [
        {
            "ioc_value": "bright6.cl1ffwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654162": [
        {
            "ioc_value": "bright7.st0y70renka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654163": [
        {
            "ioc_value": "brightden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654164": [
        {
            "ioc_value": "brightf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-28 08:32:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654165": [
        {
            "ioc_value": "brightmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654166": [
        {
            "ioc_value": "brightv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654167": [
        {
            "ioc_value": "brightvoyage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654168": [
        {
            "ioc_value": "brillar.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654169": [
        {
            "ioc_value": "brim-hopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654170": [
        {
            "ioc_value": "brimhopper.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654171": [
        {
            "ioc_value": "brinewald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-28 08:32:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654172": [
        {
            "ioc_value": "bring05.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654173": [
        {
            "ioc_value": "brisa.amberkliff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654174": [
        {
            "ioc_value": "brisa2.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:34",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654145": [
        {
            "ioc_value": "braun5.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654146": [
        {
            "ioc_value": "braycircuit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654147": [
        {
            "ioc_value": "brecc8.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654148": [
        {
            "ioc_value": "breez.s0ftvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654149": [
        {
            "ioc_value": "breez5.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654150": [
        {
            "ioc_value": "breeze.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654151": [
        {
            "ioc_value": "breezef0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654152": [
        {
            "ioc_value": "briar.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654153": [
        {
            "ioc_value": "briar9.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654154": [
        {
            "ioc_value": "bridge.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654155": [
        {
            "ioc_value": "bridge.fireciiff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654156": [
        {
            "ioc_value": "brige.firer1dge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654157": [
        {
            "ioc_value": "brige.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654158": [
        {
            "ioc_value": "bright.cl1ffwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654159": [
        {
            "ioc_value": "bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-28 08:32:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654160": [
        {
            "ioc_value": "bright2.ju4enpare1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:33",
            "last_seen_utc": "2025-11-29 09:56:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654131": [
        {
            "ioc_value": "br1ghtmist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-28 08:32:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654132": [
        {
            "ioc_value": "br1ghtwood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-28 08:32:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654133": [
        {
            "ioc_value": "br1ise.pr0p0sedtact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654134": [
        {
            "ioc_value": "br1mbay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654135": [
        {
            "ioc_value": "br1ng0.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654136": [
        {
            "ioc_value": "bra.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654137": [
        {
            "ioc_value": "brackenloft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-28 08:32:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654138": [
        {
            "ioc_value": "brambleholt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-28 08:32:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654139": [
        {
            "ioc_value": "bramblequell.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-28 08:32:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654140": [
        {
            "ioc_value": "brand.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654141": [
        {
            "ioc_value": "brand8.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654142": [
        {
            "ioc_value": "brandung.wolkenkueste.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654143": [
        {
            "ioc_value": "brassgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654144": [
        {
            "ioc_value": "brassufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:32",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654114": [
        {
            "ioc_value": "bq.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654115": [
        {
            "ioc_value": "bq.q5z9s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654116": [
        {
            "ioc_value": "bq.s9i1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654117": [
        {
            "ioc_value": "bq.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654118": [
        {
            "ioc_value": "bq.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654119": [
        {
            "ioc_value": "bq.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654120": [
        {
            "ioc_value": "bq.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654121": [
        {
            "ioc_value": "bqet-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654122": [
        {
            "ioc_value": "bqk.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654123": [
        {
            "ioc_value": "bqk.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654124": [
        {
            "ioc_value": "br-0-ad-temp-1-ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654125": [
        {
            "ioc_value": "br.frost-wilder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654126": [
        {
            "ioc_value": "br.g3w2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654127": [
        {
            "ioc_value": "br.r-1-mrock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654128": [
        {
            "ioc_value": "br.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654129": [
        {
            "ioc_value": "br.x0e8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-29 09:59:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654130": [
        {
            "ioc_value": "br0adtemp1ate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:31",
            "last_seen_utc": "2025-11-28 08:32:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654095": [
        {
            "ioc_value": "boped.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654096": [
        {
            "ioc_value": "bopuc.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654097": [
        {
            "ioc_value": "boqobui1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654098": [
        {
            "ioc_value": "boruq.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654099": [
        {
            "ioc_value": "boulderfield.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654100": [
        {
            "ioc_value": "bow.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654101": [
        {
            "ioc_value": "bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-28 08:32:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654102": [
        {
            "ioc_value": "boy.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654103": [
        {
            "ioc_value": "bp.b8a2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654104": [
        {
            "ioc_value": "bp.n6p5j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654105": [
        {
            "ioc_value": "bp6.gl1tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654106": [
        {
            "ioc_value": "bpk.brightsage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654107": [
        {
            "ioc_value": "bpu.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654108": [
        {
            "ioc_value": "bq.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654109": [
        {
            "ioc_value": "bq.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654110": [
        {
            "ioc_value": "bq.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654111": [
        {
            "ioc_value": "bq.cobaltwolke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654112": [
        {
            "ioc_value": "bq.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654113": [
        {
            "ioc_value": "bq.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:30",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654078": [
        {
            "ioc_value": "bo.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654079": [
        {
            "ioc_value": "bo.v4h3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:58:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654080": [
        {
            "ioc_value": "bo.vwjy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654081": [
        {
            "ioc_value": "boa.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654082": [
        {
            "ioc_value": "board73.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654083": [
        {
            "ioc_value": "boargrund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654084": [
        {
            "ioc_value": "boat.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654085": [
        {
            "ioc_value": "bog.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654086": [
        {
            "ioc_value": "bog.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654087": [
        {
            "ioc_value": "bogig.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654088": [
        {
            "ioc_value": "bogx.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654089": [
        {
            "ioc_value": "bojut.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654090": [
        {
            "ioc_value": "boku-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654091": [
        {
            "ioc_value": "bolt9a.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654092": [
        {
            "ioc_value": "book.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654093": [
        {
            "ioc_value": "book.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654094": [
        {
            "ioc_value": "bop.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:29",
            "last_seen_utc": "2025-11-29 09:54:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654061": [
        {
            "ioc_value": "bluecr4ft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-28 08:32:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654062": [
        {
            "ioc_value": "bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654063": [
        {
            "ioc_value": "bm.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654064": [
        {
            "ioc_value": "bm.m7e4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654065": [
        {
            "ioc_value": "bm.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654066": [
        {
            "ioc_value": "bm.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654067": [
        {
            "ioc_value": "bm.w3h8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654068": [
        {
            "ioc_value": "bmr74.m1stbird.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654069": [
        {
            "ioc_value": "bn.g-69-p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654070": [
        {
            "ioc_value": "bn.g6i2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654071": [
        {
            "ioc_value": "bn.m5k1k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654072": [
        {
            "ioc_value": "bnd.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654073": [
        {
            "ioc_value": "bo.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654074": [
        {
            "ioc_value": "bo.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654075": [
        {
            "ioc_value": "bo.h8y0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654076": [
        {
            "ioc_value": "bo.k25q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654077": [
        {
            "ioc_value": "bo.kmbo6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:28",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654045": [
        {
            "ioc_value": "blink.v1b3forge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:58:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654046": [
        {
            "ioc_value": "blink2.hre9in7mamma.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654047": [
        {
            "ioc_value": "blink6.hre9in7mamma.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:55:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654048": [
        {
            "ioc_value": "blink8.brahtr0phy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654049": [
        {
            "ioc_value": "blitz.elmfalter.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654050": [
        {
            "ioc_value": "blitz.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654051": [
        {
            "ioc_value": "blitz.ironklippe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654052": [
        {
            "ioc_value": "blitz.sparrowdock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654053": [
        {
            "ioc_value": "bln.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654054": [
        {
            "ioc_value": "blo0d.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654055": [
        {
            "ioc_value": "block.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654056": [
        {
            "ioc_value": "bloom.br1arwild.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654057": [
        {
            "ioc_value": "bloom.neoniake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654058": [
        {
            "ioc_value": "bloom.opalhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654059": [
        {
            "ioc_value": "bloom.stormbioom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654060": [
        {
            "ioc_value": "blue.m1ntflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:27",
            "last_seen_utc": "2025-11-29 09:54:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654028": [
        {
            "ioc_value": "bl.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654029": [
        {
            "ioc_value": "bl.f8t6m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654030": [
        {
            "ioc_value": "bl.g6i2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654031": [
        {
            "ioc_value": "bl1nkswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654032": [
        {
            "ioc_value": "bl2eu.ember-glade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654033": [
        {
            "ioc_value": "bl3nda.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654034": [
        {
            "ioc_value": "bl8205.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654035": [
        {
            "ioc_value": "black.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654036": [
        {
            "ioc_value": "blatt.stormgrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654037": [
        {
            "ioc_value": "blend4.rockbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654038": [
        {
            "ioc_value": "bleue4.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654039": [
        {
            "ioc_value": "blink.cl0udvex.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654040": [
        {
            "ioc_value": "blink.comp0tsab3e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654041": [
        {
            "ioc_value": "blink.foamswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654042": [
        {
            "ioc_value": "blink.quant-melt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654043": [
        {
            "ioc_value": "blink.spry-volt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654044": [
        {
            "ioc_value": "blink.st0nepeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654010": [
        {
            "ioc_value": "bit.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654011": [
        {
            "ioc_value": "bivedyi2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654012": [
        {
            "ioc_value": "biwiv.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654013": [
        {
            "ioc_value": "biz.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654014": [
        {
            "ioc_value": "bj.jzak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:56:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654015": [
        {
            "ioc_value": "bj.m7e4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654016": [
        {
            "ioc_value": "bj.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654017": [
        {
            "ioc_value": "bj.v96g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:58:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654018": [
        {
            "ioc_value": "bjrgt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654019": [
        {
            "ioc_value": "bk.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654020": [
        {
            "ioc_value": "bk.w3h8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:58:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654021": [
        {
            "ioc_value": "bk.x0e8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654022": [
        {
            "ioc_value": "bk1l.comp-0-tsab-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654023": [
        {
            "ioc_value": "bklbd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654024": [
        {
            "ioc_value": "bkldz.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654025": [
        {
            "ioc_value": "bkp.st-0-bepress.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654026": [
        {
            "ioc_value": "bkzu.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654027": [
        {
            "ioc_value": "bl-1-zpond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:25",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653993": [
        {
            "ioc_value": "birch.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653994": [
        {
            "ioc_value": "birch.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653995": [
        {
            "ioc_value": "birch.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653996": [
        {
            "ioc_value": "birch.obsidianpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653997": [
        {
            "ioc_value": "birch.orionfeld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:57:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653998": [
        {
            "ioc_value": "birch.pixelbuche.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653999": [
        {
            "ioc_value": "birch.shad0wline.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:57:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654000": [
        {
            "ioc_value": "birch.skyblend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654001": [
        {
            "ioc_value": "birch.sparrowdock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654002": [
        {
            "ioc_value": "birch.sprigkompass.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654003": [
        {
            "ioc_value": "birhc.2tannenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654004": [
        {
            "ioc_value": "birhc.c1earpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654005": [
        {
            "ioc_value": "birke.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654006": [
        {
            "ioc_value": "bisaj.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654007": [
        {
            "ioc_value": "bit-e.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654008": [
        {
            "ioc_value": "bit-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1654009": [
        {
            "ioc_value": "bit.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:24",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653975": [
        {
            "ioc_value": "bil1sun8en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653976": [
        {
            "ioc_value": "birch.aurorafels.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653977": [
        {
            "ioc_value": "birch.awreti-3-uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653978": [
        {
            "ioc_value": "birch.beechmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653979": [
        {
            "ioc_value": "birch.br1ght5tar.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653980": [
        {
            "ioc_value": "birch.br1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653981": [
        {
            "ioc_value": "birch.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653982": [
        {
            "ioc_value": "birch.clearpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653983": [
        {
            "ioc_value": "birch.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653984": [
        {
            "ioc_value": "birch.cobaltspore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653985": [
        {
            "ioc_value": "birch.cou10sheaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653986": [
        {
            "ioc_value": "birch.darkfeather.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653987": [
        {
            "ioc_value": "birch.dinfectt0rs0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653988": [
        {
            "ioc_value": "birch.ec0nomyfl0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653989": [
        {
            "ioc_value": "birch.ele-6-tricmul-1-ed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653990": [
        {
            "ioc_value": "birch.flintpaddle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653991": [
        {
            "ioc_value": "birch.gladecrown.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:54:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653992": [
        {
            "ioc_value": "birch.ic0n1cforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:23",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653958": [
        {
            "ioc_value": "bh.f0z1n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653959": [
        {
            "ioc_value": "bh.frostwilder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653960": [
        {
            "ioc_value": "bh.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653961": [
        {
            "ioc_value": "bi.f0z1n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653962": [
        {
            "ioc_value": "bi.fy-7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653963": [
        {
            "ioc_value": "bi.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653964": [
        {
            "ioc_value": "bi.kmbo6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653965": [
        {
            "ioc_value": "bi.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653966": [
        {
            "ioc_value": "bi.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653967": [
        {
            "ioc_value": "bi.vwjy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:58:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653968": [
        {
            "ioc_value": "bi.w9a5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653969": [
        {
            "ioc_value": "bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-28 08:32:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653970": [
        {
            "ioc_value": "bi4.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653971": [
        {
            "ioc_value": "biame.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653972": [
        {
            "ioc_value": "bibyn.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653973": [
        {
            "ioc_value": "bid.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653974": [
        {
            "ioc_value": "big.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:22",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653943": [
        {
            "ioc_value": "bf.d1a8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653944": [
        {
            "ioc_value": "bf.d42n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653945": [
        {
            "ioc_value": "bf.k0v1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653946": [
        {
            "ioc_value": "bf.k5b2q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653947": [
        {
            "ioc_value": "bf.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653948": [
        {
            "ioc_value": "bfb.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653949": [
        {
            "ioc_value": "bg.f05t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653950": [
        {
            "ioc_value": "bg.f8t6m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653951": [
        {
            "ioc_value": "bg.t4c5d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653952": [
        {
            "ioc_value": "bg.x0a3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653953": [
        {
            "ioc_value": "bg.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:59:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653954": [
        {
            "ioc_value": "bgq.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653955": [
        {
            "ioc_value": "bgu.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653956": [
        {
            "ioc_value": "bh.c8i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653957": [
        {
            "ioc_value": "bh.d3l4d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:21",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653927": [
        {
            "ioc_value": "begin7.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653928": [
        {
            "ioc_value": "begun.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653929": [
        {
            "ioc_value": "being.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653930": [
        {
            "ioc_value": "being.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653931": [
        {
            "ioc_value": "bemyxye5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653932": [
        {
            "ioc_value": "berg.graniteweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653933": [
        {
            "ioc_value": "beryl6.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653934": [
        {
            "ioc_value": "berylhammer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653935": [
        {
            "ioc_value": "best.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653936": [
        {
            "ioc_value": "best.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653937": [
        {
            "ioc_value": "bestffriend.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653938": [
        {
            "ioc_value": "bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-28 08:32:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653939": [
        {
            "ioc_value": "bet.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653940": [
        {
            "ioc_value": "bet.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653941": [
        {
            "ioc_value": "bevipou05.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653942": [
        {
            "ioc_value": "bezyhio9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:20",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653908": [
        {
            "ioc_value": "be.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:58:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653909": [
        {
            "ioc_value": "be.vxof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:58:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653910": [
        {
            "ioc_value": "be1.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653911": [
        {
            "ioc_value": "be2rg.test6yvarn1sh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653912": [
        {
            "ioc_value": "beacon.c0rkpr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653913": [
        {
            "ioc_value": "beacon1.kn1fecast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653914": [
        {
            "ioc_value": "bear.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653915": [
        {
            "ioc_value": "beartor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653916": [
        {
            "ioc_value": "bebir.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653917": [
        {
            "ioc_value": "becel.press",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653918": [
        {
            "ioc_value": "becyz.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653919": [
        {
            "ioc_value": "bed.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653920": [
        {
            "ioc_value": "bedym.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653921": [
        {
            "ioc_value": "bee.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653922": [
        {
            "ioc_value": "bee.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653923": [
        {
            "ioc_value": "beechmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-28 08:32:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653924": [
        {
            "ioc_value": "beft.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653925": [
        {
            "ioc_value": "beg.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653926": [
        {
            "ioc_value": "began.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:19",
            "last_seen_utc": "2025-11-29 09:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653894": [
        {
            "ioc_value": "bd.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653895": [
        {
            "ioc_value": "bd.t3m3d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653896": [
        {
            "ioc_value": "bd.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653897": [
        {
            "ioc_value": "bd.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653898": [
        {
            "ioc_value": "bd.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653899": [
        {
            "ioc_value": "bd.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653900": [
        {
            "ioc_value": "bd.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653901": [
        {
            "ioc_value": "bd2.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653902": [
        {
            "ioc_value": "bd2.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653903": [
        {
            "ioc_value": "be.devy-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-28 07:43:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653904": [
        {
            "ioc_value": "be.kmbo6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-28 07:42:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653905": [
        {
            "ioc_value": "be.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-28 08:32:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653906": [
        {
            "ioc_value": "be.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-28 08:32:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653907": [
        {
            "ioc_value": "be.ror6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:18",
            "last_seen_utc": "2025-11-29 09:57:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653877": [
        {
            "ioc_value": "bd.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653878": [
        {
            "ioc_value": "bd.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653879": [
        {
            "ioc_value": "bd.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653880": [
        {
            "ioc_value": "bd.falconhimmel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653881": [
        {
            "ioc_value": "bd.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653882": [
        {
            "ioc_value": "bd.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653883": [
        {
            "ioc_value": "bd.j2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653884": [
        {
            "ioc_value": "bd.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653885": [
        {
            "ioc_value": "bd.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653886": [
        {
            "ioc_value": "bd.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653887": [
        {
            "ioc_value": "bd.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653888": [
        {
            "ioc_value": "bd.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653889": [
        {
            "ioc_value": "bd.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653890": [
        {
            "ioc_value": "bd.papervolt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653891": [
        {
            "ioc_value": "bd.r3l1x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653892": [
        {
            "ioc_value": "bd.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653893": [
        {
            "ioc_value": "bd.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:17",
            "last_seen_utc": "2025-11-29 09:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653860": [
        {
            "ioc_value": "bb.j2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653861": [
        {
            "ioc_value": "bb.n5m4t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653862": [
        {
            "ioc_value": "bb.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653863": [
        {
            "ioc_value": "bb7.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653864": [
        {
            "ioc_value": "bbj.subozaa7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653865": [
        {
            "ioc_value": "bc.b5x1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653866": [
        {
            "ioc_value": "bc.d3l4d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653867": [
        {
            "ioc_value": "bc.k9u1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:56:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653868": [
        {
            "ioc_value": "bc.pxys.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653869": [
        {
            "ioc_value": "bc.t65p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653870": [
        {
            "ioc_value": "bcq.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653871": [
        {
            "ioc_value": "bcqz.clearspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653872": [
        {
            "ioc_value": "bcts.br1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653873": [
        {
            "ioc_value": "bd.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653874": [
        {
            "ioc_value": "bd.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653875": [
        {
            "ioc_value": "bd.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653876": [
        {
            "ioc_value": "bd.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:16",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653844": [
        {
            "ioc_value": "banit.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653845": [
        {
            "ioc_value": "bar.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653846": [
        {
            "ioc_value": "shift1.mor-5-tud-1-es.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1653847": [
        {
            "ioc_value": "baruruy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653848": [
        {
            "ioc_value": "bas-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653849": [
        {
            "ioc_value": "bas1c36.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653850": [
        {
            "ioc_value": "bas9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653851": [
        {
            "ioc_value": "basaltstern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653852": [
        {
            "ioc_value": "basaltwisp9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-28 08:32:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653853": [
        {
            "ioc_value": "bash-glider.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-28 08:32:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653854": [
        {
            "ioc_value": "basil9.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653855": [
        {
            "ioc_value": "batch6.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653856": [
        {
            "ioc_value": "bawejai1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653857": [
        {
            "ioc_value": "bay.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653858": [
        {
            "ioc_value": "bay.spindle-way.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653859": [
        {
            "ioc_value": "bb.j1g3k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:15",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653829": [
        {
            "ioc_value": "bach2.darkspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653830": [
        {
            "ioc_value": "bach2.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653831": [
        {
            "ioc_value": "bach2.med1aflow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:56:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653832": [
        {
            "ioc_value": "bach3.thistleforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653833": [
        {
            "ioc_value": "back.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653834": [
        {
            "ioc_value": "backend.zyde.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:59:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653835": [
        {
            "ioc_value": "bad.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653836": [
        {
            "ioc_value": "badejie69.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-28 08:32:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653837": [
        {
            "ioc_value": "badger.badgerfels.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653838": [
        {
            "ioc_value": "badiy.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653839": [
        {
            "ioc_value": "baf8t.gr-1-tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653840": [
        {
            "ioc_value": "bag.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653841": [
        {
            "ioc_value": "baj.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653842": [
        {
            "ioc_value": "ban.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653843": [
        {
            "ioc_value": "ban.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:14",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653812": [
        {
            "ioc_value": "bach.heatherpass.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653813": [
        {
            "ioc_value": "bach.heatherquell.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653814": [
        {
            "ioc_value": "bach.jasperhain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653815": [
        {
            "ioc_value": "bach.l1necloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653816": [
        {
            "ioc_value": "bach.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:54:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653817": [
        {
            "ioc_value": "bach.netit-0-c-0-rec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653818": [
        {
            "ioc_value": "bach.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:54:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653819": [
        {
            "ioc_value": "bach.prairiewolf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653820": [
        {
            "ioc_value": "bach.r1verbend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653821": [
        {
            "ioc_value": "bach.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:54:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653822": [
        {
            "ioc_value": "bach.st0necloud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653823": [
        {
            "ioc_value": "bach.st0nepath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653824": [
        {
            "ioc_value": "bach.stormlaterne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653825": [
        {
            "ioc_value": "bach.stormpeak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653826": [
        {
            "ioc_value": "bach.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:54:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653827": [
        {
            "ioc_value": "bach.walnutsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:58:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653828": [
        {
            "ioc_value": "bach.zephyrquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:13",
            "last_seen_utc": "2025-11-29 09:59:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653794": [
        {
            "ioc_value": "ba5eq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653795": [
        {
            "ioc_value": "ba8o.driftl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653796": [
        {
            "ioc_value": "babuc.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653797": [
        {
            "ioc_value": "bach.5ilverm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653798": [
        {
            "ioc_value": "bach.brightstep.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653799": [
        {
            "ioc_value": "bach.c1oudmap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653800": [
        {
            "ioc_value": "bach.cedarquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653801": [
        {
            "ioc_value": "bach.clouddrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653802": [
        {
            "ioc_value": "bach.cobaltquelle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653803": [
        {
            "ioc_value": "bach.copperalpen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653804": [
        {
            "ioc_value": "bach.deepstream.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653805": [
        {
            "ioc_value": "bach.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653806": [
        {
            "ioc_value": "bach.echohang.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653807": [
        {
            "ioc_value": "bach.emberweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653808": [
        {
            "ioc_value": "bach.f1anerchan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653809": [
        {
            "ioc_value": "bach.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:55:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653810": [
        {
            "ioc_value": "bach.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:54:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653811": [
        {
            "ioc_value": "bach.guan0mesca.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:12",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653776": [
        {
            "ioc_value": "b7.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653777": [
        {
            "ioc_value": "b71yl.pulseknob.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653778": [
        {
            "ioc_value": "b7qk.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653779": [
        {
            "ioc_value": "b8.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653780": [
        {
            "ioc_value": "b8.c-0-sm-1-cweld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653781": [
        {
            "ioc_value": "b8c90.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653782": [
        {
            "ioc_value": "b9.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653783": [
        {
            "ioc_value": "b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653784": [
        {
            "ioc_value": "b9w.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653785": [
        {
            "ioc_value": "ba.c2y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653786": [
        {
            "ioc_value": "ba.d3g7t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653787": [
        {
            "ioc_value": "ba.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653788": [
        {
            "ioc_value": "ba.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653789": [
        {
            "ioc_value": "ba.n6p5j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653790": [
        {
            "ioc_value": "ba.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653791": [
        {
            "ioc_value": "ba.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653792": [
        {
            "ioc_value": "ba.txso1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653793": [
        {
            "ioc_value": "ba3ch.dr0gaguaran.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:11",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653761": [
        {
            "ioc_value": "b3.wuhp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653762": [
        {
            "ioc_value": "b3.yy88.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653763": [
        {
            "ioc_value": "b3m.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653764": [
        {
            "ioc_value": "b4.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653765": [
        {
            "ioc_value": "b4.fl0wbud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653766": [
        {
            "ioc_value": "b4m.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653767": [
        {
            "ioc_value": "b4yn.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653768": [
        {
            "ioc_value": "b5.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653769": [
        {
            "ioc_value": "b5.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653770": [
        {
            "ioc_value": "b5.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653771": [
        {
            "ioc_value": "b53.syrupdock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:58:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653772": [
        {
            "ioc_value": "b5d.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653773": [
        {
            "ioc_value": "b5o.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653774": [
        {
            "ioc_value": "b7.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653775": [
        {
            "ioc_value": "b7.mintflash.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:10",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653747": [
        {
            "ioc_value": "b1.uz-k9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:58:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653748": [
        {
            "ioc_value": "b1.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653749": [
        {
            "ioc_value": "b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653750": [
        {
            "ioc_value": "b1d.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653751": [
        {
            "ioc_value": "b1tcrush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653752": [
        {
            "ioc_value": "b1ue5pr1lng.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653753": [
        {
            "ioc_value": "b2.ede-1-g-0-rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653754": [
        {
            "ioc_value": "b2.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653755": [
        {
            "ioc_value": "b21.wib-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:58:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653756": [
        {
            "ioc_value": "b23.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653757": [
        {
            "ioc_value": "b27.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653758": [
        {
            "ioc_value": "b2i.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653759": [
        {
            "ioc_value": "b2z7r5k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653760": [
        {
            "ioc_value": "b3.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:09",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653728": [
        {
            "ioc_value": "b.h8y0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653729": [
        {
            "ioc_value": "b.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653730": [
        {
            "ioc_value": "b.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653731": [
        {
            "ioc_value": "b.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653732": [
        {
            "ioc_value": "b.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653733": [
        {
            "ioc_value": "b.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653734": [
        {
            "ioc_value": "b.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653735": [
        {
            "ioc_value": "b.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653736": [
        {
            "ioc_value": "b.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653737": [
        {
            "ioc_value": "b.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653738": [
        {
            "ioc_value": "b.t408.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653739": [
        {
            "ioc_value": "b.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653740": [
        {
            "ioc_value": "b.wehv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:58:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653741": [
        {
            "ioc_value": "b.yy88.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653742": [
        {
            "ioc_value": "b0.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653743": [
        {
            "ioc_value": "b0.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653744": [
        {
            "ioc_value": "b0t.drift-meadow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653745": [
        {
            "ioc_value": "b1.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653746": [
        {
            "ioc_value": "b1.kos0ltyu4etey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:08",
            "last_seen_utc": "2025-11-29 09:56:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653711": [
        {
            "ioc_value": "b.4kl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653712": [
        {
            "ioc_value": "b.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653713": [
        {
            "ioc_value": "b.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653714": [
        {
            "ioc_value": "b.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653715": [
        {
            "ioc_value": "b.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653716": [
        {
            "ioc_value": "b.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653717": [
        {
            "ioc_value": "b.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653718": [
        {
            "ioc_value": "b.bvqu7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653719": [
        {
            "ioc_value": "b.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653720": [
        {
            "ioc_value": "b.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653721": [
        {
            "ioc_value": "b.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653722": [
        {
            "ioc_value": "b.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653723": [
        {
            "ioc_value": "b.f2g5q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:55:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653724": [
        {
            "ioc_value": "b.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653725": [
        {
            "ioc_value": "b.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653726": [
        {
            "ioc_value": "b.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653727": [
        {
            "ioc_value": "b.g3w2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:07",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653694": [
        {
            "ioc_value": "ay.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653695": [
        {
            "ioc_value": "ay.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653696": [
        {
            "ioc_value": "ay.r1a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653697": [
        {
            "ioc_value": "ay.t4g9w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653698": [
        {
            "ioc_value": "ay.txso1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653699": [
        {
            "ioc_value": "ay.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653700": [
        {
            "ioc_value": "ayeu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653701": [
        {
            "ioc_value": "ayl.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653702": [
        {
            "ioc_value": "aytuna.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653703": [
        {
            "ioc_value": "ayx.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653704": [
        {
            "ioc_value": "az.b8a2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653705": [
        {
            "ioc_value": "az.g0s1f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653706": [
        {
            "ioc_value": "az.v1n4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:58:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653707": [
        {
            "ioc_value": "azaler.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653708": [
        {
            "ioc_value": "azure.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:56:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653709": [
        {
            "ioc_value": "azure5.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653710": [
        {
            "ioc_value": "b.25qx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:06",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653677": [
        {
            "ioc_value": "aws.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653678": [
        {
            "ioc_value": "awxy.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653679": [
        {
            "ioc_value": "ax.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653680": [
        {
            "ioc_value": "ax.m0onforger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653681": [
        {
            "ioc_value": "ax.r3l1x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653682": [
        {
            "ioc_value": "ax.s3i1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653683": [
        {
            "ioc_value": "ax.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653684": [
        {
            "ioc_value": "ax.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653685": [
        {
            "ioc_value": "ax.txso1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653686": [
        {
            "ioc_value": "ax.v4h3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653687": [
        {
            "ioc_value": "ax.v96g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653688": [
        {
            "ioc_value": "ax.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653689": [
        {
            "ioc_value": "axe.run-c-you.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:57:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653690": [
        {
            "ioc_value": "axm.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653691": [
        {
            "ioc_value": "ay.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653692": [
        {
            "ioc_value": "ay.c0h9w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653693": [
        {
            "ioc_value": "ay.gr0ssgar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:05",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653659": [
        {
            "ioc_value": "av.p9v7g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653660": [
        {
            "ioc_value": "av.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653661": [
        {
            "ioc_value": "av.r1a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653662": [
        {
            "ioc_value": "av.x8q0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653663": [
        {
            "ioc_value": "avian2.st0nebird.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653664": [
        {
            "ioc_value": "aw.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653665": [
        {
            "ioc_value": "aw.g6i2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653666": [
        {
            "ioc_value": "aw.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653667": [
        {
            "ioc_value": "aw.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653668": [
        {
            "ioc_value": "aw.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653669": [
        {
            "ioc_value": "aw.r2h7m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653670": [
        {
            "ioc_value": "aw.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653671": [
        {
            "ioc_value": "aw.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653672": [
        {
            "ioc_value": "aw.s7z7r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653673": [
        {
            "ioc_value": "aw.txso1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653674": [
        {
            "ioc_value": "aw9.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653675": [
        {
            "ioc_value": "awreti-3-uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-29 09:54:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653676": [
        {
            "ioc_value": "awreti3uette.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:04",
            "last_seen_utc": "2025-11-28 08:32:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653647": [
        {
            "ioc_value": "aurg7o.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653648": [
        {
            "ioc_value": "auricfluss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653649": [
        {
            "ioc_value": "auricklang.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653650": [
        {
            "ioc_value": "aurora.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653651": [
        {
            "ioc_value": "aurora1hain.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-28 08:32:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653652": [
        {
            "ioc_value": "aurorafels.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653653": [
        {
            "ioc_value": "auroralinde.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653654": [
        {
            "ioc_value": "autodiscover.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:56:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653655": [
        {
            "ioc_value": "autodiscover.wbth.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:58:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653656": [
        {
            "ioc_value": "autodiscover.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653657": [
        {
            "ioc_value": "autodiscover.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653658": [
        {
            "ioc_value": "auul8.dup-1-ic-4-ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:03",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653646": [
        {
            "ioc_value": "aur3.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:02",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653637": [
        {
            "ioc_value": "au.d3g7t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:01",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653638": [
        {
            "ioc_value": "au.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:01",
            "last_seen_utc": "2025-11-29 09:54:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653639": [
        {
            "ioc_value": "au.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:01",
            "last_seen_utc": "2025-11-29 09:55:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653640": [
        {
            "ioc_value": "au.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:01",
            "last_seen_utc": "2025-11-29 09:54:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653641": [
        {
            "ioc_value": "au.v4h3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:01",
            "last_seen_utc": "2025-11-29 09:54:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653642": [
        {
            "ioc_value": "au.w9a5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:01",
            "last_seen_utc": "2025-11-29 09:54:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653643": [
        {
            "ioc_value": "aue.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:01",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653644": [
        {
            "ioc_value": "auf.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:01",
            "last_seen_utc": "2025-11-29 09:54:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653645": [
        {
            "ioc_value": "auf.nelypuu5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:01",
            "last_seen_utc": "2025-11-29 09:56:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653624": [
        {
            "ioc_value": "astralwiese.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-29 09:54:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653625": [
        {
            "ioc_value": "at.b8a2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-28 07:42:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653626": [
        {
            "ioc_value": "at.gyfc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-28 08:34:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653627": [
        {
            "ioc_value": "at.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653628": [
        {
            "ioc_value": "at.p2-om.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653629": [
        {
            "ioc_value": "at.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-28 08:32:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653630": [
        {
            "ioc_value": "at.s4-ti.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653631": [
        {
            "ioc_value": "at.v7h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-29 09:58:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653632": [
        {
            "ioc_value": "at7.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653633": [
        {
            "ioc_value": "atd.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-29 09:54:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653634": [
        {
            "ioc_value": "ate.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-29 09:54:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653635": [
        {
            "ioc_value": "ate.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-29 09:54:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653636": [
        {
            "ioc_value": "atlasufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:42:00",
            "last_seen_utc": "2025-11-28 08:32:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653608": [
        {
            "ioc_value": "as.pl-8a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-28 08:32:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653609": [
        {
            "ioc_value": "as.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653610": [
        {
            "ioc_value": "as.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-28 08:34:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653611": [
        {
            "ioc_value": "asaf.social",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653612": [
        {
            "ioc_value": "asfb.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653613": [
        {
            "ioc_value": "asgp2.lake-ray.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653614": [
        {
            "ioc_value": "ash.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653615": [
        {
            "ioc_value": "ash.web-d-n-45.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:58:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653616": [
        {
            "ioc_value": "ashenkrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653617": [
        {
            "ioc_value": "ashriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-28 08:32:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653618": [
        {
            "ioc_value": "ask.xonulee9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:59:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653619": [
        {
            "ioc_value": "ask4it.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653620": [
        {
            "ioc_value": "asp.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653621": [
        {
            "ioc_value": "ast.7willowkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653622": [
        {
            "ioc_value": "astra3.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653623": [
        {
            "ioc_value": "astra7.starf0ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:59",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653594": [
        {
            "ioc_value": "ar.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653595": [
        {
            "ioc_value": "ar.w6n2t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653596": [
        {
            "ioc_value": "ar.x8q0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:59:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653597": [
        {
            "ioc_value": "ar.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653598": [
        {
            "ioc_value": "ar1th0metback.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653599": [
        {
            "ioc_value": "ardor.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653600": [
        {
            "ioc_value": "argent.s1lvergate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653601": [
        {
            "ioc_value": "argonbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-28 08:32:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653602": [
        {
            "ioc_value": "arise.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653603": [
        {
            "ioc_value": "arm.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653604": [
        {
            "ioc_value": "arm.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653605": [
        {
            "ioc_value": "art.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653606": [
        {
            "ioc_value": "art.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:54:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653607": [
        {
            "ioc_value": "as.lage2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:58",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653578": [
        {
            "ioc_value": "ape.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653579": [
        {
            "ioc_value": "aphrh1tc4h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-28 08:32:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653580": [
        {
            "ioc_value": "app-6-v.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653581": [
        {
            "ioc_value": "app-6-v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653582": [
        {
            "ioc_value": "app.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653583": [
        {
            "ioc_value": "apple.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653584": [
        {
            "ioc_value": "apple.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653585": [
        {
            "ioc_value": "apple.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653586": [
        {
            "ioc_value": "aq.b5x1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653587": [
        {
            "ioc_value": "aq.k9u1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653588": [
        {
            "ioc_value": "aq.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653589": [
        {
            "ioc_value": "aq.pen1sp7edef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:57:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653590": [
        {
            "ioc_value": "ar-1-th-0-metback.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653591": [
        {
            "ioc_value": "ar.q8e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653592": [
        {
            "ioc_value": "ar.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653593": [
        {
            "ioc_value": "ar.tvti0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:57",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653560": [
        {
            "ioc_value": "anchor.z1ncspike.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:59:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653561": [
        {
            "ioc_value": "anchor0.gyro-desk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653562": [
        {
            "ioc_value": "anger.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653563": [
        {
            "ioc_value": "anger35.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653564": [
        {
            "ioc_value": "angry.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653565": [
        {
            "ioc_value": "anre.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653566": [
        {
            "ioc_value": "ant.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653567": [
        {
            "ioc_value": "antitoxicperkiness.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653568": [
        {
            "ioc_value": "any.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653569": [
        {
            "ioc_value": "ao.f8t6m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653570": [
        {
            "ioc_value": "ao.n9t6m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653571": [
        {
            "ioc_value": "ao.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653572": [
        {
            "ioc_value": "ao.x0a3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653573": [
        {
            "ioc_value": "ap.b5x1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653574": [
        {
            "ioc_value": "ap.c8i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653575": [
        {
            "ioc_value": "ap.mintcraft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653576": [
        {
            "ioc_value": "ap.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653577": [
        {
            "ioc_value": "ape.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:56",
            "last_seen_utc": "2025-11-29 09:54:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653545": [
        {
            "ioc_value": "amo.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653546": [
        {
            "ioc_value": "an-1-sepechu-7-ka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653547": [
        {
            "ioc_value": "an.bo-x2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653548": [
        {
            "ioc_value": "an.boku0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:54:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653549": [
        {
            "ioc_value": "an.ht-if.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-28 08:34:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653550": [
        {
            "ioc_value": "an.k5b2q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653551": [
        {
            "ioc_value": "an.t3m3d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653552": [
        {
            "ioc_value": "an.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-28 08:32:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653553": [
        {
            "ioc_value": "an1sepechu7ka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653554": [
        {
            "ioc_value": "anch0rsugar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653555": [
        {
            "ioc_value": "anchor.dripanchor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653556": [
        {
            "ioc_value": "anchor.foamswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653557": [
        {
            "ioc_value": "anchor.galy8phony.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653558": [
        {
            "ioc_value": "anchor.mashrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653559": [
        {
            "ioc_value": "anchor.plasmabout.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:55",
            "last_seen_utc": "2025-11-29 09:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653530": [
        {
            "ioc_value": "am.myga3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653531": [
        {
            "ioc_value": "am.n5m4t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653532": [
        {
            "ioc_value": "am.nwyk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653533": [
        {
            "ioc_value": "am.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653534": [
        {
            "ioc_value": "am.raha1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:57:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653535": [
        {
            "ioc_value": "am.tvti0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653536": [
        {
            "ioc_value": "am.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653537": [
        {
            "ioc_value": "am.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653538": [
        {
            "ioc_value": "am89.ic0n1cshore.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653539": [
        {
            "ioc_value": "amber.citrinewald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653540": [
        {
            "ioc_value": "ambergeist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653541": [
        {
            "ioc_value": "amberkliff.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-28 08:32:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653542": [
        {
            "ioc_value": "ambr.firer1dge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653543": [
        {
            "ioc_value": "amhq.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653544": [
        {
            "ioc_value": "amin0mer3ges.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:54",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653514": [
        {
            "ioc_value": "alderquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-28 08:32:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653515": [
        {
            "ioc_value": "alk.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653516": [
        {
            "ioc_value": "alm.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653517": [
        {
            "ioc_value": "alone9.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653518": [
        {
            "ioc_value": "alosym.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653519": [
        {
            "ioc_value": "alpen.glaciergrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:55:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653520": [
        {
            "ioc_value": "alpha-cinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653521": [
        {
            "ioc_value": "alpha3.n0v0se1prew.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653522": [
        {
            "ioc_value": "alphacinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653523": [
        {
            "ioc_value": "also.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653524": [
        {
            "ioc_value": "alv.lotegeo7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653525": [
        {
            "ioc_value": "am.devy3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653526": [
        {
            "ioc_value": "am.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653527": [
        {
            "ioc_value": "am.fy-7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653528": [
        {
            "ioc_value": "am.g6i2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653529": [
        {
            "ioc_value": "am.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:53",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653501": [
        {
            "ioc_value": "ak.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653502": [
        {
            "ioc_value": "ak.tygilyo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653503": [
        {
            "ioc_value": "aka.torquebud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653504": [
        {
            "ioc_value": "akq.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653505": [
        {
            "ioc_value": "al.c0h9w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653506": [
        {
            "ioc_value": "al.f8t6m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653507": [
        {
            "ioc_value": "al.l9a5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653508": [
        {
            "ioc_value": "al.luxemyy2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:56:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653509": [
        {
            "ioc_value": "al.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653510": [
        {
            "ioc_value": "al1ve.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653511": [
        {
            "ioc_value": "album.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653512": [
        {
            "ioc_value": "alder.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653513": [
        {
            "ioc_value": "alder3.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:52",
            "last_seen_utc": "2025-11-29 09:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653485": [
        {
            "ioc_value": "aj.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653486": [
        {
            "ioc_value": "aj.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653487": [
        {
            "ioc_value": "aj.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653488": [
        {
            "ioc_value": "aj.t4a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653489": [
        {
            "ioc_value": "aj.w6n2t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653490": [
        {
            "ioc_value": "ajbkf.c1earwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653491": [
        {
            "ioc_value": "ajf.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653492": [
        {
            "ioc_value": "ajk.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653493": [
        {
            "ioc_value": "ajml.icymoth.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653494": [
        {
            "ioc_value": "ajs.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653495": [
        {
            "ioc_value": "ak.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653496": [
        {
            "ioc_value": "ak.g7r7s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653497": [
        {
            "ioc_value": "ak.kairosmix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653498": [
        {
            "ioc_value": "ak.m5k1k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653499": [
        {
            "ioc_value": "ak.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653500": [
        {
            "ioc_value": "ak.r1a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:51",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653468": [
        {
            "ioc_value": "ai.d-09-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653469": [
        {
            "ioc_value": "ai.k0v1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653470": [
        {
            "ioc_value": "ai.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653471": [
        {
            "ioc_value": "ai.s9i1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653472": [
        {
            "ioc_value": "ai.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653473": [
        {
            "ioc_value": "ai.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653474": [
        {
            "ioc_value": "ai.w2r1k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653475": [
        {
            "ioc_value": "aid.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653476": [
        {
            "ioc_value": "aim.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653477": [
        {
            "ioc_value": "air.bavyzeo47.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653478": [
        {
            "ioc_value": "air.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653479": [
        {
            "ioc_value": "air.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653480": [
        {
            "ioc_value": "air.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653481": [
        {
            "ioc_value": "air.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653482": [
        {
            "ioc_value": "aj.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653483": [
        {
            "ioc_value": "aj.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:54:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653484": [
        {
            "ioc_value": "aj.g0s1f.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:50",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653453": [
        {
            "ioc_value": "ag.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653454": [
        {
            "ioc_value": "agatehof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653455": [
        {
            "ioc_value": "age.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653456": [
        {
            "ioc_value": "age.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653457": [
        {
            "ioc_value": "age.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653458": [
        {
            "ioc_value": "agv.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653459": [
        {
            "ioc_value": "ah.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:56:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653460": [
        {
            "ioc_value": "ah.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653461": [
        {
            "ioc_value": "ah.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653462": [
        {
            "ioc_value": "ah.w2r1k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653463": [
        {
            "ioc_value": "ah.w3h8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653464": [
        {
            "ioc_value": "ah.w9a5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:58:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653465": [
        {
            "ioc_value": "ahh.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653466": [
        {
            "ioc_value": "ahorn7.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653467": [
        {
            "ioc_value": "ai.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:49",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653434": [
        {
            "ioc_value": "ae.g7r7s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:55:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653435": [
        {
            "ioc_value": "ae.j1g3k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653436": [
        {
            "ioc_value": "ae.k9u1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653437": [
        {
            "ioc_value": "ae.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653438": [
        {
            "ioc_value": "ae.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653439": [
        {
            "ioc_value": "ae09.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653440": [
        {
            "ioc_value": "ae3.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653441": [
        {
            "ioc_value": "aer.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653442": [
        {
            "ioc_value": "aeri4s.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653443": [
        {
            "ioc_value": "af.b5x1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653444": [
        {
            "ioc_value": "af.g7r7s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653445": [
        {
            "ioc_value": "af.n44s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653446": [
        {
            "ioc_value": "af.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653447": [
        {
            "ioc_value": "af.r1a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653448": [
        {
            "ioc_value": "ag.d1a8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653449": [
        {
            "ioc_value": "ag.dgod.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653450": [
        {
            "ioc_value": "ag.f-05-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653451": [
        {
            "ioc_value": "ag.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:54:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653452": [
        {
            "ioc_value": "ag.q5z9s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:48",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653415": [
        {
            "ioc_value": "adler.ferretpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653416": [
        {
            "ioc_value": "adler.gladecrown.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:55:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653417": [
        {
            "ioc_value": "adler.granitebach.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653418": [
        {
            "ioc_value": "adler.graniteweide.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653419": [
        {
            "ioc_value": "adler.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653420": [
        {
            "ioc_value": "adler.ivyvale.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:56:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653421": [
        {
            "ioc_value": "adler.p0lys5pear.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653422": [
        {
            "ioc_value": "adler.quartzfuchs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653423": [
        {
            "ioc_value": "adler.quirkforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:57:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653424": [
        {
            "ioc_value": "adler.ravenbucht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653425": [
        {
            "ioc_value": "adler.ravenkloster.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653426": [
        {
            "ioc_value": "adler.stargl0w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653427": [
        {
            "ioc_value": "adler.stormfiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653428": [
        {
            "ioc_value": "adler.w1ldgate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653429": [
        {
            "ioc_value": "adler.willowufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653430": [
        {
            "ioc_value": "adli.academy",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653431": [
        {
            "ioc_value": "admin.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653432": [
        {
            "ioc_value": "adopt.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653433": [
        {
            "ioc_value": "ady.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:47",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653397": [
        {
            "ioc_value": "ad.n2-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653398": [
        {
            "ioc_value": "ad.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653399": [
        {
            "ioc_value": "ad.q8e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653400": [
        {
            "ioc_value": "ad.sapeniu2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653401": [
        {
            "ioc_value": "ad.t8g2w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653402": [
        {
            "ioc_value": "ad.tfpe6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653403": [
        {
            "ioc_value": "ad9vh.gi0wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653404": [
        {
            "ioc_value": "add.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653405": [
        {
            "ioc_value": "add.homohay31.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653406": [
        {
            "ioc_value": "adler.anvilklee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653407": [
        {
            "ioc_value": "adler.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653408": [
        {
            "ioc_value": "adler.cairnsteg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653409": [
        {
            "ioc_value": "adler.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653410": [
        {
            "ioc_value": "adler.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653411": [
        {
            "ioc_value": "adler.cobaltweald.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653412": [
        {
            "ioc_value": "adler.darkr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:54:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653413": [
        {
            "ioc_value": "adler.eaglekrone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:55:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653414": [
        {
            "ioc_value": "adler.ele-6-tricmul-1-ed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:46",
            "last_seen_utc": "2025-11-29 09:55:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653380": [
        {
            "ioc_value": "abz52.s0apthorn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653381": [
        {
            "ioc_value": "ac.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653382": [
        {
            "ioc_value": "ac.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653383": [
        {
            "ioc_value": "ac.r3j5c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653384": [
        {
            "ioc_value": "ac.s3i1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653385": [
        {
            "ioc_value": "ac.s7z7r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653386": [
        {
            "ioc_value": "acidwrench.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-28 08:32:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653387": [
        {
            "ioc_value": "acorn.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653388": [
        {
            "ioc_value": "acornhollow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653389": [
        {
            "ioc_value": "acp.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653390": [
        {
            "ioc_value": "act.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653391": [
        {
            "ioc_value": "act.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653392": [
        {
            "ioc_value": "actor.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653393": [
        {
            "ioc_value": "actor6.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653394": [
        {
            "ioc_value": "ad.c0h9w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653395": [
        {
            "ioc_value": "ad.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653396": [
        {
            "ioc_value": "ad.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:45",
            "last_seen_utc": "2025-11-29 09:54:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653363": [
        {
            "ioc_value": "aa.x0e8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653364": [
        {
            "ioc_value": "ab.b3x1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653365": [
        {
            "ioc_value": "ab.hihijie3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653366": [
        {
            "ioc_value": "ab.hwke4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653367": [
        {
            "ioc_value": "ab.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653368": [
        {
            "ioc_value": "ab.lysyrei3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653369": [
        {
            "ioc_value": "ab.q6o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:57:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653370": [
        {
            "ioc_value": "ab.tfpe6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:58:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653371": [
        {
            "ioc_value": "ab.w3h8j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653372": [
        {
            "ioc_value": "ab.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653373": [
        {
            "ioc_value": "ab.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653374": [
        {
            "ioc_value": "ab0ve.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653375": [
        {
            "ioc_value": "ab7.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653376": [
        {
            "ioc_value": "abcd.b-18a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653377": [
        {
            "ioc_value": "abd.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653378": [
        {
            "ioc_value": "abh.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653379": [
        {
            "ioc_value": "above55.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:44",
            "last_seen_utc": "2025-11-29 09:54:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653346": [
        {
            "ioc_value": "a9.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653347": [
        {
            "ioc_value": "a9.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653348": [
        {
            "ioc_value": "a9.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653349": [
        {
            "ioc_value": "a9.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653350": [
        {
            "ioc_value": "a9.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653351": [
        {
            "ioc_value": "a9.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653352": [
        {
            "ioc_value": "a9jpf.f1rewall.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653353": [
        {
            "ioc_value": "a9m.wuk0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653354": [
        {
            "ioc_value": "a9v3c2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653355": [
        {
            "ioc_value": "aa.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653356": [
        {
            "ioc_value": "aa.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653357": [
        {
            "ioc_value": "aa.hwke4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653358": [
        {
            "ioc_value": "aa.k0v1p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653359": [
        {
            "ioc_value": "aa.q1s6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:57:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653360": [
        {
            "ioc_value": "aa.tfpe6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653361": [
        {
            "ioc_value": "aa.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653362": [
        {
            "ioc_value": "aa.v96g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:43",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653330": [
        {
            "ioc_value": "a27.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653331": [
        {
            "ioc_value": "a2n.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653332": [
        {
            "ioc_value": "a3.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653333": [
        {
            "ioc_value": "a3.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:55:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653334": [
        {
            "ioc_value": "a3.sm-0-kewood.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653335": [
        {
            "ioc_value": "a31a.wind-barrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:58:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653336": [
        {
            "ioc_value": "a4.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653337": [
        {
            "ioc_value": "a4.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653338": [
        {
            "ioc_value": "a4t.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653339": [
        {
            "ioc_value": "a4za.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:57:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653340": [
        {
            "ioc_value": "a5.29rs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653341": [
        {
            "ioc_value": "a5ide.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653342": [
        {
            "ioc_value": "a7.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653343": [
        {
            "ioc_value": "a89b.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653344": [
        {
            "ioc_value": "a8eq.fr0stp1llar.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653345": [
        {
            "ioc_value": "a9.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:42",
            "last_seen_utc": "2025-11-29 09:54:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653313": [
        {
            "ioc_value": "a1.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653314": [
        {
            "ioc_value": "a1.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653315": [
        {
            "ioc_value": "a1.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653316": [
        {
            "ioc_value": "a1.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653317": [
        {
            "ioc_value": "a1.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653318": [
        {
            "ioc_value": "a1.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653319": [
        {
            "ioc_value": "a1.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653320": [
        {
            "ioc_value": "a12.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653321": [
        {
            "ioc_value": "a19.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653322": [
        {
            "ioc_value": "a1f.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653323": [
        {
            "ioc_value": "a1over.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653324": [
        {
            "ioc_value": "a1t.myga3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:56:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653325": [
        {
            "ioc_value": "a1x.81dm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653326": [
        {
            "ioc_value": "a2.driftl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653327": [
        {
            "ioc_value": "a2.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653328": [
        {
            "ioc_value": "a2.kijx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653329": [
        {
            "ioc_value": "a2.snowr1se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:41",
            "last_seen_utc": "2025-11-29 09:54:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653296": [
        {
            "ioc_value": "a.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653297": [
        {
            "ioc_value": "a.velvetnebel.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:58:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653298": [
        {
            "ioc_value": "a.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653299": [
        {
            "ioc_value": "a.wuhp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653300": [
        {
            "ioc_value": "a.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653301": [
        {
            "ioc_value": "a.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653302": [
        {
            "ioc_value": "a.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653303": [
        {
            "ioc_value": "a0.crju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653304": [
        {
            "ioc_value": "a1.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653305": [
        {
            "ioc_value": "a1.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653306": [
        {
            "ioc_value": "a1.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653307": [
        {
            "ioc_value": "a1.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653308": [
        {
            "ioc_value": "a1.focove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653309": [
        {
            "ioc_value": "a1.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653310": [
        {
            "ioc_value": "a1.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653311": [
        {
            "ioc_value": "a1.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653312": [
        {
            "ioc_value": "a1.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:40",
            "last_seen_utc": "2025-11-29 09:53:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653278": [
        {
            "ioc_value": "a.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:35:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653279": [
        {
            "ioc_value": "a.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:35:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653280": [
        {
            "ioc_value": "a.n5m4t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653281": [
        {
            "ioc_value": "a.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653282": [
        {
            "ioc_value": "a.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:36:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653283": [
        {
            "ioc_value": "a.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:36:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653284": [
        {
            "ioc_value": "a.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:36:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653285": [
        {
            "ioc_value": "a.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653286": [
        {
            "ioc_value": "a.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653287": [
        {
            "ioc_value": "a.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653288": [
        {
            "ioc_value": "a.t2w3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-29 09:58:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653289": [
        {
            "ioc_value": "a.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653290": [
        {
            "ioc_value": "a.tem5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-29 09:58:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653291": [
        {
            "ioc_value": "a.tfpe6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653292": [
        {
            "ioc_value": "a.u-na5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653293": [
        {
            "ioc_value": "a.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653294": [
        {
            "ioc_value": "a.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653295": [
        {
            "ioc_value": "a.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:39",
            "last_seen_utc": "2025-11-28 08:32:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653264": [
        {
            "ioc_value": "a.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 08:32:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653265": [
        {
            "ioc_value": "a.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 08:32:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653266": [
        {
            "ioc_value": "a.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-29 09:54:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653267": [
        {
            "ioc_value": "a.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 08:33:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653268": [
        {
            "ioc_value": "a.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 08:33:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653269": [
        {
            "ioc_value": "a.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 08:33:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653270": [
        {
            "ioc_value": "a.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 07:43:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653271": [
        {
            "ioc_value": "a.embergarten.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653272": [
        {
            "ioc_value": "a.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 08:33:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653273": [
        {
            "ioc_value": "a.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 08:34:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653274": [
        {
            "ioc_value": "a.hwke4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 08:34:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653275": [
        {
            "ioc_value": "a.if-p4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-29 09:55:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653276": [
        {
            "ioc_value": "a.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": "2025-11-28 08:34:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653277": [
        {
            "ioc_value": "a.l9a5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653250": [
        {
            "ioc_value": "9t4.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653251": [
        {
            "ioc_value": "9u.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653252": [
        {
            "ioc_value": "9vo.wolkenspur3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:59:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653253": [
        {
            "ioc_value": "9x.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653254": [
        {
            "ioc_value": "9x2.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653255": [
        {
            "ioc_value": "9xy.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653256": [
        {
            "ioc_value": "9xz.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653257": [
        {
            "ioc_value": "9y.njur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653258": [
        {
            "ioc_value": "9y.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653259": [
        {
            "ioc_value": "9yg.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653260": [
        {
            "ioc_value": "9yi.j935.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653261": [
        {
            "ioc_value": "9z.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653262": [
        {
            "ioc_value": "9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653263": [
        {
            "ioc_value": "9zpya.drift-shad-0-w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:37",
            "last_seen_utc": "2025-11-29 09:53:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653234": [
        {
            "ioc_value": "9kp.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653235": [
        {
            "ioc_value": "9l.m0onforger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:56:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653236": [
        {
            "ioc_value": "9ls.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653237": [
        {
            "ioc_value": "9mv.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653238": [
        {
            "ioc_value": "9mz.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653239": [
        {
            "ioc_value": "9n.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653240": [
        {
            "ioc_value": "9n.m1dnightr0ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:56:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653241": [
        {
            "ioc_value": "9o.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653242": [
        {
            "ioc_value": "9p.marbletug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653243": [
        {
            "ioc_value": "9p6.frostwalk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653244": [
        {
            "ioc_value": "9q.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653245": [
        {
            "ioc_value": "9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-28 08:32:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653246": [
        {
            "ioc_value": "9s.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653247": [
        {
            "ioc_value": "9st6r.liner-9-ick.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653248": [
        {
            "ioc_value": "9t.stormmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653249": [
        {
            "ioc_value": "9t.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:36",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653218": [
        {
            "ioc_value": "9e.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653219": [
        {
            "ioc_value": "9f.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653220": [
        {
            "ioc_value": "9f.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653221": [
        {
            "ioc_value": "9fwu4.nibsnap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653222": [
        {
            "ioc_value": "9gh.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653223": [
        {
            "ioc_value": "9gu.wildr0sehub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653224": [
        {
            "ioc_value": "9hb.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653225": [
        {
            "ioc_value": "9hctu.nightwharf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653226": [
        {
            "ioc_value": "9hm.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653227": [
        {
            "ioc_value": "9ht.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653228": [
        {
            "ioc_value": "9i.njur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653229": [
        {
            "ioc_value": "9ij.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653230": [
        {
            "ioc_value": "9iy.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653231": [
        {
            "ioc_value": "9j5.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653232": [
        {
            "ioc_value": "9jw.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653233": [
        {
            "ioc_value": "9ki.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:35",
            "last_seen_utc": "2025-11-29 09:53:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653201": [
        {
            "ioc_value": "971.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653202": [
        {
            "ioc_value": "9715w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653203": [
        {
            "ioc_value": "976.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653204": [
        {
            "ioc_value": "98.drip-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653205": [
        {
            "ioc_value": "98.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653206": [
        {
            "ioc_value": "984.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653207": [
        {
            "ioc_value": "99.derl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653208": [
        {
            "ioc_value": "99.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653209": [
        {
            "ioc_value": "9912043.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653210": [
        {
            "ioc_value": "9912043.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653211": [
        {
            "ioc_value": "9a.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653212": [
        {
            "ioc_value": "9aoj.jump3r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653213": [
        {
            "ioc_value": "9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653214": [
        {
            "ioc_value": "9c.81dm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653215": [
        {
            "ioc_value": "9ca6.cl0ckmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653216": [
        {
            "ioc_value": "9cm.rockbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653217": [
        {
            "ioc_value": "9d4.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:34",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653184": [
        {
            "ioc_value": "92x.w1ld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:58:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653185": [
        {
            "ioc_value": "93.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653186": [
        {
            "ioc_value": "93.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653187": [
        {
            "ioc_value": "93055.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653188": [
        {
            "ioc_value": "93055.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653189": [
        {
            "ioc_value": "932.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653190": [
        {
            "ioc_value": "9375.skym0tion.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653191": [
        {
            "ioc_value": "94f.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653192": [
        {
            "ioc_value": "9505.cl0ckmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653193": [
        {
            "ioc_value": "954.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653194": [
        {
            "ioc_value": "95f.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653195": [
        {
            "ioc_value": "96.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653196": [
        {
            "ioc_value": "964.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653197": [
        {
            "ioc_value": "964.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653198": [
        {
            "ioc_value": "964.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653199": [
        {
            "ioc_value": "96btv.brightridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653200": [
        {
            "ioc_value": "97.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:33",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653166": [
        {
            "ioc_value": "9031.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653167": [
        {
            "ioc_value": "9031542.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653168": [
        {
            "ioc_value": "9031542.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653169": [
        {
            "ioc_value": "907.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653170": [
        {
            "ioc_value": "91-7l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653171": [
        {
            "ioc_value": "91.njur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653172": [
        {
            "ioc_value": "91.zeromint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653173": [
        {
            "ioc_value": "911.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653174": [
        {
            "ioc_value": "913560.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653175": [
        {
            "ioc_value": "913c50.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653176": [
        {
            "ioc_value": "913c50.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653177": [
        {
            "ioc_value": "918274.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653178": [
        {
            "ioc_value": "91u.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653179": [
        {
            "ioc_value": "92.sp1remoss.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:57:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653180": [
        {
            "ioc_value": "925.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653181": [
        {
            "ioc_value": "925.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653182": [
        {
            "ioc_value": "925.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653183": [
        {
            "ioc_value": "927.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:32",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653147": [
        {
            "ioc_value": "8xouz.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653148": [
        {
            "ioc_value": "8y.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653149": [
        {
            "ioc_value": "8y.cloud5eed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653150": [
        {
            "ioc_value": "8y.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653151": [
        {
            "ioc_value": "8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653152": [
        {
            "ioc_value": "8zmw8.harpswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653153": [
        {
            "ioc_value": "9-ck6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653154": [
        {
            "ioc_value": "9-tli.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653155": [
        {
            "ioc_value": "9-zsy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653156": [
        {
            "ioc_value": "9.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653157": [
        {
            "ioc_value": "9.v9542.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:58:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653158": [
        {
            "ioc_value": "90.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653159": [
        {
            "ioc_value": "90.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:56:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653160": [
        {
            "ioc_value": "90.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653161": [
        {
            "ioc_value": "9023.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653162": [
        {
            "ioc_value": "9026.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653163": [
        {
            "ioc_value": "9026.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653164": [
        {
            "ioc_value": "903.marbletug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653165": [
        {
            "ioc_value": "9031.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:31",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653127": [
        {
            "ioc_value": "8ql.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653128": [
        {
            "ioc_value": "8qs.ravenklause.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653129": [
        {
            "ioc_value": "8r.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653130": [
        {
            "ioc_value": "8r.kijx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:56:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653131": [
        {
            "ioc_value": "8rt2.emberhoehle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653132": [
        {
            "ioc_value": "8s.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653133": [
        {
            "ioc_value": "8s3.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653134": [
        {
            "ioc_value": "8t.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653135": [
        {
            "ioc_value": "8tk.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653136": [
        {
            "ioc_value": "8u2.7-gb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653137": [
        {
            "ioc_value": "8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653138": [
        {
            "ioc_value": "8v.njur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653139": [
        {
            "ioc_value": "8v.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653140": [
        {
            "ioc_value": "8vpz.r0ckveil.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653141": [
        {
            "ioc_value": "8w.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653142": [
        {
            "ioc_value": "8w.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653143": [
        {
            "ioc_value": "8w.frostlake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653144": [
        {
            "ioc_value": "8w.skyb1end.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653145": [
        {
            "ioc_value": "8x4.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653146": [
        {
            "ioc_value": "8xd.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:30",
            "last_seen_utc": "2025-11-29 09:53:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653109": [
        {
            "ioc_value": "8i.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653110": [
        {
            "ioc_value": "8k.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653111": [
        {
            "ioc_value": "8lo.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653112": [
        {
            "ioc_value": "8ls.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653113": [
        {
            "ioc_value": "8lwyc.dunn-0-en-7-el.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653114": [
        {
            "ioc_value": "8m.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:54:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653115": [
        {
            "ioc_value": "8m.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653116": [
        {
            "ioc_value": "8mr.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653117": [
        {
            "ioc_value": "8n.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653118": [
        {
            "ioc_value": "8n.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653119": [
        {
            "ioc_value": "8nbw6.shevypro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653120": [
        {
            "ioc_value": "8o6.halfquark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653121": [
        {
            "ioc_value": "8oryn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653122": [
        {
            "ioc_value": "8p.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653123": [
        {
            "ioc_value": "8po.gr-1-tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653124": [
        {
            "ioc_value": "8q.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653125": [
        {
            "ioc_value": "8q.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653126": [
        {
            "ioc_value": "8q7.oceanshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:29",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653094": [
        {
            "ioc_value": "8b.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653095": [
        {
            "ioc_value": "8b.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653096": [
        {
            "ioc_value": "8b.op76.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:57:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653097": [
        {
            "ioc_value": "8bg.bashglider.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653098": [
        {
            "ioc_value": "8cj.amberr-0-ck-et.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:54:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653099": [
        {
            "ioc_value": "8d.derl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653100": [
        {
            "ioc_value": "8d.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653101": [
        {
            "ioc_value": "8e.skylintap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653102": [
        {
            "ioc_value": "8ey.jam-crest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653103": [
        {
            "ioc_value": "8f.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653104": [
        {
            "ioc_value": "8f2q.kairosmix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653105": [
        {
            "ioc_value": "8fz.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653106": [
        {
            "ioc_value": "8g8.torquebud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653107": [
        {
            "ioc_value": "8g89.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:53:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653108": [
        {
            "ioc_value": "8h.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:28",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653082": [
        {
            "ioc_value": "88.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653083": [
        {
            "ioc_value": "889.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653084": [
        {
            "ioc_value": "88c2.pyroclay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653085": [
        {
            "ioc_value": "88u.comp0tsab3e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653086": [
        {
            "ioc_value": "89.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653087": [
        {
            "ioc_value": "89.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653088": [
        {
            "ioc_value": "89.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653089": [
        {
            "ioc_value": "890.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:55:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653090": [
        {
            "ioc_value": "8a.s0ftmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653091": [
        {
            "ioc_value": "8a.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653092": [
        {
            "ioc_value": "8a.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653093": [
        {
            "ioc_value": "8ab.sketchloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:27",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653072": [
        {
            "ioc_value": "851.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:58:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653073": [
        {
            "ioc_value": "86.bl1zpond.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653074": [
        {
            "ioc_value": "86.cogwhittle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653075": [
        {
            "ioc_value": "866p1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653076": [
        {
            "ioc_value": "86w.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653077": [
        {
            "ioc_value": "87-so.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653078": [
        {
            "ioc_value": "879.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653079": [
        {
            "ioc_value": "87kd.fl0wstone.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653080": [
        {
            "ioc_value": "88.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653081": [
        {
            "ioc_value": "88.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:26",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653061": [
        {
            "ioc_value": "84.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:54:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653062": [
        {
            "ioc_value": "84.t1nystar.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653063": [
        {
            "ioc_value": "8427.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653064": [
        {
            "ioc_value": "8427.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653065": [
        {
            "ioc_value": "8427.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653066": [
        {
            "ioc_value": "8451203.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653067": [
        {
            "ioc_value": "8451203.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:59:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653068": [
        {
            "ioc_value": "8451203.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:59:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653069": [
        {
            "ioc_value": "84w7.pulseknob.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:57:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653070": [
        {
            "ioc_value": "85.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:53:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653071": [
        {
            "ioc_value": "851.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:25",
            "last_seen_utc": "2025-11-29 09:53:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653045": [
        {
            "ioc_value": "80deo.oak-ember.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653046": [
        {
            "ioc_value": "80n.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653047": [
        {
            "ioc_value": "81.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653048": [
        {
            "ioc_value": "81.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653049": [
        {
            "ioc_value": "814.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653050": [
        {
            "ioc_value": "81dm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-28 08:32:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653051": [
        {
            "ioc_value": "81s.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653052": [
        {
            "ioc_value": "82-mo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653053": [
        {
            "ioc_value": "82.j-7m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:56:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653054": [
        {
            "ioc_value": "83.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653055": [
        {
            "ioc_value": "83.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653056": [
        {
            "ioc_value": "8321.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653057": [
        {
            "ioc_value": "8321.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653058": [
        {
            "ioc_value": "8321.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653059": [
        {
            "ioc_value": "8343.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653060": [
        {
            "ioc_value": "84.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:24",
            "last_seen_utc": "2025-11-29 09:54:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653027": [
        {
            "ioc_value": "7u.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653028": [
        {
            "ioc_value": "7u.viberspan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653029": [
        {
            "ioc_value": "7uo.g0sslamp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653030": [
        {
            "ioc_value": "7v7.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653031": [
        {
            "ioc_value": "7w.lobd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653032": [
        {
            "ioc_value": "7w.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653033": [
        {
            "ioc_value": "7wa.cieardrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:54:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653034": [
        {
            "ioc_value": "7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653035": [
        {
            "ioc_value": "7willowkranz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-28 08:32:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653036": [
        {
            "ioc_value": "7ws9g.turbotap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653037": [
        {
            "ioc_value": "7x.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653038": [
        {
            "ioc_value": "7xk.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653039": [
        {
            "ioc_value": "7y.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653040": [
        {
            "ioc_value": "7yf.67tf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653041": [
        {
            "ioc_value": "7z.l5228.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:56:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653042": [
        {
            "ioc_value": "8.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653043": [
        {
            "ioc_value": "8.mijk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653044": [
        {
            "ioc_value": "80.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:23",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653009": [
        {
            "ioc_value": "7o.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653010": [
        {
            "ioc_value": "7ol4i.a5t1gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653011": [
        {
            "ioc_value": "7p.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653012": [
        {
            "ioc_value": "7plpf.spryvolt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653013": [
        {
            "ioc_value": "7q.knackquill.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653014": [
        {
            "ioc_value": "7q7-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653015": [
        {
            "ioc_value": "7qti.v3ctorplum.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:58:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653016": [
        {
            "ioc_value": "7r.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653017": [
        {
            "ioc_value": "7r.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653018": [
        {
            "ioc_value": "7r.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653019": [
        {
            "ioc_value": "7r.wreckly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653020": [
        {
            "ioc_value": "7r.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653021": [
        {
            "ioc_value": "7rj.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653022": [
        {
            "ioc_value": "7sd.stoner0ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653023": [
        {
            "ioc_value": "7t.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653024": [
        {
            "ioc_value": "7tq.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653025": [
        {
            "ioc_value": "7tq70.rock-bay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653026": [
        {
            "ioc_value": "7u.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:22",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652990": [
        {
            "ioc_value": "7hb.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652991": [
        {
            "ioc_value": "7hz.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652992": [
        {
            "ioc_value": "7i.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652993": [
        {
            "ioc_value": "7ih.windbarrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652994": [
        {
            "ioc_value": "7it.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652995": [
        {
            "ioc_value": "7jp.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:55:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652996": [
        {
            "ioc_value": "7k.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652997": [
        {
            "ioc_value": "7k.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652998": [
        {
            "ioc_value": "7k.razor-plume.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652999": [
        {
            "ioc_value": "7l.brightridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653000": [
        {
            "ioc_value": "7l.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653001": [
        {
            "ioc_value": "7l.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653002": [
        {
            "ioc_value": "7lq.lakesp1rit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653003": [
        {
            "ioc_value": "7m.van1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653004": [
        {
            "ioc_value": "7m.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653005": [
        {
            "ioc_value": "7mj20.turbo-tap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653006": [
        {
            "ioc_value": "7n.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653007": [
        {
            "ioc_value": "7n28r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1653008": [
        {
            "ioc_value": "7ne.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:21",
            "last_seen_utc": "2025-11-29 09:53:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652970": [
        {
            "ioc_value": "79.riftcog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:57:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652971": [
        {
            "ioc_value": "7a.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652972": [
        {
            "ioc_value": "7a.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652973": [
        {
            "ioc_value": "7b.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652974": [
        {
            "ioc_value": "7b9o0.fr0stp1llar.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652975": [
        {
            "ioc_value": "7bv.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652976": [
        {
            "ioc_value": "7c3.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:58:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652977": [
        {
            "ioc_value": "7c7.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652978": [
        {
            "ioc_value": "7cw.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652979": [
        {
            "ioc_value": "7d.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652980": [
        {
            "ioc_value": "7d.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652981": [
        {
            "ioc_value": "7d0.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652982": [
        {
            "ioc_value": "7d7ai.st-0-y-70-renka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652983": [
        {
            "ioc_value": "7e.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652984": [
        {
            "ioc_value": "7e8g.brambleforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:54:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652985": [
        {
            "ioc_value": "7f1q0h.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652986": [
        {
            "ioc_value": "7fl06.harpswitch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:55:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652987": [
        {
            "ioc_value": "7g.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652988": [
        {
            "ioc_value": "7h.5g-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652989": [
        {
            "ioc_value": "7h.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:20",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652952": [
        {
            "ioc_value": "77.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652953": [
        {
            "ioc_value": "77.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652954": [
        {
            "ioc_value": "77.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652955": [
        {
            "ioc_value": "77.windbarrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:58:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652956": [
        {
            "ioc_value": "773.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:54:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652957": [
        {
            "ioc_value": "777.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652958": [
        {
            "ioc_value": "777.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652959": [
        {
            "ioc_value": "777.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652960": [
        {
            "ioc_value": "777012.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652961": [
        {
            "ioc_value": "777012.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:54:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652962": [
        {
            "ioc_value": "777012.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:58:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652963": [
        {
            "ioc_value": "77950.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652964": [
        {
            "ioc_value": "77950.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652965": [
        {
            "ioc_value": "77950.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652966": [
        {
            "ioc_value": "77w.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652967": [
        {
            "ioc_value": "78.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652968": [
        {
            "ioc_value": "78y.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652969": [
        {
            "ioc_value": "79.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:19",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652936": [
        {
            "ioc_value": "73k03.turbotap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652937": [
        {
            "ioc_value": "74.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652938": [
        {
            "ioc_value": "74.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652939": [
        {
            "ioc_value": "740.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652940": [
        {
            "ioc_value": "740.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652941": [
        {
            "ioc_value": "740182.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652942": [
        {
            "ioc_value": "740182.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652943": [
        {
            "ioc_value": "7436901.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652944": [
        {
            "ioc_value": "7436901.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652945": [
        {
            "ioc_value": "75.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652946": [
        {
            "ioc_value": "75.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652947": [
        {
            "ioc_value": "75qk.ic3gate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652948": [
        {
            "ioc_value": "76.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652949": [
        {
            "ioc_value": "7652190.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652950": [
        {
            "ioc_value": "7652190.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:53:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652951": [
        {
            "ioc_value": "7652190.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:18",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652917": [
        {
            "ioc_value": "71.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652918": [
        {
            "ioc_value": "712.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652919": [
        {
            "ioc_value": "7123001.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652920": [
        {
            "ioc_value": "7123001.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652921": [
        {
            "ioc_value": "7123001.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652922": [
        {
            "ioc_value": "71290.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652923": [
        {
            "ioc_value": "717.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652924": [
        {
            "ioc_value": "719.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652925": [
        {
            "ioc_value": "719.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652926": [
        {
            "ioc_value": "719.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652927": [
        {
            "ioc_value": "719.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:57:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652928": [
        {
            "ioc_value": "71f9.fr0gpulse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652929": [
        {
            "ioc_value": "71kxr.cogwhittle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652930": [
        {
            "ioc_value": "72563.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652931": [
        {
            "ioc_value": "72563.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652932": [
        {
            "ioc_value": "72563.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652933": [
        {
            "ioc_value": "72i3q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652934": [
        {
            "ioc_value": "72k.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652935": [
        {
            "ioc_value": "731.b1uespark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:17",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652900": [
        {
            "ioc_value": "7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652901": [
        {
            "ioc_value": "7.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652902": [
        {
            "ioc_value": "7.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652903": [
        {
            "ioc_value": "70.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652904": [
        {
            "ioc_value": "70.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652905": [
        {
            "ioc_value": "70.le3nsnet7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652906": [
        {
            "ioc_value": "70.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:57:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652907": [
        {
            "ioc_value": "70.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652908": [
        {
            "ioc_value": "70018.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652909": [
        {
            "ioc_value": "70018.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652910": [
        {
            "ioc_value": "7001845.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652911": [
        {
            "ioc_value": "7001845.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652912": [
        {
            "ioc_value": "7001845.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652913": [
        {
            "ioc_value": "706391.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652914": [
        {
            "ioc_value": "706391.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652915": [
        {
            "ioc_value": "706391.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:53:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652916": [
        {
            "ioc_value": "70ywi.emberhoehle.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:16",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652883": [
        {
            "ioc_value": "6t.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652884": [
        {
            "ioc_value": "6tm.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652885": [
        {
            "ioc_value": "6tpmi.stormbioom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652886": [
        {
            "ioc_value": "6u.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652887": [
        {
            "ioc_value": "6u1.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652888": [
        {
            "ioc_value": "6v.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652889": [
        {
            "ioc_value": "6vwj8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652890": [
        {
            "ioc_value": "6vy.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652891": [
        {
            "ioc_value": "6wo.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652892": [
        {
            "ioc_value": "6y.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652893": [
        {
            "ioc_value": "6yi.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652894": [
        {
            "ioc_value": "6ymh.mintcraft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652895": [
        {
            "ioc_value": "6z.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652896": [
        {
            "ioc_value": "6zbr.protohush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652897": [
        {
            "ioc_value": "6zy.l-ly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-29 09:56:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652898": [
        {
            "ioc_value": "7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652899": [
        {
            "ioc_value": "7-gb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:15",
            "last_seen_utc": "2025-11-28 08:32:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652864": [
        {
            "ioc_value": "6j.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652865": [
        {
            "ioc_value": "6jr.fog-map.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652866": [
        {
            "ioc_value": "6jtg4.quibsnare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652867": [
        {
            "ioc_value": "6kdo.hovermint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652868": [
        {
            "ioc_value": "6lv.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652869": [
        {
            "ioc_value": "6lz.horizonbloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:55:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652870": [
        {
            "ioc_value": "6m.quantmelt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:57:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652871": [
        {
            "ioc_value": "6m4.c0sm1cweld.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652872": [
        {
            "ioc_value": "6mm.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:56:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652873": [
        {
            "ioc_value": "6n.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652874": [
        {
            "ioc_value": "6nn.gr1tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652875": [
        {
            "ioc_value": "6o.jamcrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652876": [
        {
            "ioc_value": "6p.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652877": [
        {
            "ioc_value": "6pz.bray-circuit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652878": [
        {
            "ioc_value": "6r.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652879": [
        {
            "ioc_value": "6r8.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652880": [
        {
            "ioc_value": "6rv.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652881": [
        {
            "ioc_value": "6s.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652882": [
        {
            "ioc_value": "6t.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:14",
            "last_seen_utc": "2025-11-29 09:53:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652843": [
        {
            "ioc_value": "6b.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652844": [
        {
            "ioc_value": "6c.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652845": [
        {
            "ioc_value": "6c.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652846": [
        {
            "ioc_value": "6c.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652847": [
        {
            "ioc_value": "6cfc.frostmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652848": [
        {
            "ioc_value": "6ci.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652849": [
        {
            "ioc_value": "6cm.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652850": [
        {
            "ioc_value": "6d.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652851": [
        {
            "ioc_value": "6d.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652852": [
        {
            "ioc_value": "6dx.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652853": [
        {
            "ioc_value": "6fl.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652854": [
        {
            "ioc_value": "6g.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652855": [
        {
            "ioc_value": "6gx.gi-0-wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:55:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652856": [
        {
            "ioc_value": "6h.f0rce.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652857": [
        {
            "ioc_value": "6h.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652858": [
        {
            "ioc_value": "6h7s.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652859": [
        {
            "ioc_value": "6ho.neoniake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652860": [
        {
            "ioc_value": "6hu.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652861": [
        {
            "ioc_value": "6i4.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652862": [
        {
            "ioc_value": "6i4.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": "2025-11-29 09:53:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652863": [
        {
            "ioc_value": "6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652826": [
        {
            "ioc_value": "65.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652827": [
        {
            "ioc_value": "65o.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652828": [
        {
            "ioc_value": "65pcw.jump3r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652829": [
        {
            "ioc_value": "65y.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652830": [
        {
            "ioc_value": "66.shevypro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652831": [
        {
            "ioc_value": "663.67tf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652832": [
        {
            "ioc_value": "67.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652833": [
        {
            "ioc_value": "67.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652834": [
        {
            "ioc_value": "676.stonemist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652835": [
        {
            "ioc_value": "689.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652836": [
        {
            "ioc_value": "6901420.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652837": [
        {
            "ioc_value": "6901420.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652838": [
        {
            "ioc_value": "6901420.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652839": [
        {
            "ioc_value": "698.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652840": [
        {
            "ioc_value": "69d.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652841": [
        {
            "ioc_value": "6a.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652842": [
        {
            "ioc_value": "6ajg.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:12",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652808": [
        {
            "ioc_value": "61.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652809": [
        {
            "ioc_value": "610294.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652810": [
        {
            "ioc_value": "610294.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:55:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652811": [
        {
            "ioc_value": "610294.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:56:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652812": [
        {
            "ioc_value": "61g.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652813": [
        {
            "ioc_value": "62.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652814": [
        {
            "ioc_value": "620714.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652815": [
        {
            "ioc_value": "620714.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652816": [
        {
            "ioc_value": "620714.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652817": [
        {
            "ioc_value": "624.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652818": [
        {
            "ioc_value": "628.torquebud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:58:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652819": [
        {
            "ioc_value": "64.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652820": [
        {
            "ioc_value": "64.rockbyte.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652821": [
        {
            "ioc_value": "6416516876.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652822": [
        {
            "ioc_value": "648.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652823": [
        {
            "ioc_value": "64d-821.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652824": [
        {
            "ioc_value": "64d.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652825": [
        {
            "ioc_value": "65.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:11",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652791": [
        {
            "ioc_value": "5x.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652792": [
        {
            "ioc_value": "5xw.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652793": [
        {
            "ioc_value": "5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-28 08:32:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652794": [
        {
            "ioc_value": "5ye8.n0rthw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652795": [
        {
            "ioc_value": "5z.lumentwist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652796": [
        {
            "ioc_value": "5z.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652797": [
        {
            "ioc_value": "6-bbe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652798": [
        {
            "ioc_value": "6.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652799": [
        {
            "ioc_value": "60.crju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652800": [
        {
            "ioc_value": "60.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652801": [
        {
            "ioc_value": "60012.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652802": [
        {
            "ioc_value": "60012.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652803": [
        {
            "ioc_value": "6003.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652804": [
        {
            "ioc_value": "6003.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652805": [
        {
            "ioc_value": "6003.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652806": [
        {
            "ioc_value": "60w.lake-spry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652807": [
        {
            "ioc_value": "61.m1ntflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:10",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652774": [
        {
            "ioc_value": "5tl.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652775": [
        {
            "ioc_value": "5tonefiare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652776": [
        {
            "ioc_value": "5tormmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652777": [
        {
            "ioc_value": "5tq.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652778": [
        {
            "ioc_value": "5u.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:58:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652779": [
        {
            "ioc_value": "5u2.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652780": [
        {
            "ioc_value": "5u2.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652781": [
        {
            "ioc_value": "5v.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652782": [
        {
            "ioc_value": "5v05.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652783": [
        {
            "ioc_value": "5v6.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652784": [
        {
            "ioc_value": "5vt.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652785": [
        {
            "ioc_value": "5vyg.copperlattice.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:54:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652786": [
        {
            "ioc_value": "5w.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652787": [
        {
            "ioc_value": "5weuo.ta11y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652788": [
        {
            "ioc_value": "5wf.yw9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652789": [
        {
            "ioc_value": "5x.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652790": [
        {
            "ioc_value": "5x.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:09",
            "last_seen_utc": "2025-11-29 09:53:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652757": [
        {
            "ioc_value": "5nu.8786.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652758": [
        {
            "ioc_value": "5nyo.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652759": [
        {
            "ioc_value": "5o.do-k3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652760": [
        {
            "ioc_value": "5o.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652761": [
        {
            "ioc_value": "5obr8.brightsage.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:54:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652762": [
        {
            "ioc_value": "5parkfieid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652763": [
        {
            "ioc_value": "5pc.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652764": [
        {
            "ioc_value": "5pi.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652765": [
        {
            "ioc_value": "5q.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652766": [
        {
            "ioc_value": "5q.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652767": [
        {
            "ioc_value": "5qi.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652768": [
        {
            "ioc_value": "5r.a-5-t-1-gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652769": [
        {
            "ioc_value": "5rn.b1tzdrop.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652770": [
        {
            "ioc_value": "5rq9.t1nystar.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652771": [
        {
            "ioc_value": "5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652772": [
        {
            "ioc_value": "5t.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652773": [
        {
            "ioc_value": "5t0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:08",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652741": [
        {
            "ioc_value": "5j.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652742": [
        {
            "ioc_value": "5jxd.r-1-mrock.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:57:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652743": [
        {
            "ioc_value": "5k.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652744": [
        {
            "ioc_value": "5k.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652745": [
        {
            "ioc_value": "5kch.n0vaharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652746": [
        {
            "ioc_value": "5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-28 08:31:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652747": [
        {
            "ioc_value": "5lw6.lumentwist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652748": [
        {
            "ioc_value": "5m.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652749": [
        {
            "ioc_value": "5m.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652750": [
        {
            "ioc_value": "5m.njur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652751": [
        {
            "ioc_value": "5m9081.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652752": [
        {
            "ioc_value": "5mx.ve1vet0rchid.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:58:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652753": [
        {
            "ioc_value": "5n.97qm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652754": [
        {
            "ioc_value": "5n.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652755": [
        {
            "ioc_value": "5n.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652756": [
        {
            "ioc_value": "5n.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:07",
            "last_seen_utc": "2025-11-29 09:53:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652728": [
        {
            "ioc_value": "5f2zf.frost-fox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652729": [
        {
            "ioc_value": "5fj.st0negate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652730": [
        {
            "ioc_value": "5fw.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652731": [
        {
            "ioc_value": "5h.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652732": [
        {
            "ioc_value": "5h.n0rthw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652733": [
        {
            "ioc_value": "5h0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-28 08:31:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652734": [
        {
            "ioc_value": "5h4553.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652735": [
        {
            "ioc_value": "5ha.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652736": [
        {
            "ioc_value": "5hj.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652737": [
        {
            "ioc_value": "5i.mintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652738": [
        {
            "ioc_value": "5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652739": [
        {
            "ioc_value": "5ilverm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-28 08:31:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652740": [
        {
            "ioc_value": "5j.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:06",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652711": [
        {
            "ioc_value": "5b.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652712": [
        {
            "ioc_value": "5bwm.galy8phony.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:55:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652713": [
        {
            "ioc_value": "5c.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652714": [
        {
            "ioc_value": "5c5.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652715": [
        {
            "ioc_value": "5cf.mistv1be.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652716": [
        {
            "ioc_value": "5cg77.miragepad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652717": [
        {
            "ioc_value": "5ct.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652718": [
        {
            "ioc_value": "5d.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652719": [
        {
            "ioc_value": "5d.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652720": [
        {
            "ioc_value": "5d.n0vaharbor.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:56:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652721": [
        {
            "ioc_value": "5e.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652722": [
        {
            "ioc_value": "5e.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652723": [
        {
            "ioc_value": "5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652724": [
        {
            "ioc_value": "5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652725": [
        {
            "ioc_value": "5egzr.suf1nau8h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652726": [
        {
            "ioc_value": "5eo39.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:53:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652727": [
        {
            "ioc_value": "5f.kalmykvic0te.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:05",
            "last_seen_utc": "2025-11-29 09:56:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652695": [
        {
            "ioc_value": "57.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652696": [
        {
            "ioc_value": "57411.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652697": [
        {
            "ioc_value": "57411.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652698": [
        {
            "ioc_value": "57411.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652699": [
        {
            "ioc_value": "57y.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652700": [
        {
            "ioc_value": "581.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652701": [
        {
            "ioc_value": "581.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652702": [
        {
            "ioc_value": "581.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652703": [
        {
            "ioc_value": "581004.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652704": [
        {
            "ioc_value": "58k2.c0deroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652705": [
        {
            "ioc_value": "59.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652706": [
        {
            "ioc_value": "59gwy.ic0n1ctrove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652707": [
        {
            "ioc_value": "5a.frost-indigo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652708": [
        {
            "ioc_value": "5a0.ember-cross.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652709": [
        {
            "ioc_value": "5ai.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652710": [
        {
            "ioc_value": "5ap.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:04",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652683": [
        {
            "ioc_value": "55.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652684": [
        {
            "ioc_value": "55027.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652685": [
        {
            "ioc_value": "55027.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652686": [
        {
            "ioc_value": "55027.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652687": [
        {
            "ioc_value": "55728.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652688": [
        {
            "ioc_value": "55728.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652689": [
        {
            "ioc_value": "55a07.neoniake.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652690": [
        {
            "ioc_value": "55i.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652691": [
        {
            "ioc_value": "56.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652692": [
        {
            "ioc_value": "56.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652693": [
        {
            "ioc_value": "56039.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652694": [
        {
            "ioc_value": "56039.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:03",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652682": [
        {
            "ioc_value": "55.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:02",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652669": [
        {
            "ioc_value": "501.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652670": [
        {
            "ioc_value": "501.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652671": [
        {
            "ioc_value": "501.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652672": [
        {
            "ioc_value": "51cv.ember-grove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652673": [
        {
            "ioc_value": "52.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652674": [
        {
            "ioc_value": "52i.snowr1se.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652675": [
        {
            "ioc_value": "53-mo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652676": [
        {
            "ioc_value": "53.ede-1-g-0-rge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652677": [
        {
            "ioc_value": "53.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652678": [
        {
            "ioc_value": "536df.frostmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652679": [
        {
            "ioc_value": "53f.clearspark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652680": [
        {
            "ioc_value": "54.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652681": [
        {
            "ioc_value": "54.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:01",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652653": [
        {
            "ioc_value": "4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-28 08:31:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652654": [
        {
            "ioc_value": "4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-28 08:31:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652655": [
        {
            "ioc_value": "4y3e4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652656": [
        {
            "ioc_value": "4y7w.spiicepad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-29 09:57:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652657": [
        {
            "ioc_value": "4ym.gyro-desk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-29 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652658": [
        {
            "ioc_value": "4z.st0rmleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652659": [
        {
            "ioc_value": "5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652660": [
        {
            "ioc_value": "5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652661": [
        {
            "ioc_value": "5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652662": [
        {
            "ioc_value": "5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652663": [
        {
            "ioc_value": "5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652664": [
        {
            "ioc_value": "5.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652665": [
        {
            "ioc_value": "50.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652666": [
        {
            "ioc_value": "5002201.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652667": [
        {
            "ioc_value": "5002201.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652668": [
        {
            "ioc_value": "5002201.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:41:00",
            "last_seen_utc": "2025-11-29 09:53:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652634": [
        {
            "ioc_value": "4ol.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652635": [
        {
            "ioc_value": "4p.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652636": [
        {
            "ioc_value": "4p2.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652637": [
        {
            "ioc_value": "4q.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652638": [
        {
            "ioc_value": "4q.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652639": [
        {
            "ioc_value": "4q.rubyraum.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652640": [
        {
            "ioc_value": "4q.wreckly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652641": [
        {
            "ioc_value": "4r.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652642": [
        {
            "ioc_value": "4r1i.zenithsnap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652643": [
        {
            "ioc_value": "4shn.t1decrystai.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:58:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652644": [
        {
            "ioc_value": "4sv.cl0udmark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652645": [
        {
            "ioc_value": "4t.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652646": [
        {
            "ioc_value": "4u.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652647": [
        {
            "ioc_value": "4u29.manual1sa1yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652648": [
        {
            "ioc_value": "4v.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652649": [
        {
            "ioc_value": "4v.rock-bay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:57:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652650": [
        {
            "ioc_value": "4v9-u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652651": [
        {
            "ioc_value": "4x.gug7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:55:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652652": [
        {
            "ioc_value": "4xc.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:59",
            "last_seen_utc": "2025-11-29 09:53:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652616": [
        {
            "ioc_value": "4ia.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652617": [
        {
            "ioc_value": "4j.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652618": [
        {
            "ioc_value": "4j1.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652619": [
        {
            "ioc_value": "4j5.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652620": [
        {
            "ioc_value": "4jb.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652621": [
        {
            "ioc_value": "4jf.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652622": [
        {
            "ioc_value": "4jx.mossowl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:56:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652623": [
        {
            "ioc_value": "4k.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652624": [
        {
            "ioc_value": "4k.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652625": [
        {
            "ioc_value": "4kl-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652626": [
        {
            "ioc_value": "4l.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652627": [
        {
            "ioc_value": "4m.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652628": [
        {
            "ioc_value": "4m.v-9542.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:58:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652629": [
        {
            "ioc_value": "4n.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652630": [
        {
            "ioc_value": "4n.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652631": [
        {
            "ioc_value": "4n.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652632": [
        {
            "ioc_value": "4o.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652633": [
        {
            "ioc_value": "4o2.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:58",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652598": [
        {
            "ioc_value": "4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-28 08:31:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652599": [
        {
            "ioc_value": "4c.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652600": [
        {
            "ioc_value": "4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-28 08:31:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652601": [
        {
            "ioc_value": "4d.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652602": [
        {
            "ioc_value": "4d.pyroclay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:57:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652603": [
        {
            "ioc_value": "4d.stormblink.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652604": [
        {
            "ioc_value": "4dl.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652605": [
        {
            "ioc_value": "4ed.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652606": [
        {
            "ioc_value": "4es.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652607": [
        {
            "ioc_value": "4f.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652608": [
        {
            "ioc_value": "4f.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652609": [
        {
            "ioc_value": "4f8a.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652610": [
        {
            "ioc_value": "4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-28 08:32:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652611": [
        {
            "ioc_value": "4h.97jt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652612": [
        {
            "ioc_value": "4hp.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652613": [
        {
            "ioc_value": "4i.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652614": [
        {
            "ioc_value": "4i1.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-29 09:53:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652615": [
        {
            "ioc_value": "4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:57",
            "last_seen_utc": "2025-11-28 08:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652580": [
        {
            "ioc_value": "46.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652581": [
        {
            "ioc_value": "46.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652582": [
        {
            "ioc_value": "46.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652583": [
        {
            "ioc_value": "47b.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652584": [
        {
            "ioc_value": "48.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652585": [
        {
            "ioc_value": "482.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652586": [
        {
            "ioc_value": "482.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652587": [
        {
            "ioc_value": "4823.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652588": [
        {
            "ioc_value": "4823.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652589": [
        {
            "ioc_value": "48mm.cloudw1re.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652590": [
        {
            "ioc_value": "48o.qute3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652591": [
        {
            "ioc_value": "490.halfquark.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:55:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652592": [
        {
            "ioc_value": "4920.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652593": [
        {
            "ioc_value": "4920.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652594": [
        {
            "ioc_value": "4920.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652595": [
        {
            "ioc_value": "49i.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652596": [
        {
            "ioc_value": "4a.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652597": [
        {
            "ioc_value": "4a.tundra-flip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:56",
            "last_seen_utc": "2025-11-29 09:58:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652562": [
        {
            "ioc_value": "42.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652563": [
        {
            "ioc_value": "42.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652564": [
        {
            "ioc_value": "428.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652565": [
        {
            "ioc_value": "42a5.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652566": [
        {
            "ioc_value": "42a5.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652567": [
        {
            "ioc_value": "42s.starforged.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:57:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652568": [
        {
            "ioc_value": "431.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652569": [
        {
            "ioc_value": "431.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652570": [
        {
            "ioc_value": "431.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652571": [
        {
            "ioc_value": "44.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652572": [
        {
            "ioc_value": "45-ty.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652573": [
        {
            "ioc_value": "45019.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652574": [
        {
            "ioc_value": "45019.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652575": [
        {
            "ioc_value": "45019.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652576": [
        {
            "ioc_value": "454.razorplume.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:57:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652577": [
        {
            "ioc_value": "45b.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652578": [
        {
            "ioc_value": "46.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:53:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652579": [
        {
            "ioc_value": "46.cloud5eed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:55",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652544": [
        {
            "ioc_value": "4.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652545": [
        {
            "ioc_value": "4.derl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652546": [
        {
            "ioc_value": "4.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:56:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652547": [
        {
            "ioc_value": "4.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652548": [
        {
            "ioc_value": "40.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652549": [
        {
            "ioc_value": "40.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652550": [
        {
            "ioc_value": "402f1.digncbe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652551": [
        {
            "ioc_value": "405.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652552": [
        {
            "ioc_value": "4084.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652553": [
        {
            "ioc_value": "4084.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652554": [
        {
            "ioc_value": "41.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652555": [
        {
            "ioc_value": "410.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652556": [
        {
            "ioc_value": "41002.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652557": [
        {
            "ioc_value": "41002.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652558": [
        {
            "ioc_value": "41002.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652559": [
        {
            "ioc_value": "4137.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652560": [
        {
            "ioc_value": "4137.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652561": [
        {
            "ioc_value": "415.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:54",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652525": [
        {
            "ioc_value": "3u1y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-28 08:31:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652526": [
        {
            "ioc_value": "3uv.g0ldnest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:56:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652527": [
        {
            "ioc_value": "3v.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652528": [
        {
            "ioc_value": "3vo.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652529": [
        {
            "ioc_value": "3w.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652530": [
        {
            "ioc_value": "3w4nn.cedarwinkel5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652531": [
        {
            "ioc_value": "3w5.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:54:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652532": [
        {
            "ioc_value": "3wa.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652533": [
        {
            "ioc_value": "3x1.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652534": [
        {
            "ioc_value": "3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-28 08:31:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652535": [
        {
            "ioc_value": "3xh.sketch-loom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652536": [
        {
            "ioc_value": "3xlu.icy-moth.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652537": [
        {
            "ioc_value": "3y.brightridge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652538": [
        {
            "ioc_value": "3z.7-fd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652539": [
        {
            "ioc_value": "3z.comp-0-tsab-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:54:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652540": [
        {
            "ioc_value": "3z.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652541": [
        {
            "ioc_value": "3z1s.oddkraken.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652542": [
        {
            "ioc_value": "3z6.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": "2025-11-29 09:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652543": [
        {
            "ioc_value": "4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652507": [
        {
            "ioc_value": "3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-28 08:31:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652508": [
        {
            "ioc_value": "3o9.b-3-aconz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:54:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652509": [
        {
            "ioc_value": "3oi.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652510": [
        {
            "ioc_value": "3oil.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652511": [
        {
            "ioc_value": "3q6.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652512": [
        {
            "ioc_value": "3r.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652513": [
        {
            "ioc_value": "3r.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652514": [
        {
            "ioc_value": "3r7.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652515": [
        {
            "ioc_value": "3rd.67tf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652516": [
        {
            "ioc_value": "3rv.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652517": [
        {
            "ioc_value": "3t.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652518": [
        {
            "ioc_value": "3t2.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652519": [
        {
            "ioc_value": "3t6.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652520": [
        {
            "ioc_value": "3tc.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652521": [
        {
            "ioc_value": "3tq.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652522": [
        {
            "ioc_value": "3u-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652523": [
        {
            "ioc_value": "3u.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652524": [
        {
            "ioc_value": "3u.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:52",
            "last_seen_utc": "2025-11-29 09:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652487": [
        {
            "ioc_value": "3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-28 08:32:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652488": [
        {
            "ioc_value": "3f.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652489": [
        {
            "ioc_value": "3f.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652490": [
        {
            "ioc_value": "3fp.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652491": [
        {
            "ioc_value": "3g.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652492": [
        {
            "ioc_value": "3gmi.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652493": [
        {
            "ioc_value": "3hg.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652494": [
        {
            "ioc_value": "3i.kunb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652495": [
        {
            "ioc_value": "3i7.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652496": [
        {
            "ioc_value": "3j.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652497": [
        {
            "ioc_value": "3j6cb.ic0n1ctrove.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652498": [
        {
            "ioc_value": "3jc.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652499": [
        {
            "ioc_value": "3k.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652500": [
        {
            "ioc_value": "3l.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652501": [
        {
            "ioc_value": "3l.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652502": [
        {
            "ioc_value": "3l8-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652503": [
        {
            "ioc_value": "3le.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:56:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652504": [
        {
            "ioc_value": "3mb.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652505": [
        {
            "ioc_value": "3mt.manual-1-sa-1-yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652506": [
        {
            "ioc_value": "3n.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:51",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652467": [
        {
            "ioc_value": "36c48.t1ger.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652468": [
        {
            "ioc_value": "37.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652469": [
        {
            "ioc_value": "382.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652470": [
        {
            "ioc_value": "383cc.mistfaii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652471": [
        {
            "ioc_value": "384.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652472": [
        {
            "ioc_value": "384.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652473": [
        {
            "ioc_value": "3998107.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652474": [
        {
            "ioc_value": "3998107.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652475": [
        {
            "ioc_value": "3998107.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652476": [
        {
            "ioc_value": "39o1.oakember.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652477": [
        {
            "ioc_value": "3a.driftshad0w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:54:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652478": [
        {
            "ioc_value": "3a.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652479": [
        {
            "ioc_value": "3a.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652480": [
        {
            "ioc_value": "3bm.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652481": [
        {
            "ioc_value": "3c.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652482": [
        {
            "ioc_value": "3c7.nightwharf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652483": [
        {
            "ioc_value": "3ccw2.orbitalnip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652484": [
        {
            "ioc_value": "3ch.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652485": [
        {
            "ioc_value": "3d.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652486": [
        {
            "ioc_value": "3dw.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:50",
            "last_seen_utc": "2025-11-29 09:53:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652448": [
        {
            "ioc_value": "324.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652449": [
        {
            "ioc_value": "324.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652450": [
        {
            "ioc_value": "33.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652451": [
        {
            "ioc_value": "33.njur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652452": [
        {
            "ioc_value": "333.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652453": [
        {
            "ioc_value": "333.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652454": [
        {
            "ioc_value": "333.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652455": [
        {
            "ioc_value": "34972.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652456": [
        {
            "ioc_value": "34972.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652457": [
        {
            "ioc_value": "34972.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652458": [
        {
            "ioc_value": "3499013.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652459": [
        {
            "ioc_value": "3499013.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652460": [
        {
            "ioc_value": "34m37.c0rkpr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:54:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652461": [
        {
            "ioc_value": "35i.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652462": [
        {
            "ioc_value": "35k.kn1fecast.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652463": [
        {
            "ioc_value": "35y.mintforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652464": [
        {
            "ioc_value": "36.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652465": [
        {
            "ioc_value": "36.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652466": [
        {
            "ioc_value": "36.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:49",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652432": [
        {
            "ioc_value": "3.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652433": [
        {
            "ioc_value": "3.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652434": [
        {
            "ioc_value": "30.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652435": [
        {
            "ioc_value": "3007812.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652436": [
        {
            "ioc_value": "30951.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652437": [
        {
            "ioc_value": "30951.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652438": [
        {
            "ioc_value": "30951.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652439": [
        {
            "ioc_value": "3135.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652440": [
        {
            "ioc_value": "3135.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652441": [
        {
            "ioc_value": "3135.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652442": [
        {
            "ioc_value": "31x.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652443": [
        {
            "ioc_value": "32.emberglade.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:55:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652444": [
        {
            "ioc_value": "32.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652445": [
        {
            "ioc_value": "32.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652446": [
        {
            "ioc_value": "32.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652447": [
        {
            "ioc_value": "324.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:48",
            "last_seen_utc": "2025-11-29 09:53:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652413": [
        {
            "ioc_value": "2v1.lumentwist.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:56:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652414": [
        {
            "ioc_value": "2w.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652415": [
        {
            "ioc_value": "2w1.527w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652416": [
        {
            "ioc_value": "2wa.stormblink.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652417": [
        {
            "ioc_value": "2x7.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652418": [
        {
            "ioc_value": "2x9.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652419": [
        {
            "ioc_value": "2x9mv.dew-root.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652420": [
        {
            "ioc_value": "2xado.oak-ember.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652421": [
        {
            "ioc_value": "2xe.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652422": [
        {
            "ioc_value": "2xg.jamcrest.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652423": [
        {
            "ioc_value": "2xh.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652424": [
        {
            "ioc_value": "2y.hre9in7mamma.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652425": [
        {
            "ioc_value": "2y.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652426": [
        {
            "ioc_value": "2yf.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652427": [
        {
            "ioc_value": "2yn.polywhiz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652428": [
        {
            "ioc_value": "2yv.waveb0x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652429": [
        {
            "ioc_value": "2z.mirage-pad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652430": [
        {
            "ioc_value": "2z.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:58:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652431": [
        {
            "ioc_value": "2zs.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:47",
            "last_seen_utc": "2025-11-29 09:53:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652395": [
        {
            "ioc_value": "2o.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652396": [
        {
            "ioc_value": "2on.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652397": [
        {
            "ioc_value": "2oy.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652398": [
        {
            "ioc_value": "2p.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652399": [
        {
            "ioc_value": "2p0.mintcraft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652400": [
        {
            "ioc_value": "2pb.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652401": [
        {
            "ioc_value": "2pq.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652402": [
        {
            "ioc_value": "2q.fid1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:55:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652403": [
        {
            "ioc_value": "2ql.dunn-0-en-7-el.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652404": [
        {
            "ioc_value": "2qn80.fl0wbud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652405": [
        {
            "ioc_value": "2rf.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652406": [
        {
            "ioc_value": "2ro.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652407": [
        {
            "ioc_value": "2se.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652408": [
        {
            "ioc_value": "2t.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652409": [
        {
            "ioc_value": "2tannenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-28 08:31:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652410": [
        {
            "ioc_value": "2tkvw.twist-nova.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652411": [
        {
            "ioc_value": "2u8.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652412": [
        {
            "ioc_value": "2v.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:46",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652378": [
        {
            "ioc_value": "2h6.mistfaii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652379": [
        {
            "ioc_value": "2hk8u.drift-shad-0-w.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:54:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652380": [
        {
            "ioc_value": "2hu.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652381": [
        {
            "ioc_value": "2i.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652382": [
        {
            "ioc_value": "2iw.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652383": [
        {
            "ioc_value": "2iz.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652384": [
        {
            "ioc_value": "2iz.qu1rkfuse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652385": [
        {
            "ioc_value": "2j.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652386": [
        {
            "ioc_value": "2k.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652387": [
        {
            "ioc_value": "2luj.pooflare.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652388": [
        {
            "ioc_value": "2m.s836.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:57:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652389": [
        {
            "ioc_value": "2m42.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652390": [
        {
            "ioc_value": "2n.b3aconz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652391": [
        {
            "ioc_value": "2n.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652392": [
        {
            "ioc_value": "2n4.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:53:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652393": [
        {
            "ioc_value": "2n62w.ma-shrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:56:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652394": [
        {
            "ioc_value": "2n6w.v0rt3xlab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:45",
            "last_seen_utc": "2025-11-29 09:58:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652362": [
        {
            "ioc_value": "2c.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652363": [
        {
            "ioc_value": "2c.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652364": [
        {
            "ioc_value": "2cr.4qo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652365": [
        {
            "ioc_value": "2d.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652366": [
        {
            "ioc_value": "2d4.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652367": [
        {
            "ioc_value": "2d63.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652368": [
        {
            "ioc_value": "2dhk1.s0ftmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652369": [
        {
            "ioc_value": "2dx.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652370": [
        {
            "ioc_value": "2dzr0.silverrun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:57:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652371": [
        {
            "ioc_value": "2e.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652372": [
        {
            "ioc_value": "2eq.sketchloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:57:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652373": [
        {
            "ioc_value": "2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652374": [
        {
            "ioc_value": "2fq4.dunn-0-en-7-el.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:55:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652375": [
        {
            "ioc_value": "2fr.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652376": [
        {
            "ioc_value": "2h.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652377": [
        {
            "ioc_value": "2h.tweakmire.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:44",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652345": [
        {
            "ioc_value": "23jn.fluxcrate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652346": [
        {
            "ioc_value": "24lb.cl0udrise.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652347": [
        {
            "ioc_value": "24s6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652348": [
        {
            "ioc_value": "25.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652349": [
        {
            "ioc_value": "259ox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652350": [
        {
            "ioc_value": "25ow.ember-cross.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652351": [
        {
            "ioc_value": "25qx7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652352": [
        {
            "ioc_value": "260941.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652353": [
        {
            "ioc_value": "260941.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652354": [
        {
            "ioc_value": "26e.j0tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652355": [
        {
            "ioc_value": "27.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652356": [
        {
            "ioc_value": "28.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652357": [
        {
            "ioc_value": "280.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652358": [
        {
            "ioc_value": "28xr3.clipmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652359": [
        {
            "ioc_value": "29.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652360": [
        {
            "ioc_value": "2b3.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652361": [
        {
            "ioc_value": "2bhkg.r0ad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:43",
            "last_seen_utc": "2025-11-29 09:53:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652329": [
        {
            "ioc_value": "201.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652330": [
        {
            "ioc_value": "201.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652331": [
        {
            "ioc_value": "20q.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652332": [
        {
            "ioc_value": "21.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652333": [
        {
            "ioc_value": "21.stormcairn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:58:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652334": [
        {
            "ioc_value": "21.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:58:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652335": [
        {
            "ioc_value": "219.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652336": [
        {
            "ioc_value": "219.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652337": [
        {
            "ioc_value": "21k2.fl-0-wbud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652338": [
        {
            "ioc_value": "21n.glacialufer.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652339": [
        {
            "ioc_value": "22.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652340": [
        {
            "ioc_value": "2215.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652341": [
        {
            "ioc_value": "2215.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652342": [
        {
            "ioc_value": "22k.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652343": [
        {
            "ioc_value": "23.heronturm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652344": [
        {
            "ioc_value": "238.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:42",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652313": [
        {
            "ioc_value": "1wd.viberspan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:58:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652314": [
        {
            "ioc_value": "1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-28 08:32:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652315": [
        {
            "ioc_value": "1wt.wildm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652316": [
        {
            "ioc_value": "1y.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652317": [
        {
            "ioc_value": "1yd0a.pulse-knob.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652318": [
        {
            "ioc_value": "1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652319": [
        {
            "ioc_value": "1yqf.c1earwave.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:54:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652320": [
        {
            "ioc_value": "1zs.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652321": [
        {
            "ioc_value": "2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652322": [
        {
            "ioc_value": "2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652323": [
        {
            "ioc_value": "2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652324": [
        {
            "ioc_value": "2.kunb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:56:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652325": [
        {
            "ioc_value": "2.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652326": [
        {
            "ioc_value": "20.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652327": [
        {
            "ioc_value": "20.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652328": [
        {
            "ioc_value": "201.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:41",
            "last_seen_utc": "2025-11-29 09:53:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652295": [
        {
            "ioc_value": "1s.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652296": [
        {
            "ioc_value": "1s.stoner0ck.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:58:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652297": [
        {
            "ioc_value": "1sp.5g-t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652298": [
        {
            "ioc_value": "1sw.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652299": [
        {
            "ioc_value": "1t.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652300": [
        {
            "ioc_value": "1t.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652301": [
        {
            "ioc_value": "1t.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652302": [
        {
            "ioc_value": "1t.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652303": [
        {
            "ioc_value": "1t1v5.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652304": [
        {
            "ioc_value": "1tqwn.morrowplug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652305": [
        {
            "ioc_value": "1u.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652306": [
        {
            "ioc_value": "1u74z.moss-owl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652307": [
        {
            "ioc_value": "1v.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652308": [
        {
            "ioc_value": "1v0ry51gnai.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652309": [
        {
            "ioc_value": "1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-28 08:32:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652310": [
        {
            "ioc_value": "1w.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652311": [
        {
            "ioc_value": "1w.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652312": [
        {
            "ioc_value": "1w2.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:40",
            "last_seen_utc": "2025-11-29 09:53:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652277": [
        {
            "ioc_value": "1m.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652278": [
        {
            "ioc_value": "1m.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652279": [
        {
            "ioc_value": "1m.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652280": [
        {
            "ioc_value": "1mk.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652281": [
        {
            "ioc_value": "1n.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652282": [
        {
            "ioc_value": "1n.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652283": [
        {
            "ioc_value": "1n.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652284": [
        {
            "ioc_value": "1o.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652285": [
        {
            "ioc_value": "1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-28 08:32:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652286": [
        {
            "ioc_value": "1oi.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652287": [
        {
            "ioc_value": "1ojva.g0sslamp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:55:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652288": [
        {
            "ioc_value": "1olj.glitch-pact.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:55:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652289": [
        {
            "ioc_value": "1on.heronturm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652290": [
        {
            "ioc_value": "1p2.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652291": [
        {
            "ioc_value": "1qtbb.aucti0nz7ir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652292": [
        {
            "ioc_value": "1r.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652293": [
        {
            "ioc_value": "1r55.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652294": [
        {
            "ioc_value": "1ronpath.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:39",
            "last_seen_utc": "2025-11-28 08:31:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652258": [
        {
            "ioc_value": "1je.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652259": [
        {
            "ioc_value": "1k.j-0-tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652260": [
        {
            "ioc_value": "1k.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652261": [
        {
            "ioc_value": "1k.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652262": [
        {
            "ioc_value": "1kl.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652263": [
        {
            "ioc_value": "1l.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652264": [
        {
            "ioc_value": "1l.s0apthorn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652265": [
        {
            "ioc_value": "1m.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652266": [
        {
            "ioc_value": "1m.526r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652267": [
        {
            "ioc_value": "1m.595-1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652268": [
        {
            "ioc_value": "1m.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652269": [
        {
            "ioc_value": "1m.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652270": [
        {
            "ioc_value": "1m.harborfreund.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652271": [
        {
            "ioc_value": "1m.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652272": [
        {
            "ioc_value": "1m.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652273": [
        {
            "ioc_value": "1m.paradeabend.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652274": [
        {
            "ioc_value": "1m.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652275": [
        {
            "ioc_value": "1m.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652276": [
        {
            "ioc_value": "1m.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:38",
            "last_seen_utc": "2025-11-29 09:53:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652238": [
        {
            "ioc_value": "1f.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652239": [
        {
            "ioc_value": "1fj.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652240": [
        {
            "ioc_value": "1fu.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652241": [
        {
            "ioc_value": "1g.windowl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:58:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652242": [
        {
            "ioc_value": "1h.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652243": [
        {
            "ioc_value": "1h.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652244": [
        {
            "ioc_value": "1h.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652245": [
        {
            "ioc_value": "1hi.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652246": [
        {
            "ioc_value": "1hj.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652247": [
        {
            "ioc_value": "1hx8.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652248": [
        {
            "ioc_value": "1i.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652249": [
        {
            "ioc_value": "1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-28 08:31:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652250": [
        {
            "ioc_value": "1i7.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652251": [
        {
            "ioc_value": "1id.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652252": [
        {
            "ioc_value": "1ig.1nyearbo0k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652253": [
        {
            "ioc_value": "1it.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652254": [
        {
            "ioc_value": "1ittleriver.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-28 08:31:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652255": [
        {
            "ioc_value": "1j.ember-trail.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:55:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652256": [
        {
            "ioc_value": "1jd.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652257": [
        {
            "ioc_value": "1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652220": [
        {
            "ioc_value": "180264.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652221": [
        {
            "ioc_value": "180264.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652222": [
        {
            "ioc_value": "19.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652223": [
        {
            "ioc_value": "1a1.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652224": [
        {
            "ioc_value": "1acn.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652225": [
        {
            "ioc_value": "1apde.zeromint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652226": [
        {
            "ioc_value": "1ax.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652227": [
        {
            "ioc_value": "1b.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652228": [
        {
            "ioc_value": "1b8.flintzoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:55:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652229": [
        {
            "ioc_value": "1c.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652230": [
        {
            "ioc_value": "1c.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:54:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652231": [
        {
            "ioc_value": "1c.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652232": [
        {
            "ioc_value": "1cher.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652233": [
        {
            "ioc_value": "1csr.cl1ppleap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:54:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652234": [
        {
            "ioc_value": "1d.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652235": [
        {
            "ioc_value": "1e.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:53:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652236": [
        {
            "ioc_value": "1efys.st1ltforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652237": [
        {
            "ioc_value": "1f.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:36",
            "last_seen_utc": "2025-11-29 09:55:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652201": [
        {
            "ioc_value": "14h.aucti-0-nz-7-ir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652202": [
        {
            "ioc_value": "14myx.oakember.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:56:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652203": [
        {
            "ioc_value": "15.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652204": [
        {
            "ioc_value": "15.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652205": [
        {
            "ioc_value": "15yf.mirthcap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:56:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652206": [
        {
            "ioc_value": "16.bashglider.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652207": [
        {
            "ioc_value": "16.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652208": [
        {
            "ioc_value": "160287.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652209": [
        {
            "ioc_value": "160287.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652210": [
        {
            "ioc_value": "163.4sa.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652211": [
        {
            "ioc_value": "1665s.saffronjet.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:57:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652212": [
        {
            "ioc_value": "169.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652213": [
        {
            "ioc_value": "169.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652214": [
        {
            "ioc_value": "169.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652215": [
        {
            "ioc_value": "17.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652216": [
        {
            "ioc_value": "17.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652217": [
        {
            "ioc_value": "17m.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652218": [
        {
            "ioc_value": "18.f0rce.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:55:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652219": [
        {
            "ioc_value": "180264.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:35",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652184": [
        {
            "ioc_value": "1205.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652185": [
        {
            "ioc_value": "1205.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652186": [
        {
            "ioc_value": "1207.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652187": [
        {
            "ioc_value": "1207.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652188": [
        {
            "ioc_value": "120984.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652189": [
        {
            "ioc_value": "120984.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652190": [
        {
            "ioc_value": "12if.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652191": [
        {
            "ioc_value": "13-yz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652192": [
        {
            "ioc_value": "13.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652193": [
        {
            "ioc_value": "13586721moon.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652194": [
        {
            "ioc_value": "137f.stormmint.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652195": [
        {
            "ioc_value": "137z.qu1rkfuse.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652196": [
        {
            "ioc_value": "14.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652197": [
        {
            "ioc_value": "14.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652198": [
        {
            "ioc_value": "14.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652199": [
        {
            "ioc_value": "14b6.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652200": [
        {
            "ioc_value": "14ba.fogmap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:34",
            "last_seen_utc": "2025-11-29 09:55:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652170": [
        {
            "ioc_value": "100587.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652171": [
        {
            "ioc_value": "10f.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652172": [
        {
            "ioc_value": "11.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652173": [
        {
            "ioc_value": "11.clear-fog.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:54:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652174": [
        {
            "ioc_value": "11.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652175": [
        {
            "ioc_value": "11.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652176": [
        {
            "ioc_value": "118.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652177": [
        {
            "ioc_value": "118.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652178": [
        {
            "ioc_value": "118.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652179": [
        {
            "ioc_value": "11f.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652180": [
        {
            "ioc_value": "11v.st1rlingpad.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652181": [
        {
            "ioc_value": "12.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652182": [
        {
            "ioc_value": "12.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652183": [
        {
            "ioc_value": "1205.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:33",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652151": [
        {
            "ioc_value": "0z.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652152": [
        {
            "ioc_value": "0z3sa.tweak-mire.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:58:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652153": [
        {
            "ioc_value": "0zf5z.ic0n1cbrook.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:55:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652154": [
        {
            "ioc_value": "0zjkg.lakeray.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:56:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652155": [
        {
            "ioc_value": "0zq.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652156": [
        {
            "ioc_value": "0zq.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652157": [
        {
            "ioc_value": "0zq.802d.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652158": [
        {
            "ioc_value": "0zq.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652159": [
        {
            "ioc_value": "0zq.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652160": [
        {
            "ioc_value": "0zq.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652161": [
        {
            "ioc_value": "0zq.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652162": [
        {
            "ioc_value": "0zq.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652163": [
        {
            "ioc_value": "0zq.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652164": [
        {
            "ioc_value": "1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652165": [
        {
            "ioc_value": "1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652166": [
        {
            "ioc_value": "10.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652167": [
        {
            "ioc_value": "10.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652168": [
        {
            "ioc_value": "100587.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652169": [
        {
            "ioc_value": "100587.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:32",
            "last_seen_utc": "2025-11-29 09:53:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652134": [
        {
            "ioc_value": "0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652135": [
        {
            "ioc_value": "0ur.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652136": [
        {
            "ioc_value": "0v.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652137": [
        {
            "ioc_value": "0v.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652138": [
        {
            "ioc_value": "0ver.heronturm.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:55:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652139": [
        {
            "ioc_value": "0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-28 08:31:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652140": [
        {
            "ioc_value": "0w.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652141": [
        {
            "ioc_value": "0x0.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652142": [
        {
            "ioc_value": "0xwdn.marble-tug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652143": [
        {
            "ioc_value": "0y.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652144": [
        {
            "ioc_value": "0y.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652145": [
        {
            "ioc_value": "0y.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652146": [
        {
            "ioc_value": "0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652147": [
        {
            "ioc_value": "0z.cloverschnee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:54:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652148": [
        {
            "ioc_value": "0z.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:53:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652149": [
        {
            "ioc_value": "0z.pihp.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652150": [
        {
            "ioc_value": "0z.sproutkraft.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:31",
            "last_seen_utc": "2025-11-29 09:57:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652116": [
        {
            "ioc_value": "0m.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:56:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652117": [
        {
            "ioc_value": "0m0.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652118": [
        {
            "ioc_value": "0ma.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652119": [
        {
            "ioc_value": "0mf.dewroot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652120": [
        {
            "ioc_value": "0n.cl0udrise.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652121": [
        {
            "ioc_value": "0n.crju.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652122": [
        {
            "ioc_value": "0o.dup-1-ic-4-ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652123": [
        {
            "ioc_value": "0o3.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652124": [
        {
            "ioc_value": "0okm8.dew-root.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:54:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652125": [
        {
            "ioc_value": "0op3s.oddkraken.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652126": [
        {
            "ioc_value": "0p.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652127": [
        {
            "ioc_value": "0palsummit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-28 08:31:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652128": [
        {
            "ioc_value": "0pv.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652129": [
        {
            "ioc_value": "0q.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652130": [
        {
            "ioc_value": "0q.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652131": [
        {
            "ioc_value": "0t.orbitalnip.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652132": [
        {
            "ioc_value": "0ti.night-bloom.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:56:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652133": [
        {
            "ioc_value": "0tl.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:30",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652096": [
        {
            "ioc_value": "0gk.lake-ray.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:56:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652097": [
        {
            "ioc_value": "0gs.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652098": [
        {
            "ioc_value": "0h.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652099": [
        {
            "ioc_value": "0i.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652100": [
        {
            "ioc_value": "0i.frostwilder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:55:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652101": [
        {
            "ioc_value": "0i.pulse-knob.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:57:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652102": [
        {
            "ioc_value": "0i4.4qo8.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652103": [
        {
            "ioc_value": "0i4.suncrest0n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652104": [
        {
            "ioc_value": "0icby.gr-1-tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:55:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652105": [
        {
            "ioc_value": "0iz7q.mashrift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:56:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652106": [
        {
            "ioc_value": "0jd.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652107": [
        {
            "ioc_value": "0jz.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652108": [
        {
            "ioc_value": "0k.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652109": [
        {
            "ioc_value": "0k.29rs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652110": [
        {
            "ioc_value": "0k.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652111": [
        {
            "ioc_value": "0k.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652112": [
        {
            "ioc_value": "0kd.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652113": [
        {
            "ioc_value": "0kj3.warpclutch.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:58:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652114": [
        {
            "ioc_value": "0lj.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652115": [
        {
            "ioc_value": "0m.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:29",
            "last_seen_utc": "2025-11-29 09:53:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652077": [
        {
            "ioc_value": "0a.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652078": [
        {
            "ioc_value": "0a5f.st0y70renka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:57:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652079": [
        {
            "ioc_value": "0akstream.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-28 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652080": [
        {
            "ioc_value": "0b.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652081": [
        {
            "ioc_value": "0b.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652082": [
        {
            "ioc_value": "0bl.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652083": [
        {
            "ioc_value": "0c.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652084": [
        {
            "ioc_value": "0ceanforgebay.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652085": [
        {
            "ioc_value": "0ceanleaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-28 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652086": [
        {
            "ioc_value": "0e.8-fr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652087": [
        {
            "ioc_value": "0e.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652088": [
        {
            "ioc_value": "0e2.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652089": [
        {
            "ioc_value": "0er.owlflug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652090": [
        {
            "ioc_value": "0f.padj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:59:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652091": [
        {
            "ioc_value": "0f.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652092": [
        {
            "ioc_value": "0f78.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652093": [
        {
            "ioc_value": "0ff.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652094": [
        {
            "ioc_value": "0g.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652095": [
        {
            "ioc_value": "0g7o3.redm0on.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:28",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652061": [
        {
            "ioc_value": "07.plx5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:57:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652062": [
        {
            "ioc_value": "0789.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652063": [
        {
            "ioc_value": "0789.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652064": [
        {
            "ioc_value": "07a9.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652065": [
        {
            "ioc_value": "07a9.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652066": [
        {
            "ioc_value": "07c9.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652067": [
        {
            "ioc_value": "08.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652068": [
        {
            "ioc_value": "08.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652069": [
        {
            "ioc_value": "08.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652070": [
        {
            "ioc_value": "080.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652071": [
        {
            "ioc_value": "080.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652072": [
        {
            "ioc_value": "080.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652073": [
        {
            "ioc_value": "092.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652074": [
        {
            "ioc_value": "0984.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652075": [
        {
            "ioc_value": "0984.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652076": [
        {
            "ioc_value": "0a.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:27",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652043": [
        {
            "ioc_value": "04ck.fr0stharrow.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:55:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652044": [
        {
            "ioc_value": "04j.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652045": [
        {
            "ioc_value": "05.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652046": [
        {
            "ioc_value": "053.knotberry.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:56:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652047": [
        {
            "ioc_value": "05a9.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652048": [
        {
            "ioc_value": "05b8.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652049": [
        {
            "ioc_value": "05b8.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652050": [
        {
            "ioc_value": "05b8.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652051": [
        {
            "ioc_value": "05c8.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652052": [
        {
            "ioc_value": "05c8.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652053": [
        {
            "ioc_value": "05xg.br-1-ar-wild.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:54:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652054": [
        {
            "ioc_value": "061.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652055": [
        {
            "ioc_value": "0615.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652056": [
        {
            "ioc_value": "0615.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652057": [
        {
            "ioc_value": "06342.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652058": [
        {
            "ioc_value": "06342.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652059": [
        {
            "ioc_value": "06d1.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652060": [
        {
            "ioc_value": "07.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:26",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652025": [
        {
            "ioc_value": "028.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652026": [
        {
            "ioc_value": "028.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652027": [
        {
            "ioc_value": "02au.echozig.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:55:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652028": [
        {
            "ioc_value": "03.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652029": [
        {
            "ioc_value": "0315.protohush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:57:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652030": [
        {
            "ioc_value": "03452.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652031": [
        {
            "ioc_value": "034d2.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652032": [
        {
            "ioc_value": "034d2.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652033": [
        {
            "ioc_value": "035.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652034": [
        {
            "ioc_value": "035.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652035": [
        {
            "ioc_value": "03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652036": [
        {
            "ioc_value": "04.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652037": [
        {
            "ioc_value": "04.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652038": [
        {
            "ioc_value": "04.morrow-plug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:56:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652039": [
        {
            "ioc_value": "04137.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652040": [
        {
            "ioc_value": "0482.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652041": [
        {
            "ioc_value": "0482.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652042": [
        {
            "ioc_value": "0482.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:25",
            "last_seen_utc": "2025-11-29 09:53:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652013": [
        {
            "ioc_value": "0-pal-summit.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-28 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652014": [
        {
            "ioc_value": "0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652015": [
        {
            "ioc_value": "0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652016": [
        {
            "ioc_value": "0.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-29 09:53:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652017": [
        {
            "ioc_value": "00.0fv1.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-29 09:53:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652018": [
        {
            "ioc_value": "00x.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-29 09:53:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652019": [
        {
            "ioc_value": "00x.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-29 09:53:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652020": [
        {
            "ioc_value": "01.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-29 09:53:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652021": [
        {
            "ioc_value": "012.zenith-snap.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-29 09:53:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652022": [
        {
            "ioc_value": "017fk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-29 09:53:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652023": [
        {
            "ioc_value": "01efv.odd-kraken.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-29 09:56:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652024": [
        {
            "ioc_value": "028.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:40:24",
            "last_seen_utc": "2025-11-29 09:53:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1652008": [
        {
            "ioc_value": "98du.mor-5-tud-1-es.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:37:30",
            "last_seen_utc": "2025-11-28 07:40:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1652006": [
        {
            "ioc_value": "v1tv.mor-5-tud-1-es.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:34:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1652005": [
        {
            "ioc_value": "vale1.le-3-nsnet-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:26:01",
            "last_seen_utc": "2025-11-28 07:27:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1652004": [
        {
            "ioc_value": "bobbot.xcvx.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-28 07:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e040b6465295d8e438017f2d69a060d6a7c8af8ed3db145a30231953d36c7d53/",
            "tags": "Hailbot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1652003": [
        {
            "ioc_value": "moon.le-3-nsnet-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:18:15",
            "last_seen_utc": "2025-11-28 07:20:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651912": [
        {
            "ioc_value": "altobg.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-28 07:13:47",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1651913": [
        {
            "ioc_value": "bajzii.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-28 07:13:47",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1651914": [
        {
            "ioc_value": "falofao.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-28 07:13:47",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1651915": [
        {
            "ioc_value": "lopeixn.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-28 07:13:46",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1651918": [
        {
            "ioc_value": "noidprb.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-28 07:13:44",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1651916": [
        {
            "ioc_value": "unakpn.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-28 07:13:41",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1651917": [
        {
            "ioc_value": "geapezk.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-28 07:13:40",
            "last_seen_utc": "2025-11-29 15:02:33",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1652001": [
        {
            "ioc_value": "vale.le-3-nsnet-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:11:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1652000": [
        {
            "ioc_value": "adkadoad.xcvx.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-28 07:10:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/51c5ca5399f1d103a75aaa39183c389bb8d0b1a14b8fa4a141dd30b31fe3775b/",
            "tags": "Hailbot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1651999": [
        {
            "ioc_value": "ridge3.le-3-nsnet-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651998": [
        {
            "ioc_value": "shift.comp-0-tsab-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 07:04:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651997": [
        {
            "ioc_value": "wc18k.comp-0-tsab-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651996": [
        {
            "ioc_value": "bk1l.comp-0-tsab-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 06:53:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651987": [
        {
            "ioc_value": "3z.comp-0-tsab-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 06:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651986": [
        {
            "ioc_value": "r2cw.1nyearbo0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 06:37:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651985": [
        {
            "ioc_value": "stone.1nyearbo0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 06:31:26",
            "last_seen_utc": "2025-11-28 06:34:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651984": [
        {
            "ioc_value": "1ig.1nyearbo0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 06:26:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651983": [
        {
            "ioc_value": "hd.1nyearbo0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 06:17:28",
            "last_seen_utc": "2025-11-28 06:18:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651982": [
        {
            "ioc_value": "blink.comp0tsab3e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 06:07:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651981": [
        {
            "ioc_value": "pdaxingyuanko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-28 06:06:12",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251128-cnkz2sylfj",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651980": [
        {
            "ioc_value": "cloud.comp0tsab3e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 06:04:23",
            "last_seen_utc": "2025-11-28 06:05:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651979": [
        {
            "ioc_value": "datescruciferra22.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-28 06:02:01",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251128-cswmcaymfm",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651978": [
        {
            "ioc_value": "nixum.harpmos.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-28 06:00:52",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251128-czjalavma1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651977": [
        {
            "ioc_value": "hv4.comp0tsab3e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 05:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651976": [
        {
            "ioc_value": "88u.comp0tsab3e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 05:49:46",
            "last_seen_utc": "2025-11-28 05:56:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651975": [
        {
            "ioc_value": "simple.simp7euna3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 05:40:13",
            "last_seen_utc": "2025-11-28 05:47:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651974": [
        {
            "ioc_value": "nqpv.simp7euna3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 05:37:50",
            "last_seen_utc": "2025-11-28 05:38:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651973": [
        {
            "ioc_value": "npimr.simp7euna3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 05:31:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651972": [
        {
            "ioc_value": "comp0.simp7euna3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 05:27:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651971": [
        {
            "ioc_value": "pulse6.simp-7-euna-3-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 05:21:44",
            "last_seen_utc": "2025-11-28 05:26:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651970": [
        {
            "ioc_value": "simple3.simp-7-euna-3-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 05:16:56",
            "last_seen_utc": "2025-11-28 05:20:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651969": [
        {
            "ioc_value": "pht.simp-7-euna-3-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 05:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651968": [
        {
            "ioc_value": "l0.simp-7-euna-3-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 04:57:43",
            "last_seen_utc": "2025-11-28 05:05:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651967": [
        {
            "ioc_value": "yg.mor5tud1es.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 04:43:18",
            "last_seen_utc": "2025-11-28 04:56:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651966": [
        {
            "ioc_value": "ck2x.mor5tud1es.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 04:38:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651964": [
        {
            "ioc_value": "fx3r.mor5tud1es.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 04:27:09",
            "last_seen_utc": "2025-11-28 04:30:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651963": [
        {
            "ioc_value": "comp.mor5tud1es.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 04:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651950": [
        {
            "ioc_value": "root.le3nsnet7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 04:00:48",
            "last_seen_utc": "2025-11-28 04:09:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651946": [
        {
            "ioc_value": "70.le3nsnet7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 03:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651945": [
        {
            "ioc_value": "code.le3nsnet7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 03:45:46",
            "last_seen_utc": "2025-11-28 03:46:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651944": [
        {
            "ioc_value": "nr.le3nsnet7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 03:40:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651943": [
        {
            "ioc_value": "aq.pen1sp7edef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 03:35:45",
            "last_seen_utc": "2025-11-28 03:36:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651942": [
        {
            "ioc_value": "spark.pen1sp7edef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 03:22:19",
            "last_seen_utc": "2025-11-28 03:24:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651941": [
        {
            "ioc_value": "wave.pen1sp7edef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 03:13:00",
            "last_seen_utc": "2025-11-28 03:21:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651940": [
        {
            "ioc_value": "mint.pen1sp7edef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 03:06:28",
            "last_seen_utc": "2025-11-28 03:07:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651939": [
        {
            "ioc_value": "ipl.dunn0en7el.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 03:03:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651936": [
        {
            "ioc_value": "code6.dunn0en7el.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 02:53:56",
            "last_seen_utc": "2025-11-28 02:59:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651935": [
        {
            "ioc_value": "cliff4.dunn0en7el.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 02:48:12",
            "last_seen_utc": "2025-11-28 02:55:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651934": [
        {
            "ioc_value": "su.dunn0en7el.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 02:41:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651933": [
        {
            "ioc_value": "3mt.manual-1-sa-1-yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 02:38:03",
            "last_seen_utc": "2025-11-28 02:38:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651932": [
        {
            "ioc_value": "cliff.manual-1-sa-1-yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 02:22:36",
            "last_seen_utc": "2025-11-28 02:37:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651931": [
        {
            "ioc_value": "h18u.manual-1-sa-1-yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 02:12:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651930": [
        {
            "ioc_value": "cliff0.manual-1-sa-1-yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 02:07:29",
            "last_seen_utc": "2025-11-28 02:10:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651929": [
        {
            "ioc_value": "flow2.st-0-y-70-renka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 01:57:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651928": [
        {
            "ioc_value": "pulse.st-0-y-70-renka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 01:48:22",
            "last_seen_utc": "2025-11-28 01:56:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651927": [
        {
            "ioc_value": "7d7ai.st-0-y-70-renka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 01:45:20",
            "last_seen_utc": "2025-11-28 01:47:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651926": [
        {
            "ioc_value": "pulse2.st-0-y-70-renka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 01:30:15",
            "last_seen_utc": "2025-11-28 01:32:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651925": [
        {
            "ioc_value": "trail.ede1g0rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 01:23:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651924": [
        {
            "ioc_value": "iz.ede1g0rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 01:21:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651923": [
        {
            "ioc_value": "frost.ede1g0rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 01:12:53",
            "last_seen_utc": "2025-11-28 01:14:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651922": [
        {
            "ioc_value": "ne9.ede1g0rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 01:09:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651921": [
        {
            "ioc_value": "wave5.ju4enpare1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 00:52:45",
            "last_seen_utc": "2025-11-28 01:08:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651920": [
        {
            "ioc_value": "o1.ju4enpare1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 00:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651919": [
        {
            "ioc_value": "bright2.ju4enpare1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 00:37:21",
            "last_seen_utc": "2025-11-28 00:42:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651911": [
        {
            "ioc_value": "vh1xr.ju4enpare1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 00:23:22",
            "last_seen_utc": "2025-11-28 00:35:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651910": [
        {
            "ioc_value": "snow.ju-4-en-pare-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 00:17:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651909": [
        {
            "ioc_value": "eju.ju-4-en-pare-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-28 00:07:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651898": [
        {
            "ioc_value": "dk2fp.ju-4-en-pare-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 23:57:57",
            "last_seen_utc": "2025-11-28 00:03:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651897": [
        {
            "ioc_value": "root7.ju-4-en-pare-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 23:48:23",
            "last_seen_utc": "2025-11-27 23:53:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651896": [
        {
            "ioc_value": "red7.a5t1gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 23:37:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651895": [
        {
            "ioc_value": "storm.a5t1gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 23:27:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651894": [
        {
            "ioc_value": "lake2.a5t1gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 23:16:17",
            "last_seen_utc": "2025-11-27 23:17:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651893": [
        {
            "ioc_value": "7ol4i.a5t1gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 23:08:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651892": [
        {
            "ioc_value": "dperw.ede-1-g-0-rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 23:03:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651872": [
        {
            "ioc_value": "evanrobot.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-11-27 23:00:33",
            "last_seen_utc": "2025-11-28 00:01:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/74.48.84.76+evanrobot.xyz",
            "tags": "AS35916,C2,censys,Hookbot,MULTA-ASN1",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1651870": [
        {
            "ioc_value": "td.ede-1-g-0-rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 22:59:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651869": [
        {
            "ioc_value": "b2.ede-1-g-0-rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 22:52:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651868": [
        {
            "ioc_value": "53.ede-1-g-0-rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 22:45:25",
            "last_seen_utc": "2025-11-27 22:48:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651867": [
        {
            "ioc_value": "2fq4.dunn-0-en-7-el.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 22:38:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651866": [
        {
            "ioc_value": "2ql.dunn-0-en-7-el.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 22:27:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651865": [
        {
            "ioc_value": "tvaz.dunn-0-en-7-el.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 22:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651864": [
        {
            "ioc_value": "8lwyc.dunn-0-en-7-el.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 22:07:41",
            "last_seen_utc": "2025-11-27 22:09:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651863": [
        {
            "ioc_value": "5r.a-5-t-1-gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 22:03:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651862": [
        {
            "ioc_value": "ei.a-5-t-1-gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 21:59:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651861": [
        {
            "ioc_value": "wood.a-5-t-1-gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 21:56:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651860": [
        {
            "ioc_value": "ugmbe.a-5-t-1-gstudy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 21:47:22",
            "last_seen_utc": "2025-11-27 21:55:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651859": [
        {
            "ioc_value": "wzs.manual1sa1yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 21:35:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651858": [
        {
            "ioc_value": "oxiw.manual1sa1yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 21:29:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651857": [
        {
            "ioc_value": "4u29.manual1sa1yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 21:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651856": [
        {
            "ioc_value": "p5.manual1sa1yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 21:11:13",
            "last_seen_utc": "2025-11-27 21:19:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651855": [
        {
            "ioc_value": "frost7.st0y70renka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 21:00:51",
            "last_seen_utc": "2025-11-27 21:08:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651854": [
        {
            "ioc_value": "0a5f.st0y70renka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 20:57:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651853": [
        {
            "ioc_value": "bright7.st0y70renka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 20:49:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651852": [
        {
            "ioc_value": "z1w.st0y70renka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 20:44:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651851": [
        {
            "ioc_value": "pz8ux.mistlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 20:41:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651850": [
        {
            "ioc_value": "red9.mistlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 20:31:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651849": [
        {
            "ioc_value": "lake5.mistlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 20:26:20",
            "last_seen_utc": "2025-11-27 20:29:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651848": [
        {
            "ioc_value": "spark7.mistlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 20:15:24",
            "last_seen_utc": "2025-11-27 20:20:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651847": [
        {
            "ioc_value": "gty6.stonem1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 20:09:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651846": [
        {
            "ioc_value": "p81s.stonem1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 20:03:25",
            "last_seen_utc": "2025-11-27 20:06:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651835": [
        {
            "ioc_value": "smartlegal.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-27 20:01:35",
            "last_seen_utc": "2025-11-27 23:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+smartlegal.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651833": [
        {
            "ioc_value": "www.microsofrtonline.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-27 20:01:34",
            "last_seen_utc": "2025-11-27 23:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.105.183.234+www.microsofrtonline.com",
            "tags": "AKAMAI-LINODE-AP,AS63949,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651834": [
        {
            "ioc_value": "tmsawards.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-27 20:01:34",
            "last_seen_utc": "2025-11-27 23:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+tmsawards.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651822": [
        {
            "ioc_value": "note7.stonem1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 19:59:15",
            "last_seen_utc": "2025-11-27 20:02:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651821": [
        {
            "ioc_value": "spark8.stonem1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 19:45:54",
            "last_seen_utc": "2025-11-27 19:58:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651820": [
        {
            "ioc_value": "echo9.snowr1se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 19:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651819": [
        {
            "ioc_value": "52i.snowr1se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 19:27:51",
            "last_seen_utc": "2025-11-27 19:33:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651818": [
        {
            "ioc_value": "lake.snowr1se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 19:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651817": [
        {
            "ioc_value": "a2.snowr1se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 19:01:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651816": [
        {
            "ioc_value": "wq.cl1ffwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 18:51:35",
            "last_seen_utc": "2025-11-27 18:53:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651807": [
        {
            "ioc_value": "bright.cl1ffwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 18:43:17",
            "last_seen_utc": "2025-11-27 18:47:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651806": [
        {
            "ioc_value": "bright6.cl1ffwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 18:37:33",
            "last_seen_utc": "2025-11-27 18:40:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651805": [
        {
            "ioc_value": "qyvu.cl1ffwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 18:31:51",
            "last_seen_utc": "2025-11-27 18:34:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651803": [
        {
            "ioc_value": "lauderteacher.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 18:30:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651801": [
        {
            "ioc_value": "f15yw.cioudriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 18:28:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651799": [
        {
            "ioc_value": "verification-step-5321.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 18:23:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651797": [
        {
            "ioc_value": "fut.cioudriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 18:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651796": [
        {
            "ioc_value": "ijels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-27 18:10:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651792": [
        {
            "ioc_value": "stonehandlop.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-27 18:08:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651791": [
        {
            "ioc_value": "w4.cioudriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 18:07:37",
            "last_seen_utc": "2025-11-27 18:10:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651790": [
        {
            "ioc_value": "vibranthealthventure.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 18:03:35",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651787": [
        {
            "ioc_value": "tentori.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 18:02:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651785": [
        {
            "ioc_value": "tyrafast.se",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 18:01:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651784": [
        {
            "ioc_value": "tiw6q.cioudriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 18:01:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651782": [
        {
            "ioc_value": "samurai-car-jpn.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 18:01:01",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651780": [
        {
            "ioc_value": "copyright-cnn.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-27 18:00:44",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251127-t54xxsbk7y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651779": [
        {
            "ioc_value": "peterandalexa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 18:00:19",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651776": [
        {
            "ioc_value": "edanurcakmak.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651774": [
        {
            "ioc_value": "bcts.br1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 17:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651773": [
        {
            "ioc_value": "hands-japan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:58:49",
            "last_seen_utc": "2025-12-08 19:00:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651771": [
        {
            "ioc_value": "nurselnc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:58:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651769": [
        {
            "ioc_value": "papaburrito.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:57:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651767": [
        {
            "ioc_value": "gembetoffermy2.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:56:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651765": [
        {
            "ioc_value": "q54.br1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 17:55:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651763": [
        {
            "ioc_value": "ithroofingremodelingllc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:54:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651760": [
        {
            "ioc_value": "oscarsalinas.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:53:26",
            "last_seen_utc": "2025-12-11 19:29:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651759": [
        {
            "ioc_value": "expertsbyexperience.knightcott.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:50:09",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651757": [
        {
            "ioc_value": "clinicafisiotrat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:48:15",
            "last_seen_utc": "2025-12-07 20:34:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651755": [
        {
            "ioc_value": "data.br1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 17:46:58",
            "last_seen_utc": "2025-11-27 17:55:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651753": [
        {
            "ioc_value": "sayaracentral.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:45:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651752": [
        {
            "ioc_value": "h2powersystem.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:44:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651750": [
        {
            "ioc_value": "os2rz.br1ghtwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 17:42:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651749": [
        {
            "ioc_value": "sendmeavoucher.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:41:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651747": [
        {
            "ioc_value": "opnoit.prospy.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:40:42",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651745": [
        {
            "ioc_value": "csirtennisclub.org.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:37:00",
            "last_seen_utc": "2025-12-09 13:35:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651743": [
        {
            "ioc_value": "adcom.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:35:59",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651741": [
        {
            "ioc_value": "sunrise-f.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:32:32",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651739": [
        {
            "ioc_value": "thabet.black",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:31:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651737": [
        {
            "ioc_value": "fkl7.redm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 17:30:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651736": [
        {
            "ioc_value": "autostikeri.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:28:34",
            "last_seen_utc": "2025-12-08 19:00:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651734": [
        {
            "ioc_value": "agri-life.tokyo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:26:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651731": [
        {
            "ioc_value": "janvilleroofing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:25:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651730": [
        {
            "ioc_value": "00c29c34fd.nxcli.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:24:30",
            "last_seen_utc": "2025-12-11 19:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651727": [
        {
            "ioc_value": "belsiorealestate.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651725": [
        {
            "ioc_value": "t7q2.redm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 17:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651723": [
        {
            "ioc_value": "lindtmobile.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:19:40",
            "last_seen_utc": "2025-12-08 19:00:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651722": [
        {
            "ioc_value": "zero-start.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:19:13",
            "last_seen_utc": "2025-12-09 13:35:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651719": [
        {
            "ioc_value": "mayinhue.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:18:00",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651718": [
        {
            "ioc_value": "pulse1.redm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 17:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651717": [
        {
            "ioc_value": "oberfohring.umzug-milbertshofen.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:15:49",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651714": [
        {
            "ioc_value": "innovationpowerhouse.africa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:14:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651713": [
        {
            "ioc_value": "venkateshwarmines.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:11:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651711": [
        {
            "ioc_value": "saikou.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:10:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651709": [
        {
            "ioc_value": "ir.karpirajobs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:09:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651707": [
        {
            "ioc_value": "campbrainstorm.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:08:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651705": [
        {
            "ioc_value": "0g7o3.redm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 17:06:28",
            "last_seen_utc": "2025-11-27 17:10:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651703": [
        {
            "ioc_value": "gharbanau.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 17:05:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651701": [
        {
            "ioc_value": "fst.fl0wstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 17:00:17",
            "last_seen_utc": "2025-11-27 17:06:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651697": [
        {
            "ioc_value": "highondots.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 16:56:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651696": [
        {
            "ioc_value": "87kd.fl0wstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 16:56:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651695": [
        {
            "ioc_value": "rise.fl0wstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 16:52:22",
            "last_seen_utc": "2025-11-27 16:56:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651694": [
        {
            "ioc_value": "q8s9.fl0wstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 16:46:24",
            "last_seen_utc": "2025-11-27 16:46:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651693": [
        {
            "ioc_value": "sessionsverificate.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 16:43:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651690": [
        {
            "ioc_value": "sessionverificates.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 16:41:10",
            "last_seen_utc": "2025-11-27 16:45:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651689": [
        {
            "ioc_value": "spark2.c0deroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 16:39:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651688": [
        {
            "ioc_value": "fy.c0deroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 16:33:07",
            "last_seen_utc": "2025-11-27 16:39:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651687": [
        {
            "ioc_value": "58k2.c0deroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 16:25:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651686": [
        {
            "ioc_value": "ds.c0deroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 16:14:55",
            "last_seen_utc": "2025-11-27 16:21:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651685": [
        {
            "ioc_value": "n2ag.stormmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 16:11:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651683": [
        {
            "ioc_value": "137f.stormmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 16:02:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651674": [
        {
            "ioc_value": "9t.stormmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 15:51:36",
            "last_seen_utc": "2025-11-27 15:56:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651673": [
        {
            "ioc_value": "r767b.stormmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 15:48:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651672": [
        {
            "ioc_value": "firn5a.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 15:43:15",
            "last_seen_utc": "2025-11-27 15:44:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651669": [
        {
            "ioc_value": "thaw9r.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 15:31:18",
            "last_seen_utc": "2025-11-27 15:40:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651668": [
        {
            "ioc_value": "sl3etx.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 15:28:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651667": [
        {
            "ioc_value": "root4x.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 15:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651666": [
        {
            "ioc_value": "snow7y.snowroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 15:10:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651664": [
        {
            "ioc_value": "thu.thesmarthustle.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-27 15:10:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1651663": [
        {
            "ioc_value": "thu.itermed.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-27 15:10:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1651660": [
        {
            "ioc_value": "splo8s.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 15:01:41",
            "last_seen_utc": "2025-11-27 15:03:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651659": [
        {
            "ioc_value": "patt3r.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:52:54",
            "last_seen_utc": "2025-11-27 14:54:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651658": [
        {
            "ioc_value": "cl0udy.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:48:42",
            "last_seen_utc": "2025-11-27 14:51:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651657": [
        {
            "ioc_value": "drop5y.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:45:26",
            "last_seen_utc": "2025-11-27 14:46:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651656": [
        {
            "ioc_value": "rain7x.rainbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:40:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651655": [
        {
            "ioc_value": "twig9x.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:36:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651654": [
        {
            "ioc_value": "bud4le.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:27:42",
            "last_seen_utc": "2025-11-27 14:34:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651653": [
        {
            "ioc_value": "spr1gg.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:15:26",
            "last_seen_utc": "2025-11-27 14:22:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651652": [
        {
            "ioc_value": "byt3rx.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:11:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651651": [
        {
            "ioc_value": "leaf7y.leafbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:08:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651650": [
        {
            "ioc_value": "halo9r.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 14:04:14",
            "last_seen_utc": "2025-11-27 14:05:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651647": [
        {
            "ioc_value": "lum3na.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 13:56:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651645": [
        {
            "ioc_value": "icey4x.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 13:47:49",
            "last_seen_utc": "2025-11-27 13:52:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651644": [
        {
            "ioc_value": "froz7y.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 13:38:02",
            "last_seen_utc": "2025-11-27 13:44:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651643": [
        {
            "ioc_value": "glaci5.iceglow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 13:32:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651642": [
        {
            "ioc_value": "clap9t.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 13:27:36",
            "last_seen_utc": "2025-11-27 13:32:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651641": [
        {
            "ioc_value": "rumbl3.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 13:21:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651640": [
        {
            "ioc_value": "gust5y.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 13:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651639": [
        {
            "ioc_value": "ling7o.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 13:04:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651637": [
        {
            "ioc_value": "st0rmx.stormling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 12:56:36",
            "last_seen_utc": "2025-11-27 12:57:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651634": [
        {
            "ioc_value": "calm4y.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 12:48:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651633": [
        {
            "ioc_value": "yawn9x.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 12:45:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651632": [
        {
            "ioc_value": "breez5.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 12:41:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651631": [
        {
            "ioc_value": "laz7ee.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 12:37:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651630": [
        {
            "ioc_value": "doz3er.lazywind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 12:26:55",
            "last_seen_utc": "2025-11-27 12:36:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651629": [
        {
            "ioc_value": "racy5n.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 12:23:21",
            "last_seen_utc": "2025-11-27 12:23:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651628": [
        {
            "ioc_value": "bolt9a.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 12:16:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651627": [
        {
            "ioc_value": "qu1ckr.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 12:07:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651626": [
        {
            "ioc_value": "b1.yydscd3.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-27 12:03:25",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251127-hy7vfssqbs",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651625": [
        {
            "ioc_value": "b1.yydscd1.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-27 12:03:24",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251127-hy7vfssqbs",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651614": [
        {
            "ioc_value": "sp4rkx.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:57:49",
            "last_seen_utc": "2025-11-27 12:01:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651613": [
        {
            "ioc_value": "flash7.fastspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:51:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651612": [
        {
            "ioc_value": "mote5r.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:47:23",
            "last_seen_utc": "2025-11-27 11:51:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651611": [
        {
            "ioc_value": "haz3lo.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:43:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651610": [
        {
            "ioc_value": "silt9x.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:36:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651609": [
        {
            "ioc_value": "peak7r.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:27:10",
            "last_seen_utc": "2025-11-27 11:32:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651608": [
        {
            "ioc_value": "du5tly.dustpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:22:28",
            "last_seen_utc": "2025-11-27 11:26:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651607": [
        {
            "ioc_value": "flak8e.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:17:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651606": [
        {
            "ioc_value": "shivr5.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:15:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651605": [
        {
            "ioc_value": "icell3.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:12:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651604": [
        {
            "ioc_value": "drip7y.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:08:15",
            "last_seen_utc": "2025-11-27 11:10:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651603": [
        {
            "ioc_value": "fr0stx.frostdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 11:02:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651584": [
        {
            "ioc_value": "dew4ly.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:57:37",
            "last_seen_utc": "2025-11-27 10:59:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651583": [
        {
            "ioc_value": "clov8r.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:52:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651582": [
        {
            "ioc_value": "zefyr7.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:46:09",
            "last_seen_utc": "2025-11-27 10:46:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651581": [
        {
            "ioc_value": "mnt3ak.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:38:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651580": [
        {
            "ioc_value": "herb5x.mintpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:35:21",
            "last_seen_utc": "2025-11-27 10:36:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651579": [
        {
            "ioc_value": "fr3sha.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:27:53",
            "last_seen_utc": "2025-11-27 10:31:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651577": [
        {
            "ioc_value": "shamr4.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:23:42",
            "last_seen_utc": "2025-11-27 10:26:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651575": [
        {
            "ioc_value": "bop.itermed.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-27 10:22:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1651576": [
        {
            "ioc_value": "bop.thesmarthustle.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-27 10:22:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1651572": [
        {
            "ioc_value": "herb6x.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651571": [
        {
            "ioc_value": "minty7.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:15:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651570": [
        {
            "ioc_value": "clov3r.cl0vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:12:33",
            "last_seen_utc": "2025-11-27 10:12:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651569": [
        {
            "ioc_value": "mar3na.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 10:07:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651567": [
        {
            "ioc_value": "surf9a.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:57:36",
            "last_seen_utc": "2025-11-27 10:02:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651566": [
        {
            "ioc_value": "wave7x.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:52:19",
            "last_seen_utc": "2025-11-27 09:56:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651565": [
        {
            "ioc_value": "tid4l.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:47:06",
            "last_seen_utc": "2025-11-27 09:52:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651564": [
        {
            "ioc_value": "softe5.soft0cean.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:44:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651563": [
        {
            "ioc_value": "delta6.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:40:52",
            "last_seen_utc": "2025-11-27 09:44:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651562": [
        {
            "ioc_value": "splash8.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:36:39",
            "last_seen_utc": "2025-11-27 09:39:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1651561": [
        {
            "ioc_value": "creek5.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:31:58",
            "last_seen_utc": "2025-11-27 09:32:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651560": [
        {
            "ioc_value": "dropl7.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:26:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651559": [
        {
            "ioc_value": "riv3t.r1verdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:21:05",
            "last_seen_utc": "2025-11-27 09:23:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651558": [
        {
            "ioc_value": "foggy6.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651557": [
        {
            "ioc_value": "bleue4.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:07:51",
            "last_seen_utc": "2025-11-27 09:13:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651499": [
        {
            "ioc_value": "myfandollars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 09:03:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651501": [
        {
            "ioc_value": "nisourcetech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 09:03:30",
            "last_seen_utc": "2025-12-09 13:35:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651503": [
        {
            "ioc_value": "peppersghost.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 09:03:29",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651508": [
        {
            "ioc_value": "africanalphacc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 09:03:28",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651506": [
        {
            "ioc_value": "23wincom.agency",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 09:03:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651541": [
        {
            "ioc_value": "fdlkewebsite.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 09:03:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651556": [
        {
            "ioc_value": "cyan9x.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 09:02:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651555": [
        {
            "ioc_value": "mist7y.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651554": [
        {
            "ioc_value": "azure5.bluem1st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:52:40",
            "last_seen_utc": "2025-11-27 08:57:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651553": [
        {
            "ioc_value": "skid9x.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:49:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651550": [
        {
            "ioc_value": "flurr6.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:46:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651549": [
        {
            "ioc_value": "trac3r.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:40:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651548": [
        {
            "ioc_value": "sn0wy7.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:35:18",
            "last_seen_utc": "2025-11-27 08:37:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651547": [
        {
            "ioc_value": "slush5.sn0wtrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:27:26",
            "last_seen_utc": "2025-11-27 08:28:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651546": [
        {
            "ioc_value": "quak3r.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:23:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651545": [
        {
            "ioc_value": "rumbl5.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651544": [
        {
            "ioc_value": "shard7.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:14:53",
            "last_seen_utc": "2025-11-27 08:16:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651543": [
        {
            "ioc_value": "brecc8.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:10:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651540": [
        {
            "ioc_value": "st0ne.stoneburst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 08:04:06",
            "last_seen_utc": "2025-11-27 08:07:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651528": [
        {
            "ioc_value": "w1ndo.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 07:57:49",
            "last_seen_utc": "2025-11-27 07:59:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651520": [
        {
            "ioc_value": "pec.itermed.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-27 07:49:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1651521": [
        {
            "ioc_value": "pec.thesmarthustle.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-27 07:49:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1651512": [
        {
            "ioc_value": "squall6.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 07:47:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651511": [
        {
            "ioc_value": "aeri4s.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 07:41:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651510": [
        {
            "ioc_value": "vindex5.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 07:37:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651504": [
        {
            "ioc_value": "gale7x.windstack.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 07:26:39",
            "last_seen_utc": "2025-11-27 07:33:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651496": [
        {
            "ioc_value": "keyframe.com.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:22:22",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651495": [
        {
            "ioc_value": "baby-mine0821.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:21:34",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651493": [
        {
            "ioc_value": "frakt8.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 07:20:22",
            "last_seen_utc": "2025-11-27 07:21:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651491": [
        {
            "ioc_value": "training-uat.rapidascent.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:19:45",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651490": [
        {
            "ioc_value": "thewrightgiftstore.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651487": [
        {
            "ioc_value": "nithani.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:13:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651485": [
        {
            "ioc_value": "glint5.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 07:12:31",
            "last_seen_utc": "2025-11-27 07:13:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651483": [
        {
            "ioc_value": "mmoo.vet",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:11:52",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651482": [
        {
            "ioc_value": "ridethecape.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:10:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651480": [
        {
            "ioc_value": "nutritionadvicehub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:09:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651478": [
        {
            "ioc_value": "lumyx6.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 07:08:19",
            "last_seen_utc": "2025-11-27 07:08:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651477": [
        {
            "ioc_value": "sparklehomecleaningcompany.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:06:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651475": [
        {
            "ioc_value": "padelsportacademy.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:05:16",
            "last_seen_utc": "2025-12-11 19:29:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651473": [
        {
            "ioc_value": "lorriedeenacaplan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:04:24",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651471": [
        {
            "ioc_value": "homeexplore.novacrm.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:03:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651468": [
        {
            "ioc_value": "gotokenta.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:02:22",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651467": [
        {
            "ioc_value": "bongoshare.bishtelecom.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 07:01:12",
            "last_seen_utc": "2025-12-11 19:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651464": [
        {
            "ioc_value": "does-58376.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-27 06:58:48",
            "last_seen_utc": "2025-12-12 18:39:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651465": [
        {
            "ioc_value": "most-inbox.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-27 06:58:48",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651462": [
        {
            "ioc_value": "science-tight.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-27 06:57:47",
            "last_seen_utc": "2025-12-12 18:39:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651450": [
        {
            "ioc_value": "v2.socolive6.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651451": [
        {
            "ioc_value": "v2.www.50thirdand3rd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651452": [
        {
            "ioc_value": "v2.www.allaboutbasketball.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651453": [
        {
            "ioc_value": "v2.www.istas22.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651454": [
        {
            "ioc_value": "v2.www.outsideprague.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651455": [
        {
            "ioc_value": "v3.aceawarewales.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651456": [
        {
            "ioc_value": "v3.homoclimbtastic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651457": [
        {
            "ioc_value": "v3.socolive6.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651458": [
        {
            "ioc_value": "v3.www.50thirdand3rd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651459": [
        {
            "ioc_value": "v3.www.allaboutbasketball.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651460": [
        {
            "ioc_value": "v3.www.istas22.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651461": [
        {
            "ioc_value": "v3.www.outsideprague.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:33",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651448": [
        {
            "ioc_value": "v2.aceawarewales.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:32",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651449": [
        {
            "ioc_value": "v2.homoclimbtastic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-27 06:57:32",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651444": [
        {
            "ioc_value": "arnaelevators.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 06:57:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651443": [
        {
            "ioc_value": "vib3ro.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 06:56:57",
            "last_seen_utc": "2025-11-27 06:59:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651437": [
        {
            "ioc_value": "aceawarewales.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-27 06:56:56",
            "last_seen_utc": "2025-11-27 06:57:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651438": [
        {
            "ioc_value": "gatex.aceawarewales.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-27 06:56:56",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651439": [
        {
            "ioc_value": "gatex.www.50thirdand3rd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-27 06:56:56",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651440": [
        {
            "ioc_value": "kitchen-bet.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-27 06:56:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651441": [
        {
            "ioc_value": "www.canwoodgallery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-27 06:56:56",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651442": [
        {
            "ioc_value": "www.fondazionesabattini.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-27 06:56:56",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651434": [
        {
            "ioc_value": "ami-thai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 06:54:56",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651431": [
        {
            "ioc_value": "99sbobet.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 06:54:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651432": [
        {
            "ioc_value": "aimania2024.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 06:54:52",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651429": [
        {
            "ioc_value": "cryptoportalhub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 06:50:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651427": [
        {
            "ioc_value": "crys7a.crystalv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 06:46:08",
            "last_seen_utc": "2025-11-27 06:54:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651426": [
        {
            "ioc_value": "nubil3.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 06:41:54",
            "last_seen_utc": "2025-11-27 06:43:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651425": [
        {
            "ioc_value": "slursbeback.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-27 06:38:12",
            "last_seen_utc": "2025-11-30 12:44:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/d508929946b9ae3d643d900983435230eedb2549b8d30690b516bd5a70ee67c4/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1651423": [
        {
            "ioc_value": "driff7.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 06:38:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651421": [
        {
            "ioc_value": "yolwkl.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 06:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651419": [
        {
            "ioc_value": "halox5.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 06:27:51",
            "last_seen_utc": "2025-11-27 06:30:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651418": [
        {
            "ioc_value": "silverpath.shadowstresser.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-27 06:23:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/499a9490102cc55e94f6a9c304eea86bbe968cff36b9ac4a8b7ff866b224739f/",
            "tags": "Mirai,ShadowV2",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1651417": [
        {
            "ioc_value": "strm9a.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 06:16:56",
            "last_seen_utc": "2025-11-27 06:20:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651416": [
        {
            "ioc_value": "buyaofengwoa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-27 06:07:08",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251127-bvg2asylfy",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651415": [
        {
            "ioc_value": "vex7in.st0rmshade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 06:06:33",
            "last_seen_utc": "2025-11-27 06:10:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651413": [
        {
            "ioc_value": "uzlehalo134.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-27 06:00:41",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251127-f8ynes1rby",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651412": [
        {
            "ioc_value": "borass.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-27 06:00:40",
            "last_seen_utc": "2025-12-12 18:39:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/251127-ge76fadj4z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651411": [
        {
            "ioc_value": "brand8.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 05:57:44",
            "last_seen_utc": "2025-11-27 06:06:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651319": [
        {
            "ioc_value": "control.myaffiliateincome.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-27 05:50:32",
            "last_seen_utc": "2025-12-07 10:23:12",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115618524659194678",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1651323": [
        {
            "ioc_value": "cryptoinfa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-27 05:50:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651406": [
        {
            "ioc_value": "flar4e.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 05:47:19",
            "last_seen_utc": "2025-11-27 05:48:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651405": [
        {
            "ioc_value": "schlu7.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 05:36:00",
            "last_seen_utc": "2025-11-27 05:42:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651404": [
        {
            "ioc_value": "kalm3m.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 05:30:16",
            "last_seen_utc": "2025-11-27 05:31:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651403": [
        {
            "ioc_value": "ember5.emberklamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 05:27:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651402": [
        {
            "ioc_value": "grot8o.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 05:19:19",
            "last_seen_utc": "2025-11-27 05:23:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651401": [
        {
            "ioc_value": "sourc3.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 05:12:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651399": [
        {
            "ioc_value": "quel7e.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 05:05:45",
            "last_seen_utc": "2025-11-27 05:10:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651398": [
        {
            "ioc_value": "brun4n.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 04:57:59",
            "last_seen_utc": "2025-11-27 05:03:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651397": [
        {
            "ioc_value": "onyx5a.onyxquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 04:47:38",
            "last_seen_utc": "2025-11-27 04:56:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651396": [
        {
            "ioc_value": "schne8.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 04:37:46",
            "last_seen_utc": "2025-11-27 04:45:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651393": [
        {
            "ioc_value": "ficht4.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 04:28:26",
            "last_seen_utc": "2025-11-27 04:32:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651392": [
        {
            "ioc_value": "harz7a.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 04:25:17",
            "last_seen_utc": "2025-11-27 04:26:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651391": [
        {
            "ioc_value": "wink3l.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 04:15:27",
            "last_seen_utc": "2025-11-27 04:18:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651390": [
        {
            "ioc_value": "spruc5.sprucewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 04:10:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651388": [
        {
            "ioc_value": "fluss8.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 04:02:21",
            "last_seen_utc": "2025-11-27 04:08:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651371": [
        {
            "ioc_value": "talon4.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:59:11",
            "last_seen_utc": "2025-11-27 04:01:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651370": [
        {
            "ioc_value": "grau5e.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:52:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651369": [
        {
            "ioc_value": "tau3ig.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:48:07",
            "last_seen_utc": "2025-11-27 03:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651368": [
        {
            "ioc_value": "nebe7l.nebeltal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:41:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651367": [
        {
            "ioc_value": "zerfa2.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:32:04",
            "last_seen_utc": "2025-11-27 03:39:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651366": [
        {
            "ioc_value": "haust5.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:27:52",
            "last_seen_utc": "2025-11-27 03:32:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651365": [
        {
            "ioc_value": "nebl4e.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:18:37",
            "last_seen_utc": "2025-11-27 03:19:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1651364": [
        {
            "ioc_value": "gas3en.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:14:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651363": [
        {
            "ioc_value": "will7o.willowgase.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:11:47",
            "last_seen_utc": "2025-11-27 03:13:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651362": [
        {
            "ioc_value": "beryl6.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651361": [
        {
            "ioc_value": "rauch4.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 03:05:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651360": [
        {
            "ioc_value": "glanz5.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 02:59:43",
            "last_seen_utc": "2025-11-27 03:03:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651359": [
        {
            "ioc_value": "qartz7.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 02:53:29",
            "last_seen_utc": "2025-11-27 02:56:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651357": [
        {
            "ioc_value": "www.beihu-jlbank.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-27 02:48:18",
            "last_seen_utc": "2025-12-14 11:48:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1651356": [
        {
            "ioc_value": "static-mtpjoriqkv.cn-beijing.fcapp.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-27 02:48:16",
            "last_seen_utc": "2025-12-14 11:48:16",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1651355": [
        {
            "ioc_value": "1310445127-bo78zajqf2.ap-shanghai.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-27 02:47:58",
            "last_seen_utc": "2025-12-14 11:48:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1651354": [
        {
            "ioc_value": "silb3r.silberquarz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 02:46:11",
            "last_seen_utc": "2025-11-27 02:52:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651353": [
        {
            "ioc_value": "bl3nda.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 02:17:00",
            "last_seen_utc": "2025-11-27 02:34:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651352": [
        {
            "ioc_value": "scher4.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 02:08:05",
            "last_seen_utc": "2025-11-27 02:13:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651351": [
        {
            "ioc_value": "funke5.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 01:57:48",
            "last_seen_utc": "2025-11-27 01:58:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651350": [
        {
            "ioc_value": "kran7z.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 01:50:29",
            "last_seen_utc": "2025-11-27 01:53:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651349": [
        {
            "ioc_value": "gl1mra.glimmerkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 01:47:47",
            "last_seen_utc": "2025-11-27 01:48:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651348": [
        {
            "ioc_value": "bryz4a.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 01:36:35",
            "last_seen_utc": "2025-11-27 01:39:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651347": [
        {
            "ioc_value": "ahorn7.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 01:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651346": [
        {
            "ioc_value": "kuest5.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 01:17:12",
            "last_seen_utc": "2025-11-27 01:20:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651345": [
        {
            "ioc_value": "fjord6.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 01:08:22",
            "last_seen_utc": "2025-11-27 01:14:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651343": [
        {
            "ioc_value": "mapl3e.maplekueste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 00:54:59",
            "last_seen_utc": "2025-11-27 01:00:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651342": [
        {
            "ioc_value": "noxil7.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 00:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651341": [
        {
            "ioc_value": "steyn4.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 00:39:57",
            "last_seen_utc": "2025-11-27 00:42:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651340": [
        {
            "ioc_value": "korvo5.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 00:31:38",
            "last_seen_utc": "2025-11-27 00:38:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651339": [
        {
            "ioc_value": "eis3en.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 00:25:58",
            "last_seen_utc": "2025-11-27 00:28:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651338": [
        {
            "ioc_value": "rava7n.ravenstein.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 00:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651337": [
        {
            "ioc_value": "yoxel2.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 00:15:25",
            "last_seen_utc": "2025-11-27 00:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651336": [
        {
            "ioc_value": "braun5.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-27 00:05:36",
            "last_seen_utc": "2025-11-27 00:07:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651328": [
        {
            "ioc_value": "mist4y.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 23:56:19",
            "last_seen_utc": "2025-11-26 23:57:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651327": [
        {
            "ioc_value": "weid7e.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 23:44:26",
            "last_seen_utc": "2025-11-26 23:54:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651326": [
        {
            "ioc_value": "copp3r.copperweide8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 23:38:08",
            "last_seen_utc": "2025-11-26 23:40:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651324": [
        {
            "ioc_value": "raxen3.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 23:24:12",
            "last_seen_utc": "2025-11-26 23:34:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651321": [
        {
            "ioc_value": "glim8r.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 23:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651318": [
        {
            "ioc_value": "nordiq4.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 23:08:38",
            "last_seen_utc": "2025-11-26 23:17:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651317": [
        {
            "ioc_value": "stel5a.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 23:05:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651304": [
        {
            "ioc_value": "aurg7o.auroragrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 22:56:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651303": [
        {
            "ioc_value": "qidra5.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 22:45:47",
            "last_seen_utc": "2025-11-26 22:46:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651302": [
        {
            "ioc_value": "havn3x.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 22:38:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651301": [
        {
            "ioc_value": "tresk9.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 22:34:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651299": [
        {
            "ioc_value": "lomqa7.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 22:27:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651298": [
        {
            "ioc_value": "snf.testdevsite.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 22:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651297": [
        {
            "ioc_value": "vrix5a.thistlehavn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 22:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651296": [
        {
            "ioc_value": "lofsitewebsdrft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-26 22:16:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.210.82",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651295": [
        {
            "ioc_value": "sp1rel.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 22:15:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651293": [
        {
            "ioc_value": "3-acc-domain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 22:09:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651292": [
        {
            "ioc_value": "ublak5.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 22:08:13",
            "last_seen_utc": "2025-11-26 22:13:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651291": [
        {
            "ioc_value": "3accdomain2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 22:05:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651289": [
        {
            "ioc_value": "wav3ly.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 22:03:05",
            "last_seen_utc": "2025-11-26 22:04:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651288": [
        {
            "ioc_value": "fjord7a.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:56:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651287": [
        {
            "ioc_value": "m1sty.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:51:02",
            "last_seen_utc": "2025-11-26 21:55:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651286": [
        {
            "ioc_value": "clad0n.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:47:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651285": [
        {
            "ioc_value": "bud3le.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651284": [
        {
            "ioc_value": "stemm7.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:40:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651283": [
        {
            "ioc_value": "root4y.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:37:47",
            "last_seen_utc": "2025-11-26 21:39:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651281": [
        {
            "ioc_value": "spr1g.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:28:57",
            "last_seen_utc": "2025-11-26 21:31:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651280": [
        {
            "ioc_value": "batch6.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:25:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651279": [
        {
            "ioc_value": "krimp8.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651278": [
        {
            "ioc_value": "seo-hit.cz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 21:06:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651276": [
        {
            "ioc_value": "pl1edo.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:05:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651274": [
        {
            "ioc_value": "fact-2012.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 21:03:29",
            "last_seen_utc": "2025-12-10 23:56:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651273": [
        {
            "ioc_value": "twirl5.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 21:03:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651272": [
        {
            "ioc_value": "uniquedreambuilders.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 21:01:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651270": [
        {
            "ioc_value": "d0ugh7.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 20:58:10",
            "last_seen_utc": "2025-11-26 20:59:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651269": [
        {
            "ioc_value": "pix3ly.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 20:48:22",
            "last_seen_utc": "2025-11-26 20:50:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651268": [
        {
            "ioc_value": "stelaconvites.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:39:27",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651266": [
        {
            "ioc_value": "rag8lo.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 20:37:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651265": [
        {
            "ioc_value": "cortosengrande.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:36:38",
            "last_seen_utc": "2025-12-08 19:00:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651263": [
        {
            "ioc_value": "clearfreight.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:35:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651261": [
        {
            "ioc_value": "azcaringservices.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:35:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651259": [
        {
            "ioc_value": "patch7.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 20:33:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651258": [
        {
            "ioc_value": "masato-tech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:33:26",
            "last_seen_utc": "2025-12-09 13:35:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651255": [
        {
            "ioc_value": "smile-life-yits.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:29:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651254": [
        {
            "ioc_value": "m0saik.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 20:28:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651253": [
        {
            "ioc_value": "rahul-chind.novacrm.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:25:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651251": [
        {
            "ioc_value": "tess3l.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 20:22:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651250": [
        {
            "ioc_value": "kanadenomori-report.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:21:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651248": [
        {
            "ioc_value": "clasp8.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 20:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651247": [
        {
            "ioc_value": "anadasinkyu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651245": [
        {
            "ioc_value": "aquariumacademy.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:15:49",
            "last_seen_utc": "2025-12-08 11:34:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651243": [
        {
            "ioc_value": "mang0x.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 20:11:35",
            "last_seen_utc": "2025-11-26 20:19:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651240": [
        {
            "ioc_value": "3neko3.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:08:49",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651239": [
        {
            "ioc_value": "squib7.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 20:07:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651238": [
        {
            "ioc_value": "harukanishitani.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 20:03:43",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651234": [
        {
            "ioc_value": "rockbase.testingweblink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-26 20:01:34",
            "last_seen_utc": "2025-11-26 23:01:10",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.166.156.56+rockbase.testingweblink.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651218": [
        {
            "ioc_value": "pc.whitesky.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:59:47",
            "last_seen_utc": "2025-12-13 15:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651217": [
        {
            "ioc_value": "kr1llo.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 19:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651215": [
        {
            "ioc_value": "sauna-bassein.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:57:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651212": [
        {
            "ioc_value": "gidcomp.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:56:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651210": [
        {
            "ioc_value": "23win.coach",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:54:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651208": [
        {
            "ioc_value": "guardhive.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:53:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651207": [
        {
            "ioc_value": "white-tag.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:50:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651204": [
        {
            "ioc_value": "sakurab21.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:48:56",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651203": [
        {
            "ioc_value": "reef5y.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 19:47:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651201": [
        {
            "ioc_value": "offerchi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:47:05",
            "last_seen_utc": "2025-11-26 19:47:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651199": [
        {
            "ioc_value": "zain.novacrm.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:45:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651198": [
        {
            "ioc_value": "sr-bb-recruit.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:41:46",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651196": [
        {
            "ioc_value": "tide9r.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 19:40:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651194": [
        {
            "ioc_value": "bybtacademy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:39:30",
            "last_seen_utc": "2025-11-26 19:39:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651192": [
        {
            "ioc_value": "proeole-ne.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:32:29",
            "last_seen_utc": "2025-12-09 13:35:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651191": [
        {
            "ioc_value": "rumba6.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 19:32:12",
            "last_seen_utc": "2025-11-26 19:36:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651189": [
        {
            "ioc_value": "music2.eq.ee",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:27:43",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651188": [
        {
            "ioc_value": "foxa3n.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 19:27:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651186": [
        {
            "ioc_value": "new.bvmparish.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:24:47",
            "last_seen_utc": "2025-12-08 19:00:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651185": [
        {
            "ioc_value": "skeld7.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 19:24:21",
            "last_seen_utc": "2025-11-26 19:24:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651183": [
        {
            "ioc_value": "doccontact.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:22:34",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651181": [
        {
            "ioc_value": "green-foods.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:21:40",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651179": [
        {
            "ioc_value": "mail.espacodocdigital.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:20:58",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651177": [
        {
            "ioc_value": "selamat123.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:20:14",
            "last_seen_utc": "2025-12-09 13:35:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651176": [
        {
            "ioc_value": "nav5is.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 19:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651175": [
        {
            "ioc_value": "handy-duple.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:18:20",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651172": [
        {
            "ioc_value": "chinmayapublicschool.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:15:48",
            "last_seen_utc": "2025-12-10 23:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651171": [
        {
            "ioc_value": "gl1nto.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 19:13:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651169": [
        {
            "ioc_value": "pasnicenko.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:10:42",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651168": [
        {
            "ioc_value": "taukr.lt",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:10:12",
            "last_seen_utc": "2025-12-02 18:30:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651166": [
        {
            "ioc_value": "vortex7.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 19:05:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651165": [
        {
            "ioc_value": "club388.world.slot918kiss.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:04:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651163": [
        {
            "ioc_value": "com.geoedge.lk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:03:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651162": [
        {
            "ioc_value": "atxsa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:02:13",
            "last_seen_utc": "2025-12-11 19:29:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651160": [
        {
            "ioc_value": "qh88.luxury",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:01:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651159": [
        {
            "ioc_value": "how2r.vibethink.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 19:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651157": [
        {
            "ioc_value": "fumet3.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 18:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651156": [
        {
            "ioc_value": "drak0n.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 18:56:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651149": [
        {
            "ioc_value": "hel9ix.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 18:42:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651148": [
        {
            "ioc_value": "sylph8.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 18:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651147": [
        {
            "ioc_value": "miro2n.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 18:26:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651146": [
        {
            "ioc_value": "qaz7er.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 18:21:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651145": [
        {
            "ioc_value": "brivox5.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 18:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651144": [
        {
            "ioc_value": "tal9en.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 18:04:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651143": [
        {
            "ioc_value": "ak1.xingxiangs4.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-26 18:03:56",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251126-pfqxjsyrew",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651136": [
        {
            "ioc_value": "kres8t.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 18:02:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651134": [
        {
            "ioc_value": "or1ona.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 17:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651133": [
        {
            "ioc_value": "pluv7x.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 17:56:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651132": [
        {
            "ioc_value": "zed9ra.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 17:52:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651131": [
        {
            "ioc_value": "m4rloq.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 17:47:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651130": [
        {
            "ioc_value": "cs2bs.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 17:41:27",
            "last_seen_utc": "2025-11-26 17:44:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651129": [
        {
            "ioc_value": "forge7.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 17:33:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651128": [
        {
            "ioc_value": "z8914.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 17:26:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651127": [
        {
            "ioc_value": "spark0.lake5p1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 17:22:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651126": [
        {
            "ioc_value": "crest.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 17:13:43",
            "last_seen_utc": "2025-11-26 17:17:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651125": [
        {
            "ioc_value": "zkaw.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 16:39:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651123": [
        {
            "ioc_value": "oxt.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 16:27:25",
            "last_seen_utc": "2025-11-26 16:46:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651122": [
        {
            "ioc_value": "mint.lynchstem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 16:24:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651059": [
        {
            "ioc_value": "jvplaces.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:23:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651074": [
        {
            "ioc_value": "acts-based-on-facts.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:23:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651076": [
        {
            "ioc_value": "eleven11industries.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:23:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651078": [
        {
            "ioc_value": "comoestases.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:23:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651080": [
        {
            "ioc_value": "gimtuganchiki.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:23:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651082": [
        {
            "ioc_value": "hanblga.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:23:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651085": [
        {
            "ioc_value": "lblnkedbln.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:23:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651086": [
        {
            "ioc_value": "meteoraag.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:22:59",
            "last_seen_utc": "2025-12-02 20:18:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651088": [
        {
            "ioc_value": "trojanonsolbot.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:22:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651091": [
        {
            "ioc_value": "everyshufflin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:22:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651093": [
        {
            "ioc_value": "kambergebai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:22:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651097": [
        {
            "ioc_value": "olatugilati.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:22:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651101": [
        {
            "ioc_value": "holidaysinrosarito.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:22:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake GitHub",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651121": [
        {
            "ioc_value": "ridge.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 16:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651120": [
        {
            "ioc_value": "717.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 16:17:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651119": [
        {
            "ioc_value": "pulse.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 16:14:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651118": [
        {
            "ioc_value": "h79.kneadloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 16:09:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651117": [
        {
            "ioc_value": "echo.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 16:04:08",
            "last_seen_utc": "2025-11-26 16:06:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651116": [
        {
            "ioc_value": "ajax.rs-dns.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 16:02:30",
            "last_seen_utc": "2025-12-01 23:00:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.90.144.124+ajax.rs-dns.sbs",
            "tags": "AS24940,censys,EvilGinx,HETZNER-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1651107": [
        {
            "ioc_value": "gdfm0.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:59:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651106": [
        {
            "ioc_value": "echo3.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:56:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651105": [
        {
            "ioc_value": "cqgj.ragmosaic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:51:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651104": [
        {
            "ioc_value": "n61i1.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:48:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651103": [
        {
            "ioc_value": "9kp.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651102": [
        {
            "ioc_value": "port2.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:37:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651099": [
        {
            "ioc_value": "bkzu.spongeclaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:32:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651090": [
        {
            "ioc_value": "u7423.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:27:22",
            "last_seen_utc": "2025-11-26 15:29:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651077": [
        {
            "ioc_value": "kv5k7.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:22:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651071": [
        {
            "ioc_value": "spicsxz-52017.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-26 15:17:34",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651062": [
        {
            "ioc_value": "cawawaeadaswadeaef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651063": [
        {
            "ioc_value": "nkskhifhiwgahoehih.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651064": [
        {
            "ioc_value": "opunamurwueodhsheu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651065": [
        {
            "ioc_value": "ouagwfuoegfugfgedr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651066": [
        {
            "ioc_value": "plapegugufuszemnza.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651067": [
        {
            "ioc_value": "trikhaus.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651068": [
        {
            "ioc_value": "wdfoaeuoaefhoahifd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651069": [
        {
            "ioc_value": "wdokwuroouaklzwudo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651070": [
        {
            "ioc_value": "wurzuqeozoueztuzqe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651060": [
        {
            "ioc_value": "abdzwuazduroowdufa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651061": [
        {
            "ioc_value": "aefhpiaepgfiaeirod.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-26 15:17:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651046": [
        {
            "ioc_value": "gp.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:16:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651039": [
        {
            "ioc_value": "v2.www.agil8.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:18",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651040": [
        {
            "ioc_value": "v2.www.authorandrewsmith.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:18",
            "last_seen_utc": "2025-12-12 18:38:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651041": [
        {
            "ioc_value": "v3.socolive16.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:18",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651042": [
        {
            "ioc_value": "v3.socolive17.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:18",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651043": [
        {
            "ioc_value": "v3.urbanedleadership.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:18",
            "last_seen_utc": "2025-12-12 18:38:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651044": [
        {
            "ioc_value": "v3.www.agil8.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:18",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651045": [
        {
            "ioc_value": "v3.www.authorandrewsmith.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:18",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651036": [
        {
            "ioc_value": "v2.socolive16.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:17",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651037": [
        {
            "ioc_value": "v2.socolive17.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:17",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651038": [
        {
            "ioc_value": "v2.urbanedleadership.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-26 15:16:17",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651034": [
        {
            "ioc_value": "c2.enanana.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-26 15:15:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651027": [
        {
            "ioc_value": "gatex.socolive10.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-26 15:14:56",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651028": [
        {
            "ioc_value": "gatex.socolive12.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-26 15:14:56",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651029": [
        {
            "ioc_value": "gatex.socolive17.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-26 15:14:56",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651030": [
        {
            "ioc_value": "gatex.www.agil8.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-26 15:14:56",
            "last_seen_utc": "2025-12-12 18:38:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651031": [
        {
            "ioc_value": "www.2026worldcupnorthamerica.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-26 15:14:56",
            "last_seen_utc": "2025-12-12 18:39:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1651023": [
        {
            "ioc_value": "claw.p0rthopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:11:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651022": [
        {
            "ioc_value": "flare.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:08:31",
            "last_seen_utc": "2025-11-26 15:10:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651021": [
        {
            "ioc_value": "forge.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 15:04:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651020": [
        {
            "ioc_value": "softkomsolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 15:00:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651017": [
        {
            "ioc_value": "bergtrampoline.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 14:57:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651014": [
        {
            "ioc_value": "hoppaspringkastelen.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 14:55:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651015": [
        {
            "ioc_value": "drift.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:54:22",
            "last_seen_utc": "2025-11-26 14:59:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651009": [
        {
            "ioc_value": "voltscrypt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 14:52:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651010": [
        {
            "ioc_value": "jasonward.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 14:52:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651012": [
        {
            "ioc_value": "priceconsultinggrp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 14:52:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651007": [
        {
            "ioc_value": "yq.spiintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:46:07",
            "last_seen_utc": "2025-11-26 14:51:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1651006": [
        {
            "ioc_value": "1u.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:40:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650995": [
        {
            "ioc_value": "boriver.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-26 14:39:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650999": [
        {
            "ioc_value": "stromaejs.world",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-26 14:39:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651003": [
        {
            "ioc_value": "stoneandjon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-26 14:39:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1651002": [
        {
            "ioc_value": "port.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:38:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650997": [
        {
            "ioc_value": "o78qu.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:34:00",
            "last_seen_utc": "2025-11-26 14:35:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650994": [
        {
            "ioc_value": "6ajg.v0ltmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:30:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650993": [
        {
            "ioc_value": "9mz.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:27:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650992": [
        {
            "ioc_value": "stem.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:23:56",
            "last_seen_utc": "2025-11-26 14:24:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650990": [
        {
            "ioc_value": "8xouz.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:17:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650988": [
        {
            "ioc_value": "yorkci.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-26 14:16:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650987": [
        {
            "ioc_value": "itd.driftquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:10:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650986": [
        {
            "ioc_value": "dodan.mistv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:06:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650985": [
        {
            "ioc_value": "qu.mistv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 14:02:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650984": [
        {
            "ioc_value": "5cf.mistv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:57:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650982": [
        {
            "ioc_value": "ridge9.mistv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:52:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650981": [
        {
            "ioc_value": "stone.frostwalk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:49:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650980": [
        {
            "ioc_value": "9p6.frostwalk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:46:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650978": [
        {
            "ioc_value": "stone0.frostwalk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:42:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650977": [
        {
            "ioc_value": "anotherroadtutoring.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:42:05",
            "last_seen_utc": "2025-12-07 20:34:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650975": [
        {
            "ioc_value": "alltech-egypt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:39:18",
            "last_seen_utc": "2025-11-26 13:41:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650974": [
        {
            "ioc_value": "odpt.frostwalk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:38:34",
            "last_seen_utc": "2025-11-26 13:42:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650972": [
        {
            "ioc_value": "proveoriente.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:37:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650970": [
        {
            "ioc_value": "ajedrezchiletorneos.cl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:35:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650968": [
        {
            "ioc_value": "ironsolution.by",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:34:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650966": [
        {
            "ioc_value": "bhagabankarinstitute.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:33:40",
            "last_seen_utc": "2025-11-26 19:52:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650965": [
        {
            "ioc_value": "pulse6.r1verbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:32:20",
            "last_seen_utc": "2025-11-26 13:33:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650963": [
        {
            "ioc_value": "pucambu.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:31:57",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650962": [
        {
            "ioc_value": "crudohouse.art",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:30:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650960": [
        {
            "ioc_value": "traders-journey.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:30:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650957": [
        {
            "ioc_value": "kachionna.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:28:41",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650955": [
        {
            "ioc_value": "zestsolutions.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650954": [
        {
            "ioc_value": "craft.r1verbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:27:02",
            "last_seen_utc": "2025-11-26 13:28:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650952": [
        {
            "ioc_value": "certificadodigital.tech",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650950": [
        {
            "ioc_value": "mail.getshelters.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:25:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650948": [
        {
            "ioc_value": "npo-aura.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:24:09",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650947": [
        {
            "ioc_value": "nova.r1verbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:23:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650945": [
        {
            "ioc_value": "webek.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:22:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650943": [
        {
            "ioc_value": "platinumpainters.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:21:07",
            "last_seen_utc": "2025-12-09 13:35:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650942": [
        {
            "ioc_value": "shreeshyammotors.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650938": [
        {
            "ioc_value": "pourtapomme.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:18:24",
            "last_seen_utc": "2025-11-26 19:33:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650936": [
        {
            "ioc_value": "jamstaphotography.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650935": [
        {
            "ioc_value": "piumondo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:17:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650934": [
        {
            "ioc_value": "echo9.r1verbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:17:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650931": [
        {
            "ioc_value": "zubora-shufudiet.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:16:04",
            "last_seen_utc": "2025-12-09 13:35:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650929": [
        {
            "ioc_value": "healinglovehomestay.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:14:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650927": [
        {
            "ioc_value": "perspectives-book.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650925": [
        {
            "ioc_value": "new.amadehlaziz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:11:05",
            "last_seen_utc": "2025-12-11 19:29:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650923": [
        {
            "ioc_value": "sysdein.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:09:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650922": [
        {
            "ioc_value": "warteeth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:08:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650919": [
        {
            "ioc_value": "protectormexico.com.mx",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:07:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650917": [
        {
            "ioc_value": "sky.wildm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:07:00",
            "last_seen_utc": "2025-11-26 13:09:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650916": [
        {
            "ioc_value": "futbol-11.es",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:06:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650914": [
        {
            "ioc_value": "oknaprof.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:06:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650912": [
        {
            "ioc_value": "godvibes.us",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:03:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650911": [
        {
            "ioc_value": "walk.wildm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:02:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650899": [
        {
            "ioc_value": "food.probill.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:02:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650898": [
        {
            "ioc_value": "holzbau-weiner.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:02:06",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650901": [
        {
            "ioc_value": "tokushimakoken.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:02:05",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650903": [
        {
            "ioc_value": "couvreur-clamart-toiture.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:02:04",
            "last_seen_utc": "2025-12-13 15:28:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650907": [
        {
            "ioc_value": "888casinoreview.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:02:02",
            "last_seen_utc": "2025-12-10 23:56:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650909": [
        {
            "ioc_value": "clever-llc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 13:02:01",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650904": [
        {
            "ioc_value": "1wt.wildm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 13:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650895": [
        {
            "ioc_value": "cymage-media.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 12:55:42",
            "last_seen_utc": "2025-12-10 23:56:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650896": [
        {
            "ioc_value": "shift.wildm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:54:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650892": [
        {
            "ioc_value": "modernnutraguide.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 12:53:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650891": [
        {
            "ioc_value": "playbook.aes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-26 12:51:08",
            "last_seen_utc": "2025-12-14 11:48:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1650890": [
        {
            "ioc_value": "ns1.btgpactual.app.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-26 12:51:00",
            "last_seen_utc": "2025-12-14 11:48:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1650889": [
        {
            "ioc_value": "job.itechno.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-26 12:50:54",
            "last_seen_utc": "2025-12-14 11:48:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1650888": [
        {
            "ioc_value": "ss.lakesp1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:50:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650887": [
        {
            "ioc_value": "7lq.lakesp1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:45:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650886": [
        {
            "ioc_value": "ridge.lakesp1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:41:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650885": [
        {
            "ioc_value": "crest.lakesp1rit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:34:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650854": [
        {
            "ioc_value": "rtku.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-11-26 12:32:14",
            "last_seen_utc": null,
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1650855": [
        {
            "ioc_value": "title-car.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 12:32:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650857": [
        {
            "ioc_value": "linkmore.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 12:32:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650877": [
        {
            "ioc_value": "btexee3dc53f6dc453f6a9f461a5hfamd.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 12:32:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650881": [
        {
            "ioc_value": "steamcommunity-account.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 12:32:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650884": [
        {
            "ioc_value": "53f.clearspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:25:42",
            "last_seen_utc": "2025-11-26 12:34:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650883": [
        {
            "ioc_value": "frost5.clearspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:22:31",
            "last_seen_utc": "2025-11-26 12:24:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650882": [
        {
            "ioc_value": "spark.clearspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650879": [
        {
            "ioc_value": "bcqz.clearspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:13:39",
            "last_seen_utc": "2025-11-26 12:18:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650875": [
        {
            "ioc_value": "ocean.oceanshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:10:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650874": [
        {
            "ioc_value": "mist8.oceanshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:05:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650867": [
        {
            "ioc_value": "channel-belly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-26 12:01:33",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251126-hky1dsyrdj",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650866": [
        {
            "ioc_value": "express-through.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-26 12:01:32",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251126-jbx76swkcw",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650862": [
        {
            "ioc_value": "frost2.oceanshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 12:01:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650861": [
        {
            "ioc_value": "gassssssssssssssssssssssssss.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-26 12:00:59",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251126-mecbnaxqbt",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650856": [
        {
            "ioc_value": "8q7.oceanshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650853": [
        {
            "ioc_value": "life1.l1festone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:50:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650849": [
        {
            "ioc_value": "wild3.l1festone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:45:57",
            "last_seen_utc": "2025-11-26 11:47:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650847": [
        {
            "ioc_value": "pulse9.l1festone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650846": [
        {
            "ioc_value": "nova1.l1festone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:39:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650841": [
        {
            "ioc_value": "account-extranetcheck.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 11:34:18",
            "last_seen_utc": "2025-11-26 11:29:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650844": [
        {
            "ioc_value": "kjarz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 11:34:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650845": [
        {
            "ioc_value": "9375.skym0tion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:32:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650837": [
        {
            "ioc_value": "account-extranetcheck.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 11:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650840": [
        {
            "ioc_value": "lospls.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 11:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650836": [
        {
            "ioc_value": "ta.skym0tion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:23:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650833": [
        {
            "ioc_value": "verification-220-check-441-8890.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 11:22:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650835": [
        {
            "ioc_value": "trail.skym0tion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650831": [
        {
            "ioc_value": "jui.itermed.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-26 11:15:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1650832": [
        {
            "ioc_value": "jui.theoptimizedbody.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-26 11:15:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1650828": [
        {
            "ioc_value": "at.skym0tion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:14:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650827": [
        {
            "ioc_value": "m0q8.mintcraft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:09:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650826": [
        {
            "ioc_value": "6ymh.mintcraft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:05:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650813": [
        {
            "ioc_value": "validate-348-captcha-220-8237.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 11:04:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650807": [
        {
            "ioc_value": "ap.mintcraft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 11:00:34",
            "last_seen_utc": "2025-11-26 11:01:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650803": [
        {
            "ioc_value": "2p0.mintcraft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650802": [
        {
            "ioc_value": "spur8.emberhoehle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:53:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650800": [
        {
            "ioc_value": "8rt2.emberhoehle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:47:22",
            "last_seen_utc": "2025-11-26 10:52:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650799": [
        {
            "ioc_value": "xjqi.emberhoehle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:41:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650798": [
        {
            "ioc_value": "70ywi.emberhoehle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:37:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650797": [
        {
            "ioc_value": "eqwxe.heatherkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:32:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650796": [
        {
            "ioc_value": "wolken9.heatherkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:27:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650795": [
        {
            "ioc_value": "forest.heatherkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650794": [
        {
            "ioc_value": "wtg2.heatherkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:16:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650793": [
        {
            "ioc_value": "zuqfv.wolkenspur3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:12:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650792": [
        {
            "ioc_value": "h6f.wolkenspur3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650790": [
        {
            "ioc_value": "9vo.wolkenspur3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:03:51",
            "last_seen_utc": "2025-11-26 10:08:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650789": [
        {
            "ioc_value": "wi.wolkenspur3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 10:00:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650788": [
        {
            "ioc_value": "cedar9.quartzweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:54:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650787": [
        {
            "ioc_value": "spur.quartzweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:49:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650786": [
        {
            "ioc_value": "z4d.quartzweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:40:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650785": [
        {
            "ioc_value": "dz.quartzweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:33:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650784": [
        {
            "ioc_value": "silver2.prariehafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:29:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650783": [
        {
            "ioc_value": "wolken.prariehafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:26:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650782": [
        {
            "ioc_value": "ufer9.prariehafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:23:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650781": [
        {
            "ioc_value": "csju5.prariehafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650780": [
        {
            "ioc_value": "glacial1.glacialufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:14:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650779": [
        {
            "ioc_value": "grotto4.glacialufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:10:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650778": [
        {
            "ioc_value": "21n.glacialufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:05:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650777": [
        {
            "ioc_value": "fs.glacialufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 09:00:19",
            "last_seen_utc": "2025-11-26 09:04:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650776": [
        {
            "ioc_value": "8qs.ravenklause.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650775": [
        {
            "ioc_value": "psm1e.ravenklause.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:48:00",
            "last_seen_utc": "2025-11-26 08:50:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650773": [
        {
            "ioc_value": "jqk.ravenklause.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:43:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650772": [
        {
            "ioc_value": "rzie8.ravenklause.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:35:54",
            "last_seen_utc": "2025-11-26 08:39:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650771": [
        {
            "ioc_value": "glacial.cedarwinkel5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:30:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650763": [
        {
            "ioc_value": "grotto8.cedarwinkel5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:23:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650753": [
        {
            "ioc_value": "trp.theoptimizedbody.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-26 08:22:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1650754": [
        {
            "ioc_value": "her.theoptimizedbody.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-26 08:22:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1650755": [
        {
            "ioc_value": "trp.itermed.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-26 08:22:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1650741": [
        {
            "ioc_value": "3w4nn.cedarwinkel5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:19:53",
            "last_seen_utc": "2025-11-26 08:21:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650740": [
        {
            "ioc_value": "td.cedarwinkel5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:14:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650738": [
        {
            "ioc_value": "spark2.silverklamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:09:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650737": [
        {
            "ioc_value": "lft5.silverklamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:05:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650732": [
        {
            "ioc_value": "heather9.silverklamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 08:02:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650714": [
        {
            "ioc_value": "hn.silverklamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650713": [
        {
            "ioc_value": "harbor.mossgrotte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:56:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650712": [
        {
            "ioc_value": "quartz.mossgrotte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:53:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650711": [
        {
            "ioc_value": "mist.mossgrotte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:50:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650710": [
        {
            "ioc_value": "ocdfg.mossgrotte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:47:27",
            "last_seen_utc": "2025-11-26 07:50:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650708": [
        {
            "ioc_value": "pfad.quartzweide4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:42:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650707": [
        {
            "ioc_value": "klee.quartzweide4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:37:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650706": [
        {
            "ioc_value": "glanz.quartzweide4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:33:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650705": [
        {
            "ioc_value": "ast.7willowkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:28:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650704": [
        {
            "ioc_value": "laub.7willowkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650703": [
        {
            "ioc_value": "ring.7willowkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650702": [
        {
            "ioc_value": "weide.7willowkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:14:02",
            "last_seen_utc": "2025-11-26 07:19:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650701": [
        {
            "ioc_value": "sumpf.heatherquell.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:09:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650700": [
        {
            "ioc_value": "farn.heatherquell.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:05:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650699": [
        {
            "ioc_value": "bach.heatherquell.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 07:01:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650698": [
        {
            "ioc_value": "nest.ravenbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:58:03",
            "last_seen_utc": "2025-11-26 07:01:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650350": [
        {
            "ioc_value": "alpeoqa.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-26 06:56:11",
            "last_seen_utc": "2025-11-25 19:49:03",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1650351": [
        {
            "ioc_value": "binauxa.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-26 06:56:11",
            "last_seen_utc": "2025-12-06 17:34:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1650352": [
        {
            "ioc_value": "convuey.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-26 06:56:11",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1650353": [
        {
            "ioc_value": "impzowr.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-26 06:56:10",
            "last_seen_utc": "2025-12-06 17:34:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1650354": [
        {
            "ioc_value": "manpfqa.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-26 06:56:10",
            "last_seen_utc": "2025-12-06 17:34:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1650355": [
        {
            "ioc_value": "smipmue.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-26 06:56:09",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1650356": [
        {
            "ioc_value": "twobkgg.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-26 06:56:09",
            "last_seen_utc": "2025-12-06 17:34:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1650357": [
        {
            "ioc_value": "unotinf.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-26 06:56:09",
            "last_seen_utc": "2025-12-06 17:34:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1650360": [
        {
            "ioc_value": "kb-f.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 06:56:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650364": [
        {
            "ioc_value": "cashforclutter.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 06:56:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650365": [
        {
            "ioc_value": "tffoodindustries.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-26 06:56:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650397": [
        {
            "ioc_value": "deploy.webpaydaz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-26 06:56:06",
            "last_seen_utc": "2025-12-07 10:23:12",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115612150324224384",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1650438": [
        {
            "ioc_value": "evoshield-db-proxy-52388.orbyt.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-26 06:55:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1650697": [
        {
            "ioc_value": "hafen.ravenbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:51:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650696": [
        {
            "ioc_value": "klippe.ravenbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:45:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650695": [
        {
            "ioc_value": "adler.ravenbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:40:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650694": [
        {
            "ioc_value": "block.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:34:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650693": [
        {
            "ioc_value": "steig.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:31:21",
            "last_seen_utc": "2025-11-26 06:33:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650692": [
        {
            "ioc_value": "ridge.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:28:44",
            "last_seen_utc": "2025-11-26 06:31:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650691": [
        {
            "ioc_value": "schlucht.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:23:31",
            "last_seen_utc": "2025-11-26 06:25:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650690": [
        {
            "ioc_value": "hammer.granitepfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650689": [
        {
            "ioc_value": "firn.frostwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650688": [
        {
            "ioc_value": "rime.frostwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:10:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650687": [
        {
            "ioc_value": "eis.frostwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:06:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650686": [
        {
            "ioc_value": "shawwerma.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-26 06:01:02",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251126-fa4rsatlfx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650685": [
        {
            "ioc_value": "korn.wolkenkueste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 06:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650684": [
        {
            "ioc_value": "dune.wolkenkueste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650683": [
        {
            "ioc_value": "ufer.wolkenkueste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:52:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650682": [
        {
            "ioc_value": "brandung.wolkenkueste.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:50:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650681": [
        {
            "ioc_value": "hang.glimmerufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:44:58",
            "last_seen_utc": "2025-11-26 05:49:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650680": [
        {
            "ioc_value": "weide.glimmerufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:40:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650679": [
        {
            "ioc_value": "stern.glimmerufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:35:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650678": [
        {
            "ioc_value": "birch.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:31:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650677": [
        {
            "ioc_value": "rune.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:28:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650675": [
        {
            "ioc_value": "moos.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:24:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650674": [
        {
            "ioc_value": "tal.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:22:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650673": [
        {
            "ioc_value": "fjord.cedarhollw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:11:47",
            "last_seen_utc": "2025-11-26 05:16:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650672": [
        {
            "ioc_value": "tau.silberhain9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 05:07:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650671": [
        {
            "ioc_value": "licht.silberhain9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 04:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650670": [
        {
            "ioc_value": "wolke.silberhain9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 04:53:37",
            "last_seen_utc": "2025-11-26 04:54:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650669": [
        {
            "ioc_value": "nord.amberkliff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 04:47:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650668": [
        {
            "ioc_value": "cedro.amberkliff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 04:37:27",
            "last_seen_utc": "2025-11-26 04:39:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650667": [
        {
            "ioc_value": "storm.amberkliff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 04:25:12",
            "last_seen_utc": "2025-11-26 04:28:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650666": [
        {
            "ioc_value": "brisa.amberkliff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 04:14:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650665": [
        {
            "ioc_value": "nival3.snowdr1ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 04:08:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650643": [
        {
            "ioc_value": "firn2.snowdr1ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 03:52:38",
            "last_seen_utc": "2025-11-26 04:01:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650642": [
        {
            "ioc_value": "frost9.snowdr1ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 03:47:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650641": [
        {
            "ioc_value": "phase7.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 03:38:33",
            "last_seen_utc": "2025-11-26 03:45:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650640": [
        {
            "ioc_value": "orbit0.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 03:34:23",
            "last_seen_utc": "2025-11-26 03:36:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650639": [
        {
            "ioc_value": "noct4.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 03:27:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650638": [
        {
            "ioc_value": "selene8.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 03:18:25",
            "last_seen_utc": "2025-11-26 03:21:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650637": [
        {
            "ioc_value": "luna1.clearm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 03:15:16",
            "last_seen_utc": "2025-11-26 03:17:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650636": [
        {
            "ioc_value": "spina3.mintsp1ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 03:03:20",
            "last_seen_utc": "2025-11-26 03:11:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650634": [
        {
            "ioc_value": "cedro4.mintsp1ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 03:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650633": [
        {
            "ioc_value": "punta6.mintsp1ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 02:54:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650632": [
        {
            "ioc_value": "menta2.mintsp1ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 02:45:16",
            "last_seen_utc": "2025-11-26 02:46:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650631": [
        {
            "ioc_value": "prair1e.wildb1ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 02:41:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650630": [
        {
            "ioc_value": "lupus7.wildb1ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 02:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650629": [
        {
            "ioc_value": "feral4.wildb1ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 02:28:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650460": [
        {
            "ioc_value": "basil9.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 02:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650459": [
        {
            "ioc_value": "fresh1.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 02:11:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650458": [
        {
            "ioc_value": "verde7.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 02:07:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650457": [
        {
            "ioc_value": "brisa2.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 01:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650456": [
        {
            "ioc_value": "herb5.br1ghtmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 01:48:10",
            "last_seen_utc": "2025-11-26 01:51:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650455": [
        {
            "ioc_value": "raven3.shad0wdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 01:45:27",
            "last_seen_utc": "2025-11-26 01:47:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650454": [
        {
            "ioc_value": "umbra6.shad0wdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 01:38:15",
            "last_seen_utc": "2025-11-26 01:38:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650453": [
        {
            "ioc_value": "drip1.shad0wdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 01:28:19",
            "last_seen_utc": "2025-11-26 01:32:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650452": [
        {
            "ioc_value": "shade8.shad0wdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 01:11:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650451": [
        {
            "ioc_value": "astra7.starf0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 01:03:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650450": [
        {
            "ioc_value": "nova1.starf0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 01:01:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650449": [
        {
            "ioc_value": "orbit5.starf0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 00:53:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650448": [
        {
            "ioc_value": "aur3.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 00:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650447": [
        {
            "ioc_value": "nimbus6.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 00:37:45",
            "last_seen_utc": "2025-11-26 00:38:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650446": [
        {
            "ioc_value": "spark9.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 00:25:35",
            "last_seen_utc": "2025-11-26 00:29:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650445": [
        {
            "ioc_value": "zeph1r.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 00:17:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650444": [
        {
            "ioc_value": "glow2.l1ghtstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 00:04:18",
            "last_seen_utc": "2025-11-26 00:12:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650441": [
        {
            "ioc_value": "rune5.st0nebird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-26 00:00:20",
            "last_seen_utc": "2025-11-26 00:00:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650440": [
        {
            "ioc_value": "cliff7.st0nebird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 23:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650439": [
        {
            "ioc_value": "avian2.st0nebird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 23:42:03",
            "last_seen_utc": "2025-11-25 23:55:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650436": [
        {
            "ioc_value": "rock3.st0nebird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 23:36:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650427": [
        {
            "ioc_value": "noir4.darksun5et.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 22:23:45",
            "last_seen_utc": "2025-11-25 22:36:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650426": [
        {
            "ioc_value": "dusk1.darksun5et.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 22:17:02",
            "last_seen_utc": "2025-11-25 22:22:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650424": [
        {
            "ioc_value": "umbra8.darksun5et.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 22:05:44",
            "last_seen_utc": "2025-11-25 22:10:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650423": [
        {
            "ioc_value": "astra3.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 21:54:50",
            "last_seen_utc": "2025-11-25 22:03:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650422": [
        {
            "ioc_value": "flare9.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 21:50:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650420": [
        {
            "ioc_value": "nebu7la.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 21:42:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650419": [
        {
            "ioc_value": "sol1.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 21:37:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650418": [
        {
            "ioc_value": "vento5.skyf1ame.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 21:34:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650417": [
        {
            "ioc_value": "wood.sun0rbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 21:27:19",
            "last_seen_utc": "2025-11-25 21:29:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650416": [
        {
            "ioc_value": "sun2.sun0rbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 21:16:24",
            "last_seen_utc": "2025-11-25 21:22:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650414": [
        {
            "ioc_value": "ue.sun0rbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 21:10:11",
            "last_seen_utc": "2025-11-25 21:12:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650413": [
        {
            "ioc_value": "kji.sun0rbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 21:05:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650411": [
        {
            "ioc_value": "stone.m1stbird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:57:13",
            "last_seen_utc": "2025-11-25 21:01:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650410": [
        {
            "ioc_value": "wild.m1stbird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:51:00",
            "last_seen_utc": "2025-11-25 20:53:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650409": [
        {
            "ioc_value": "bmr74.m1stbird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:45:48",
            "last_seen_utc": "2025-11-25 20:50:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650408": [
        {
            "ioc_value": "rj8h.m1stbird.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:41:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650407": [
        {
            "ioc_value": "wood4.cloud5eed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:37:01",
            "last_seen_utc": "2025-11-25 20:43:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650406": [
        {
            "ioc_value": "h8jc.cloud5eed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:29:46",
            "last_seen_utc": "2025-11-25 20:34:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650405": [
        {
            "ioc_value": "46.cloud5eed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:23:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650404": [
        {
            "ioc_value": "8y.cloud5eed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650399": [
        {
            "ioc_value": "pulse1.wild0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:13:27",
            "last_seen_utc": "2025-11-25 20:17:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650398": [
        {
            "ioc_value": "vale8.wild0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:10:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650390": [
        {
            "ioc_value": "spark.wild0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 20:06:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650372": [
        {
            "ioc_value": "seed.wild0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:59:17",
            "last_seen_utc": "2025-11-25 20:03:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650371": [
        {
            "ioc_value": "d458f.miststone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:52:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650370": [
        {
            "ioc_value": "zyy93.miststone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:48:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650369": [
        {
            "ioc_value": "lake8.miststone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:46:05",
            "last_seen_utc": "2025-11-25 19:46:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650368": [
        {
            "ioc_value": "hrhzf.miststone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:42:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650367": [
        {
            "ioc_value": "silver.br1ghtwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:37:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650362": [
        {
            "ioc_value": "orbit.br1ghtwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:27:49",
            "last_seen_utc": "2025-11-25 19:28:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650359": [
        {
            "ioc_value": "spark1.br1ghtwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:21:05",
            "last_seen_utc": "2025-11-25 19:25:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650358": [
        {
            "ioc_value": "oak2.br1ghtwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:12:50",
            "last_seen_utc": "2025-11-25 19:13:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650349": [
        {
            "ioc_value": "yt.silverpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:07:38",
            "last_seen_utc": "2025-11-25 19:09:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650348": [
        {
            "ioc_value": "pulse.silverpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 19:00:52",
            "last_seen_utc": "2025-11-25 19:06:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650347": [
        {
            "ioc_value": "fa.silverpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:56:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650346": [
        {
            "ioc_value": "sun.silverpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:52:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650341": [
        {
            "ioc_value": "4z.st0rmleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:44:24",
            "last_seen_utc": "2025-11-25 18:52:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650338": [
        {
            "ioc_value": "coctrecongtrinh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:41:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650336": [
        {
            "ioc_value": "blog.cementah.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:40:54",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650335": [
        {
            "ioc_value": "lawwizafrica.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:40:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650333": [
        {
            "ioc_value": "storm.st0rmleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:39:38",
            "last_seen_utc": "2025-11-25 18:42:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650332": [
        {
            "ioc_value": "autonom.com.pl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:39:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650330": [
        {
            "ioc_value": "celebrityinfograph.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:38:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650327": [
        {
            "ioc_value": "wealthruproperty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:37:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650325": [
        {
            "ioc_value": "uscentacademy.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:36:45",
            "last_seen_utc": "2025-12-11 19:29:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650324": [
        {
            "ioc_value": "takublog2020.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:36:17",
            "last_seen_utc": "2025-12-08 19:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650322": [
        {
            "ioc_value": "lj.st0rmleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:31:23",
            "last_seen_utc": "2025-11-25 18:34:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650320": [
        {
            "ioc_value": "sophiaev.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:30:11",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650319": [
        {
            "ioc_value": "flightplanoriginal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:28:55",
            "last_seen_utc": "2025-12-09 13:35:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650317": [
        {
            "ioc_value": "frozensexgames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:28:10",
            "last_seen_utc": "2025-12-07 20:34:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650315": [
        {
            "ioc_value": "ldm.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:27:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650313": [
        {
            "ioc_value": "mist.st0rmleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:26:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650312": [
        {
            "ioc_value": "profissionaisdevendas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650310": [
        {
            "ioc_value": "injuryarbitration.drdatasaver.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:23:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650308": [
        {
            "ioc_value": "euromoc.co.mz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:22:10",
            "last_seen_utc": "2025-12-11 19:29:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650305": [
        {
            "ioc_value": "utama777.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:20:00",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650304": [
        {
            "ioc_value": "8w.frostlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:19:24",
            "last_seen_utc": "2025-11-25 18:22:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650303": [
        {
            "ioc_value": "i987.frostlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:17:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650301": [
        {
            "ioc_value": "matrimoniosconproposito.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:14:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650300": [
        {
            "ioc_value": "optics.oxyappscr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:14:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650298": [
        {
            "ioc_value": "path.frostlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:13:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650296": [
        {
            "ioc_value": "marinabrizzibraus.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:13:00",
            "last_seen_utc": "2025-12-08 19:00:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650295": [
        {
            "ioc_value": "indianafoodpantry.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:11:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650292": [
        {
            "ioc_value": "drohobycz-boryslaw.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:10:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650291": [
        {
            "ioc_value": "candourtankers.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:09:35",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650289": [
        {
            "ioc_value": "rg.frostlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 18:08:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650288": [
        {
            "ioc_value": "dynamicedge-llc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:07:31",
            "last_seen_utc": "2025-12-07 20:34:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650285": [
        {
            "ioc_value": "saikicleaning.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:06:08",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650283": [
        {
            "ioc_value": "palaghiacciocatania.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:05:08",
            "last_seen_utc": "2025-12-08 19:00:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650281": [
        {
            "ioc_value": "moneypond.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:03:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650280": [
        {
            "ioc_value": "softx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-25 18:01:53",
            "last_seen_utc": "2025-12-12 18:38:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251125-plxmaawmgk",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650279": [
        {
            "ioc_value": "brut.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-25 18:01:01",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251125-qxeraaskd1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650272": [
        {
            "ioc_value": "diabezill.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:00:58",
            "last_seen_utc": "2025-12-08 19:00:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650274": [
        {
            "ioc_value": "grrrowth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:00:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650275": [
        {
            "ioc_value": "hoigiong.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 18:00:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650270": [
        {
            "ioc_value": "bestincestsexgames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:55:41",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650268": [
        {
            "ioc_value": "peak.stormbiend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:54:46",
            "last_seen_utc": "2025-11-25 18:01:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650267": [
        {
            "ioc_value": "nardoweb.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:53:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650264": [
        {
            "ioc_value": "enor.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:51:58",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650262": [
        {
            "ioc_value": "trendsgh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:51:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650261": [
        {
            "ioc_value": "forest.stormbiend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:49:05",
            "last_seen_utc": "2025-11-25 17:50:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650259": [
        {
            "ioc_value": "powerforward.llc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:48:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650258": [
        {
            "ioc_value": "wordpress-theme-collection.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:47:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650255": [
        {
            "ioc_value": "naglisgym.lt",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:46:35",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650253": [
        {
            "ioc_value": "bekaskantor.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:45:16",
            "last_seen_utc": "2025-12-13 15:28:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650252": [
        {
            "ioc_value": "soft.stormbiend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:44:54",
            "last_seen_utc": "2025-11-25 17:48:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650250": [
        {
            "ioc_value": "einfach-sup.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:44:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650248": [
        {
            "ioc_value": "freqbitsolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:42:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650246": [
        {
            "ioc_value": "dise-global.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:42:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650243": [
        {
            "ioc_value": "cliff.stormbiend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:41:44",
            "last_seen_utc": "2025-11-25 17:42:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650241": [
        {
            "ioc_value": "tea-garden.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:41:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650238": [
        {
            "ioc_value": "jyoushin-solar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:40:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650233": [
        {
            "ioc_value": "manshinseyaku.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:39:01",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650232": [
        {
            "ioc_value": "ldx.fireciiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:38:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650230": [
        {
            "ioc_value": "syedamahnoorjaffery.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:38:18",
            "last_seen_utc": "2025-12-07 20:34:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650228": [
        {
            "ioc_value": "upperdecklakes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:36:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650226": [
        {
            "ioc_value": "hijabbandung.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:35:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650225": [
        {
            "ioc_value": "lx88w.fireciiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:34:55",
            "last_seen_utc": "2025-11-25 17:38:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650223": [
        {
            "ioc_value": "zamek.ilza.pl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:33:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650221": [
        {
            "ioc_value": "encoderunlimited.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:33:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650219": [
        {
            "ioc_value": "shiga-hagukumikai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:32:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650218": [
        {
            "ioc_value": "fkk.fireciiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:31:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650216": [
        {
            "ioc_value": "rajstonex.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:31:21",
            "last_seen_utc": "2025-11-27 17:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650215": [
        {
            "ioc_value": "bx.digitech.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:30:28",
            "last_seen_utc": "2025-12-10 23:56:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650213": [
        {
            "ioc_value": "trd.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650211": [
        {
            "ioc_value": "builder.cannazipbags.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:28:13",
            "last_seen_utc": "2025-12-09 13:35:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650210": [
        {
            "ioc_value": "bridge.fireciiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:27:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650209": [
        {
            "ioc_value": "saaratechnepal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:27:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650206": [
        {
            "ioc_value": "bbc-themes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:25:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650205": [
        {
            "ioc_value": "bulk-url-opener.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:25:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650203": [
        {
            "ioc_value": "forest1.waveb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:24:22",
            "last_seen_utc": "2025-11-25 17:25:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650201": [
        {
            "ioc_value": "atmasolucoes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650200": [
        {
            "ioc_value": "varuna.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:23:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650198": [
        {
            "ioc_value": "kolbexenterprise.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650196": [
        {
            "ioc_value": "zarkons.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650194": [
        {
            "ioc_value": "allsportsandwellness.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:18:25",
            "last_seen_utc": "2025-11-26 13:41:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650193": [
        {
            "ioc_value": "forest2.waveb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650191": [
        {
            "ioc_value": "buke-monogatari.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:16:07",
            "last_seen_utc": "2025-12-13 15:28:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650189": [
        {
            "ioc_value": "daimakkk.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:12:39",
            "last_seen_utc": "2025-12-07 20:34:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650187": [
        {
            "ioc_value": "shienkenkyu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:11:55",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650186": [
        {
            "ioc_value": "2yv.waveb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:11:31",
            "last_seen_utc": "2025-11-25 17:16:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650184": [
        {
            "ioc_value": "onlysix.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:10:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650182": [
        {
            "ioc_value": "hifoison.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:09:38",
            "last_seen_utc": "2025-12-08 19:00:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650180": [
        {
            "ioc_value": "landman.africa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:08:56",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650179": [
        {
            "ioc_value": "tj.waveb0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:08:19",
            "last_seen_utc": "2025-11-25 17:11:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650178": [
        {
            "ioc_value": "wadainomori.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:06:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650175": [
        {
            "ioc_value": "fiqueforadacaixa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:04:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650174": [
        {
            "ioc_value": "sky.softm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 17:04:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650172": [
        {
            "ioc_value": "clwrealestate.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:02:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650170": [
        {
            "ioc_value": "tech247.com.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 17:00:22",
            "last_seen_utc": "2025-12-08 19:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650168": [
        {
            "ioc_value": "shutter.myaccessio.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650166": [
        {
            "ioc_value": "creators--cloud.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650164": [
        {
            "ioc_value": "3squaredapps.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:57:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650163": [
        {
            "ioc_value": "hollow.softm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:57:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650161": [
        {
            "ioc_value": "all-life-flower.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:56:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650160": [
        {
            "ioc_value": "cardloan-bank.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:55:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650157": [
        {
            "ioc_value": "tiltdesigns.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:53:49",
            "last_seen_utc": "2025-12-07 20:34:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650155": [
        {
            "ioc_value": "columbusveteransfc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:51:32",
            "last_seen_utc": "2025-11-25 17:17:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650153": [
        {
            "ioc_value": "keonhacai.cheap",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:48:42",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650151": [
        {
            "ioc_value": "avciauto.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:47:48",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650150": [
        {
            "ioc_value": "e8rgy.softm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:46:58",
            "last_seen_utc": "2025-11-25 16:56:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650148": [
        {
            "ioc_value": "sky3.softm1nt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:44:17",
            "last_seen_utc": "2025-11-25 16:45:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650147": [
        {
            "ioc_value": "pharmacygletsos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:44:13",
            "last_seen_utc": "2025-12-07 20:34:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650144": [
        {
            "ioc_value": "adtrucking.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 16:42:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650143": [
        {
            "ioc_value": "spark0.cioudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:40:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650142": [
        {
            "ioc_value": "drift.cioudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:36:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650141": [
        {
            "ioc_value": "hb.cioudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:33:08",
            "last_seen_utc": "2025-11-25 16:37:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650140": [
        {
            "ioc_value": "mint.cioudpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:28:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650139": [
        {
            "ioc_value": "hkz.cieardrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:22:12",
            "last_seen_utc": "2025-11-25 16:22:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650138": [
        {
            "ioc_value": "drop.cieardrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:16:59",
            "last_seen_utc": "2025-11-25 16:21:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650137": [
        {
            "ioc_value": "7wa.cieardrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:13:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650136": [
        {
            "ioc_value": "wave1.cieardrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:11:32",
            "last_seen_utc": "2025-11-25 16:12:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650135": [
        {
            "ioc_value": "6ho.neoniake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:07:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650134": [
        {
            "ioc_value": "e2.neoniake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:04:40",
            "last_seen_utc": "2025-11-25 16:05:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650127": [
        {
            "ioc_value": "bloom.neoniake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 16:00:43",
            "last_seen_utc": "2025-11-25 16:03:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650125": [
        {
            "ioc_value": "55a07.neoniake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:56:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650123": [
        {
            "ioc_value": "r0f.skybr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:49:16",
            "last_seen_utc": "2025-11-25 15:52:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650122": [
        {
            "ioc_value": "z3t.skybr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:46:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650118": [
        {
            "ioc_value": "lp.skybr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:42:26",
            "last_seen_utc": "2025-11-25 15:43:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650117": [
        {
            "ioc_value": "alsokdalsdkals.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 15:42:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650116": [
        {
            "ioc_value": "qpiy0.skybr1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:38:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650115": [
        {
            "ioc_value": "9gu.wildr0sehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:33:26",
            "last_seen_utc": "2025-11-25 15:38:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650113": [
        {
            "ioc_value": "dasktiitititit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 15:32:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650111": [
        {
            "ioc_value": "grunbcv.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-25 15:31:38",
            "last_seen_utc": "2025-11-25 19:49:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650112": [
        {
            "ioc_value": "grobpa.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-25 15:31:38",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650110": [
        {
            "ioc_value": "vale.wildr0sehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:27:07",
            "last_seen_utc": "2025-11-25 15:31:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650108": [
        {
            "ioc_value": "ulv.wildr0sehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:19:23",
            "last_seen_utc": "2025-11-25 15:22:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650106": [
        {
            "ioc_value": "cn8y.wildr0sehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:15:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650105": [
        {
            "ioc_value": "neon.mintforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:11:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650104": [
        {
            "ioc_value": "wave.mintforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:07:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650103": [
        {
            "ioc_value": "fire2.mintforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 15:01:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650102": [
        {
            "ioc_value": "ox1i.mintforest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 14:55:14",
            "last_seen_utc": "2025-11-25 14:56:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650100": [
        {
            "ioc_value": "brillar.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 14:46:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650098": [
        {
            "ioc_value": "ardor.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 14:37:48",
            "last_seen_utc": "2025-11-25 14:42:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650097": [
        {
            "ioc_value": "solis.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 14:32:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650093": [
        {
            "ioc_value": "cptchic.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 14:24:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650096": [
        {
            "ioc_value": "flare.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 14:21:38",
            "last_seen_utc": "2025-11-25 14:29:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650091": [
        {
            "ioc_value": "aurora.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 14:15:25",
            "last_seen_utc": "2025-11-25 14:19:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650089": [
        {
            "ioc_value": "sora.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 14:11:26",
            "last_seen_utc": "2025-11-25 14:13:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650088": [
        {
            "ioc_value": "lago.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 14:05:05",
            "last_seen_utc": "2025-11-25 14:12:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650087": [
        {
            "ioc_value": "selva.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 13:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650086": [
        {
            "ioc_value": "vento.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 13:47:58",
            "last_seen_utc": "2025-11-25 13:52:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650085": [
        {
            "ioc_value": "mizu.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 13:43:15",
            "last_seen_utc": "2025-11-25 13:44:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650084": [
        {
            "ioc_value": "licht.breezef0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 13:37:02",
            "last_seen_utc": "2025-11-25 13:38:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650082": [
        {
            "ioc_value": "weald3.breezef0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 13:28:13",
            "last_seen_utc": "2025-11-25 13:34:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650081": [
        {
            "ioc_value": "zorn.breezef0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 13:17:50",
            "last_seen_utc": "2025-11-25 13:21:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650080": [
        {
            "ioc_value": "hafen.breezef0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 13:00:29",
            "last_seen_utc": "2025-11-25 13:01:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650078": [
        {
            "ioc_value": "glade4.clearpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 12:53:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650076": [
        {
            "ioc_value": "birch.clearpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 12:46:20",
            "last_seen_utc": "2025-11-25 12:47:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650075": [
        {
            "ioc_value": "wind.clearpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 12:35:31",
            "last_seen_utc": "2025-11-25 12:39:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650074": [
        {
            "ioc_value": "wolke.clearpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 12:25:36",
            "last_seen_utc": "2025-11-25 12:29:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650073": [
        {
            "ioc_value": "hain2.w1ldgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 12:16:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650072": [
        {
            "ioc_value": "tal.w1ldgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 12:08:22",
            "last_seen_utc": "2025-11-25 12:16:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650066": [
        {
            "ioc_value": "adler.w1ldgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 11:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650065": [
        {
            "ioc_value": "gleis.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 11:47:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650064": [
        {
            "ioc_value": "weiss.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 11:39:39",
            "last_seen_utc": "2025-11-25 11:43:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650063": [
        {
            "ioc_value": "korn3.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 11:36:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650062": [
        {
            "ioc_value": "falke.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 11:20:27",
            "last_seen_utc": "2025-11-25 11:33:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650059": [
        {
            "ioc_value": "nacht.midn1ghtdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 11:17:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650058": [
        {
            "ioc_value": "rill.fl0wbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 11:07:22",
            "last_seen_utc": "2025-11-25 11:16:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650051": [
        {
            "ioc_value": "ufer2.fl0wbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 10:57:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650041": [
        {
            "ioc_value": "glanz.fl0wbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 10:51:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650037": [
        {
            "ioc_value": "1pc1wdstwjv4p.cfc-execute.gz.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-25 10:48:44",
            "last_seen_utc": "2025-12-14 11:48:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1650036": [
        {
            "ioc_value": "shore.sunm0tion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 10:44:03",
            "last_seen_utc": "2025-11-25 10:52:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650031": [
        {
            "ioc_value": "wasimoc.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-25 10:40:27",
            "last_seen_utc": "2025-11-25 19:49:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650032": [
        {
            "ioc_value": "crpavdsg.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-25 10:40:27",
            "last_seen_utc": "2025-11-25 19:49:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650033": [
        {
            "ioc_value": "lacuobl.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-25 10:40:27",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650034": [
        {
            "ioc_value": "senszlz.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-25 10:40:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650035": [
        {
            "ioc_value": "realad.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-25 10:40:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1650030": [
        {
            "ioc_value": "crest.sunm0tion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 10:37:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650029": [
        {
            "ioc_value": "glow1.sunm0tion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 10:27:55",
            "last_seen_utc": "2025-11-25 10:32:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650027": [
        {
            "ioc_value": "trp.wallyapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-25 10:26:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1650028": [
        {
            "ioc_value": "trp.shortletsinaberdeen.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-25 10:26:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1650024": [
        {
            "ioc_value": "reef.sunm0tion.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 10:14:34",
            "last_seen_utc": "2025-11-25 10:16:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650023": [
        {
            "ioc_value": "klee.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 10:06:48",
            "last_seen_utc": "2025-11-25 10:11:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650022": [
        {
            "ioc_value": "moor.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:58:58",
            "last_seen_utc": "2025-11-25 10:04:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650021": [
        {
            "ioc_value": "wolfe2.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:53:21",
            "last_seen_utc": "2025-11-25 09:55:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650018": [
        {
            "ioc_value": "wp2.unairdedemo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-25 09:47:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1650020": [
        {
            "ioc_value": "licht.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:47:36",
            "last_seen_utc": "2025-11-25 09:50:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650017": [
        {
            "ioc_value": "pfad.stormseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:42:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650016": [
        {
            "ioc_value": "dune3.softl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:39:14",
            "last_seen_utc": "2025-11-25 09:40:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650015": [
        {
            "ioc_value": "weald.softl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:34:02",
            "last_seen_utc": "2025-11-25 09:35:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650014": [
        {
            "ioc_value": "tau.softl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:27:19",
            "last_seen_utc": "2025-11-25 09:28:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650013": [
        {
            "ioc_value": "glade.st0necloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:22:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650012": [
        {
            "ioc_value": "kamm2.st0necloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:18:05",
            "last_seen_utc": "2025-11-25 09:22:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650009": [
        {
            "ioc_value": "bach.st0necloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 09:01:05",
            "last_seen_utc": "2025-11-25 09:03:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650006": [
        {
            "ioc_value": "wolke.st0necloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 08:47:44",
            "last_seen_utc": "2025-11-25 08:58:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650003": [
        {
            "ioc_value": "glanz.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 08:37:23",
            "last_seen_utc": "2025-11-25 08:40:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650002": [
        {
            "ioc_value": "wald.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 08:26:36",
            "last_seen_utc": "2025-11-25 08:32:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650001": [
        {
            "ioc_value": "strom2.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 08:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1650000": [
        {
            "ioc_value": "ufer.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 08:17:06",
            "last_seen_utc": "2025-11-25 08:19:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649998": [
        {
            "ioc_value": "weiss.bluer1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 08:12:23",
            "last_seen_utc": "2025-11-25 08:17:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649996": [
        {
            "ioc_value": "dune4.0ceanleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 08:07:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649988": [
        {
            "ioc_value": "giw.shortletsinaberdeen.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-25 08:02:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1649987": [
        {
            "ioc_value": "giw.wallyapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-25 08:02:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1649967": [
        {
            "ioc_value": "tau.0ceanleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 07:56:55",
            "last_seen_utc": "2025-11-25 08:05:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649966": [
        {
            "ioc_value": "reef.0ceanleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 07:48:09",
            "last_seen_utc": "2025-11-25 07:51:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649965": [
        {
            "ioc_value": "tal.starl1nq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 07:37:47",
            "last_seen_utc": "2025-11-25 07:39:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649963": [
        {
            "ioc_value": "microsoft.ms-drivers.cam",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sliver",
            "malware_alias": null,
            "malware_printable": "Sliver",
            "first_seen_utc": "2025-11-25 07:29:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,sliver",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649964": [
        {
            "ioc_value": "milauth-mygovin.serveftp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sliver",
            "malware_alias": null,
            "malware_printable": "Sliver",
            "first_seen_utc": "2025-11-25 07:29:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,sliver",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649962": [
        {
            "ioc_value": "wolke.starl1nq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 07:21:54",
            "last_seen_utc": "2025-11-25 07:23:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649961": [
        {
            "ioc_value": "gleis2.starl1nq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 07:17:44",
            "last_seen_utc": "2025-11-25 07:19:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649959": [
        {
            "ioc_value": "call-sin.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-25 07:09:43",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649957": [
        {
            "ioc_value": "update.especificotks.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-25 07:09:13",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649956": [
        {
            "ioc_value": "v3.socolive105.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-25 07:08:04",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649952": [
        {
            "ioc_value": "chocola.ru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-25 07:08:03",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649953": [
        {
            "ioc_value": "maintenance-behavior.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-25 07:08:03",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649954": [
        {
            "ioc_value": "socolive105.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-25 07:08:03",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649955": [
        {
            "ioc_value": "v2.socolive105.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-25 07:08:03",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649949": [
        {
            "ioc_value": "stern.starl1nq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 07:07:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649948": [
        {
            "ioc_value": "www.xoilac86e.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-25 07:07:10",
            "last_seen_utc": "2025-11-25 07:07:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649947": [
        {
            "ioc_value": "shadowb1t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 06:57:34",
            "last_seen_utc": "2025-11-25 07:01:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649946": [
        {
            "ioc_value": "crest.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 06:47:17",
            "last_seen_utc": "2025-11-25 06:48:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649945": [
        {
            "ioc_value": "shore.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 06:37:21",
            "last_seen_utc": "2025-11-25 06:43:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649944": [
        {
            "ioc_value": "reef2.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 06:28:05",
            "last_seen_utc": "2025-11-25 06:30:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649942": [
        {
            "ioc_value": "spray.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 06:18:14",
            "last_seen_utc": "2025-11-25 06:18:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649941": [
        {
            "ioc_value": "korn.m1stwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 06:07:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649804": [
        {
            "ioc_value": "funnel.weightlosstonight.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-25 06:01:30",
            "last_seen_utc": "2025-11-29 09:46:27",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115606245904138186",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1649938": [
        {
            "ioc_value": "haze.c1earwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 05:54:36",
            "last_seen_utc": "2025-11-25 06:04:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649937": [
        {
            "ioc_value": "licht2.c1earwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 05:47:54",
            "last_seen_utc": "2025-11-25 05:54:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649936": [
        {
            "ioc_value": "wolke.c1earwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 05:37:36",
            "last_seen_utc": "2025-11-25 05:42:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649935": [
        {
            "ioc_value": "wind.c1earwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 05:27:15",
            "last_seen_utc": "2025-11-25 05:28:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649934": [
        {
            "ioc_value": "glow1.night0ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 05:17:29",
            "last_seen_utc": "2025-11-25 05:24:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649933": [
        {
            "ioc_value": "pfad.night0ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 05:07:11",
            "last_seen_utc": "2025-11-25 05:08:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649932": [
        {
            "ioc_value": "nacht.night0ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 04:56:55",
            "last_seen_utc": "2025-11-25 05:02:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649930": [
        {
            "ioc_value": "tal.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 04:47:07",
            "last_seen_utc": "2025-11-25 04:53:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649928": [
        {
            "ioc_value": "dune4.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 04:37:51",
            "last_seen_utc": "2025-11-25 04:40:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649925": [
        {
            "ioc_value": "weald.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 04:28:04",
            "last_seen_utc": "2025-11-25 04:32:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649924": [
        {
            "ioc_value": "fjord.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 04:17:41",
            "last_seen_utc": "2025-11-25 04:21:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649923": [
        {
            "ioc_value": "birch.mount0ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 04:07:28",
            "last_seen_utc": "2025-11-25 04:12:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649905": [
        {
            "ioc_value": "klee3.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 03:57:37",
            "last_seen_utc": "2025-11-25 04:00:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649904": [
        {
            "ioc_value": "ufer.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 03:47:20",
            "last_seen_utc": "2025-11-25 03:49:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649903": [
        {
            "ioc_value": "moor.deep5tone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 03:37:03",
            "last_seen_utc": "2025-11-25 03:43:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649899": [
        {
            "ioc_value": "em.cl0udmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 03:28:19",
            "last_seen_utc": "2025-11-25 03:30:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649898": [
        {
            "ioc_value": "4sv.cl0udmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 03:18:00",
            "last_seen_utc": "2025-11-25 03:22:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649897": [
        {
            "ioc_value": "soft.cl0udmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 03:07:44",
            "last_seen_utc": "2025-11-25 03:09:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649893": [
        {
            "ioc_value": "cloud.cl0udmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 02:58:58",
            "last_seen_utc": "2025-11-25 03:04:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649889": [
        {
            "ioc_value": "1318289497-b40xhuifyy.ap-beijing.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-25 02:47:53",
            "last_seen_utc": "2025-12-14 11:48:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649888": [
        {
            "ioc_value": "4d.stormblink.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 02:47:40",
            "last_seen_utc": "2025-11-25 02:54:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649887": [
        {
            "ioc_value": "2wa.stormblink.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 02:37:18",
            "last_seen_utc": "2025-11-25 02:41:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649885": [
        {
            "ioc_value": "e31.stormblink.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 02:27:31",
            "last_seen_utc": "2025-11-25 02:28:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649883": [
        {
            "ioc_value": "peak.stormblink.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 02:17:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649882": [
        {
            "ioc_value": "r91.b1tzdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 02:08:23",
            "last_seen_utc": "2025-11-25 02:11:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649881": [
        {
            "ioc_value": "5rn.b1tzdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 01:57:02",
            "last_seen_utc": "2025-11-25 02:00:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649880": [
        {
            "ioc_value": "silver0.b1tzdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 01:47:46",
            "last_seen_utc": "2025-11-25 01:50:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649879": [
        {
            "ioc_value": "li90.b1tzdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 01:37:59",
            "last_seen_utc": "2025-11-25 01:43:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649878": [
        {
            "ioc_value": "shadow6.st0nepeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 01:27:36",
            "last_seen_utc": "2025-11-25 01:29:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649877": [
        {
            "ioc_value": "scg7.st0nepeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 01:17:43",
            "last_seen_utc": "2025-11-25 01:23:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649876": [
        {
            "ioc_value": "blink.st0nepeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 01:07:27",
            "last_seen_utc": "2025-11-25 01:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649874": [
        {
            "ioc_value": "crest.st0nepeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 00:57:32",
            "last_seen_utc": "2025-11-25 01:02:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649873": [
        {
            "ioc_value": "e2h.s0ftmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 00:44:11",
            "last_seen_utc": "2025-11-25 00:50:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649872": [
        {
            "ioc_value": "crest.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 00:37:58",
            "last_seen_utc": "2025-11-25 00:39:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649871": [
        {
            "ioc_value": "reef.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 00:27:11",
            "last_seen_utc": "2025-11-25 00:29:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649870": [
        {
            "ioc_value": "glade2.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 00:17:55",
            "last_seen_utc": "2025-11-25 00:19:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649869": [
        {
            "ioc_value": "wolke.sunb1aze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-25 00:07:32",
            "last_seen_utc": "2025-11-25 00:09:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649864": [
        {
            "ioc_value": "www.cybermac.co.tz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-11-25 00:01:26",
            "last_seen_utc": "2025-12-02 20:03:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/62.171.179.24+www.cybermac.co.tz",
            "tags": "AS51167,C2,censys,CONTABO,Ermac,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649859": [
        {
            "ioc_value": "ol.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 23:53:42",
            "last_seen_utc": "2025-11-24 23:55:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649858": [
        {
            "ioc_value": "trail.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 23:47:23",
            "last_seen_utc": "2025-11-24 23:49:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649857": [
        {
            "ioc_value": "fern2.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 23:36:35",
            "last_seen_utc": "2025-11-24 23:37:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649856": [
        {
            "ioc_value": "ridge.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 23:32:25",
            "last_seen_utc": "2025-11-24 23:34:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649855": [
        {
            "ioc_value": "wolke.wildcr3st.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 23:24:07",
            "last_seen_utc": "2025-11-24 23:25:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649854": [
        {
            "ioc_value": "vale.s0ftmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 23:17:23",
            "last_seen_utc": "2025-11-24 23:21:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649853": [
        {
            "ioc_value": "2dhk1.s0ftmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 23:08:01",
            "last_seen_utc": "2025-11-24 23:15:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649831": [
        {
            "ioc_value": "8a.s0ftmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 22:58:14",
            "last_seen_utc": "2025-11-24 23:04:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649830": [
        {
            "ioc_value": "om17w.rockwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 22:47:53",
            "last_seen_utc": "2025-11-24 22:51:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649829": [
        {
            "ioc_value": "o7oz.rockwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 22:31:59",
            "last_seen_utc": "2025-11-24 22:37:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649828": [
        {
            "ioc_value": "soft2.rockwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 22:27:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649827": [
        {
            "ioc_value": "peak0.rockwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 22:17:32",
            "last_seen_utc": "2025-11-24 22:19:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649826": [
        {
            "ioc_value": "m2m8.silverrun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 22:07:15",
            "last_seen_utc": "2025-11-24 22:09:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649825": [
        {
            "ioc_value": "hqk4.silverrun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 21:57:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649824": [
        {
            "ioc_value": "2dzr0.silverrun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 21:48:13",
            "last_seen_utc": "2025-11-24 21:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649823": [
        {
            "ioc_value": "wind9.silverrun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 21:36:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649822": [
        {
            "ioc_value": "jdiw5.mintflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 21:28:03",
            "last_seen_utc": "2025-11-24 21:29:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649821": [
        {
            "ioc_value": "lhf6.mintflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 21:17:47",
            "last_seen_utc": "2025-11-24 21:20:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649820": [
        {
            "ioc_value": "b7.mintflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 21:07:30",
            "last_seen_utc": "2025-11-24 21:08:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649819": [
        {
            "ioc_value": "pulse5.mintflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 20:57:43",
            "last_seen_utc": "2025-11-24 21:03:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649816": [
        {
            "ioc_value": "upux.firetrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 20:47:27",
            "last_seen_utc": "2025-11-24 20:49:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649815": [
        {
            "ioc_value": "sun.firetrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 20:37:09",
            "last_seen_utc": "2025-11-24 20:38:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649814": [
        {
            "ioc_value": "run1.firetrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 20:27:21",
            "last_seen_utc": "2025-11-24 20:30:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649813": [
        {
            "ioc_value": "dsc.firetrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 20:17:05",
            "last_seen_utc": "2025-11-24 20:20:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649812": [
        {
            "ioc_value": "yr4y5.shadowsun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 20:08:31",
            "last_seen_utc": "2025-11-24 20:10:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649810": [
        {
            "ioc_value": "spark3.shadowsun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 19:57:55",
            "last_seen_utc": "2025-11-24 20:04:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649809": [
        {
            "ioc_value": "cliff4.shadowsun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 19:49:41",
            "last_seen_utc": "2025-11-24 19:53:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649807": [
        {
            "ioc_value": "run.shadowsun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 19:37:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649806": [
        {
            "ioc_value": "yg3jg.cliffwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 19:27:37",
            "last_seen_utc": "2025-11-24 19:38:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649805": [
        {
            "ioc_value": "rx6cd.cliffwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 19:13:14",
            "last_seen_utc": "2025-11-24 19:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649803": [
        {
            "ioc_value": "v98.cliffwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 19:07:26",
            "last_seen_utc": "2025-11-24 19:07:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649801": [
        {
            "ioc_value": "trail.cliffwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 18:58:07",
            "last_seen_utc": "2025-11-24 19:02:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649798": [
        {
            "ioc_value": "moor.c0dehawk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 18:47:20",
            "last_seen_utc": "2025-11-24 18:53:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649796": [
        {
            "ioc_value": "ufer4.c0dehawk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 18:37:03",
            "last_seen_utc": "2025-11-24 18:42:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649795": [
        {
            "ioc_value": "stern.c0dehawk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 18:27:41",
            "last_seen_utc": "2025-11-24 18:35:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649793": [
        {
            "ioc_value": "glade.c0dehawk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 18:17:55",
            "last_seen_utc": "2025-11-24 18:20:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649792": [
        {
            "ioc_value": "zorn.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 18:07:33",
            "last_seen_utc": "2025-11-24 18:15:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649791": [
        {
            "ioc_value": "exportsales.gkngroupsbk.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-24 18:00:55",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-n6zrpsel6t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649790": [
        {
            "ioc_value": "exportsales.gkngroups.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-24 18:00:54",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-n6zrpsel6t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649789": [
        {
            "ioc_value": "iniiivanbk.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-24 18:00:53",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-sntj7a1lbl",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649788": [
        {
            "ioc_value": "iniiivan.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-24 18:00:52",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-sntj7a1lbl",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649787": [
        {
            "ioc_value": "policybk.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-24 18:00:51",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-sj3bjawjfw",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649786": [
        {
            "ioc_value": "policy.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-24 18:00:49",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-sj3bjawjfw",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649785": [
        {
            "ioc_value": "nexlunix.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-24 18:00:48",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-sshngsgn8x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649784": [
        {
            "ioc_value": "goodmoneyi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-24 18:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-vxpcyaak9w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649774": [
        {
            "ioc_value": "licht.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 17:50:38",
            "last_seen_utc": "2025-11-24 17:55:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649773": [
        {
            "ioc_value": "wind3.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 17:47:24",
            "last_seen_utc": "2025-11-24 17:50:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649771": [
        {
            "ioc_value": "klee.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 17:37:37",
            "last_seen_utc": "2025-11-24 17:42:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649770": [
        {
            "ioc_value": "pfote.crystalf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 17:28:20",
            "last_seen_utc": "2025-11-24 17:31:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649769": [
        {
            "ioc_value": "wolke2.oceantrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 17:17:02",
            "last_seen_utc": "2025-11-24 17:23:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649768": [
        {
            "ioc_value": "tau.oceantrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 17:07:13",
            "last_seen_utc": "2025-11-24 17:11:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649767": [
        {
            "ioc_value": "fjord.oceantrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 16:57:56",
            "last_seen_utc": "2025-11-24 17:06:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649761": [
        {
            "ioc_value": "hitonowa-salon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649756": [
        {
            "ioc_value": "nathanhowe.nathanhowemusic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:46:39",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649758": [
        {
            "ioc_value": "yaoisexgames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:46:38",
            "last_seen_utc": "2025-12-07 20:34:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649760": [
        {
            "ioc_value": "dorn2.stargl0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 16:45:36",
            "last_seen_utc": "2025-11-24 16:49:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649752": [
        {
            "ioc_value": "printlife.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:40:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649754": [
        {
            "ioc_value": "missdulcet.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:40:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649747": [
        {
            "ioc_value": "utazznapolyba.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:38:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649750": [
        {
            "ioc_value": "miserugrayhair.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:38:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649749": [
        {
            "ioc_value": "weiss.stargl0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 16:36:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649740": [
        {
            "ioc_value": "tsfs.com.my",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:34:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649742": [
        {
            "ioc_value": "vair.xcreative.cz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:34:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649744": [
        {
            "ioc_value": "cockpit.hartsimagineering.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 16:34:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649739": [
        {
            "ioc_value": "glow.stargl0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 16:28:35",
            "last_seen_utc": "2025-11-24 16:29:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649738": [
        {
            "ioc_value": "adler.stargl0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 16:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649737": [
        {
            "ioc_value": "kamm3.m1stwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 16:17:42",
            "last_seen_utc": "2025-11-24 16:19:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649736": [
        {
            "ioc_value": "hafen.m1stwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 16:05:22",
            "last_seen_utc": "2025-11-24 16:07:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649733": [
        {
            "ioc_value": "wald.m1stwood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 16:01:13",
            "last_seen_utc": "2025-11-24 16:04:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649731": [
        {
            "ioc_value": "d.hansang.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-24 16:01:03",
            "last_seen_utc": "2025-11-24 23:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/121.169.59.210+d.hansang.top",
            "tags": "AS4766,C2,censys,KIXS-AS-KR,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649724": [
        {
            "ioc_value": "hain.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 15:58:02",
            "last_seen_utc": "2025-11-24 15:59:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649722": [
        {
            "ioc_value": "falke1.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 15:51:12",
            "last_seen_utc": "2025-11-24 15:57:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649721": [
        {
            "ioc_value": "licht.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 15:45:00",
            "last_seen_utc": "2025-11-24 15:48:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649720": [
        {
            "ioc_value": "grat.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 15:37:16",
            "last_seen_utc": "2025-11-24 15:44:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649719": [
        {
            "ioc_value": "wolke.shadowc0re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 15:21:53",
            "last_seen_utc": "2025-11-24 15:32:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649718": [
        {
            "ioc_value": "korn.safebl0ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 15:17:39",
            "last_seen_utc": "2025-11-24 15:20:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649717": [
        {
            "ioc_value": "tal2.safebl0ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 15:07:55",
            "last_seen_utc": "2025-11-24 15:09:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649716": [
        {
            "ioc_value": "nest.safebl0ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 14:56:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649704": [
        {
            "ioc_value": "viedorta.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-24 14:51:50",
            "last_seen_utc": "2025-11-24 14:20:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1649711": [
        {
            "ioc_value": "modernrecent.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-24 14:51:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115605111926442020",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1649715": [
        {
            "ioc_value": "glanz.safebl0ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 14:47:17",
            "last_seen_utc": "2025-11-24 14:53:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649714": [
        {
            "ioc_value": "pfad.darkfeather.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 14:38:27",
            "last_seen_utc": "2025-11-24 14:47:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649713": [
        {
            "ioc_value": "moor.darkfeather.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 14:27:10",
            "last_seen_utc": "2025-11-24 14:38:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649705": [
        {
            "ioc_value": "birch.darkfeather.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 14:17:22",
            "last_seen_utc": "2025-11-24 14:21:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649703": [
        {
            "ioc_value": "gleam.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 14:08:07",
            "last_seen_utc": "2025-11-24 14:11:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649702": [
        {
            "ioc_value": "rauch.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 13:57:48",
            "last_seen_utc": "2025-11-24 14:03:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649701": [
        {
            "ioc_value": "stern.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 13:48:02",
            "last_seen_utc": "2025-11-24 13:48:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649699": [
        {
            "ioc_value": "fer.wallyapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-24 13:41:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1649700": [
        {
            "ioc_value": "fer.pigeonforgetnrestaurant.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-24 13:41:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1649696": [
        {
            "ioc_value": "ufer1.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 13:39:45",
            "last_seen_utc": "2025-11-24 13:41:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649695": [
        {
            "ioc_value": "klee.r1vermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 13:35:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649694": [
        {
            "ioc_value": "dune.silentwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 13:27:20",
            "last_seen_utc": "2025-11-24 13:31:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649693": [
        {
            "ioc_value": "weald.silentwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 13:17:33",
            "last_seen_utc": "2025-11-24 13:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649692": [
        {
            "ioc_value": "rune.silentwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 13:07:15",
            "last_seen_utc": "2025-11-24 13:12:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649691": [
        {
            "ioc_value": "tau.bluecr4ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 12:56:59",
            "last_seen_utc": "2025-11-24 13:01:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649689": [
        {
            "ioc_value": "glade2.bluecr4ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 12:46:54",
            "last_seen_utc": "2025-11-24 12:55:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649686": [
        {
            "ioc_value": "fjord.bluecr4ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 12:38:10",
            "last_seen_utc": "2025-11-24 12:48:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649685": [
        {
            "ioc_value": "wolke.bluecr4ft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 12:27:22",
            "last_seen_utc": "2025-11-24 12:33:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649684": [
        {
            "ioc_value": "brook.gl0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 12:17:35",
            "last_seen_utc": "2025-11-24 12:20:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649683": [
        {
            "ioc_value": "rime.gl0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 12:07:52",
            "last_seen_utc": "2025-11-24 12:11:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649682": [
        {
            "ioc_value": "fern2.gl0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 12:03:36",
            "last_seen_utc": "2025-11-24 12:06:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649678": [
        {
            "ioc_value": "ak2.xingxings3.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-24 12:02:21",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-nss21axral",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649674": [
        {
            "ioc_value": "haze.gl0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 11:57:24",
            "last_seen_utc": "2025-11-24 11:58:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649673": [
        {
            "ioc_value": "birch.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 11:47:38",
            "last_seen_utc": "2025-11-24 11:49:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649672": [
        {
            "ioc_value": "dune.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 11:37:20",
            "last_seen_utc": "2025-11-24 11:46:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649670": [
        {
            "ioc_value": "ufer5.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 11:26:02",
            "last_seen_utc": "2025-11-24 11:28:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649667": [
        {
            "ioc_value": "weiss.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 11:15:18",
            "last_seen_utc": "2025-11-24 11:25:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649666": [
        {
            "ioc_value": "gleam.mystic0rb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 11:06:59",
            "last_seen_utc": "2025-11-24 11:08:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649648": [
        {
            "ioc_value": "tal1.st0nepath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 10:56:42",
            "last_seen_utc": "2025-11-24 10:58:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649646": [
        {
            "ioc_value": "bach.st0nepath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 10:47:53",
            "last_seen_utc": "2025-11-24 10:48:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649645": [
        {
            "ioc_value": "wolke.st0nepath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 10:35:33",
            "last_seen_utc": "2025-11-24 10:37:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649644": [
        {
            "ioc_value": "topstarwor.loseyourip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-24 10:35:28",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/85c0e3209b312fc6d2f5e2079caa0d33aec8348e39579a7babe7a6b482a07648/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649643": [
        {
            "ioc_value": "eiche.dustycode.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 10:27:18",
            "last_seen_utc": "2025-11-24 10:29:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649642": [
        {
            "ioc_value": "wind3.dustycode.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 10:17:32",
            "last_seen_utc": "2025-11-24 10:19:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649641": [
        {
            "ioc_value": "pfote.dustycode.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 10:07:08",
            "last_seen_utc": "2025-11-24 10:12:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649640": [
        {
            "ioc_value": "sturm.dustycode.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 09:57:22",
            "last_seen_utc": "2025-11-24 09:58:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649639": [
        {
            "ioc_value": "glanz.cl0udnest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 09:55:11",
            "last_seen_utc": "2025-11-24 09:57:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649638": [
        {
            "ioc_value": "ufer2.cl0udnest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 09:47:57",
            "last_seen_utc": "2025-11-24 09:51:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649637": [
        {
            "ioc_value": "grat.cl0udnest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 09:38:10",
            "last_seen_utc": "2025-11-24 09:44:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649636": [
        {
            "ioc_value": "wolke1.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 09:27:47",
            "last_seen_utc": "2025-11-24 09:33:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649635": [
        {
            "ioc_value": "licht.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 09:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649633": [
        {
            "ioc_value": "falke.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 09:07:37",
            "last_seen_utc": "2025-11-24 09:11:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649630": [
        {
            "ioc_value": "dune4.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 08:57:50",
            "last_seen_utc": "2025-11-24 08:59:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649629": [
        {
            "ioc_value": "weald.bright0wl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 08:47:29",
            "last_seen_utc": "2025-11-24 08:54:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649624": [
        {
            "ioc_value": "bach2.med1aflow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 08:37:11",
            "last_seen_utc": "2025-11-24 08:38:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649604": [
        {
            "ioc_value": "stern.med1aflow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 08:26:28",
            "last_seen_utc": "2025-11-24 08:30:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649601": [
        {
            "ioc_value": "totalsecllc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 08:10:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649599": [
        {
            "ioc_value": "oehme-partner.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 08:08:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649597": [
        {
            "ioc_value": "ehcsils-id.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 08:07:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649595": [
        {
            "ioc_value": "houstoncomputerrepairgeeks.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 08:06:22",
            "last_seen_utc": "2025-11-25 16:56:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649593": [
        {
            "ioc_value": "evy2023website.nohasslebusiness.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 08:05:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649591": [
        {
            "ioc_value": "estate-recipe.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 08:04:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649589": [
        {
            "ioc_value": "asobi-plus.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 08:03:42",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649580": [
        {
            "ioc_value": "msgtrcrane.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 08:00:26",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649574": [
        {
            "ioc_value": "subasanat.ir",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:58:20",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649573": [
        {
            "ioc_value": "renwebdesign.xsrv.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:54:52",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649570": [
        {
            "ioc_value": "cittadellese.sitonuovo.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:53:45",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649568": [
        {
            "ioc_value": "haachan.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:50:06",
            "last_seen_utc": "2025-12-09 13:35:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649566": [
        {
            "ioc_value": "rachelsvineyardkc.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:48:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649564": [
        {
            "ioc_value": "sagarpatil.bhsupportgt8.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:46:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649562": [
        {
            "ioc_value": "lreindia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:45:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649560": [
        {
            "ioc_value": "castra.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:44:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649558": [
        {
            "ioc_value": "bl555.gratis",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:43:32",
            "last_seen_utc": "2025-12-11 19:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649556": [
        {
            "ioc_value": "camersoftware.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:41:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649554": [
        {
            "ioc_value": "estacaopequenaalemanha.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:39:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649552": [
        {
            "ioc_value": "omaxtrans.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:39:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649549": [
        {
            "ioc_value": "teambuildingtunisie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:37:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649547": [
        {
            "ioc_value": "r-lien.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:36:21",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649545": [
        {
            "ioc_value": "sri-lanka-traumurlaub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:34:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649543": [
        {
            "ioc_value": "panplanning.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:32:36",
            "last_seen_utc": "2025-12-08 19:00:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649537": [
        {
            "ioc_value": "craftmasters.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:30:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649541": [
        {
            "ioc_value": "solidarityinsaya.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:30:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649539": [
        {
            "ioc_value": "m8ke.agency",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:30:57",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649536": [
        {
            "ioc_value": "hafen.med1aflow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 07:26:43",
            "last_seen_utc": "2025-11-24 07:43:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649535": [
        {
            "ioc_value": "tal.nightf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 07:17:27",
            "last_seen_utc": "2025-11-24 07:19:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649525": [
        {
            "ioc_value": "mujjs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:09:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649533": [
        {
            "ioc_value": "prsuerinkicon.today",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-24 07:09:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1649534": [
        {
            "ioc_value": "kraut.nightf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 07:07:10",
            "last_seen_utc": "2025-11-24 07:09:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649531": [
        {
            "ioc_value": "rill1.nightf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 07:03:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649530": [
        {
            "ioc_value": "zorn.nightf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 06:58:18",
            "last_seen_utc": "2025-11-24 06:59:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649529": [
        {
            "ioc_value": "gleis.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 06:56:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649528": [
        {
            "ioc_value": "moos.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 06:53:01",
            "last_seen_utc": "2025-11-24 06:54:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649527": [
        {
            "ioc_value": "wolfe2.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 06:47:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649526": [
        {
            "ioc_value": "zurumaks.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-11-24 06:45:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649524": [
        {
            "ioc_value": "pfad.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 06:38:03",
            "last_seen_utc": "2025-11-24 06:40:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649523": [
        {
            "ioc_value": "adler.clearbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 06:27:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649522": [
        {
            "ioc_value": "weald.storml1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 06:17:55",
            "last_seen_utc": "2025-11-24 06:19:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649521": [
        {
            "ioc_value": "dune3.storml1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 06:07:38",
            "last_seen_utc": "2025-11-24 06:12:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649517": [
        {
            "ioc_value": "f77.f3322.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-24 06:03:59",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251124-dp26dsxlcv",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649514": [
        {
            "ioc_value": "tau.storml1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 05:57:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649513": [
        {
            "ioc_value": "glade.br1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 05:54:42",
            "last_seen_utc": "2025-11-24 05:55:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649511": [
        {
            "ioc_value": "birch.br1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 05:47:28",
            "last_seen_utc": "2025-11-24 05:49:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649510": [
        {
            "ioc_value": "kamm2.br1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 05:37:10",
            "last_seen_utc": "2025-11-24 05:43:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649508": [
        {
            "ioc_value": "wolke.br1ghtstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 05:27:24",
            "last_seen_utc": "2025-11-24 05:34:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649505": [
        {
            "ioc_value": "glanz.l1necloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 05:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649503": [
        {
            "ioc_value": "tal1.l1necloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 05:17:02",
            "last_seen_utc": "2025-11-24 05:20:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649502": [
        {
            "ioc_value": "bach.l1necloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 05:07:45",
            "last_seen_utc": "2025-11-24 05:12:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649501": [
        {
            "ioc_value": "wolke.l1necloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 04:57:58",
            "last_seen_utc": "2025-11-24 05:05:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649500": [
        {
            "ioc_value": "dune2.shad0wline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 04:47:41",
            "last_seen_utc": "2025-11-24 04:56:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649499": [
        {
            "ioc_value": "wind.shad0wline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 04:37:24",
            "last_seen_utc": "2025-11-24 04:38:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649498": [
        {
            "ioc_value": "birch.shad0wline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 04:28:07",
            "last_seen_utc": "2025-11-24 04:32:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649497": [
        {
            "ioc_value": "weiss.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 04:17:19",
            "last_seen_utc": "2025-11-24 04:27:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649496": [
        {
            "ioc_value": "tau.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 04:08:39",
            "last_seen_utc": "2025-11-24 04:13:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649478": [
        {
            "ioc_value": "eiche4.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 03:57:11",
            "last_seen_utc": "2025-11-24 04:01:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649476": [
        {
            "ioc_value": "hafen.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 03:46:53",
            "last_seen_utc": "2025-11-24 03:53:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649475": [
        {
            "ioc_value": "gleam.mintdrive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 03:38:09",
            "last_seen_utc": "2025-11-24 03:43:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649474": [
        {
            "ioc_value": "pfad2.rapidmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 03:26:44",
            "last_seen_utc": "2025-11-24 03:28:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649473": [
        {
            "ioc_value": "wolke.rapidmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 03:17:58",
            "last_seen_utc": "2025-11-24 03:18:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649472": [
        {
            "ioc_value": "korn.rapidmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 03:07:39",
            "last_seen_utc": "2025-11-24 03:13:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649471": [
        {
            "ioc_value": "rill.nightspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 02:57:23",
            "last_seen_utc": "2025-11-24 03:06:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649470": [
        {
            "ioc_value": "ufer1.nightspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 02:47:36",
            "last_seen_utc": "2025-11-24 02:53:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649469": [
        {
            "ioc_value": "licht.nightspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 02:38:15",
            "last_seen_utc": "2025-11-24 02:41:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649468": [
        {
            "ioc_value": "weald.nightspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 02:26:55",
            "last_seen_utc": "2025-11-24 02:31:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649467": [
        {
            "ioc_value": "moor3.w1ndstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 02:18:05",
            "last_seen_utc": "2025-11-24 02:19:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649466": [
        {
            "ioc_value": "kamm.w1ndstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 02:06:47",
            "last_seen_utc": "2025-11-24 02:13:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649465": [
        {
            "ioc_value": "grat.w1ndstorm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 01:58:02",
            "last_seen_utc": "2025-11-24 02:02:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649464": [
        {
            "ioc_value": "tal.darkspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 01:47:44",
            "last_seen_utc": "2025-11-24 01:48:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649462": [
        {
            "ioc_value": "wolke.darkspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 01:37:26",
            "last_seen_utc": "2025-11-24 01:44:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649461": [
        {
            "ioc_value": "bach2.darkspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 01:27:34",
            "last_seen_utc": "2025-11-24 01:31:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649460": [
        {
            "ioc_value": "rauch.darkspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 01:17:15",
            "last_seen_utc": "2025-11-24 01:19:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649459": [
        {
            "ioc_value": "gleis3.oceanbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 01:07:29",
            "last_seen_utc": "2025-11-24 01:11:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649458": [
        {
            "ioc_value": "stern.oceanbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 00:58:13",
            "last_seen_utc": "2025-11-24 01:05:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649457": [
        {
            "ioc_value": "ufer.oceanbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 00:47:50",
            "last_seen_utc": "2025-11-24 00:52:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649456": [
        {
            "ioc_value": "wald.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 00:38:03",
            "last_seen_utc": "2025-11-24 00:42:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649454": [
        {
            "ioc_value": "dorn4.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 00:27:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649453": [
        {
            "ioc_value": "tau.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 00:17:55",
            "last_seen_utc": "2025-11-24 00:23:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649452": [
        {
            "ioc_value": "fluss.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-24 00:07:32",
            "last_seen_utc": "2025-11-24 00:08:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649444": [
        {
            "ioc_value": "weiss.snowl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 23:52:38",
            "last_seen_utc": "2025-11-24 00:04:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649443": [
        {
            "ioc_value": "falke2.g0ldmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 23:47:24",
            "last_seen_utc": "2025-11-23 23:50:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649442": [
        {
            "ioc_value": "moor.g0ldmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 23:38:08",
            "last_seen_utc": "2025-11-23 23:42:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649441": [
        {
            "ioc_value": "klee.g0ldmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 23:27:11",
            "last_seen_utc": "2025-11-23 23:35:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649440": [
        {
            "ioc_value": "choice99.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 23:25:24",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7ff590c3ccaa69ee1e58d56217bc1c36e1b4a00ca545bf71562c7b005be6d5ba/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649438": [
        {
            "ioc_value": "bach.brightstep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 23:13:48",
            "last_seen_utc": "2025-11-23 23:17:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649437": [
        {
            "ioc_value": "ufer3.brightstep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 23:08:05",
            "last_seen_utc": "2025-11-23 23:12:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649428": [
        {
            "ioc_value": "glade.brightstep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 22:57:49",
            "last_seen_utc": "2025-11-23 22:58:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649425": [
        {
            "ioc_value": "wolke.brightstep.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 22:47:29",
            "last_seen_utc": "2025-11-23 22:49:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649423": [
        {
            "ioc_value": "echo.cloudw1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 21:57:04",
            "last_seen_utc": "2025-11-23 22:11:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649422": [
        {
            "ioc_value": "48mm.cloudw1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 21:47:48",
            "last_seen_utc": "2025-11-23 21:52:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649421": [
        {
            "ioc_value": "m8o.cloudw1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 21:40:03",
            "last_seen_utc": "2025-11-23 21:48:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649420": [
        {
            "ioc_value": "l32.cloudw1re.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 21:36:53",
            "last_seen_utc": "2025-11-23 21:39:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649419": [
        {
            "ioc_value": "line2.driftl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 21:27:36",
            "last_seen_utc": "2025-11-23 21:31:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649418": [
        {
            "ioc_value": "mist3.driftl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 21:17:49",
            "last_seen_utc": "2025-11-23 21:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649417": [
        {
            "ioc_value": "ba8o.driftl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 21:00:21",
            "last_seen_utc": "2025-11-23 21:04:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649416": [
        {
            "ioc_value": "a2.driftl1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 20:54:40",
            "last_seen_utc": "2025-11-23 20:58:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649415": [
        {
            "ioc_value": "dot.cbzp.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-23 20:51:21",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649407": [
        {
            "ioc_value": "cakhiatvab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-23 20:50:51",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649408": [
        {
            "ioc_value": "v2.cakhiatvab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-23 20:50:51",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649409": [
        {
            "ioc_value": "v2.xoilacne.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-23 20:50:51",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649410": [
        {
            "ioc_value": "v2.xoilaczzztz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-23 20:50:51",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649411": [
        {
            "ioc_value": "v3.cakhiatvab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-23 20:50:51",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649412": [
        {
            "ioc_value": "v3.xoilacne.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-23 20:50:51",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649413": [
        {
            "ioc_value": "v3.xoilaczzztz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-23 20:50:51",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649414": [
        {
            "ioc_value": "word8328.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-23 20:50:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649406": [
        {
            "ioc_value": "gatex.xoilaczzztz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 20:50:32",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649404": [
        {
            "ioc_value": "crest.stonemist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 20:48:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649403": [
        {
            "ioc_value": "676.stonemist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 20:37:08",
            "last_seen_utc": "2025-11-23 20:37:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649402": [
        {
            "ioc_value": "doc.stonemist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 20:27:22",
            "last_seen_utc": "2025-11-23 20:34:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649401": [
        {
            "ioc_value": "qp1.stonemist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 20:19:07",
            "last_seen_utc": "2025-11-23 20:23:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649400": [
        {
            "ioc_value": "5fj.st0negate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 20:06:47",
            "last_seen_utc": "2025-11-23 20:12:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649399": [
        {
            "ioc_value": "login.easymeo365.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-23 20:02:46",
            "last_seen_utc": "2025-11-23 23:00:51",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/107.172.63.100+login.easymeo365.store",
            "tags": "AS-COLOCROSSING,AS36352,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649387": [
        {
            "ioc_value": "veiii.st0negate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 19:58:01",
            "last_seen_utc": "2025-11-23 20:01:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649385": [
        {
            "ioc_value": "clock.st0negate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 19:47:44",
            "last_seen_utc": "2025-11-23 19:51:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649380": [
        {
            "ioc_value": "ovalresponsibility.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-23 19:47:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://bruceketta.space/posts/nova-script-251110/",
            "tags": "NovaStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649381": [
        {
            "ioc_value": "horsemanufacturer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-23 19:47:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://bruceketta.space/posts/nova-script-251110/",
            "tags": "NovaStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649382": [
        {
            "ioc_value": "captainnose.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-23 19:47:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://bruceketta.space/posts/nova-script-251110/",
            "tags": "NovaStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649383": [
        {
            "ioc_value": "wheelchairmoments.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-23 19:47:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://bruceketta.space/posts/nova-script-251110/",
            "tags": "NovaStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649384": [
        {
            "ioc_value": "sunrisefootball.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-23 19:47:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://bruceketta.space/posts/nova-script-251110/",
            "tags": "NovaStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649372": [
        {
            "ioc_value": "rise.st0negate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 19:37:21",
            "last_seen_utc": "2025-11-23 19:43:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649371": [
        {
            "ioc_value": "rock.skyb1end.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 19:27:35",
            "last_seen_utc": "2025-11-23 19:34:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649370": [
        {
            "ioc_value": "8w.skyb1end.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 19:17:15",
            "last_seen_utc": "2025-11-23 19:18:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649369": [
        {
            "ioc_value": "dlop3.skyb1end.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 19:08:30",
            "last_seen_utc": "2025-11-23 19:09:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649368": [
        {
            "ioc_value": "trail6.skyb1end.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 18:58:13",
            "last_seen_utc": "2025-11-23 19:03:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649367": [
        {
            "ioc_value": "24lb.cl0udrise.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 18:47:53",
            "last_seen_utc": "2025-11-23 18:54:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649363": [
        {
            "ioc_value": "clock1.cl0udrise.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 18:38:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649362": [
        {
            "ioc_value": "0n.cl0udrise.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 18:27:49",
            "last_seen_utc": "2025-11-23 18:33:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649361": [
        {
            "ioc_value": "drop1.cl0udrise.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 18:17:32",
            "last_seen_utc": "2025-11-23 18:19:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649360": [
        {
            "ioc_value": "nvgt8.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 18:07:45",
            "last_seen_utc": "2025-11-23 18:10:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649356": [
        {
            "ioc_value": "airport-planning.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 18:01:03",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-sz4jjasrgp",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649354": [
        {
            "ioc_value": "director-nw.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-23 18:00:30",
            "last_seen_utc": "2025-12-12 18:39:26",
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-reakaahl71",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649353": [
        {
            "ioc_value": "eowkai600.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-23 18:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-skf5pahq9z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649352": [
        {
            "ioc_value": "engineering-metadata.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-23 18:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-s7s3rsxrc1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649351": [
        {
            "ioc_value": "gle3recbk.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-23 18:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-tl758sam9y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649350": [
        {
            "ioc_value": "archive-candidate.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-23 18:00:26",
            "last_seen_utc": "2025-12-12 18:39:24",
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-vebn5ayndw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649349": [
        {
            "ioc_value": "0e2.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 17:57:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649348": [
        {
            "ioc_value": "flare.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 17:47:11",
            "last_seen_utc": "2025-11-23 17:50:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649347": [
        {
            "ioc_value": "svzzv.wildshift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 17:38:25",
            "last_seen_utc": "2025-11-23 17:46:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649346": [
        {
            "ioc_value": "byte.mintburst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 17:27:08",
            "last_seen_utc": "2025-11-23 17:37:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649345": [
        {
            "ioc_value": "jzyc.mintburst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 17:16:51",
            "last_seen_utc": "2025-11-23 17:17:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649344": [
        {
            "ioc_value": "wire8.mintburst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 17:07:59",
            "last_seen_utc": "2025-11-23 17:13:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649343": [
        {
            "ioc_value": "trail9.mintburst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 16:54:35",
            "last_seen_utc": "2025-11-23 16:55:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649342": [
        {
            "ioc_value": "fjb9d0fp905cc.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-23 16:49:29",
            "last_seen_utc": "2025-12-14 11:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649341": [
        {
            "ioc_value": "mist.rockbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 16:48:49",
            "last_seen_utc": "2025-11-23 16:54:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649340": [
        {
            "ioc_value": "blend4.rockbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 16:37:30",
            "last_seen_utc": "2025-11-23 16:44:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649339": [
        {
            "ioc_value": "9cm.rockbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 16:27:13",
            "last_seen_utc": "2025-11-23 16:30:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649313": [
        {
            "ioc_value": "xps.pigeonforgetnrestaurant.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-23 16:21:51",
            "last_seen_utc": "2025-11-24 08:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1649324": [
        {
            "ioc_value": "xps.wallyapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-23 16:21:51",
            "last_seen_utc": "2025-11-24 08:28:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3e2c77b8c1442e1cbc084b8ee9abcf3f1f888f312b58970a1663012466aa1f8/",
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1649338": [
        {
            "ioc_value": "64.rockbyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 16:13:21",
            "last_seen_utc": "2025-11-23 16:17:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649337": [
        {
            "ioc_value": "crest7.mysticdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 16:05:05",
            "last_seen_utc": "2025-11-23 16:06:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649332": [
        {
            "ioc_value": "duce.fascism.rocks",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-23 16:00:54",
            "last_seen_utc": "2025-11-23 23:00:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/62.4.15.41+duce.fascism.rocks",
            "tags": "AS12876,C2,censys,Havoc,Online",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649329": [
        {
            "ioc_value": "rg.mysticdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 15:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649328": [
        {
            "ioc_value": "wn.mysticdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 15:50:08",
            "last_seen_utc": "2025-11-23 15:53:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649327": [
        {
            "ioc_value": "burst.mysticdrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 15:46:58",
            "last_seen_utc": "2025-11-23 15:48:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649325": [
        {
            "ioc_value": "vh0.cl0ckmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 15:34:38",
            "last_seen_utc": "2025-11-23 15:42:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649323": [
        {
            "ioc_value": "9ca6.cl0ckmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 15:27:54",
            "last_seen_utc": "2025-11-23 15:33:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649322": [
        {
            "ioc_value": "9505.cl0ckmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 15:18:39",
            "last_seen_utc": "2025-11-23 15:19:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649321": [
        {
            "ioc_value": "hl5n.cl0ckmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 15:11:48",
            "last_seen_utc": "2025-11-23 15:13:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649320": [
        {
            "ioc_value": "wndb.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 15:07:38",
            "last_seen_utc": "2025-11-23 15:10:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649319": [
        {
            "ioc_value": "ex6.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 14:57:22",
            "last_seen_utc": "2025-11-23 15:06:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649317": [
        {
            "ioc_value": "briar.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 14:50:08",
            "last_seen_utc": "2025-11-23 14:50:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649316": [
        {
            "ioc_value": "alder3.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 14:47:29",
            "last_seen_utc": "2025-11-23 14:47:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649312": [
        {
            "ioc_value": "moss6.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 14:37:12",
            "last_seen_utc": "2025-11-23 14:42:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649311": [
        {
            "ioc_value": "gate8.alderstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 14:26:55",
            "last_seen_utc": "2025-11-23 14:30:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649309": [
        {
            "ioc_value": "ridge.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 14:18:07",
            "last_seen_utc": "2025-11-23 14:26:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649307": [
        {
            "ioc_value": "north5.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 14:03:43",
            "last_seen_utc": "2025-11-23 14:13:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649306": [
        {
            "ioc_value": "k7t.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 13:52:57",
            "last_seen_utc": "2025-11-23 13:58:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649304": [
        {
            "ioc_value": "trail2.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 13:47:44",
            "last_seen_utc": "2025-11-23 13:47:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649303": [
        {
            "ioc_value": "14b6.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 13:35:19",
            "last_seen_utc": "2025-11-23 13:41:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649302": [
        {
            "ioc_value": "briar9.prairieforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 13:27:34",
            "last_seen_utc": "2025-11-23 13:29:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649301": [
        {
            "ioc_value": "trail0.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 13:15:15",
            "last_seen_utc": "2025-11-23 13:20:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649300": [
        {
            "ioc_value": "ember6.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 13:08:24",
            "last_seen_utc": "2025-11-23 13:15:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649299": [
        {
            "ioc_value": "meer.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 12:57:06",
            "last_seen_utc": "2025-11-23 13:04:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649296": [
        {
            "ioc_value": "vale2.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 12:46:49",
            "last_seen_utc": "2025-11-23 12:54:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649295": [
        {
            "ioc_value": "prairie.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 12:38:03",
            "last_seen_utc": "2025-11-23 12:40:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649294": [
        {
            "ioc_value": "moss.regenwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 12:27:47",
            "last_seen_utc": "2025-11-23 12:33:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649293": [
        {
            "ioc_value": "4f8a.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 12:17:33",
            "last_seen_utc": "2025-11-23 12:24:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649284": [
        {
            "ioc_value": "gate5.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 12:05:34",
            "last_seen_utc": "2025-11-23 12:14:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649280": [
        {
            "ioc_value": "wald.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 11:57:20",
            "last_seen_utc": "2025-11-23 11:58:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649279": [
        {
            "ioc_value": "3oil.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 11:47:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649278": [
        {
            "ioc_value": "ember.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 11:37:11",
            "last_seen_utc": "2025-11-23 11:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649277": [
        {
            "ioc_value": "grove.wolkenmeer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 11:26:49",
            "last_seen_utc": "2025-11-23 11:27:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649276": [
        {
            "ioc_value": "bkldz.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 11:18:04",
            "last_seen_utc": "2025-11-23 11:19:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649275": [
        {
            "ioc_value": "pacific-requirement.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-23 11:16:03",
            "last_seen_utc": "2025-12-12 18:39:24",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649274": [
        {
            "ioc_value": "everyone-constructed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-23 11:16:02",
            "last_seen_utc": "2025-12-12 18:39:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649271": [
        {
            "ioc_value": "yovngmandaynotu-43886.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:09",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649262": [
        {
            "ioc_value": "s3aw936qw6-60719.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:08",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649263": [
        {
            "ioc_value": "southern-offers.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:08",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649264": [
        {
            "ioc_value": "supply-pottery.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:08",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649265": [
        {
            "ioc_value": "texas-stockings.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:08",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649266": [
        {
            "ioc_value": "thiago8786-47707.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:08",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649267": [
        {
            "ioc_value": "urmomisgay34234-43734.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:08",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649268": [
        {
            "ioc_value": "vehicle-duck.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:08",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649269": [
        {
            "ioc_value": "xfpxfpxfp-58223.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:08",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649270": [
        {
            "ioc_value": "yesir123-55857.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:08",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649252": [
        {
            "ioc_value": "malware.kallisti.uk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649253": [
        {
            "ioc_value": "malware.www.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649254": [
        {
            "ioc_value": "memory-retention.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649255": [
        {
            "ioc_value": "milisie12-56888.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649256": [
        {
            "ioc_value": "mxckxxn-58785.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649257": [
        {
            "ioc_value": "piyeno-52807.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649258": [
        {
            "ioc_value": "ragaven09-21698.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649259": [
        {
            "ioc_value": "regarding-hunt.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649260": [
        {
            "ioc_value": "resource-uv.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649261": [
        {
            "ioc_value": "rngrz-86-92-45-65.a.free.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:07",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649241": [
        {
            "ioc_value": "hospital-agreed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649242": [
        {
            "ioc_value": "introduction-guestbook.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649243": [
        {
            "ioc_value": "jeni85-58537.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649244": [
        {
            "ioc_value": "joyasen522-45848.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649245": [
        {
            "ioc_value": "jul-recommended.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649246": [
        {
            "ioc_value": "kokino-60107.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649247": [
        {
            "ioc_value": "lasyu-50008.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649248": [
        {
            "ioc_value": "mac-m4.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649249": [
        {
            "ioc_value": "mac-thai.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649250": [
        {
            "ioc_value": "malware.brentwood-operatic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649251": [
        {
            "ioc_value": "malware.dcfl.cn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:06",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649229": [
        {
            "ioc_value": "data.kallisti.uk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649230": [
        {
            "ioc_value": "data.www.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649231": [
        {
            "ioc_value": "ddos.brentwood-operatic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649232": [
        {
            "ioc_value": "ddos.dcfl.cn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649233": [
        {
            "ioc_value": "ddos.kallisti.uk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649234": [
        {
            "ioc_value": "ddos.www.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649235": [
        {
            "ioc_value": "defender.proces",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649236": [
        {
            "ioc_value": "ef590o1ari-44145.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649237": [
        {
            "ioc_value": "ensure-witness.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649238": [
        {
            "ioc_value": "fjaf-46175.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649239": [
        {
            "ioc_value": "h3javff1-40716.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649240": [
        {
            "ioc_value": "hard-jelsoft.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:05",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649224": [
        {
            "ioc_value": "available-discussion.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:04",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649225": [
        {
            "ioc_value": "condition-macedonia.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:04",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649226": [
        {
            "ioc_value": "coreuiwin.sys",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649227": [
        {
            "ioc_value": "data.brentwood-operatic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:04",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649228": [
        {
            "ioc_value": "data.dcfl.cn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 11:15:04",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649218": [
        {
            "ioc_value": "www.xoilac86v.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:33",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649219": [
        {
            "ioc_value": "www.xoilac86w.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:33",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649220": [
        {
            "ioc_value": "www.xoilac86x.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:33",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649221": [
        {
            "ioc_value": "www.xoilac86y.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:33",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649222": [
        {
            "ioc_value": "www.xoilac86z.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:33",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649203": [
        {
            "ioc_value": "www.xoilac86f.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649204": [
        {
            "ioc_value": "www.xoilac86g.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649205": [
        {
            "ioc_value": "www.xoilac86h.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649206": [
        {
            "ioc_value": "www.xoilac86i.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649207": [
        {
            "ioc_value": "www.xoilac86j.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649208": [
        {
            "ioc_value": "www.xoilac86k.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649209": [
        {
            "ioc_value": "www.xoilac86l.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649210": [
        {
            "ioc_value": "www.xoilac86m.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649211": [
        {
            "ioc_value": "www.xoilac86n.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649212": [
        {
            "ioc_value": "www.xoilac86o.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649213": [
        {
            "ioc_value": "www.xoilac86p.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649214": [
        {
            "ioc_value": "www.xoilac86q.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649215": [
        {
            "ioc_value": "www.xoilac86r.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649216": [
        {
            "ioc_value": "www.xoilac86t.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649217": [
        {
            "ioc_value": "www.xoilac86u.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649197": [
        {
            "ioc_value": "api.chatboxn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:31",
            "last_seen_utc": "2025-11-23 11:13:31",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649198": [
        {
            "ioc_value": "fb.sportliveapiz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:31",
            "last_seen_utc": "2025-11-23 11:13:31",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649199": [
        {
            "ioc_value": "www.xoilac86b.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:31",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649200": [
        {
            "ioc_value": "www.xoilac86c.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:31",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649201": [
        {
            "ioc_value": "www.xoilac86d.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:31",
            "last_seen_utc": "2025-11-23 11:13:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649202": [
        {
            "ioc_value": "www.xoilac86e.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-23 11:13:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1649195": [
        {
            "ioc_value": "mist.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 11:07:46",
            "last_seen_utc": "2025-11-23 11:17:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649186": [
        {
            "ioc_value": "spark.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 10:58:00",
            "last_seen_utc": "2025-11-23 11:06:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649185": [
        {
            "ioc_value": "kqa.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 10:43:38",
            "last_seen_utc": "2025-11-23 10:45:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649184": [
        {
            "ioc_value": "pyo9.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 10:41:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649183": [
        {
            "ioc_value": "i10r.thornecho.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 10:38:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649182": [
        {
            "ioc_value": "echo.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 10:27:33",
            "last_seen_utc": "2025-11-23 10:31:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649181": [
        {
            "ioc_value": "alder.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 10:17:15",
            "last_seen_utc": "2025-11-23 10:27:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649180": [
        {
            "ioc_value": "jtd.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 10:00:21",
            "last_seen_utc": "2025-11-23 10:01:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649179": [
        {
            "ioc_value": "3gmi.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 09:57:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649178": [
        {
            "ioc_value": "dw.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 09:47:03",
            "last_seen_utc": "2025-11-23 09:50:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649177": [
        {
            "ioc_value": "mp.lanternbrook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 09:38:08",
            "last_seen_utc": "2025-11-23 09:46:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649176": [
        {
            "ioc_value": "a4za.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 09:25:44",
            "last_seen_utc": "2025-11-23 09:29:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649175": [
        {
            "ioc_value": "0gs.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 09:14:27",
            "last_seen_utc": "2025-11-23 09:22:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649174": [
        {
            "ioc_value": "y2aew.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 08:47:16",
            "last_seen_utc": "2025-11-23 08:55:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649173": [
        {
            "ioc_value": "s622.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 08:38:24",
            "last_seen_utc": "2025-11-23 08:40:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649172": [
        {
            "ioc_value": "1acn.mossgate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 08:27:06",
            "last_seen_utc": "2025-11-23 08:59:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649171": [
        {
            "ioc_value": "wolken6.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 08:17:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649170": [
        {
            "ioc_value": "meer6.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 08:07:56",
            "last_seen_utc": "2025-11-23 08:11:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649162": [
        {
            "ioc_value": "11.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 07:57:32",
            "last_seen_utc": "2025-11-23 08:00:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649161": [
        {
            "ioc_value": "ae09.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 07:47:44",
            "last_seen_utc": "2025-11-23 07:56:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649156": [
        {
            "ioc_value": "pu.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 07:37:27",
            "last_seen_utc": "2025-11-23 07:47:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649155": [
        {
            "ioc_value": "regen7.briarhaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 07:22:04",
            "last_seen_utc": "2025-11-23 07:24:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649153": [
        {
            "ioc_value": "u9ldz.jatrophizt.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 07:17:24",
            "last_seen_utc": "2025-11-23 07:18:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649152": [
        {
            "ioc_value": "402f1.digncbe.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 07:06:59",
            "last_seen_utc": "2025-11-23 07:14:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649151": [
        {
            "ioc_value": "node.digncbe.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 06:57:12",
            "last_seen_utc": "2025-11-23 06:58:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649149": [
        {
            "ioc_value": "kw.digncbe.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 06:47:57",
            "last_seen_utc": "2025-11-23 06:49:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649147": [
        {
            "ioc_value": "grid.digncbe.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 06:33:35",
            "last_seen_utc": "2025-11-23 06:36:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649146": [
        {
            "ioc_value": "bharatmanufactoryhalo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-23 06:26:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/82a6ebc4ce6cc397cbcc8c7002901a83a2568beec4fa88e279a5f0512fdf5085/",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649144": [
        {
            "ioc_value": "skibidifdisdapofs-44028.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 06:01:18",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-bkn2vssmam",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649141": [
        {
            "ioc_value": "windows10-11.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 06:01:17",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-bmnh4swnhy",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649142": [
        {
            "ioc_value": "went-hello.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 06:01:17",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-blejtawne1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649143": [
        {
            "ioc_value": "skibidirizzlers-35927.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 06:01:17",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-blc1zswney",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649140": [
        {
            "ioc_value": "mywhitelab.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-23 06:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-ee99paymez",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649139": [
        {
            "ioc_value": "xwormofficial-38913.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-23 06:00:16",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251123-eq1jmaype1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1649137": [
        {
            "ioc_value": "pink.l0ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 04:18:26",
            "last_seen_utc": "2025-11-23 04:23:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649136": [
        {
            "ioc_value": "y3q6.l0ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 04:07:10",
            "last_seen_utc": "2025-11-23 04:18:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649128": [
        {
            "ioc_value": "lv5j.l0ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 03:57:49",
            "last_seen_utc": "2025-11-23 04:05:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649127": [
        {
            "ioc_value": "shop0.l0ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 03:48:02",
            "last_seen_utc": "2025-11-23 03:53:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649126": [
        {
            "ioc_value": "stop.m0rning.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 03:37:44",
            "last_seen_utc": "2025-11-23 03:44:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649125": [
        {
            "ioc_value": "road.m0rning.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 03:27:58",
            "last_seen_utc": "2025-11-23 03:28:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649124": [
        {
            "ioc_value": "echo.m0rning.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 03:17:41",
            "last_seen_utc": "2025-11-23 03:21:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649123": [
        {
            "ioc_value": "v81h.m0rning.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 03:07:24",
            "last_seen_utc": "2025-11-23 03:08:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649121": [
        {
            "ioc_value": "morning1.cleardrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 02:51:24",
            "last_seen_utc": "2025-11-23 02:56:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649120": [
        {
            "ioc_value": "burst1.cleardrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 02:47:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649119": [
        {
            "ioc_value": "dje.cleardrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 02:36:18",
            "last_seen_utc": "2025-11-23 02:46:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649118": [
        {
            "ioc_value": "road7.cleardrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 02:28:02",
            "last_seen_utc": "2025-11-23 02:30:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649117": [
        {
            "ioc_value": "ljy.r0ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 02:15:06",
            "last_seen_utc": "2025-11-23 02:21:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649116": [
        {
            "ioc_value": "c7x5i.r0ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 02:07:52",
            "last_seen_utc": "2025-11-23 02:08:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649115": [
        {
            "ioc_value": "2bhkg.r0ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 01:57:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649113": [
        {
            "ioc_value": "shadow2.r0ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 01:47:43",
            "last_seen_utc": "2025-11-23 01:49:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649111": [
        {
            "ioc_value": "tiger.ta11y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 01:37:35",
            "last_seen_utc": "2025-11-23 01:40:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649110": [
        {
            "ioc_value": "kul.ta11y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 01:27:37",
            "last_seen_utc": "2025-11-23 01:32:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649095": [
        {
            "ioc_value": "us.zepwk111.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:21",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/f9c20d69301b20542dc5de0ce3be3df0fcf0f6ccef4f554de322c27f76698743/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649094": [
        {
            "ioc_value": "smallx1.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:17",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/b583a1ff97c3887a0a46983b9c4386c4aa0d417f0c391a5b924779ee67e08ccd/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649093": [
        {
            "ioc_value": "psdf",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:16",
            "last_seen_utc": "2025-11-23 15:05:39",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/b5f6bde9fd8fdedc76d3756d66addc819f60f82c46eba2601190f13b5eb11ed8/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649092": [
        {
            "ioc_value": "mimaletamusical.gleeze.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:13",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/c516f7ead2da1acb25836c6b43db1401b492ce29c0b3d5f07c23ba38c0518115/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649091": [
        {
            "ioc_value": "malware.xoilaczzzoz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:11",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/bc29c3700a5385a9b41017ccb412c5013e28f0bba580e986d14bcb25f78fde2a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649089": [
        {
            "ioc_value": "malware.xoilaczzzgz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:10",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/af1470452b0062405ba352ea15e4a7114aae212ee2c8146a4f23e19afc7a7f53/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649090": [
        {
            "ioc_value": "malware.xoilaczzzjz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:10",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/b44903e2d5f16cab10161d03750d7d2c07e0f901cca0485bffc9d606628519ee/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649087": [
        {
            "ioc_value": "malware.xoilaczzazz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:09",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/be22132f68335602928f3f51400018bbfb4e8fbd37346c9d959006f2e40ed200/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649088": [
        {
            "ioc_value": "malware.xoilaczzzez.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:09",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/e828e55c7c7fb2ebbfcc527acdf728dd8e9cd219a1a64956151b61ef5ddb2436/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649086": [
        {
            "ioc_value": "malware.nixt.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:07",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/ae2a7a916d11a3a0c49c94a0720d9cb4c48bcdfecad486b022589f9a6d314638/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649085": [
        {
            "ioc_value": "malware.darktide.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:06",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/d1e299ededf2c8a2cbceb92190fa1185b87c586cb7bb280325bf961a9f2a15af/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649084": [
        {
            "ioc_value": "malware.8services2point0.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:05",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/d62a9cd63449595b6d503062987db48a886751639aeb1a842ba33682199131cb/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649083": [
        {
            "ioc_value": "headquarter.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:26:02",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/e195cfa8798bfe9147a6b32d8762d793a70745d5472d9dedd872996a098d2f6c/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649082": [
        {
            "ioc_value": "ethh.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:58",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/f92dfa0dd1f33115f3d57f0dca422485115db759d04413367e4c8ad9ce5638d1/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649081": [
        {
            "ioc_value": "ddos.xoilaczzzoz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:56",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/bc29c3700a5385a9b41017ccb412c5013e28f0bba580e986d14bcb25f78fde2a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649079": [
        {
            "ioc_value": "ddos.xoilaczzzgz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:55",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/af1470452b0062405ba352ea15e4a7114aae212ee2c8146a4f23e19afc7a7f53/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649080": [
        {
            "ioc_value": "ddos.xoilaczzzjz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:55",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/b44903e2d5f16cab10161d03750d7d2c07e0f901cca0485bffc9d606628519ee/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649077": [
        {
            "ioc_value": "ddos.xoilaczzazz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:54",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/be22132f68335602928f3f51400018bbfb4e8fbd37346c9d959006f2e40ed200/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649078": [
        {
            "ioc_value": "ddos.xoilaczzzez.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:54",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/e828e55c7c7fb2ebbfcc527acdf728dd8e9cd219a1a64956151b61ef5ddb2436/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649076": [
        {
            "ioc_value": "ddos.nixt.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:52",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/ae2a7a916d11a3a0c49c94a0720d9cb4c48bcdfecad486b022589f9a6d314638/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649075": [
        {
            "ioc_value": "ddos.darktide.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:51",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/d1e299ededf2c8a2cbceb92190fa1185b87c586cb7bb280325bf961a9f2a15af/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649074": [
        {
            "ioc_value": "ddos.8services2point0.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:50",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/d62a9cd63449595b6d503062987db48a886751639aeb1a842ba33682199131cb/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649073": [
        {
            "ioc_value": "data.xoilaczzzoz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:49",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/bc29c3700a5385a9b41017ccb412c5013e28f0bba580e986d14bcb25f78fde2a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649070": [
        {
            "ioc_value": "data.xoilaczzzez.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:48",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/e828e55c7c7fb2ebbfcc527acdf728dd8e9cd219a1a64956151b61ef5ddb2436/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649071": [
        {
            "ioc_value": "data.xoilaczzzgz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:48",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/af1470452b0062405ba352ea15e4a7114aae212ee2c8146a4f23e19afc7a7f53/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649072": [
        {
            "ioc_value": "data.xoilaczzzjz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:48",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/b44903e2d5f16cab10161d03750d7d2c07e0f901cca0485bffc9d606628519ee/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649069": [
        {
            "ioc_value": "data.xoilaczzazz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:47",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/be22132f68335602928f3f51400018bbfb4e8fbd37346c9d959006f2e40ed200/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649067": [
        {
            "ioc_value": "data.darktide.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:45",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/d1e299ededf2c8a2cbceb92190fa1185b87c586cb7bb280325bf961a9f2a15af/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649068": [
        {
            "ioc_value": "data.nixt.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:45",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/ae2a7a916d11a3a0c49c94a0720d9cb4c48bcdfecad486b022589f9a6d314638/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649066": [
        {
            "ioc_value": "data.8services2point0.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:44",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/d62a9cd63449595b6d503062987db48a886751639aeb1a842ba33682199131cb/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649065": [
        {
            "ioc_value": "127.00.1",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:25:37",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/ae2f768542a28598450d84dd890b43ce19d0495f721c5acee62649a0546301db/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649045": [
        {
            "ioc_value": "rat.example",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:52",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/a82a843f2d397ba0e79c879699843e563681a944dba6d9b2dfb438baeca1819a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649046": [
        {
            "ioc_value": "shenlong.eu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:52",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/8a9f36cfc9ad6277e40222b0d6480e8d530e926c873fc45d68665f2482d7f55a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649044": [
        {
            "ioc_value": "ntmahamachi.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:50",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/818e961a03ac974e50bd261b8c0b76c01d741f8d93bf608d97bab0b6a15a45dc/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649043": [
        {
            "ioc_value": "malware.xoilaczzzlz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:48",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/714c526ffaafd548700065a4ae550b4c73e2f3a72653dbd9b112acdac86a4e27/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649040": [
        {
            "ioc_value": "malware.xoilaczzzaz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:47",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/82bf83b603ed61f07416cd0a2ecc888e9fa58b366f2e566bff811c2e339f9f04/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649041": [
        {
            "ioc_value": "malware.xoilaczzzfz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:47",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7497dd1eb30c167abcb1d9d1c340c4c41eabac6f1c665fcd116974653825c574/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649042": [
        {
            "ioc_value": "malware.xoilaczzzkz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:47",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7e9cc85fa40579b1be47941326787c65e08e9ca0526149c234b311acd0c1a914/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649039": [
        {
            "ioc_value": "malware.xoilaczzpzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:46",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/abf0509b0b4dd75f5e3b1391a29c5284453a975111930e51b7a7cd0614e75dbf/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649037": [
        {
            "ioc_value": "malware.otisgrand.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:45",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/6b44e4a950b8f05aacc4cd219682ff3c4c5533ce31efc3f3e333bdd802f639c4/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649038": [
        {
            "ioc_value": "malware.sociall.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:45",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/77a80dda2664890cdc32e2e4dea682a65715bf4ed4adab1dbea72b3938f32caa/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649034": [
        {
            "ioc_value": "malware.dstat.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:44",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/71378650d3dc38c55c184ba81322695567fb860df07b11d0d2cdf1b72917e885/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649035": [
        {
            "ioc_value": "malware.medienundbildung.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:44",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/aacf6f8eeee52b8e64c1fc12666a1f2f9153b8cef8dc66b1dec5a4ecf0208a65/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649036": [
        {
            "ioc_value": "malware.nahproject.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:44",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/9d432d3e4942747ef47d20f4d6648dc68c1a1110994d7569b9be5d8511d1eabf/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649033": [
        {
            "ioc_value": "heniken.eu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:42",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/8a9f36cfc9ad6277e40222b0d6480e8d530e926c873fc45d68665f2482d7f55a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649031": [
        {
            "ioc_value": "ddos.xoilaczzzkz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:37",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7e9cc85fa40579b1be47941326787c65e08e9ca0526149c234b311acd0c1a914/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649032": [
        {
            "ioc_value": "ddos.xoilaczzzlz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:37",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/714c526ffaafd548700065a4ae550b4c73e2f3a72653dbd9b112acdac86a4e27/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649028": [
        {
            "ioc_value": "ddos.xoilaczzpzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:36",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/abf0509b0b4dd75f5e3b1391a29c5284453a975111930e51b7a7cd0614e75dbf/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649029": [
        {
            "ioc_value": "ddos.xoilaczzzaz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:36",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/82bf83b603ed61f07416cd0a2ecc888e9fa58b366f2e566bff811c2e339f9f04/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649030": [
        {
            "ioc_value": "ddos.xoilaczzzfz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:36",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7497dd1eb30c167abcb1d9d1c340c4c41eabac6f1c665fcd116974653825c574/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649027": [
        {
            "ioc_value": "ddos.sociall.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:35",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/77a80dda2664890cdc32e2e4dea682a65715bf4ed4adab1dbea72b3938f32caa/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649025": [
        {
            "ioc_value": "ddos.nahproject.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:34",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/9d432d3e4942747ef47d20f4d6648dc68c1a1110994d7569b9be5d8511d1eabf/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649026": [
        {
            "ioc_value": "ddos.otisgrand.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:34",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/6b44e4a950b8f05aacc4cd219682ff3c4c5533ce31efc3f3e333bdd802f639c4/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649023": [
        {
            "ioc_value": "ddos.dstat.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:33",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/71378650d3dc38c55c184ba81322695567fb860df07b11d0d2cdf1b72917e885/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649024": [
        {
            "ioc_value": "ddos.medienundbildung.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:33",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/aacf6f8eeee52b8e64c1fc12666a1f2f9153b8cef8dc66b1dec5a4ecf0208a65/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649021": [
        {
            "ioc_value": "data.xoilaczzzkz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:32",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7e9cc85fa40579b1be47941326787c65e08e9ca0526149c234b311acd0c1a914/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649022": [
        {
            "ioc_value": "data.xoilaczzzlz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:32",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/714c526ffaafd548700065a4ae550b4c73e2f3a72653dbd9b112acdac86a4e27/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649018": [
        {
            "ioc_value": "data.xoilaczzpzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:31",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/abf0509b0b4dd75f5e3b1391a29c5284453a975111930e51b7a7cd0614e75dbf/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649019": [
        {
            "ioc_value": "data.xoilaczzzaz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:31",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/82bf83b603ed61f07416cd0a2ecc888e9fa58b366f2e566bff811c2e339f9f04/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649020": [
        {
            "ioc_value": "data.xoilaczzzfz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:31",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7497dd1eb30c167abcb1d9d1c340c4c41eabac6f1c665fcd116974653825c574/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649017": [
        {
            "ioc_value": "data.sociall.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:30",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/77a80dda2664890cdc32e2e4dea682a65715bf4ed4adab1dbea72b3938f32caa/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649014": [
        {
            "ioc_value": "data.medienundbildung.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:29",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/aacf6f8eeee52b8e64c1fc12666a1f2f9153b8cef8dc66b1dec5a4ecf0208a65/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649015": [
        {
            "ioc_value": "data.nahproject.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:29",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/9d432d3e4942747ef47d20f4d6648dc68c1a1110994d7569b9be5d8511d1eabf/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649016": [
        {
            "ioc_value": "data.otisgrand.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:29",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/6b44e4a950b8f05aacc4cd219682ff3c4c5533ce31efc3f3e333bdd802f639c4/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649013": [
        {
            "ioc_value": "data.dstat.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:28",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/71378650d3dc38c55c184ba81322695567fb860df07b11d0d2cdf1b72917e885/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649012": [
        {
            "ioc_value": "anydesks.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:26",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/79a155fa66cc9abadeef1470f5b8c07383949915cc64948dec43b40f2c18be19/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649011": [
        {
            "ioc_value": "5jlyx6kem.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:24",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/7a13c17fde495025504e34a8d8bc755fd939007e296dc717d24a58e4f937ed0e/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649010": [
        {
            "ioc_value": "1stadd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 01:20:23",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/822513a81a5c5a24c65b8139c65c91b78b9565f95b09176de500e3568b336932/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1649009": [
        {
            "ioc_value": "clear1.ta11y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 01:17:19",
            "last_seen_utc": "2025-11-23 01:21:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649008": [
        {
            "ioc_value": "5weuo.ta11y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 01:08:00",
            "last_seen_utc": "2025-11-23 01:09:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649007": [
        {
            "ioc_value": "pq591.r1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 01:04:20",
            "last_seen_utc": "2025-11-23 01:08:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649005": [
        {
            "ioc_value": "fw.r1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 00:58:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649004": [
        {
            "ioc_value": "river4.r1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 00:41:42",
            "last_seen_utc": "2025-11-23 00:48:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1649003": [
        {
            "ioc_value": "ev.r1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 00:38:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648994": [
        {
            "ioc_value": "wifilan.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:31:03",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/3c36199f3ef466a270b479f0599781fc76d196a6f2eb7a153e1e2d86bc61607d/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648992": [
        {
            "ioc_value": "malware.xoilaczzznz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:57",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/47db8468f466c940712e997e02d2e96fa679680f2b59af6c92347c76513e0a1a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648993": [
        {
            "ioc_value": "malware.xoilaczzzpz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:57",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/3e5ecba11fe4a2d58c2fe0f880cb06ae2e094d88b30e12403abc9b85b021e500/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648991": [
        {
            "ioc_value": "malware.stope40.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:56",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5d178afd73e7ec067b5298bf1eb95f7b2070fb579c65a0fcece2335dcf84c54c/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648989": [
        {
            "ioc_value": "malware.antiracistusa.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:55",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5c9099e6b0ab7c80e057597797bd73165a20b82fa478b9426480189611763abe/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648990": [
        {
            "ioc_value": "malware.cakhiaok.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:55",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/3fe8f4417953e01e926f7f596c974ca4b18602f3367f4f765349a1500137b84c/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648987": [
        {
            "ioc_value": "ddos.xoilaczzznz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:50",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/47db8468f466c940712e997e02d2e96fa679680f2b59af6c92347c76513e0a1a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648988": [
        {
            "ioc_value": "ddos.xoilaczzzpz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:50",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/3e5ecba11fe4a2d58c2fe0f880cb06ae2e094d88b30e12403abc9b85b021e500/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648985": [
        {
            "ioc_value": "ddos.cakhiaok.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:49",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/3fe8f4417953e01e926f7f596c974ca4b18602f3367f4f765349a1500137b84c/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648986": [
        {
            "ioc_value": "ddos.stope40.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:49",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5d178afd73e7ec067b5298bf1eb95f7b2070fb579c65a0fcece2335dcf84c54c/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648982": [
        {
            "ioc_value": "data.xoilaczzznz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:48",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/47db8468f466c940712e997e02d2e96fa679680f2b59af6c92347c76513e0a1a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648983": [
        {
            "ioc_value": "data.xoilaczzzpz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:48",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/3e5ecba11fe4a2d58c2fe0f880cb06ae2e094d88b30e12403abc9b85b021e500/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648984": [
        {
            "ioc_value": "ddos.antiracistusa.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:48",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5c9099e6b0ab7c80e057597797bd73165a20b82fa478b9426480189611763abe/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648981": [
        {
            "ioc_value": "data.stope40.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:47",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5d178afd73e7ec067b5298bf1eb95f7b2070fb579c65a0fcece2335dcf84c54c/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648979": [
        {
            "ioc_value": "data.antiracistusa.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:46",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5c9099e6b0ab7c80e057597797bd73165a20b82fa478b9426480189611763abe/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648980": [
        {
            "ioc_value": "data.cakhiaok.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:46",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/3fe8f4417953e01e926f7f596c974ca4b18602f3367f4f765349a1500137b84c/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648976": [
        {
            "ioc_value": "aafraarania.ddnsking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:44",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5cf7ddfa23907ed2b33c3dd5942345c9be45faf5dd2df832dbcf31a0eaeaad02/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648977": [
        {
            "ioc_value": "ad.myftp.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:44",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/652d6a8f453a324daf5f9536196e621265434277f5cd685e281f7414c0168f52/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648978": [
        {
            "ioc_value": "alexisfargo425.myvnc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:30:44",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5e8e57b0ee5752bdd72847473b6854186a54bb7c2c9d181bd4c0c81af873ea3a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648951": [
        {
            "ioc_value": "yPZmTJDDnmJhkwf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:26:00",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648952": [
        {
            "ioc_value": "ytXDZUKKgHETqys.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:26:00",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648950": [
        {
            "ioc_value": "xMfLSMPKBWsgmUC.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:59",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648948": [
        {
            "ioc_value": "uxtyyvxtwvwvxurp.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:58",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/286d010b39e56c40de1022086ad9c4a8a733d56f2946fe068d182b7074602041/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648949": [
        {
            "ioc_value": "VYJjpyHabYhrJDd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:58",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648946": [
        {
            "ioc_value": "RgNSTMHSnjafPEX.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:56",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648947": [
        {
            "ioc_value": "RHjqJCxmCalXXEe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:56",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648944": [
        {
            "ioc_value": "QfFaRBPqOoJQqEF.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648945": [
        {
            "ioc_value": "QVggEpcffTSfXLG.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648942": [
        {
            "ioc_value": "o6tqyui3rxxk2sfghduiypzz7pxlym.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:54",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648943": [
        {
            "ioc_value": "officeworld.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:54",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/118d7d4802a5999c8b317fd7fdf1808449611607cdd211a1d7a7ca9217173a02/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648941": [
        {
            "ioc_value": "moNxVtjgeWpPVUz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:53",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648940": [
        {
            "ioc_value": "malware.xoilaczzzxz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:52",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/27a0393aef65bdd9ed7d22908b5ed18467b4481f6adc68b792b32b8ae60a6029/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648938": [
        {
            "ioc_value": "malware.xoilacva.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:51",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/1c351beed964de0b168e06b559870bd206ad5e3473d80ed1411b63337eb4eb97/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648939": [
        {
            "ioc_value": "malware.xoilaczzzcz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:51",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/11256937ccb7a761895ff40c3def0883b43f13a749979491646c110aae30967a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648935": [
        {
            "ioc_value": "kw.atrishop.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:50",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/2fcd1eec9397978660ebf6dd9a07d0992ca9b4a9c9711b07afae20e5f55fc7a5/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648936": [
        {
            "ioc_value": "malware.propxx.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:50",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/21115cba44d1a5ebc6f1fd9317d9e4726d261e3a7418d8a979c3b9c59cf06e83/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648937": [
        {
            "ioc_value": "malware.rogerperrybook.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:50",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/35ebd260624419050dee839d86b2cfcab62bbb3cb3413d4edc604b2ceb1cfdac/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648934": [
        {
            "ioc_value": "jwy1nw4mcx2svbmvgo76.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:49",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648933": [
        {
            "ioc_value": "JDIsOivQCBlbzlN.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648932": [
        {
            "ioc_value": "FHXvaxLSFIDvieO.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648929": [
        {
            "ioc_value": "ddos.xoilaczzzxz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:46",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/27a0393aef65bdd9ed7d22908b5ed18467b4481f6adc68b792b32b8ae60a6029/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648930": [
        {
            "ioc_value": "DGnZQjkVDhsxgVV.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648931": [
        {
            "ioc_value": "DqUTFasmBwlEIBT.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648926": [
        {
            "ioc_value": "ddos.rogerperrybook.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:45",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/35ebd260624419050dee839d86b2cfcab62bbb3cb3413d4edc604b2ceb1cfdac/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648927": [
        {
            "ioc_value": "ddos.xoilacva.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:45",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/1c351beed964de0b168e06b559870bd206ad5e3473d80ed1411b63337eb4eb97/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648928": [
        {
            "ioc_value": "ddos.xoilaczzzcz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:45",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/11256937ccb7a761895ff40c3def0883b43f13a749979491646c110aae30967a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648924": [
        {
            "ioc_value": "data.xoilaczzzxz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:44",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/27a0393aef65bdd9ed7d22908b5ed18467b4481f6adc68b792b32b8ae60a6029/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648925": [
        {
            "ioc_value": "ddos.propxx.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:44",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/21115cba44d1a5ebc6f1fd9317d9e4726d261e3a7418d8a979c3b9c59cf06e83/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648922": [
        {
            "ioc_value": "data.xoilacva.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:43",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/1c351beed964de0b168e06b559870bd206ad5e3473d80ed1411b63337eb4eb97/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648923": [
        {
            "ioc_value": "data.xoilaczzzcz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:43",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/11256937ccb7a761895ff40c3def0883b43f13a749979491646c110aae30967a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648920": [
        {
            "ioc_value": "data.propxx.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:42",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/21115cba44d1a5ebc6f1fd9317d9e4726d261e3a7418d8a979c3b9c59cf06e83/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648921": [
        {
            "ioc_value": "data.rogerperrybook.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:42",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/35ebd260624419050dee839d86b2cfcab62bbb3cb3413d4edc604b2ceb1cfdac/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648918": [
        {
            "ioc_value": "atrishop.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:41",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/2fcd1eec9397978660ebf6dd9a07d0992ca9b4a9c9711b07afae20e5f55fc7a5/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648919": [
        {
            "ioc_value": "ByZBzewBiKXuqUR.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:25:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648917": [
        {
            "ioc_value": "em8ix.st0neflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 00:22:40",
            "last_seen_utc": "2025-11-23 00:30:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648916": [
        {
            "ioc_value": "flash.st0neflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 00:17:28",
            "last_seen_utc": "2025-11-23 00:19:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648915": [
        {
            "ioc_value": "burst2.st0neflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-23 00:08:47",
            "last_seen_utc": "2025-11-23 00:13:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648904": [
        {
            "ioc_value": "malware.xoilaczzzmz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:18",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/02d47db3ebd7be5a7b84637b07745803cbe5e13f7bca96ad4ce2c61f01da92c0/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648903": [
        {
            "ioc_value": "malware.xoilaczzzhz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:17",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/068c0431268b3dc15bc688b5f0d46a5d0b5b1e5171d8604c8902405b7cd034ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648902": [
        {
            "ioc_value": "malware.xoilacv.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:16",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/0a7f16dea062bfcaa5456024ee32936811c5b859f8b505edabf6b1c6ceea8c2a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648901": [
        {
            "ioc_value": "malware.womensoundoff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:15",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/0796303fbfd8930ebde66e7dfd8ab79c3d648d6eb6ed7462719f433eb3af4642/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648900": [
        {
            "ioc_value": "kamal199.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:14",
            "last_seen_utc": "2025-12-12 18:37:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/02b713428a79988d28fd2577ac8622f2088b649454ea9bec830abe6a8a4cface/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648899": [
        {
            "ioc_value": "hostdgg.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:13",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/05ae34307fefa22875a6ef1c5fd7f4a19b26c86778b5cfdc0052199d337e358b/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648898": [
        {
            "ioc_value": "ddos.xoilaczzzmz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:10",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/02d47db3ebd7be5a7b84637b07745803cbe5e13f7bca96ad4ce2c61f01da92c0/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648896": [
        {
            "ioc_value": "ddos.xoilacv.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:09",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/0a7f16dea062bfcaa5456024ee32936811c5b859f8b505edabf6b1c6ceea8c2a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648897": [
        {
            "ioc_value": "ddos.xoilaczzzhz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:09",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/068c0431268b3dc15bc688b5f0d46a5d0b5b1e5171d8604c8902405b7cd034ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648895": [
        {
            "ioc_value": "ddos.womensoundoff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:08",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/0796303fbfd8930ebde66e7dfd8ab79c3d648d6eb6ed7462719f433eb3af4642/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648894": [
        {
            "ioc_value": "dcfl.cn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:07",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/0063d8e23b2227122f876f5c5ffe9df7134714dbcb6b18751417388cd4e1a88c/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648893": [
        {
            "ioc_value": "data.xoilaczzzmz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:06",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/02d47db3ebd7be5a7b84637b07745803cbe5e13f7bca96ad4ce2c61f01da92c0/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648891": [
        {
            "ioc_value": "data.xoilaczzzhz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:04",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/068c0431268b3dc15bc688b5f0d46a5d0b5b1e5171d8604c8902405b7cd034ca/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648890": [
        {
            "ioc_value": "data.xoilacv.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:01:00",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/0a7f16dea062bfcaa5456024ee32936811c5b859f8b505edabf6b1c6ceea8c2a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648889": [
        {
            "ioc_value": "data.womensoundoff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-23 00:00:57",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/0796303fbfd8930ebde66e7dfd8ab79c3d648d6eb6ed7462719f433eb3af4642/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648888": [
        {
            "ioc_value": "pink8.st0neflash.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 23:57:18",
            "last_seen_utc": "2025-11-23 00:06:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648887": [
        {
            "ioc_value": "csgo7777.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-22 23:50:38",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/da394d73bec46c23e371874665fd457d8beb46c2cb04840131ec53e158715067/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1648886": [
        {
            "ioc_value": "burst.y0ur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 23:47:26",
            "last_seen_utc": "2025-11-22 23:53:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648885": [
        {
            "ioc_value": "zdvey.y0ur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 23:37:09",
            "last_seen_utc": "2025-11-22 23:41:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648884": [
        {
            "ioc_value": "rmb.y0ur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 23:26:48",
            "last_seen_utc": "2025-11-22 23:34:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648883": [
        {
            "ioc_value": "spark.y0ur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 23:17:01",
            "last_seen_utc": "2025-11-22 23:18:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648881": [
        {
            "ioc_value": "astrologie-ruddeck.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:16:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648880": [
        {
            "ioc_value": "purposehousepublishing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:12:49",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648877": [
        {
            "ioc_value": "wpboost.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:11:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648875": [
        {
            "ioc_value": "lakhaniglobalsourcing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:10:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648873": [
        {
            "ioc_value": "mondodiponyo.it",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:09:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648871": [
        {
            "ioc_value": "radiohostbrasil.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:08:59",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648869": [
        {
            "ioc_value": "milf-sex-games.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:08:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648867": [
        {
            "ioc_value": "storehouseholdingsinc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:07:25",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648865": [
        {
            "ioc_value": "goal123.wiki",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:04:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648863": [
        {
            "ioc_value": "thortogel.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:03:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648861": [
        {
            "ioc_value": "jaguarsgame.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:02:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648859": [
        {
            "ioc_value": "razzledazzlejewelrystore.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:02:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648858": [
        {
            "ioc_value": "jump2.r1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 23:01:38",
            "last_seen_utc": "2025-11-22 23:13:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648847": [
        {
            "ioc_value": "dassmis.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 23:01:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648840": [
        {
            "ioc_value": "wild7.r1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 22:57:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648838": [
        {
            "ioc_value": "mojtabaabbasi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:56:08",
            "last_seen_utc": "2025-12-10 23:57:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648836": [
        {
            "ioc_value": "domainetarenti.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:55:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648834": [
        {
            "ioc_value": "dog-villa-portal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:54:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648832": [
        {
            "ioc_value": "weendugroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:52:34",
            "last_seen_utc": "2025-12-10 23:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648830": [
        {
            "ioc_value": "fiveonefive.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:51:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648829": [
        {
            "ioc_value": "aburae-labo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648826": [
        {
            "ioc_value": "invoiceguru.co.za",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:49:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648824": [
        {
            "ioc_value": "ieclearbra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:48:59",
            "last_seen_utc": "2025-12-13 15:29:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648822": [
        {
            "ioc_value": "marrakechpalms.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:48:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648821": [
        {
            "ioc_value": "clear2.r1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 22:47:38",
            "last_seen_utc": "2025-11-22 22:56:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648819": [
        {
            "ioc_value": "new.in-cut.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:46:38",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648817": [
        {
            "ioc_value": "meguri-toroge.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:45:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648815": [
        {
            "ioc_value": "uniquecarsppf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:44:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648813": [
        {
            "ioc_value": "alyssaramirez.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:43:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648811": [
        {
            "ioc_value": "ecologix.world",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:42:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648809": [
        {
            "ioc_value": "leomiloholidays.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:41:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648807": [
        {
            "ioc_value": "exclusiveskopjeapartments.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:41:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648805": [
        {
            "ioc_value": "hair-lopen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:39:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648804": [
        {
            "ioc_value": "takwomen.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:38:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648801": [
        {
            "ioc_value": "franny-a.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648800": [
        {
            "ioc_value": "fq8.r1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 22:37:16",
            "last_seen_utc": "2025-11-22 22:37:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648798": [
        {
            "ioc_value": "mittubi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:36:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648796": [
        {
            "ioc_value": "fapanizer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:35:49",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648794": [
        {
            "ioc_value": "hestia.gamerbase.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:35:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648792": [
        {
            "ioc_value": "buzentech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:34:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648790": [
        {
            "ioc_value": "wallstreetenglish.ar",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:32:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648788": [
        {
            "ioc_value": "cherisseebanks.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 22:31:43",
            "last_seen_utc": "2025-12-13 15:28:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648787": [
        {
            "ioc_value": "a9jpf.f1rewall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 22:27:28",
            "last_seen_utc": "2025-11-22 22:29:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648785": [
        {
            "ioc_value": "spark8.f1rewall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 22:17:06",
            "last_seen_utc": "2025-11-22 22:24:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648783": [
        {
            "ioc_value": "gg.f1rewall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 22:07:19",
            "last_seen_utc": "2025-11-22 22:13:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648782": [
        {
            "ioc_value": "gdk.f1rewall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 21:57:02",
            "last_seen_utc": "2025-11-22 22:08:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648780": [
        {
            "ioc_value": "albufeiraapt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648779": [
        {
            "ioc_value": "rb2.5t0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 21:46:45",
            "last_seen_utc": "2025-11-22 21:49:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648777": [
        {
            "ioc_value": "vlogmasterpro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648776": [
        {
            "ioc_value": "wall5.5t0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 21:37:57",
            "last_seen_utc": "2025-11-22 21:40:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648774": [
        {
            "ioc_value": "dateserenabailey.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:35:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648772": [
        {
            "ioc_value": "metrogutters.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:34:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648770": [
        {
            "ioc_value": "lifehaslevels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:33:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648768": [
        {
            "ioc_value": "ruralonlineland.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:30:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648766": [
        {
            "ioc_value": "cybersrely.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:25:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648765": [
        {
            "ioc_value": "mist.5t0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 21:25:37",
            "last_seen_utc": "2025-11-22 21:26:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648763": [
        {
            "ioc_value": "diabetescareandwellness.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:24:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648761": [
        {
            "ioc_value": "mail.etswak.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:22:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648759": [
        {
            "ioc_value": "itmsys.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648757": [
        {
            "ioc_value": "anadolu222kilisesi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648756": [
        {
            "ioc_value": "zlx.5t0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 21:17:22",
            "last_seen_utc": "2025-11-22 21:23:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648754": [
        {
            "ioc_value": "atlanticcanadashowcase.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:16:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648752": [
        {
            "ioc_value": "palkimotors.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:15:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648750": [
        {
            "ioc_value": "deluxelodgings.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:14:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648748": [
        {
            "ioc_value": "materiel-evenementiel.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:11:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648746": [
        {
            "ioc_value": "immeublesmaximus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:09:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648745": [
        {
            "ioc_value": "36c48.t1ger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 21:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648743": [
        {
            "ioc_value": "defendercloudly.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:07:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648741": [
        {
            "ioc_value": "elizabethslingerie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 21:04:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648740": [
        {
            "ioc_value": "pulse0.t1ger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 20:57:17",
            "last_seen_utc": "2025-11-22 21:08:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648738": [
        {
            "ioc_value": "tsukubalifesupport.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:55:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648736": [
        {
            "ioc_value": "live-chat-matsuyama.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:55:15",
            "last_seen_utc": "2025-12-09 13:35:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648734": [
        {
            "ioc_value": "enlightenproject.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:54:04",
            "last_seen_utc": "2025-12-13 15:28:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648733": [
        {
            "ioc_value": "tally.t1ger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 20:52:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648731": [
        {
            "ioc_value": "anciensdevaleo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:51:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648729": [
        {
            "ioc_value": "limo-ss.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:49:31",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648728": [
        {
            "ioc_value": "k1.t1ger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 20:49:09",
            "last_seen_utc": "2025-11-22 20:52:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648726": [
        {
            "ioc_value": "dianetique-49.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:42:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648724": [
        {
            "ioc_value": "losbichler.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:42:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648722": [
        {
            "ioc_value": "derekmcginty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:40:52",
            "last_seen_utc": "2025-12-13 15:28:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648719": [
        {
            "ioc_value": "adsys-iq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:38:04",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648716": [
        {
            "ioc_value": "u81r.w1ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 20:37:22",
            "last_seen_utc": "2025-11-22 20:48:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648717": [
        {
            "ioc_value": "v6bet.pics",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:37:22",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648714": [
        {
            "ioc_value": "smallbusinessandentreprenureship.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:36:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648712": [
        {
            "ioc_value": "thegreendispensarymenu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648710": [
        {
            "ioc_value": "seemoroccotravel.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:33:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648708": [
        {
            "ioc_value": "eyelashesusaacademy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:31:43",
            "last_seen_utc": "2025-11-22 20:32:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648706": [
        {
            "ioc_value": "theluxespa.co.zw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:30:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648704": [
        {
            "ioc_value": "hancohomes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:29:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648702": [
        {
            "ioc_value": "b2b-enterprise.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:28:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648700": [
        {
            "ioc_value": "asesoriaprof.com.mx",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:27:29",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648699": [
        {
            "ioc_value": "92x.w1ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 20:27:04",
            "last_seen_utc": "2025-11-22 20:28:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648697": [
        {
            "ioc_value": "pmefiduciaire.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:25:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648695": [
        {
            "ioc_value": "blogescrow.counos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648693": [
        {
            "ioc_value": "poligun.com.tr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648691": [
        {
            "ioc_value": "spiraldiagnostics.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:18:03",
            "last_seen_utc": "2025-11-25 18:35:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648690": [
        {
            "ioc_value": "wide.w1ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 20:17:49",
            "last_seen_utc": "2025-11-22 20:18:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648688": [
        {
            "ioc_value": "yamamoto-ashiba.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:16:41",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648686": [
        {
            "ioc_value": "leadsinless.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:15:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648684": [
        {
            "ioc_value": "xoxnelson.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:14:05",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648683": [
        {
            "ioc_value": "silver9.w1ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 20:08:02",
            "last_seen_utc": "2025-11-22 20:09:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648681": [
        {
            "ioc_value": "fondsxperte.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:05:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648679": [
        {
            "ioc_value": "apotheken-setzen-zeichen.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:04:32",
            "last_seen_utc": "2025-11-22 20:24:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648677": [
        {
            "ioc_value": "app.lktecno.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:03:03",
            "last_seen_utc": "2025-12-08 19:00:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648673": [
        {
            "ioc_value": "gtmetairie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:02:16",
            "last_seen_utc": "2025-12-07 20:34:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648668": [
        {
            "ioc_value": "elsner-gruppe.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 20:01:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648662": [
        {
            "ioc_value": "idoneo-hair-studio.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:59:49",
            "last_seen_utc": "2025-11-26 13:22:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648660": [
        {
            "ioc_value": "phuketia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648658": [
        {
            "ioc_value": "infra-and-aws.tokyo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:57:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648656": [
        {
            "ioc_value": "perfectbet.casino",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:55:57",
            "last_seen_utc": "2025-12-08 19:00:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648654": [
        {
            "ioc_value": "negociomejor.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:55:03",
            "last_seen_utc": "2025-12-09 13:35:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648652": [
        {
            "ioc_value": "mail.websinvention.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:54:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648650": [
        {
            "ioc_value": "powerstorage.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:51:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648648": [
        {
            "ioc_value": "benriyam.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:51:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648647": [
        {
            "ioc_value": "pulse3.m1stzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 19:50:36",
            "last_seen_utc": "2025-11-22 19:56:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648645": [
        {
            "ioc_value": "campbrainstorm.efcst.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:49:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648643": [
        {
            "ioc_value": "free-shemale-sex-games.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:48:37",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648641": [
        {
            "ioc_value": "techtrendsblogs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:47:29",
            "last_seen_utc": "2025-11-25 16:52:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648639": [
        {
            "ioc_value": "grabe-stiftung.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648637": [
        {
            "ioc_value": "primechoiceguide.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:45:07",
            "last_seen_utc": "2025-12-08 19:00:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648636": [
        {
            "ioc_value": "u5.m1stzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 19:43:52",
            "last_seen_utc": "2025-11-22 19:45:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648634": [
        {
            "ioc_value": "bencodestudio.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:42:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648632": [
        {
            "ioc_value": "blumensaat-seidel.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:42:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648630": [
        {
            "ioc_value": "onlinelectricalsupply.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:41:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648628": [
        {
            "ioc_value": "senzuritokyo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:40:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648626": [
        {
            "ioc_value": "shuhei.blog",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:39:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648624": [
        {
            "ioc_value": "lurinyo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:38:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648622": [
        {
            "ioc_value": "hermancedesign.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:37:04",
            "last_seen_utc": "2025-11-22 19:37:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648619": [
        {
            "ioc_value": "app.doselektro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:33:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648617": [
        {
            "ioc_value": "188betti.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:32:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648615": [
        {
            "ioc_value": "reitmeier-korbmoebel.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:30:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648614": [
        {
            "ioc_value": "xzoeg.m1stzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 19:30:26",
            "last_seen_utc": "2025-11-22 19:35:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648612": [
        {
            "ioc_value": "orebits.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:30:08",
            "last_seen_utc": "2025-12-08 19:00:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648610": [
        {
            "ioc_value": "arindubai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:29:27",
            "last_seen_utc": "2025-11-26 13:19:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648608": [
        {
            "ioc_value": "otonosan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:27:41",
            "last_seen_utc": "2025-12-08 19:00:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648607": [
        {
            "ioc_value": "pj9.m1stzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 19:27:13",
            "last_seen_utc": "2025-11-22 19:29:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648605": [
        {
            "ioc_value": "elevate-schweiz.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648603": [
        {
            "ioc_value": "megurublog.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:25:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648601": [
        {
            "ioc_value": "sygusch.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:24:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648600": [
        {
            "ioc_value": "kenanhasic.com.eventhouse.ba",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:22:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648597": [
        {
            "ioc_value": "khedmatcollection.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648595": [
        {
            "ioc_value": "epilepsycamp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648593": [
        {
            "ioc_value": "russellinternationalschools.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648592": [
        {
            "ioc_value": "eltw.p1nk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 19:17:27",
            "last_seen_utc": "2025-11-22 19:23:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648591": [
        {
            "ioc_value": "neoxero.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:17:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648589": [
        {
            "ioc_value": "rovo.sa",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:16:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648587": [
        {
            "ioc_value": "createsouken.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:15:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648585": [
        {
            "ioc_value": "smartseoranking.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:14:53",
            "last_seen_utc": "2025-12-10 23:57:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648583": [
        {
            "ioc_value": "autodentrepairphilly.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:14:11",
            "last_seen_utc": "2025-12-08 19:00:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648581": [
        {
            "ioc_value": "kibristicaridefteri.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:13:10",
            "last_seen_utc": "2025-12-08 19:00:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648579": [
        {
            "ioc_value": "sankou-esaka.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:12:15",
            "last_seen_utc": "2025-12-10 23:57:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648577": [
        {
            "ioc_value": "moje.bart721.cz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:11:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648575": [
        {
            "ioc_value": "life-change-shizu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:10:18",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648573": [
        {
            "ioc_value": "tokimeki-korea.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:09:04",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648571": [
        {
            "ioc_value": "gerafort.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:07:45",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648569": [
        {
            "ioc_value": "cold6.p1nk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 19:07:11",
            "last_seen_utc": "2025-11-22 19:13:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648568": [
        {
            "ioc_value": "pisosmont.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:07:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648566": [
        {
            "ioc_value": "puresoulmusic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:06:16",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648564": [
        {
            "ioc_value": "crossdaleservices.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:05:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648562": [
        {
            "ioc_value": "japanamatravel.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:03:10",
            "last_seen_utc": "2025-12-11 19:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648560": [
        {
            "ioc_value": "venver.com.ar",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 19:01:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648558": [
        {
            "ioc_value": "idb.p1nk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 18:55:52",
            "last_seen_utc": "2025-11-22 19:01:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648557": [
        {
            "ioc_value": "royalpagdiandsafa.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:55:51",
            "last_seen_utc": "2025-11-25 17:03:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648555": [
        {
            "ioc_value": "fukuoka-saiyou.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:54:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648553": [
        {
            "ioc_value": "hat-sd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:53:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648551": [
        {
            "ioc_value": "passer-elle.ch",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:52:26",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648550": [
        {
            "ioc_value": "krsseguros.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:51:24",
            "last_seen_utc": "2025-11-25 18:33:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648548": [
        {
            "ioc_value": "oeluu.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:50:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648547": [
        {
            "ioc_value": "try-eu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:48:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648544": [
        {
            "ioc_value": "pmbtar.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:47:39",
            "last_seen_utc": "2025-12-09 13:35:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648542": [
        {
            "ioc_value": "gusteaupizza.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:46:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648540": [
        {
            "ioc_value": "lasertagibiza.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:46:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648539": [
        {
            "ioc_value": "pink3.p1nk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 18:46:00",
            "last_seen_utc": "2025-11-22 18:47:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648536": [
        {
            "ioc_value": "wp.jtco.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:45:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648532": [
        {
            "ioc_value": "laundryball.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:44:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648519": [
        {
            "ioc_value": "linnert-immobilien.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:42:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648517": [
        {
            "ioc_value": "dongli-shiye.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:39:53",
            "last_seen_utc": "2025-12-09 13:35:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648515": [
        {
            "ioc_value": "ryoko22.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:38:40",
            "last_seen_utc": "2025-12-11 19:29:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648513": [
        {
            "ioc_value": "stelladueg.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:38:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648511": [
        {
            "ioc_value": "printzone.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:36:50",
            "last_seen_utc": "2025-12-08 19:00:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648509": [
        {
            "ioc_value": "subasanat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:35:11",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648507": [
        {
            "ioc_value": "mpelevage.mr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:34:16",
            "last_seen_utc": "2025-11-22 18:36:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648505": [
        {
            "ioc_value": "quietadmin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:33:24",
            "last_seen_utc": "2025-11-22 20:53:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648503": [
        {
            "ioc_value": "orebits.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:32:44",
            "last_seen_utc": "2025-12-12 18:01:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648501": [
        {
            "ioc_value": "minesgame.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:32:05",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648499": [
        {
            "ioc_value": "caldasservice.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:31:10",
            "last_seen_utc": "2025-11-24 07:42:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648498": [
        {
            "ioc_value": "mark.jump3r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 18:30:33",
            "last_seen_utc": "2025-11-22 18:31:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648497": [
        {
            "ioc_value": "followyourbliss.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:30:14",
            "last_seen_utc": "2025-12-07 20:34:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648495": [
        {
            "ioc_value": "kubet.boo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:29:06",
            "last_seen_utc": "2025-11-25 19:46:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648493": [
        {
            "ioc_value": "two-know.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:28:18",
            "last_seen_utc": "2025-12-12 18:01:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648491": [
        {
            "ioc_value": "youenchivision.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:27:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648489": [
        {
            "ioc_value": "65pcw.jump3r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 18:25:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648488": [
        {
            "ioc_value": "campbrainstorm.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:25:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648486": [
        {
            "ioc_value": "trialstructure.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:24:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648484": [
        {
            "ioc_value": "pakistanvisa.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:22:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648482": [
        {
            "ioc_value": "nakasu-east.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:21:56",
            "last_seen_utc": "2025-12-07 20:34:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648480": [
        {
            "ioc_value": "choulghada.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648479": [
        {
            "ioc_value": "edex.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648477": [
        {
            "ioc_value": "panoramarevue.sitecreation.ma",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648475": [
        {
            "ioc_value": "kaz-nakagawa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:16:44",
            "last_seen_utc": "2025-11-22 20:22:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648473": [
        {
            "ioc_value": "hitomae-kokufuku.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:15:56",
            "last_seen_utc": "2025-11-22 20:22:01",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648471": [
        {
            "ioc_value": "octamanpower.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:15:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648469": [
        {
            "ioc_value": "xsdanang.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648468": [
        {
            "ioc_value": "nova9.jump3r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 18:14:02",
            "last_seen_utc": "2025-11-22 18:21:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648467": [
        {
            "ioc_value": "renovation-create.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:13:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648464": [
        {
            "ioc_value": "digimarketing.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:11:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648462": [
        {
            "ioc_value": "bennettarbitration.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:10:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648460": [
        {
            "ioc_value": "eventocontaduriafce.viajandoalcielo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:09:27",
            "last_seen_utc": "2025-12-12 18:00:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648458": [
        {
            "ioc_value": "intermanagers.com.br.touruvaevinho.tur.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:08:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648456": [
        {
            "ioc_value": "wigwhowigme.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:07:06",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648454": [
        {
            "ioc_value": "hermo-style.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:06:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648452": [
        {
            "ioc_value": "gconfisur.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:05:20",
            "last_seen_utc": "2025-12-08 19:00:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648450": [
        {
            "ioc_value": "legalecono.com.touruvaevinho.tur.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:04:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648449": [
        {
            "ioc_value": "prowaterpolo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:04:02",
            "last_seen_utc": "2025-12-07 20:34:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648446": [
        {
            "ioc_value": "rastroconversas.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:02:40",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648444": [
        {
            "ioc_value": "mousefair.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 18:01:58",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648442": [
        {
            "ioc_value": "9aoj.jump3r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 18:01:12",
            "last_seen_utc": "2025-11-22 18:01:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648441": [
        {
            "ioc_value": "domain-gave.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 18:00:49",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251122-vvytlazjev",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1648440": [
        {
            "ioc_value": "juancaro214.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-22 18:00:36",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251122-v58rjsbn8y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1648439": [
        {
            "ioc_value": "news-reduces.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-22 18:00:23",
            "last_seen_utc": "2025-12-12 18:39:26",
            "confidence_level": 100,
            "reference": "https://tria.ge/251122-wb6krsvphk",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1648438": [
        {
            "ioc_value": "long.wildsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 17:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648436": [
        {
            "ioc_value": "borchard-dietrich.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648434": [
        {
            "ioc_value": "cbardbarns.com.fcpmezzanine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:57:44",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648433": [
        {
            "ioc_value": "lw.wildsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 17:56:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648431": [
        {
            "ioc_value": "lucentfox.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:55:36",
            "last_seen_utc": "2025-12-13 15:29:03",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648429": [
        {
            "ioc_value": "lexema-rpa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:54:51",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648428": [
        {
            "ioc_value": "cutpro.su",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:53:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648426": [
        {
            "ioc_value": "plaintiffsarbitration.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:52:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648425": [
        {
            "ioc_value": "fire2.wildsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 17:52:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648423": [
        {
            "ioc_value": "htkwood.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:51:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648421": [
        {
            "ioc_value": "sdfu.org.ua",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:49:31",
            "last_seen_utc": "2025-12-13 15:29:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648420": [
        {
            "ioc_value": "seo-conference.by",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:47:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648418": [
        {
            "ioc_value": "forum.net-gazet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:46:55",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648416": [
        {
            "ioc_value": "tarpaulinshouse.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:46:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648414": [
        {
            "ioc_value": "nhomkinhtienphatvn.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:45:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648413": [
        {
            "ioc_value": "kp1.wildsh1ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 17:45:24",
            "last_seen_utc": "2025-11-22 17:51:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648411": [
        {
            "ioc_value": "cleandrop.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:44:25",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648409": [
        {
            "ioc_value": "buckmanmetal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:43:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648407": [
        {
            "ioc_value": "athleticx.be",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:40:26",
            "last_seen_utc": "2025-12-07 20:34:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648406": [
        {
            "ioc_value": "taiki123.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:39:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648404": [
        {
            "ioc_value": "go237.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:38:53",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648402": [
        {
            "ioc_value": "arena10lrv.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:38:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648400": [
        {
            "ioc_value": "insidethecrown.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:37:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648398": [
        {
            "ioc_value": "amazingcopywritingtips.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:33:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648397": [
        {
            "ioc_value": "un3.c0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 17:31:56",
            "last_seen_utc": "2025-11-22 17:42:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648395": [
        {
            "ioc_value": "synca.onaritest-1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:31:24",
            "last_seen_utc": "2025-11-24 07:47:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648393": [
        {
            "ioc_value": "create-seibu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:29:23",
            "last_seen_utc": "2025-11-22 19:52:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648392": [
        {
            "ioc_value": "seymour-y.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:27:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648390": [
        {
            "ioc_value": "gee.c0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 17:27:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648388": [
        {
            "ioc_value": "sakitabi.blog",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:26:43",
            "last_seen_utc": "2025-11-22 18:37:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648386": [
        {
            "ioc_value": "clicksfi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:25:44",
            "last_seen_utc": "2025-12-07 20:34:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648384": [
        {
            "ioc_value": "thewigdoctorshop.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:24:36",
            "last_seen_utc": "2025-12-12 18:01:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648382": [
        {
            "ioc_value": "injuryarbitration.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:23:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648381": [
        {
            "ioc_value": "burst7.c0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 17:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648380": [
        {
            "ioc_value": "betterbuy.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:16:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648377": [
        {
            "ioc_value": "alo789pro.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:15:25",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648375": [
        {
            "ioc_value": "radiovidanews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:14:42",
            "last_seen_utc": "2025-11-22 17:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648374": [
        {
            "ioc_value": "a8a8a.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:13:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648372": [
        {
            "ioc_value": "braddudenhoffer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:12:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648370": [
        {
            "ioc_value": "larsaenergy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:11:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648368": [
        {
            "ioc_value": "jozelletech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:10:15",
            "last_seen_utc": "2025-12-11 19:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648365": [
        {
            "ioc_value": "ring.c0ld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 17:07:34",
            "last_seen_utc": "2025-11-22 17:10:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648364": [
        {
            "ioc_value": "u888com.group",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:05:29",
            "last_seen_utc": "2025-11-22 19:27:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648361": [
        {
            "ioc_value": "bekencollection.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:04:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648359": [
        {
            "ioc_value": "prebunking.cekfakta.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:02:42",
            "last_seen_utc": "2025-12-13 15:29:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648357": [
        {
            "ioc_value": "tenderloins-blog.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:01:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648355": [
        {
            "ioc_value": "supportcreation.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 17:01:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648353": [
        {
            "ioc_value": "bravestar.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648351": [
        {
            "ioc_value": "farrcreative.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:58:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648350": [
        {
            "ioc_value": "wall8.f0rce.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 16:57:48",
            "last_seen_utc": "2025-11-22 17:03:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648348": [
        {
            "ioc_value": "iniviral.baby",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:56:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648347": [
        {
            "ioc_value": "okanoue-coffee.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648344": [
        {
            "ioc_value": "kodama-room.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:54:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648343": [
        {
            "ioc_value": "buyqualityfirst.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:53:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648341": [
        {
            "ioc_value": "fieb.salvador.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:51:36",
            "last_seen_utc": "2025-12-12 18:00:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648339": [
        {
            "ioc_value": "tajulharamain.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:50:52",
            "last_seen_utc": "2025-11-22 17:59:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648337": [
        {
            "ioc_value": "mikovtraining.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:50:02",
            "last_seen_utc": "2025-12-08 19:00:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648335": [
        {
            "ioc_value": "odishanewgovtjob.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:48:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648334": [
        {
            "ioc_value": "6h.f0rce.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 16:47:24",
            "last_seen_utc": "2025-11-22 16:55:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648332": [
        {
            "ioc_value": "kawasaki-car.work",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:46:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648330": [
        {
            "ioc_value": "arbitrationstructure.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:44:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648328": [
        {
            "ioc_value": "makingprogresstoday.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:43:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648326": [
        {
            "ioc_value": "rebecca-ricks.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:43:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648324": [
        {
            "ioc_value": "gamesknit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:40:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648322": [
        {
            "ioc_value": "hotel-goger-augsfeld.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:38:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648320": [
        {
            "ioc_value": "hr3lb.f0rce.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 16:37:38",
            "last_seen_utc": "2025-11-22 16:39:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648319": [
        {
            "ioc_value": "kurominet.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648316": [
        {
            "ioc_value": "ledgerprotected.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:35:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648314": [
        {
            "ioc_value": "concavowheels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:34:39",
            "last_seen_utc": "2025-12-08 19:00:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648312": [
        {
            "ioc_value": "beleaflb.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:33:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648310": [
        {
            "ioc_value": "nonsubscriberforworkers.drdatasaver.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:32:37",
            "last_seen_utc": "2025-11-22 18:01:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648308": [
        {
            "ioc_value": "secretguarulhos.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:31:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648306": [
        {
            "ioc_value": "otvozim.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:29:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648304": [
        {
            "ioc_value": "greencube.gallery",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:28:08",
            "last_seen_utc": "2025-12-13 15:28:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648302": [
        {
            "ioc_value": "rohacoffeee.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:27:13",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648301": [
        {
            "ioc_value": "18.f0rce.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 16:26:13",
            "last_seen_utc": "2025-11-22 16:29:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648299": [
        {
            "ioc_value": "blackoxcreatives.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:25:49",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648296": [
        {
            "ioc_value": "teachers4digitalage.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:23:45",
            "last_seen_utc": "2025-12-13 15:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648295": [
        {
            "ioc_value": "drop.w1de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 16:23:03",
            "last_seen_utc": "2025-11-22 16:25:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648293": [
        {
            "ioc_value": "allen-me.solutions",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:21:56",
            "last_seen_utc": "2025-11-22 18:58:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648291": [
        {
            "ioc_value": "bio-moringa-samen.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:21:11",
            "last_seen_utc": "2025-12-12 18:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648289": [
        {
            "ioc_value": "plaintiffarbitration.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648287": [
        {
            "ioc_value": "poouyangostar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648286": [
        {
            "ioc_value": "kevius.se",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:17:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648284": [
        {
            "ioc_value": "tellusrequiem.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:15:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648282": [
        {
            "ioc_value": "pulse7.w1de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 16:14:18",
            "last_seen_utc": "2025-11-22 16:19:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648281": [
        {
            "ioc_value": "fun88bongda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:14:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648279": [
        {
            "ioc_value": "talklifemedia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:12:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648277": [
        {
            "ioc_value": "gmoadopts.mysidiahost.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:11:11",
            "last_seen_utc": "2025-11-25 18:01:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648275": [
        {
            "ioc_value": "mahaimran.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:09:44",
            "last_seen_utc": "2025-12-09 13:35:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648273": [
        {
            "ioc_value": "pes.w1de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 16:08:20",
            "last_seen_utc": "2025-11-22 16:12:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648272": [
        {
            "ioc_value": "iraqpools.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:08:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648270": [
        {
            "ioc_value": "travelsgem.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:07:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648269": [
        {
            "ioc_value": "joaopinheiro.pt",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:06:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648266": [
        {
            "ioc_value": "3dmodelscenery.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:04:34",
            "last_seen_utc": "2025-11-22 17:00:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648264": [
        {
            "ioc_value": "thejusticecollege.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:03:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648262": [
        {
            "ioc_value": "inlaser.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:02:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648254": [
        {
            "ioc_value": "kubett.mobi",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:01:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648257": [
        {
            "ioc_value": "cp-caren.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 16:01:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648252": [
        {
            "ioc_value": "hobsmedia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648245": [
        {
            "ioc_value": "themovement.fit",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:55:49",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648243": [
        {
            "ioc_value": "hrokvip247.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:55:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648248": [
        {
            "ioc_value": "cyberlaws.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:55:47",
            "last_seen_utc": "2025-12-12 18:00:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648250": [
        {
            "ioc_value": "rodacanela.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:55:46",
            "last_seen_utc": "2025-11-22 17:32:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648247": [
        {
            "ioc_value": "shine.w1de.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 15:51:40",
            "last_seen_utc": "2025-11-22 15:56:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648231": [
        {
            "ioc_value": "persenglish.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:49:07",
            "last_seen_utc": "2025-12-10 23:57:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648233": [
        {
            "ioc_value": "anupammills.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:49:07",
            "last_seen_utc": "2025-12-08 19:00:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648235": [
        {
            "ioc_value": "lacasadianto.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648237": [
        {
            "ioc_value": "epilepsygolf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:49:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648239": [
        {
            "ioc_value": "vibortherm.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:49:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648241": [
        {
            "ioc_value": "imaziner.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:49:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648238": [
        {
            "ioc_value": "536df.frostmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 15:43:56",
            "last_seen_utc": "2025-11-22 15:46:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648229": [
        {
            "ioc_value": "sohumbabyproducts.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:39:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648106": [
        {
            "ioc_value": "cld.hashes.today",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:36:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648228": [
        {
            "ioc_value": "6cfc.frostmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 15:35:41",
            "last_seen_utc": "2025-11-22 15:42:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648226": [
        {
            "ioc_value": "tas.frostmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 15:31:30",
            "last_seen_utc": "2025-11-22 15:34:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648225": [
        {
            "ioc_value": "account-captchapulse.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:31:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648223": [
        {
            "ioc_value": "mkjjq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:30:02",
            "last_seen_utc": "2025-11-22 20:07:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648220": [
        {
            "ioc_value": "account-extranetpulse.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:27:17",
            "last_seen_utc": "2025-11-22 15:35:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648219": [
        {
            "ioc_value": "xa.frostmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 15:22:44",
            "last_seen_utc": "2025-11-22 15:24:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648218": [
        {
            "ioc_value": "h6.5h0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 15:17:27",
            "last_seen_utc": "2025-11-22 15:21:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648217": [
        {
            "ioc_value": "morning.5h0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 15:07:40",
            "last_seen_utc": "2025-11-22 15:09:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648215": [
        {
            "ioc_value": "cryptolaughs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:05:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648213": [
        {
            "ioc_value": "soltrencher.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:03:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648211": [
        {
            "ioc_value": "solscan.is",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 15:01:46",
            "last_seen_utc": "2025-11-27 18:24:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648210": [
        {
            "ioc_value": "msnfmicros.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648208": [
        {
            "ioc_value": "wallet.petrnesterov.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:54:44",
            "last_seen_utc": "2025-12-07 20:34:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648207": [
        {
            "ioc_value": "nova.5h0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 14:54:19",
            "last_seen_utc": "2025-11-22 14:58:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648205": [
        {
            "ioc_value": "trading-view-app.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:52:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648202": [
        {
            "ioc_value": "sora2-openai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:47:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648201": [
        {
            "ioc_value": "trace.5h0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 14:47:05",
            "last_seen_utc": "2025-11-22 14:47:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648199": [
        {
            "ioc_value": "bfacollege.co.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:42:06",
            "last_seen_utc": "2025-11-22 15:43:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648197": [
        {
            "ioc_value": "shop.s1lver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 14:39:20",
            "last_seen_utc": "2025-11-22 14:40:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648196": [
        {
            "ioc_value": "wild6.s1lver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 14:33:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648194": [
        {
            "ioc_value": "chrome-zh-hk.com.cn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:31:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648191": [
        {
            "ioc_value": "google-chrome-intl.com.cn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:30:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648189": [
        {
            "ioc_value": "chrome-google.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648188": [
        {
            "ioc_value": "chrom-google.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:28:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648187": [
        {
            "ioc_value": "app-chrome.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:27:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648186": [
        {
            "ioc_value": "g1.s1lver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 14:26:55",
            "last_seen_utc": "2025-11-22 14:28:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648184": [
        {
            "ioc_value": "guge-chrom.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:26:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648182": [
        {
            "ioc_value": "chrom-app.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:24:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648180": [
        {
            "ioc_value": "cnzh-chrom-google.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:22:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648178": [
        {
            "ioc_value": "apps-chrome.com.cn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648176": [
        {
            "ioc_value": "google-chrome-google.com.cn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648174": [
        {
            "ioc_value": "apps-chrom.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648172": [
        {
            "ioc_value": "oe.s1lver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 14:17:39",
            "last_seen_utc": "2025-11-22 14:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648171": [
        {
            "ioc_value": "cn-google-chrom.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:17:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648170": [
        {
            "ioc_value": "web.eat82.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:16:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648168": [
        {
            "ioc_value": "chrome-google-ch.com.cn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:15:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648166": [
        {
            "ioc_value": "chrome-zhgoogle.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:13:52",
            "last_seen_utc": "2025-11-22 14:31:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648164": [
        {
            "ioc_value": "cnzh-chrom.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 14:12:49",
            "last_seen_utc": "2025-11-22 14:28:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1648163": [
        {
            "ioc_value": "wall1.shadowf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 14:07:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648162": [
        {
            "ioc_value": "frost7.shadowf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 13:57:31",
            "last_seen_utc": "2025-11-22 14:02:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648161": [
        {
            "ioc_value": "wall6.shadowf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 13:47:43",
            "last_seen_utc": "2025-11-22 13:49:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648158": [
        {
            "ioc_value": "d48e9.shadowf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 13:37:27",
            "last_seen_utc": "2025-11-22 13:41:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648157": [
        {
            "ioc_value": "quick.m0tor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 13:30:14",
            "last_seen_utc": "2025-11-22 13:33:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648156": [
        {
            "ioc_value": "o4ro.m0tor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 13:27:03",
            "last_seen_utc": "2025-11-22 13:29:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648154": [
        {
            "ioc_value": "motor.m0tor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 13:18:18",
            "last_seen_utc": "2025-11-22 13:23:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648153": [
        {
            "ioc_value": "es5.m0tor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 13:03:57",
            "last_seen_utc": "2025-11-22 13:09:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648152": [
        {
            "ioc_value": "7sd.stoner0ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 12:53:09",
            "last_seen_utc": "2025-11-22 12:58:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648150": [
        {
            "ioc_value": "gnbe2.stoner0ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 12:43:53",
            "last_seen_utc": "2025-11-22 12:46:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648149": [
        {
            "ioc_value": "1s.stoner0ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 12:37:42",
            "last_seen_utc": "2025-11-22 12:40:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648148": [
        {
            "ioc_value": "track4.stoner0ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 12:27:23",
            "last_seen_utc": "2025-11-22 12:34:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648147": [
        {
            "ioc_value": "motor0.qu1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 12:15:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648146": [
        {
            "ioc_value": "ui.qu1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 12:08:28",
            "last_seen_utc": "2025-11-22 12:15:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648143": [
        {
            "ioc_value": "elvis123456.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-11-22 12:02:27",
            "last_seen_utc": "2025-12-12 18:40:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/251122-hwqhdsxrfq",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1648134": [
        {
            "ioc_value": "ergwgfbrej.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 12:00:42",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251122-lw62xsfr8z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1648132": [
        {
            "ioc_value": "send-earlier.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-22 12:00:17",
            "last_seen_utc": "2025-12-12 18:39:24",
            "confidence_level": 100,
            "reference": "https://tria.ge/251122-nqgwyswmcs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1648131": [
        {
            "ioc_value": "ffng5.qu1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 11:57:04",
            "last_seen_utc": "2025-11-22 11:58:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648130": [
        {
            "ioc_value": "xey4.qu1ck.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 11:47:18",
            "last_seen_utc": "2025-11-22 11:51:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648129": [
        {
            "ioc_value": "y8mb.mintspr1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 11:31:55",
            "last_seen_utc": "2025-11-22 11:35:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648128": [
        {
            "ioc_value": "zone0.mintspr1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 11:26:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648127": [
        {
            "ioc_value": "shine.mintspr1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 11:17:57",
            "last_seen_utc": "2025-11-22 11:26:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648126": [
        {
            "ioc_value": "dk.mintspr1ng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 11:06:33",
            "last_seen_utc": "2025-11-22 11:12:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648112": [
        {
            "ioc_value": "jujg2.br1ghtmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 10:57:48",
            "last_seen_utc": "2025-11-22 10:59:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648111": [
        {
            "ioc_value": "trail.br1ghtmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 10:43:23",
            "last_seen_utc": "2025-11-22 10:45:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648110": [
        {
            "ioc_value": "qi.br1ghtmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 10:37:37",
            "last_seen_utc": "2025-11-22 10:39:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648109": [
        {
            "ioc_value": "drop.br1ghtmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 10:24:24",
            "last_seen_utc": "2025-11-22 10:29:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648108": [
        {
            "ioc_value": "ajbkf.c1earwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 10:17:08",
            "last_seen_utc": "2025-11-22 10:25:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648105": [
        {
            "ioc_value": "fox.c1earwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 10:07:53",
            "last_seen_utc": "2025-11-22 10:10:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648100": [
        {
            "ioc_value": "lennox23111-31851.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-22 10:05:37",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648101": [
        {
            "ioc_value": "lennox23111-46792.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-22 10:05:37",
            "last_seen_utc": "2025-12-12 18:39:24",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648102": [
        {
            "ioc_value": "make-zoom.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-22 10:05:37",
            "last_seen_utc": "2025-12-12 18:39:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648103": [
        {
            "ioc_value": "mind-conclusion.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-22 10:05:37",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648104": [
        {
            "ioc_value": "process-generous.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-22 10:05:37",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648099": [
        {
            "ioc_value": "awbnmnmammmamnre.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-22 10:05:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648098": [
        {
            "ioc_value": "auth.nsotone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-22 10:03:59",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648094": [
        {
            "ioc_value": "hofpfi01.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-11-22 10:03:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648095": [
        {
            "ioc_value": "logins.json",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-11-22 10:03:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648096": [
        {
            "ioc_value": "signons.sqlite",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-11-22 10:03:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648097": [
        {
            "ioc_value": "wymxeb13.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-11-22 10:03:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648092": [
        {
            "ioc_value": "cookies.sqlite",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-11-22 10:03:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648093": [
        {
            "ioc_value": "formhistory.sqlite",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-11-22 10:03:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648084": [
        {
            "ioc_value": "www.xoilac86a.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:17",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648085": [
        {
            "ioc_value": "www.xoilaczzfz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:17",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648069": [
        {
            "ioc_value": "ck.plcdn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648070": [
        {
            "ioc_value": "gatex.cakhiaok.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648071": [
        {
            "ioc_value": "gatex.womensoundoff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648072": [
        {
            "ioc_value": "japanthis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648073": [
        {
            "ioc_value": "socolivezw.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648074": [
        {
            "ioc_value": "www.thapcamtvz.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648075": [
        {
            "ioc_value": "www.xl365.livoraz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648076": [
        {
            "ioc_value": "www.xl365.plcdn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648077": [
        {
            "ioc_value": "www.xlvi.livoraz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-24 18:59:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648078": [
        {
            "ioc_value": "www.xlvi.plcdn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648079": [
        {
            "ioc_value": "www.xlz.livoraz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648080": [
        {
            "ioc_value": "www.xlz.plcdn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648081": [
        {
            "ioc_value": "www.xoilac.livoraz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648082": [
        {
            "ioc_value": "www.xoilac.plcdn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648083": [
        {
            "ioc_value": "www.xoilac365w.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:16",
            "last_seen_utc": "2025-11-22 10:02:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648064": [
        {
            "ioc_value": "90phuttw.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:15",
            "last_seen_utc": "2025-11-22 10:02:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648065": [
        {
            "ioc_value": "91p.livoraz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:15",
            "last_seen_utc": "2025-11-22 10:02:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648066": [
        {
            "ioc_value": "91p.plcdn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:15",
            "last_seen_utc": "2025-11-22 10:02:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648067": [
        {
            "ioc_value": "cakhiaat.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:15",
            "last_seen_utc": "2025-11-22 10:02:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648068": [
        {
            "ioc_value": "ck.livoraz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-22 10:02:15",
            "last_seen_utc": "2025-11-22 10:02:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1648061": [
        {
            "ioc_value": "1yqf.c1earwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 09:58:08",
            "last_seen_utc": "2025-11-22 10:01:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648060": [
        {
            "ioc_value": "vale6.c1earwave.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 09:46:48",
            "last_seen_utc": "2025-11-22 09:54:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648059": [
        {
            "ioc_value": "loop6.gr0ssgar.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 09:37:32",
            "last_seen_utc": "2025-11-22 09:43:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648057": [
        {
            "ioc_value": "snuff.gr0ssgar.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 09:27:45",
            "last_seen_utc": "2025-11-22 09:30:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648056": [
        {
            "ioc_value": "drift.gr0ssgar.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 09:20:00",
            "last_seen_utc": "2025-11-22 09:23:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648055": [
        {
            "ioc_value": "ay.gr0ssgar.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 09:12:17",
            "last_seen_utc": "2025-11-23 06:32:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648054": [
        {
            "ioc_value": "glow.br0adtemp1ate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 08:57:27",
            "last_seen_utc": "2025-11-22 09:01:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648053": [
        {
            "ioc_value": "wald7.br0adtemp1ate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 08:48:12",
            "last_seen_utc": "2025-11-22 08:56:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648050": [
        {
            "ioc_value": "tau.br0adtemp1ate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 08:37:19",
            "last_seen_utc": "2025-11-22 08:47:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648049": [
        {
            "ioc_value": "kamm.br0adtemp1ate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 08:28:02",
            "last_seen_utc": "2025-11-22 08:28:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648048": [
        {
            "ioc_value": "tau.netit0c0rec.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 08:17:45",
            "last_seen_utc": "2025-11-22 08:23:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648047": [
        {
            "ioc_value": "moor.netit0c0rec.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 08:08:02",
            "last_seen_utc": "2025-11-22 08:13:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647906": [
        {
            "ioc_value": "validate-3748-captcha-2920-8237.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 08:03:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647910": [
        {
            "ioc_value": "arrenegade.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-22 08:02:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647950": [
        {
            "ioc_value": "lentdwn.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:58",
            "last_seen_utc": "2025-11-25 19:49:03",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647951": [
        {
            "ioc_value": "polucxs.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:58",
            "last_seen_utc": "2025-12-06 17:34:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647952": [
        {
            "ioc_value": "atabriq.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647953": [
        {
            "ioc_value": "bivaluz.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:57",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647954": [
        {
            "ioc_value": "catwzit.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647955": [
        {
            "ioc_value": "cornxm.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:56",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647957": [
        {
            "ioc_value": "oryzac.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647959": [
        {
            "ioc_value": "sneaiov.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:54",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647956": [
        {
            "ioc_value": "lubberf.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:53",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647958": [
        {
            "ioc_value": "saucrvo.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:53",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647960": [
        {
            "ioc_value": "sponged.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:52",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647961": [
        {
            "ioc_value": "wholequz.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:52",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647962": [
        {
            "ioc_value": "untangj.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:51",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647963": [
        {
            "ioc_value": "whitegi.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:51",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1647964": [
        {
            "ioc_value": "velvepn.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-22 08:02:51",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1648038": [
        {
            "ioc_value": "stern1.netit0c0rec.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 07:57:42",
            "last_seen_utc": "2025-11-22 08:07:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648033": [
        {
            "ioc_value": "stein.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 07:47:19",
            "last_seen_utc": "2025-11-22 07:48:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648032": [
        {
            "ioc_value": "gleis.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 07:37:32",
            "last_seen_utc": "2025-11-22 07:39:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648031": [
        {
            "ioc_value": "kraut2.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 07:27:09",
            "last_seen_utc": "2025-11-22 07:32:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648030": [
        {
            "ioc_value": "licht.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 07:17:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648029": [
        {
            "ioc_value": "ufer.co-0-peratre-4-er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 07:07:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648028": [
        {
            "ioc_value": "fluss.br-0-ad-temp-1-ate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 06:57:47",
            "last_seen_utc": "2025-11-22 07:03:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648027": [
        {
            "ioc_value": "wolke3.br-0-ad-temp-1-ate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 06:47:58",
            "last_seen_utc": "2025-11-22 06:51:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648026": [
        {
            "ioc_value": "weald.br-0-ad-temp-1-ate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 06:37:43",
            "last_seen_utc": "2025-11-22 06:46:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648025": [
        {
            "ioc_value": "rain.br-0-ad-temp-1-ate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 06:27:25",
            "last_seen_utc": "2025-11-22 06:36:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648024": [
        {
            "ioc_value": "birch.awreti-3-uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 06:17:38",
            "last_seen_utc": "2025-11-22 06:20:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648023": [
        {
            "ioc_value": "fels2.awreti-3-uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 06:07:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648020": [
        {
            "ioc_value": "herady.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-22 06:00:15",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251122-dcxedabr91",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1648019": [
        {
            "ioc_value": "wind.awreti-3-uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 05:50:27",
            "last_seen_utc": "2025-11-22 06:04:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648018": [
        {
            "ioc_value": "korn.hum2nk0str.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 05:46:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648017": [
        {
            "ioc_value": "grat4.hum2nk0str.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 05:37:00",
            "last_seen_utc": "2025-11-22 05:43:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648016": [
        {
            "ioc_value": "wald.hum2nk0str.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 05:26:43",
            "last_seen_utc": "2025-11-22 05:37:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648015": [
        {
            "ioc_value": "moor.hum2nk0str.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 05:17:57",
            "last_seen_utc": "2025-11-22 05:21:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648014": [
        {
            "ioc_value": "tal2.ele-6-tricmul-1-ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 05:08:04",
            "last_seen_utc": "2025-11-22 05:10:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648013": [
        {
            "ioc_value": "birch.ele-6-tricmul-1-ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 04:57:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648012": [
        {
            "ioc_value": "adler.ele-6-tricmul-1-ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 04:47:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648011": [
        {
            "ioc_value": "bach.netit-0-c-0-rec.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 04:38:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648009": [
        {
            "ioc_value": "wolfe.netit-0-c-0-rec.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 04:27:19",
            "last_seen_utc": "2025-11-22 04:32:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648008": [
        {
            "ioc_value": "hain3.netit-0-c-0-rec.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 04:17:03",
            "last_seen_utc": "2025-11-22 04:22:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1648007": [
        {
            "ioc_value": "rune.netit-0-c-0-rec.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 04:08:30",
            "last_seen_utc": "2025-11-22 04:09:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647998": [
        {
            "ioc_value": "klee5.co0peratre4er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 03:58:00",
            "last_seen_utc": "2025-11-22 04:04:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647996": [
        {
            "ioc_value": "rauch.co0peratre4er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 03:47:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647995": [
        {
            "ioc_value": "glanz.co0peratre4er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 03:37:51",
            "last_seen_utc": "2025-11-22 03:38:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647994": [
        {
            "ioc_value": "fjord.co0peratre4er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 03:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647993": [
        {
            "ioc_value": "dune.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 03:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647992": [
        {
            "ioc_value": "weiss.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 03:07:23",
            "last_seen_utc": "2025-11-22 03:10:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647991": [
        {
            "ioc_value": "tau.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 02:57:23",
            "last_seen_utc": "2025-11-22 03:04:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647990": [
        {
            "ioc_value": "licht2.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 02:47:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647989": [
        {
            "ioc_value": "pfad.ele6tricmul1ed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 02:37:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647988": [
        {
            "ioc_value": "tal.hum-2-nk-0-str.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 02:28:03",
            "last_seen_utc": "2025-11-22 02:36:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647987": [
        {
            "ioc_value": "ufer1.hum-2-nk-0-str.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 02:17:46",
            "last_seen_utc": "2025-11-22 02:20:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647986": [
        {
            "ioc_value": "stern.hum-2-nk-0-str.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 02:09:31",
            "last_seen_utc": "2025-11-22 02:13:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647985": [
        {
            "ioc_value": "kamm.awreti3uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 01:57:42",
            "last_seen_utc": "2025-11-22 02:05:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647984": [
        {
            "ioc_value": "moor.awreti3uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 01:47:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647983": [
        {
            "ioc_value": "wolke3.awreti3uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 01:37:41",
            "last_seen_utc": "2025-11-22 01:47:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647982": [
        {
            "ioc_value": "glade.awreti3uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 01:27:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647981": [
        {
            "ioc_value": "gleis.ciearforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 01:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647980": [
        {
            "ioc_value": "moor1.ciearforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 01:08:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647979": [
        {
            "ioc_value": "wolke.ciearforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 00:57:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647978": [
        {
            "ioc_value": "mond.stormfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 00:40:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647977": [
        {
            "ioc_value": "grau5.stormfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 00:37:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647976": [
        {
            "ioc_value": "tau.stormfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 00:27:30",
            "last_seen_utc": "2025-11-22 00:30:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647975": [
        {
            "ioc_value": "adler.stormfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 00:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647974": [
        {
            "ioc_value": "wald3.mintstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-22 00:07:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647967": [
        {
            "ioc_value": "klee.mintstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 23:57:09",
            "last_seen_utc": "2025-11-22 00:00:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647966": [
        {
            "ioc_value": "rauch.mintstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 23:48:23",
            "last_seen_utc": "2025-11-21 23:49:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647965": [
        {
            "ioc_value": "shady.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 23:38:06",
            "last_seen_utc": "2025-11-21 23:43:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647949": [
        {
            "ioc_value": "rill.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 23:28:49",
            "last_seen_utc": "2025-11-21 23:34:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647948": [
        {
            "ioc_value": "glow2.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 23:26:42",
            "last_seen_utc": "2025-11-21 23:27:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647947": [
        {
            "ioc_value": "weald.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 23:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647946": [
        {
            "ioc_value": "birch.m1styvaive.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 23:05:32",
            "last_seen_utc": "2025-11-21 23:13:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647929": [
        {
            "ioc_value": "pfote.starcresting.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 22:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647928": [
        {
            "ioc_value": "jsbot.dzbot.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-21 22:54:18",
            "last_seen_utc": "2025-11-21 22:54:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "mirai",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1647926": [
        {
            "ioc_value": "falke1.starcresting.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 22:47:25",
            "last_seen_utc": "2025-11-21 22:53:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647925": [
        {
            "ioc_value": "nebel.starcresting.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 22:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647924": [
        {
            "ioc_value": "gleam.starcresting.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 22:26:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647923": [
        {
            "ioc_value": "tal2.deepstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 22:21:04",
            "last_seen_utc": "2025-11-21 22:24:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647922": [
        {
            "ioc_value": "bach.deepstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 22:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647921": [
        {
            "ioc_value": "wolfe.deepstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 22:07:01",
            "last_seen_utc": "2025-11-21 22:10:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647918": [
        {
            "ioc_value": "korn.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 21:58:16",
            "last_seen_utc": "2025-11-21 21:58:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647917": [
        {
            "ioc_value": "brise4.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 21:47:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647916": [
        {
            "ioc_value": "moos.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 21:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647915": [
        {
            "ioc_value": "ufer.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 21:27:48",
            "last_seen_utc": "2025-11-21 21:31:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647914": [
        {
            "ioc_value": "fjord.wiidharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 21:17:31",
            "last_seen_utc": "2025-11-21 21:20:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647913": [
        {
            "ioc_value": "kamm1.iunarblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 21:07:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647912": [
        {
            "ioc_value": "glade.iunarblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 20:58:28",
            "last_seen_utc": "2025-11-21 21:01:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647911": [
        {
            "ioc_value": "taiga.iunarblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 20:48:12",
            "last_seen_utc": "2025-11-21 20:56:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647908": [
        {
            "ioc_value": "rune.brightf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 20:38:11",
            "last_seen_utc": "2025-11-21 20:45:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647905": [
        {
            "ioc_value": "eiche.brightf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 20:26:52",
            "last_seen_utc": "2025-11-21 20:30:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647904": [
        {
            "ioc_value": "pfad2.brightf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 20:12:00",
            "last_seen_utc": "2025-11-21 20:25:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647900": [
        {
            "ioc_value": "wolke.brightf0rge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 20:03:42",
            "last_seen_utc": "2025-11-21 20:11:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647891": [
        {
            "ioc_value": "vh.emberiake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 19:57:30",
            "last_seen_utc": "2025-11-21 20:02:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647890": [
        {
            "ioc_value": "vsieh.emberiake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 19:47:42",
            "last_seen_utc": "2025-11-21 19:49:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647889": [
        {
            "ioc_value": "sage.emberiake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 19:31:43",
            "last_seen_utc": "2025-11-21 19:33:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647888": [
        {
            "ioc_value": "lane7.emberiake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 19:27:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647886": [
        {
            "ioc_value": "ngytp.iunarpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 19:17:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647885": [
        {
            "ioc_value": "flare.iunarpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 19:00:52",
            "last_seen_utc": "2025-11-21 19:06:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647884": [
        {
            "ioc_value": "lwch.iunarpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 18:54:38",
            "last_seen_utc": "2025-11-21 18:58:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647883": [
        {
            "ioc_value": "fkk4m.iunarpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 18:48:26",
            "last_seen_utc": "2025-11-21 18:52:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647877": [
        {
            "ioc_value": "383cc.mistfaii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 18:37:37",
            "last_seen_utc": "2025-11-21 18:43:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647876": [
        {
            "ioc_value": "cr.mistfaii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 18:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647875": [
        {
            "ioc_value": "cloud2.mistfaii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 18:17:29",
            "last_seen_utc": "2025-11-21 18:21:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647874": [
        {
            "ioc_value": "s2awscloudupdates.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-11-21 18:08:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-qkkrrsak6y",
            "tags": "C2,domain,netwire,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647873": [
        {
            "ioc_value": "2h6.mistfaii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 18:07:12",
            "last_seen_utc": "2025-11-21 18:09:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647872": [
        {
            "ioc_value": "tickets-somewhat.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-21 18:03:47",
            "last_seen_utc": "2025-12-12 18:37:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-vd8x8sdl81",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647870": [
        {
            "ioc_value": "nas064gjgfebvbutebbtakethisasitisbhfdnmn.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-21 18:02:25",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-pet8kswmey",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647868": [
        {
            "ioc_value": "said-letter.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-21 18:02:15",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-srzwdabq7v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647865": [
        {
            "ioc_value": "qsa1.stormbioom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 17:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647864": [
        {
            "ioc_value": "lake.stormbioom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 17:48:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647863": [
        {
            "ioc_value": "6tpmi.stormbioom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 17:36:51",
            "last_seen_utc": "2025-11-21 17:37:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647862": [
        {
            "ioc_value": "bloom.stormbioom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 17:21:59",
            "last_seen_utc": "2025-11-21 17:26:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647861": [
        {
            "ioc_value": "bpk.brightsage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 17:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647860": [
        {
            "ioc_value": "5obr8.brightsage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 17:05:28",
            "last_seen_utc": "2025-11-21 17:10:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647858": [
        {
            "ioc_value": "q6.brightsage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 16:53:35",
            "last_seen_utc": "2025-11-21 16:57:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647857": [
        {
            "ioc_value": "v9.brightsage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 16:49:24",
            "last_seen_utc": "2025-11-21 16:53:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647856": [
        {
            "ioc_value": "hello.tgllsy.bar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-21 16:48:19",
            "last_seen_utc": "2025-12-14 11:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647855": [
        {
            "ioc_value": "frost8.silverr0ot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 16:47:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647854": [
        {
            "ioc_value": "storm.silverr0ot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 16:37:29",
            "last_seen_utc": "2025-11-21 16:47:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647853": [
        {
            "ioc_value": "mint3.silverr0ot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 16:27:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647852": [
        {
            "ioc_value": "nova4.silverr0ot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 16:15:54",
            "last_seen_utc": "2025-11-21 16:19:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647851": [
        {
            "ioc_value": "lbs.windfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 16:08:23",
            "last_seen_utc": "2025-11-21 16:11:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647850": [
        {
            "ioc_value": "cloud.windfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 16:04:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647838": [
        {
            "ioc_value": "cloud4.windfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:57:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647837": [
        {
            "ioc_value": "nest5.windfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:47:58",
            "last_seen_utc": "2025-11-21 15:53:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647836": [
        {
            "ioc_value": "mint.st0nefield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:41:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647835": [
        {
            "ioc_value": "cloud8.st0nefield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:37:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647834": [
        {
            "ioc_value": "lpx.st0nefield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647833": [
        {
            "ioc_value": "u3i3y.st0nefield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647832": [
        {
            "ioc_value": "silver.cioudnest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:17:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647831": [
        {
            "ioc_value": "feedback.rightontheroad.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-21 15:12:25",
            "last_seen_utc": "2025-11-29 09:46:27",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115588317121724394",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1647830": [
        {
            "ioc_value": "nsi.cioudnest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647829": [
        {
            "ioc_value": "vale.cioudnest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:04:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647828": [
        {
            "ioc_value": "sage8.cioudnest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 15:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647827": [
        {
            "ioc_value": "uy3hc.mintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 14:57:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647826": [
        {
            "ioc_value": "5i.mintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 14:47:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647825": [
        {
            "ioc_value": "35y.mintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 14:44:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647824": [
        {
            "ioc_value": "pulse.mintforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 14:37:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647823": [
        {
            "ioc_value": "vale3.fro5tlane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 14:26:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647822": [
        {
            "ioc_value": "silver9.fro5tlane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 14:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647821": [
        {
            "ioc_value": "xcx.fro5tlane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 14:07:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647820": [
        {
            "ioc_value": "bv.fro5tlane.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 13:57:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647818": [
        {
            "ioc_value": "hop.wallyapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-21 13:50:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647819": [
        {
            "ioc_value": "hop.noisolation.org.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-21 13:50:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647814": [
        {
            "ioc_value": "7l.brightridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 13:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647813": [
        {
            "ioc_value": "96btv.brightridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 13:38:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647811": [
        {
            "ioc_value": "rapid.brightridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 13:28:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647810": [
        {
            "ioc_value": "3y.brightridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 13:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647809": [
        {
            "ioc_value": "lr.stonecl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 13:14:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647806": [
        {
            "ioc_value": "medinflow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-21 13:10:41",
            "last_seen_utc": "2025-11-21 13:07:56",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115587840067408494",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1647804": [
        {
            "ioc_value": "qm.stonecl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 13:07:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647803": [
        {
            "ioc_value": "wild0.stonecl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 12:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647802": [
        {
            "ioc_value": "1e8.stonecl0ud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 12:54:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647800": [
        {
            "ioc_value": "d17.w1ldforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 12:47:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647799": [
        {
            "ioc_value": "pulse1.w1ldforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 12:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647798": [
        {
            "ioc_value": "vale4.w1ldforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 12:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647797": [
        {
            "ioc_value": "ee2x.w1ldforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 12:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647793": [
        {
            "ioc_value": "0i4.suncrest0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 12:07:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647782": [
        {
            "ioc_value": "cucuketeee.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-21 12:02:33",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-mhv8yaykam",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647783": [
        {
            "ioc_value": "goloe2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-21 12:02:33",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-lf2ghaxldk",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647781": [
        {
            "ioc_value": "6menpanelgrace99.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-21 12:02:19",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-kyvk8sat8f",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647779": [
        {
            "ioc_value": "shadow.suncrest0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 11:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647778": [
        {
            "ioc_value": "6xnq.suncrest0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 11:48:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647776": [
        {
            "ioc_value": "flare.suncrest0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 11:37:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647775": [
        {
            "ioc_value": "spark5.b1uespark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 11:27:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647774": [
        {
            "ioc_value": "tw80g.b1uespark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 11:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647773": [
        {
            "ioc_value": "sun.b1uespark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 11:07:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647772": [
        {
            "ioc_value": "731.b1uespark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 11:02:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647758": [
        {
            "ioc_value": "sky.m1ntflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 10:57:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647757": [
        {
            "ioc_value": "blue.m1ntflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 10:50:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647755": [
        {
            "ioc_value": "61.m1ntflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 10:47:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647751": [
        {
            "ioc_value": "nova.m1ntflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 10:37:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647750": [
        {
            "ioc_value": "drift8.skybl1ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 10:27:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647749": [
        {
            "ioc_value": "wild6.skybl1ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 10:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647748": [
        {
            "ioc_value": "crest3.skybl1ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 10:07:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647747": [
        {
            "ioc_value": "stone.skybl1ss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 09:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647746": [
        {
            "ioc_value": "kj.rapidst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 09:47:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647745": [
        {
            "ioc_value": "ridge.rapidst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 09:43:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647744": [
        {
            "ioc_value": "mist8.rapidst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 09:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647743": [
        {
            "ioc_value": "drift.rapidst0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 09:27:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647742": [
        {
            "ioc_value": "crest5.shad0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 09:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647741": [
        {
            "ioc_value": "bj1s.shad0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 09:17:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647739": [
        {
            "ioc_value": "nf0g.shad0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 09:07:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647724": [
        {
            "ioc_value": "yyb0w.shad0wmist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 08:58:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647723": [
        {
            "ioc_value": "bach2.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 08:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647710": [
        {
            "ioc_value": "rune.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 08:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647701": [
        {
            "ioc_value": "weiss.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 08:27:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647700": [
        {
            "ioc_value": "blitz.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 08:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647699": [
        {
            "ioc_value": "wolfe.gu-5-hnatr-3-mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 08:07:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647689": [
        {
            "ioc_value": "julio31.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-21 08:01:41",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647690": [
        {
            "ioc_value": "zuwkanuikekauwawebarugibikonemwehnhumdon.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-21 08:01:41",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647688": [
        {
            "ioc_value": "play.mclighthouse.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-21 08:01:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647684": [
        {
            "ioc_value": "child-porn.womensoundoff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-21 08:00:48",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647685": [
        {
            "ioc_value": "freeporn.womensoundoff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-21 08:00:48",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647686": [
        {
            "ioc_value": "sex-child.womensoundoff.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-21 08:00:48",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647682": [
        {
            "ioc_value": "csam.www.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-21 08:00:28",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647683": [
        {
            "ioc_value": "serviciospkkm.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-21 08:00:28",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647678": [
        {
            "ioc_value": "moor4.dinfectt0rs0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 07:57:19",
            "last_seen_utc": "2025-11-21 08:03:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647663": [
        {
            "ioc_value": "fvd.wallyapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-21 07:49:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647664": [
        {
            "ioc_value": "fvd.noisolation.org.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-21 07:49:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647665": [
        {
            "ioc_value": "delivery.parsflowers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-21 07:49:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647658": [
        {
            "ioc_value": "birch.dinfectt0rs0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 07:47:29",
            "last_seen_utc": "2025-11-21 07:48:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647657": [
        {
            "ioc_value": "klee.dinfectt0rs0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 07:37:13",
            "last_seen_utc": "2025-11-21 07:38:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647656": [
        {
            "ioc_value": "tau1.kick5ubs4ance.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 07:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647655": [
        {
            "ioc_value": "krone.kick5ubs4ance.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 07:16:02",
            "last_seen_utc": "2025-11-21 07:17:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647653": [
        {
            "ioc_value": "mircd.hokkien.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.tsunami",
            "malware_alias": "Muhstik,Radiation,Amnesia",
            "malware_printable": "Tsunami",
            "first_seen_utc": "2025-11-21 07:15:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/9701ae7249aa394624bf33096e3f5dd2be0bb778debba3364f5277a50874cc31/",
            "tags": "Tsunami",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647654": [
        {
            "ioc_value": "mircd.xiao.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.tsunami",
            "malware_alias": "Muhstik,Radiation,Amnesia",
            "malware_printable": "Tsunami",
            "first_seen_utc": "2025-11-21 07:15:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/9701ae7249aa394624bf33096e3f5dd2be0bb778debba3364f5277a50874cc31/",
            "tags": "Tsunami",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647652": [
        {
            "ioc_value": "ufer.kick5ubs4ance.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 07:12:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647651": [
        {
            "ioc_value": "glanz.kick5ubs4ance.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 07:08:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647650": [
        {
            "ioc_value": "pfad.dis5h7gien.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 06:57:50",
            "last_seen_utc": "2025-11-21 07:05:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647649": [
        {
            "ioc_value": "wolke2.dis5h7gien.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 06:44:30",
            "last_seen_utc": "2025-11-21 06:46:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647648": [
        {
            "ioc_value": "rauch.dis5h7gien.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 06:37:47",
            "last_seen_utc": "2025-11-21 06:38:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647355": [
        {
            "ioc_value": "gog.nigeriaafricatime.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-21 06:31:02",
            "last_seen_utc": "2025-11-24 08:38:26",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/5.75.215.164/relations",
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "vovaan"
        }
    ],
    "1647359": [
        {
            "ioc_value": "tgk.clashofmaps.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-21 06:31:00",
            "last_seen_utc": "2025-11-24 08:38:26",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/139e44263c2bf89c93d5d3b04a041fc964c6c9ffdd35f95b995b5669eb2a4277/relations",
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "vovaan"
        }
    ],
    "1647470": [
        {
            "ioc_value": "api.cpibot.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-21 06:30:44",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1647487": [
        {
            "ioc_value": "portabalbufe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-21 06:30:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://bsky.app/profile/netresec.com/post/3m63mxgqzzs24",
            "tags": null,
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1647647": [
        {
            "ioc_value": "kamm.in-ha-4-it-mu-1-ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 06:20:22",
            "last_seen_utc": "2025-11-21 06:25:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647646": [
        {
            "ioc_value": "fjord3.in-ha-4-it-mu-1-ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 06:17:12",
            "last_seen_utc": "2025-11-21 06:19:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647645": [
        {
            "ioc_value": "wald.in-ha-4-it-mu-1-ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 06:07:26",
            "last_seen_utc": "2025-11-21 06:10:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647644": [
        {
            "ioc_value": "linmaco001.abrdns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-11-21 06:06:10",
            "last_seen_utc": "2025-12-12 18:40:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-e9bplscn6w",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647643": [
        {
            "ioc_value": "appremiumoilfield.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-11-21 06:06:09",
            "last_seen_utc": "2025-12-12 18:40:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-e9bplscn6w",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647641": [
        {
            "ioc_value": "xyk33.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-21 06:05:08",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-d2td1scm3z",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647638": [
        {
            "ioc_value": "josesi4418-31009.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-21 06:02:53",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-cccjjack2x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647636": [
        {
            "ioc_value": "cut-cash.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-21 06:02:18",
            "last_seen_utc": "2025-12-12 18:39:24",
            "confidence_level": 100,
            "reference": "https://tria.ge/251121-df6r8ahv9e",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647634": [
        {
            "ioc_value": "sturm.in-ha-4-it-mu-1-ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 05:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647633": [
        {
            "ioc_value": "nest1.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 05:44:50",
            "last_seen_utc": "2025-11-21 05:47:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647632": [
        {
            "ioc_value": "gleis.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 05:38:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647631": [
        {
            "ioc_value": "dune.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 05:27:44",
            "last_seen_utc": "2025-11-21 05:31:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647630": [
        {
            "ioc_value": "wolke.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 05:17:57",
            "last_seen_utc": "2025-11-21 05:19:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647628": [
        {
            "ioc_value": "adler.gu5hnatr3mb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 05:07:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647627": [
        {
            "ioc_value": "moor.kick-5-ubs-4-ance.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 04:57:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647626": [
        {
            "ioc_value": "brise5.kick-5-ubs-4-ance.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 04:47:28",
            "last_seen_utc": "2025-11-21 04:57:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647625": [
        {
            "ioc_value": "weald.kick-5-ubs-4-ance.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 04:37:11",
            "last_seen_utc": "2025-11-21 04:42:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647624": [
        {
            "ioc_value": "hafen2.dinfectt-0-rs-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 04:28:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647623": [
        {
            "ioc_value": "grat.dinfectt-0-rs-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 04:18:05",
            "last_seen_utc": "2025-11-21 04:27:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647622": [
        {
            "ioc_value": "tal.dinfectt-0-rs-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 04:06:47",
            "last_seen_utc": "2025-11-21 04:08:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647607": [
        {
            "ioc_value": "licht.dinfectt-0-rs-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 03:58:00",
            "last_seen_utc": "2025-11-21 04:00:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647606": [
        {
            "ioc_value": "klee.kab-1-spr-0-tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 03:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647605": [
        {
            "ioc_value": "rune4.kab-1-spr-0-tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 03:37:50",
            "last_seen_utc": "2025-11-21 03:39:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647604": [
        {
            "ioc_value": "stern.kab-1-spr-0-tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 03:27:33",
            "last_seen_utc": "2025-11-21 03:35:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647603": [
        {
            "ioc_value": "wolfe.kab-1-spr-0-tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 03:17:33",
            "last_seen_utc": "2025-11-21 03:19:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647601": [
        {
            "ioc_value": "bach.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 03:01:38",
            "last_seen_utc": "2025-11-21 03:07:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647600": [
        {
            "ioc_value": "wind2.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 02:51:14",
            "last_seen_utc": "2025-11-21 02:53:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647599": [
        {
            "ioc_value": "falke.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 02:47:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647598": [
        {
            "ioc_value": "eiche.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 02:36:48",
            "last_seen_utc": "2025-11-21 02:43:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647597": [
        {
            "ioc_value": "geist.dis-5-h-7-gien.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 02:28:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647596": [
        {
            "ioc_value": "pfad.inha4itmu1ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 02:17:39",
            "last_seen_utc": "2025-11-21 02:27:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647595": [
        {
            "ioc_value": "ufer1.inha4itmu1ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 02:07:53",
            "last_seen_utc": "2025-11-21 02:17:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647594": [
        {
            "ioc_value": "moor.inha4itmu1ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 01:57:33",
            "last_seen_utc": "2025-11-21 01:58:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647592": [
        {
            "ioc_value": "korn.kab1spr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 01:47:15",
            "last_seen_utc": "2025-11-21 01:49:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647591": [
        {
            "ioc_value": "tau3.kab1spr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 01:37:42",
            "last_seen_utc": "2025-11-21 01:38:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647590": [
        {
            "ioc_value": "glade.kab1spr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 01:28:07",
            "last_seen_utc": "2025-11-21 01:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647589": [
        {
            "ioc_value": "wolke.kab1spr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 01:16:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647588": [
        {
            "ioc_value": "wolke2.stormpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 01:07:58",
            "last_seen_utc": "2025-11-21 01:12:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647587": [
        {
            "ioc_value": "grat.stormpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 00:54:38",
            "last_seen_utc": "2025-11-21 00:59:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647586": [
        {
            "ioc_value": "tal.stormpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 00:43:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647585": [
        {
            "ioc_value": "bach.stormpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 00:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647584": [
        {
            "ioc_value": "weiss.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 00:27:15",
            "last_seen_utc": "2025-11-21 00:34:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647583": [
        {
            "ioc_value": "glanz7.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 00:17:28",
            "last_seen_utc": "2025-11-21 00:24:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647582": [
        {
            "ioc_value": "kamm.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-21 00:07:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647572": [
        {
            "ioc_value": "dune.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 23:58:09",
            "last_seen_utc": "2025-11-21 00:06:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647570": [
        {
            "ioc_value": "eiche.m1ntcioud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 23:47:51",
            "last_seen_utc": "2025-11-20 23:55:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647566": [
        {
            "ioc_value": "wind4.ciearbug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 23:30:56",
            "last_seen_utc": "2025-11-20 23:43:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647565": [
        {
            "ioc_value": "moor.ciearbug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 23:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647564": [
        {
            "ioc_value": "pfad.ciearbug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 23:17:29",
            "last_seen_utc": "2025-11-20 23:23:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647562": [
        {
            "ioc_value": "gogl-meet.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 23:08:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647561": [
        {
            "ioc_value": "stern.l1ghtcloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 23:07:42",
            "last_seen_utc": "2025-11-20 23:12:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647552": [
        {
            "ioc_value": "mail.cryptoeth.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-20 23:02:06",
            "last_seen_utc": "2025-11-21 00:03:51",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.9.213+mail.cryptoeth.store",
            "tags": "AS42624,C2,censys,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1647549": [
        {
            "ioc_value": "gleis3.l1ghtcloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 22:58:26",
            "last_seen_utc": "2025-11-20 23:04:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647546": [
        {
            "ioc_value": "vjlong5555.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-20 22:57:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "asyncrat,c2,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647547": [
        {
            "ioc_value": "vj9999.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-20 22:57:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "asyncrat,c2,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647548": [
        {
            "ioc_value": "pureforupdatebunies.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-20 22:57:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "asyncrat,c2,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647545": [
        {
            "ioc_value": "warewuasar3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-20 22:54:58",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/2a5711a4075d505a8cac92222c2ff2a6c2a99f36c345aeac40be123b9053bcfe",
            "tags": "c2,domain,quasar,rat,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647544": [
        {
            "ioc_value": "portevergrenncallaosilcent.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-20 22:52:24",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1818199/0/iochtml",
            "tags": "c2,domain,joesandbox,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647543": [
        {
            "ioc_value": "wolke.l1ghtcloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 22:46:06",
            "last_seen_utc": "2025-11-20 22:52:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647542": [
        {
            "ioc_value": "giasdfklopert.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:43:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1568228/",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647541": [
        {
            "ioc_value": "dotarhiamkloie.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:41:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1568544/",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647540": [
        {
            "ioc_value": "lasopisojioliondas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:40:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.55.16",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647539": [
        {
            "ioc_value": "kamisisterbrofanydodf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:39:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.208.104",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647538": [
        {
            "ioc_value": "hotfilipopersastriolkas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.103",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647537": [
        {
            "ioc_value": "ufer.l1ghtcloud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 22:37:17",
            "last_seen_utc": "2025-11-20 22:43:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647536": [
        {
            "ioc_value": "mikusadiokloka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:36:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.100",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647535": [
        {
            "ioc_value": "fikolasdklnbhgss.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:35:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.101",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647534": [
        {
            "ioc_value": "eradiolpsssrepshvebsqw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:35:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.167",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647533": [
        {
            "ioc_value": "aviksateroliuwertu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:33:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.185",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647532": [
        {
            "ioc_value": "gladirustoklioasfar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:32:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.246",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647531": [
        {
            "ioc_value": "dadanetuilkolaifhrts.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:31:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1646054/",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647530": [
        {
            "ioc_value": "compomhariolkifdsts.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:30:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.192",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647529": [
        {
            "ioc_value": "astovengroikoliuyastat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 22:29:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.183",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647528": [
        {
            "ioc_value": "korn1.shadowmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 22:28:01",
            "last_seen_utc": "2025-11-20 22:35:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647526": [
        {
            "ioc_value": "glade.shadowmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 22:18:15",
            "last_seen_utc": "2025-11-20 22:22:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647523": [
        {
            "ioc_value": "help.steampowered-check.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 22:11:14",
            "last_seen_utc": "2025-11-20 23:09:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647521": [
        {
            "ioc_value": "360-carview.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 22:09:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647517": [
        {
            "ioc_value": "nacht.shadowmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 22:07:58",
            "last_seen_utc": "2025-11-20 22:17:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647516": [
        {
            "ioc_value": "4vspvs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 22:07:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647515": [
        {
            "ioc_value": "nebel.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 21:57:40",
            "last_seen_utc": "2025-11-20 22:07:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647513": [
        {
            "ioc_value": "softwaretech.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 21:51:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647510": [
        {
            "ioc_value": "aws-bucket.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 21:48:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647509": [
        {
            "ioc_value": "strand.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 21:47:53",
            "last_seen_utc": "2025-11-20 21:52:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647507": [
        {
            "ioc_value": "licht2.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 21:36:34",
            "last_seen_utc": "2025-11-20 21:47:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647506": [
        {
            "ioc_value": "weide.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 21:27:17",
            "last_seen_utc": "2025-11-20 21:30:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647505": [
        {
            "ioc_value": "falke.wildr0se.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 21:17:30",
            "last_seen_utc": "2025-11-20 21:23:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647503": [
        {
            "ioc_value": "kraut.clouddrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 21:05:06",
            "last_seen_utc": "2025-11-20 21:07:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647501": [
        {
            "ioc_value": "updatechromeday.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 21:00:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "apk,fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647497": [
        {
            "ioc_value": "ns_cs2.110-110.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-20 20:58:07",
            "last_seen_utc": "2025-12-14 11:48:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647496": [
        {
            "ioc_value": "ns_cs1.110-110.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-20 20:58:06",
            "last_seen_utc": "2025-12-14 11:48:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647495": [
        {
            "ioc_value": "ns2.welslanguageschool.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-20 20:58:01",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647493": [
        {
            "ioc_value": "cs.110-110.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-20 20:57:30",
            "last_seen_utc": "2025-12-14 11:48:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647492": [
        {
            "ioc_value": "tal.clouddrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 20:57:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647490": [
        {
            "ioc_value": "priceworths.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-20 20:56:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647488": [
        {
            "ioc_value": "dceclarity.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 20:50:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647486": [
        {
            "ioc_value": "bach.clouddrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 20:46:03",
            "last_seen_utc": "2025-11-20 20:46:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647485": [
        {
            "ioc_value": "pfad4.st0nebyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 20:36:48",
            "last_seen_utc": "2025-11-20 20:37:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647484": [
        {
            "ioc_value": "lcontrols10.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 20:36:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647480": [
        {
            "ioc_value": "controlk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 20:33:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647479": [
        {
            "ioc_value": "mist.st0nebyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 20:28:02",
            "last_seen_utc": "2025-11-20 20:30:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647476": [
        {
            "ioc_value": "updateiowin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 20:27:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647474": [
        {
            "ioc_value": "sessionverificate.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 20:26:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647471": [
        {
            "ioc_value": "localhostpin.camdvr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-20 20:20:26",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/4ef44bf6815e78603aec5b480f43fa26d883897c88ced763565e912c38ac9639/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647469": [
        {
            "ioc_value": "dorn.st0nebyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 20:10:35",
            "last_seen_utc": "2025-11-20 20:13:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647468": [
        {
            "ioc_value": "glanz.st0nebyte.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 20:07:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647466": [
        {
            "ioc_value": "wisdomfromthedojo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 20:05:35",
            "last_seen_utc": "2025-12-10 23:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647464": [
        {
            "ioc_value": "3tamura.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-20 20:04:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1647449": [
        {
            "ioc_value": "grat5.mintzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 19:57:40",
            "last_seen_utc": "2025-11-20 19:59:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647445": [
        {
            "ioc_value": "ufer.mintzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 19:41:15",
            "last_seen_utc": "2025-11-20 19:47:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647444": [
        {
            "ioc_value": "wolke.mintzone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 19:38:07",
            "last_seen_utc": "2025-11-20 19:39:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647442": [
        {
            "ioc_value": "moos.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 19:27:11",
            "last_seen_utc": "2025-11-20 19:32:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647440": [
        {
            "ioc_value": "stern.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 19:17:57",
            "last_seen_utc": "2025-11-20 19:24:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647439": [
        {
            "ioc_value": "weald.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 19:07:39",
            "last_seen_utc": "2025-11-20 19:17:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647437": [
        {
            "ioc_value": "kamm2.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 18:57:51",
            "last_seen_utc": "2025-11-20 19:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647418": [
        {
            "ioc_value": "tau.st0rmfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 18:47:48",
            "last_seen_utc": "2025-11-20 18:53:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647415": [
        {
            "ioc_value": "ea.t.banana.vu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-20 18:46:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "vovaan"
        }
    ],
    "1647409": [
        {
            "ioc_value": "birch.skyblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 18:37:31",
            "last_seen_utc": "2025-11-20 18:42:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647367": [
        {
            "ioc_value": "dune3.skyblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 18:27:14",
            "last_seen_utc": "2025-11-20 18:37:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647356": [
        {
            "ioc_value": "ugg.nigeriaafricatime.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-20 18:18:17",
            "last_seen_utc": "2025-11-24 08:38:26",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/5.75.215.164/relations",
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "vovaan"
        }
    ],
    "1647343": [
        {
            "ioc_value": "glade.skyblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 18:14:23",
            "last_seen_utc": "2025-11-20 18:25:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647341": [
        {
            "ioc_value": "wolke.skyblend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 18:07:10",
            "last_seen_utc": "2025-11-20 18:12:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647340": [
        {
            "ioc_value": "print-westminster.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-11-20 18:06:40",
            "last_seen_utc": "2025-12-12 18:40:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/251120-q2vnasgk81",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647336": [
        {
            "ioc_value": "pjrcare.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-11-20 18:03:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647335": [
        {
            "ioc_value": "browse-spanish.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-20 18:03:19",
            "last_seen_utc": "2025-12-12 18:37:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/251120-v3fyraxnhv",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647333": [
        {
            "ioc_value": "CatHeadSquisher-39417.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-20 18:02:42",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 100,
            "reference": "https://tria.ge/251120-pbbxtsfk8x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647330": [
        {
            "ioc_value": "14h.aucti-0-nz-7-ir.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 17:56:53",
            "last_seen_utc": "2025-11-20 18:03:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647329": [
        {
            "ioc_value": "guard.aucti-0-nz-7-ir.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 17:48:08",
            "last_seen_utc": "2025-11-20 17:53:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647328": [
        {
            "ioc_value": "ftp.torinod.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.agent_tesla",
            "malware_alias": "AgenTesla,AgentTesla,Negasteal",
            "malware_printable": "Agent Tesla",
            "first_seen_utc": "2025-11-20 17:46:31",
            "last_seen_utc": "2025-11-20 17:46:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65/",
            "tags": "AgentTesla",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647326": [
        {
            "ioc_value": "gi0x.aucti-0-nz-7-ir.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 17:37:51",
            "last_seen_utc": "2025-11-20 17:46:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647324": [
        {
            "ioc_value": "qhnjc.aucti-0-nz-7-ir.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 17:22:58",
            "last_seen_utc": "2025-11-20 17:28:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647321": [
        {
            "ioc_value": "ugg.wallyapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-20 17:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647322": [
        {
            "ioc_value": "ugg.noisolation.org.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-20 17:19:30",
            "last_seen_utc": "2025-11-20 18:15:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647318": [
        {
            "ioc_value": "yl.suf1nau8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 17:10:21",
            "last_seen_utc": "2025-11-20 17:17:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647270": [
        {
            "ioc_value": "qaqkongtiao.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.roningloader",
            "malware_alias": null,
            "malware_printable": "RONINGLOADER",
            "first_seen_utc": "2025-11-20 17:09:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.elastic.co/security-labs/roningloader",
            "tags": null,
            "anonymous": "0",
            "reporter": "Matagi"
        }
    ],
    "1647286": [
        {
            "ioc_value": "petitesalope.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-20 17:09:04",
            "last_seen_utc": "2025-11-20 14:49:05",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115582574944886384",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1647293": [
        {
            "ioc_value": "app.myonlineprofits.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-20 17:09:02",
            "last_seen_utc": "2025-11-22 10:06:07",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115582655602414026",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1647297": [
        {
            "ioc_value": "ak1.xingxings3.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-20 17:09:01",
            "last_seen_utc": null,
            "confidence_level": 66,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1647317": [
        {
            "ioc_value": "5egzr.suf1nau8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 16:57:31",
            "last_seen_utc": "2025-11-20 16:58:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647315": [
        {
            "ioc_value": "jat.suf1nau8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 16:47:14",
            "last_seen_utc": "2025-11-20 16:53:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647314": [
        {
            "ioc_value": "echo.suf1nau8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 16:31:14",
            "last_seen_utc": "2025-11-20 16:35:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647313": [
        {
            "ioc_value": "loom.suf-1-nau-8-h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 16:27:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647312": [
        {
            "ioc_value": "stack.suf-1-nau-8-h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 16:18:11",
            "last_seen_utc": "2025-11-20 16:25:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647311": [
        {
            "ioc_value": "ne.suf-1-nau-8-h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 16:08:02",
            "last_seen_utc": "2025-11-20 16:15:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647300": [
        {
            "ioc_value": "drift.hre9in7mamma.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 15:57:36",
            "last_seen_utc": "2025-11-20 16:06:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647299": [
        {
            "ioc_value": "blink6.hre9in7mamma.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 15:47:50",
            "last_seen_utc": "2025-11-20 15:54:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647296": [
        {
            "ioc_value": "2y.hre9in7mamma.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 15:37:33",
            "last_seen_utc": "2025-11-20 15:39:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647295": [
        {
            "ioc_value": "blink2.hre9in7mamma.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 15:27:10",
            "last_seen_utc": "2025-11-20 15:34:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647294": [
        {
            "ioc_value": "vale.dup1ic4ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 15:13:19",
            "last_seen_utc": "2025-11-20 15:16:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647292": [
        {
            "ioc_value": "delta4.dup1ic4ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 15:06:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647291": [
        {
            "ioc_value": "shift.dup1ic4ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 14:58:14",
            "last_seen_utc": "2025-11-20 15:02:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647289": [
        {
            "ioc_value": "hsk.dup1ic4ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 14:49:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647284": [
        {
            "ioc_value": "fl9.hre-9-in-7-mamma.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 14:44:46",
            "last_seen_utc": "2025-11-20 14:49:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647281": [
        {
            "ioc_value": "vcute69.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-20 14:41:44",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647280": [
        {
            "ioc_value": "jbdsg65485.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-20 14:41:43",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647277": [
        {
            "ioc_value": "mrdc1963.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-20 14:41:27",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647278": [
        {
            "ioc_value": "v2.www.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-20 14:41:27",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647279": [
        {
            "ioc_value": "v3.www.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-20 14:41:27",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647274": [
        {
            "ioc_value": "lists.ineer.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-20 14:41:07",
            "last_seen_utc": "2025-11-20 14:41:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647275": [
        {
            "ioc_value": "rogerperrybook.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-20 14:41:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647276": [
        {
            "ioc_value": "virus.www.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-20 14:41:07",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1647269": [
        {
            "ioc_value": "shield.hre-9-in-7-mamma.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 14:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647268": [
        {
            "ioc_value": "trail6.hre-9-in-7-mamma.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 14:27:44",
            "last_seen_utc": "2025-11-20 14:35:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647267": [
        {
            "ioc_value": "g4k.hre-9-in-7-mamma.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 14:17:28",
            "last_seen_utc": "2025-11-20 14:23:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647266": [
        {
            "ioc_value": "pkw.kos0ltyu4etey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 14:08:08",
            "last_seen_utc": "2025-11-20 14:16:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647261": [
        {
            "ioc_value": "vk.kos0ltyu4etey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 13:57:18",
            "last_seen_utc": "2025-11-20 14:04:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647260": [
        {
            "ioc_value": "khg2e.kos0ltyu4etey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 13:47:26",
            "last_seen_utc": "2025-11-20 13:49:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647259": [
        {
            "ioc_value": "b1.kos0ltyu4etey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 13:37:09",
            "last_seen_utc": "2025-11-20 13:41:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647258": [
        {
            "ioc_value": "shard6.kos-0-ltyu-4-etey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 13:27:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647257": [
        {
            "ioc_value": "rift5.kos-0-ltyu-4-etey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 13:17:57",
            "last_seen_utc": "2025-11-20 13:20:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647255": [
        {
            "ioc_value": "shard.kos-0-ltyu-4-etey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 13:07:03",
            "last_seen_utc": "2025-11-20 13:14:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647254": [
        {
            "ioc_value": "nln7n.kos-0-ltyu-4-etey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 12:57:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647251": [
        {
            "ioc_value": "bv51.liner-9-ick.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 12:47:29",
            "last_seen_utc": "2025-11-20 12:52:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647250": [
        {
            "ioc_value": "9st6r.liner-9-ick.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 12:37:41",
            "last_seen_utc": "2025-11-20 12:47:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647248": [
        {
            "ioc_value": "sbsq.liner-9-ick.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 12:29:57",
            "last_seen_utc": "2025-11-20 12:30:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647247": [
        {
            "ioc_value": "jet8.liner-9-ick.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 12:18:11",
            "last_seen_utc": "2025-11-20 12:20:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647241": [
        {
            "ioc_value": "oixp.aucti0nz7ir.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 12:03:15",
            "last_seen_utc": "2025-11-20 12:12:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647237": [
        {
            "ioc_value": "1qtbb.aucti0nz7ir.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 11:57:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647236": [
        {
            "ioc_value": "nova.aucti0nz7ir.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 11:46:45",
            "last_seen_utc": "2025-11-20 11:48:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647235": [
        {
            "ioc_value": "dc8.aucti0nz7ir.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 11:34:55",
            "last_seen_utc": "2025-11-20 11:37:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647234": [
        {
            "ioc_value": "auul8.dup-1-ic-4-ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 11:27:40",
            "last_seen_utc": "2025-11-20 11:32:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647233": [
        {
            "ioc_value": "orbit8.dup-1-ic-4-ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 11:16:23",
            "last_seen_utc": "2025-11-20 11:17:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647232": [
        {
            "ioc_value": "dzthj.dup-1-ic-4-ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 11:04:34",
            "last_seen_utc": "2025-11-20 11:08:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647209": [
        {
            "ioc_value": "www.baiyangyan.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-20 11:00:08",
            "last_seen_utc": "2025-11-20 23:00:08",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.137.8+www.baiyangyan.cn",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1647207": [
        {
            "ioc_value": "0o.dup-1-ic-4-ermaph.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 10:52:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647205": [
        {
            "ioc_value": "dorn6.driftklause.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 10:46:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647204": [
        {
            "ioc_value": "grau.driftklause.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 10:38:19",
            "last_seen_utc": "2025-11-20 10:40:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647203": [
        {
            "ioc_value": "kamm.driftklause.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 10:28:02",
            "last_seen_utc": "2025-11-20 10:36:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647202": [
        {
            "ioc_value": "gleis.driftklause.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 10:18:10",
            "last_seen_utc": "2025-11-20 10:27:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647201": [
        {
            "ioc_value": "brise.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 10:07:54",
            "last_seen_utc": "2025-11-20 10:11:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647200": [
        {
            "ioc_value": "ridge4.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 09:57:33",
            "last_seen_utc": "2025-11-20 10:07:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647196": [
        {
            "ioc_value": "gjt.wallyapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-20 09:54:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647197": [
        {
            "ioc_value": "fra.wallyapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-20 09:54:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647198": [
        {
            "ioc_value": "gjt.nigeriaafricatime.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-20 09:54:57",
            "last_seen_utc": "2025-11-20 18:18:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1647192": [
        {
            "ioc_value": "mead.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 09:49:49",
            "last_seen_utc": "2025-11-20 09:51:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647191": [
        {
            "ioc_value": "brook.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 09:43:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647190": [
        {
            "ioc_value": "weald.loamgarde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 09:37:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647189": [
        {
            "ioc_value": "amififadinokasrwe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-20 09:28:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.208.101",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647187": [
        {
            "ioc_value": "sticka.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-20 09:25:13",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647188": [
        {
            "ioc_value": "decalcy.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-20 09:25:13",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647186": [
        {
            "ioc_value": "krone3.wolspfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 09:21:25",
            "last_seen_utc": "2025-11-20 09:24:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647185": [
        {
            "ioc_value": "wald.wolspfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 09:17:13",
            "last_seen_utc": "2025-11-20 09:18:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647184": [
        {
            "ioc_value": "falke.wolspfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 09:06:57",
            "last_seen_utc": "2025-11-20 09:08:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647183": [
        {
            "ioc_value": "rauch2.emberbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 08:58:11",
            "last_seen_utc": "2025-11-20 08:59:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647182": [
        {
            "ioc_value": "glut.emberbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 08:47:48",
            "last_seen_utc": "2025-11-20 08:49:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647177": [
        {
            "ioc_value": "ufer.emberbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 08:38:03",
            "last_seen_utc": "2025-11-20 08:44:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647176": [
        {
            "ioc_value": "hafen.emberbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 08:27:48",
            "last_seen_utc": "2025-11-20 08:33:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647175": [
        {
            "ioc_value": "stern1.alderquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 08:17:27",
            "last_seen_utc": "2025-11-20 08:23:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647174": [
        {
            "ioc_value": "eiche.alderquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 08:07:36",
            "last_seen_utc": "2025-11-20 08:09:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647159": [
        {
            "ioc_value": "fjord.alderquartz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 07:57:18",
            "last_seen_utc": "2025-11-20 08:00:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647157": [
        {
            "ioc_value": "www.batescraigprojects.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-20 07:50:32",
            "last_seen_utc": "2025-12-12 18:39:26",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/690e176d113e5292ad83e9c50dce168dd36faa62e586976f08a17cfc9b780cca/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647156": [
        {
            "ioc_value": "www.batescraigprojects.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-20 07:50:31",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/690e176d113e5292ad83e9c50dce168dd36faa62e586976f08a17cfc9b780cca/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1647155": [
        {
            "ioc_value": "taiga.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 07:47:27",
            "last_seen_utc": "2025-11-20 07:48:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647154": [
        {
            "ioc_value": "korn7.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 07:37:08",
            "last_seen_utc": "2025-11-20 07:42:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647153": [
        {
            "ioc_value": "pfad.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 07:22:11",
            "last_seen_utc": "2025-11-20 07:26:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647152": [
        {
            "ioc_value": "sturm.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 07:18:01",
            "last_seen_utc": "2025-11-20 07:22:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647151": [
        {
            "ioc_value": "static.myonlinegigs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-20 07:10:43",
            "last_seen_utc": "2025-11-22 10:06:07",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115580768454007836",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1647150": [
        {
            "ioc_value": "birch.cobaltmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 07:07:54",
            "last_seen_utc": "2025-11-20 07:14:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647148": [
        {
            "ioc_value": "wolke9.lindenarc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 06:57:34",
            "last_seen_utc": "2025-11-20 06:58:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647147": [
        {
            "ioc_value": "tal.lindenarc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 06:47:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646874": [
        {
            "ioc_value": "ethupdate.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-20 06:38:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/f8fd705a-e9dc-4091-8bd5-fc465d8146e8",
            "tags": "c2",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1646881": [
        {
            "ioc_value": "xrprelay.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-20 06:38:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1647146": [
        {
            "ioc_value": "bach.lindenarc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 06:37:29",
            "last_seen_utc": "2025-11-20 06:38:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647145": [
        {
            "ioc_value": "rune.lindenarc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 06:23:08",
            "last_seen_utc": "2025-11-20 06:35:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647144": [
        {
            "ioc_value": "strom2.granitehaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647141": [
        {
            "ioc_value": "weiss.granitehaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 06:07:01",
            "last_seen_utc": "2025-11-20 06:11:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647137": [
        {
            "ioc_value": "igw.myfirewall.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-20 06:02:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251120-gfe62szqas",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1647136": [
        {
            "ioc_value": "hain.brackenloft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 06:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647135": [
        {
            "ioc_value": "wind5.brackenloft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 05:47:59",
            "last_seen_utc": "2025-11-20 05:52:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647134": [
        {
            "ioc_value": "licht.brackenloft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 05:37:36",
            "last_seen_utc": "2025-11-20 05:48:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647133": [
        {
            "ioc_value": "fels.brackenloft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 05:27:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647132": [
        {
            "ioc_value": "moor.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 05:17:33",
            "last_seen_utc": "2025-11-20 05:23:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647131": [
        {
            "ioc_value": "geist.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 05:07:16",
            "last_seen_utc": "2025-11-20 05:14:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647130": [
        {
            "ioc_value": "ufer1.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 04:57:26",
            "last_seen_utc": "2025-11-20 05:00:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647129": [
        {
            "ioc_value": "tau.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 04:40:56",
            "last_seen_utc": "2025-11-20 04:56:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647128": [
        {
            "ioc_value": "glade.moonfenster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 04:36:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647127": [
        {
            "ioc_value": "rauch.thistleforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 04:27:53",
            "last_seen_utc": "2025-11-20 04:32:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647126": [
        {
            "ioc_value": "klee.thistleforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 04:20:03",
            "last_seen_utc": "2025-11-20 04:28:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647125": [
        {
            "ioc_value": "bach3.thistleforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 04:07:48",
            "last_seen_utc": "2025-11-20 04:17:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647113": [
        {
            "ioc_value": "wolke.thistleforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 03:57:52",
            "last_seen_utc": "2025-11-20 03:58:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647112": [
        {
            "ioc_value": "w0ald.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 03:47:34",
            "last_seen_utc": "2025-11-20 03:52:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647111": [
        {
            "ioc_value": "gl4ut.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 03:37:12",
            "last_seen_utc": "2025-11-20 03:43:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647110": [
        {
            "ioc_value": "haf3en.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 03:27:25",
            "last_seen_utc": "2025-11-20 03:32:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647109": [
        {
            "ioc_value": "wei5ss.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 03:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647108": [
        {
            "ioc_value": "st0urm.se1fish5tupid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 03:07:19",
            "last_seen_utc": "2025-11-20 03:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647106": [
        {
            "ioc_value": "eich3e.nar7owsized.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 02:58:03",
            "last_seen_utc": "2025-11-20 03:04:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647099": [
        {
            "ioc_value": "wo2lke.nar7owsized.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 02:47:45",
            "last_seen_utc": "2025-11-20 02:53:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647098": [
        {
            "ioc_value": "fa3lke.nar7owsized.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 02:37:59",
            "last_seen_utc": "2025-11-20 02:38:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647097": [
        {
            "ioc_value": "ne1bel.nar7owsized.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 02:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647096": [
        {
            "ioc_value": "do4rn.pr0p0sedtact.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 02:20:27",
            "last_seen_utc": "2025-11-20 02:25:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1647095": [
        {
            "ioc_value": "gle2is.pr0p0sedtact.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 02:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646884": [
        {
            "ioc_value": "br1ise.pr0p0sedtact.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 02:07:31",
            "last_seen_utc": "2025-11-20 02:08:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646883": [
        {
            "ioc_value": "pf7ad.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 01:52:09",
            "last_seen_utc": "2025-11-20 01:59:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646882": [
        {
            "ioc_value": "u6fer.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 01:44:19",
            "last_seen_utc": "2025-11-20 01:50:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646880": [
        {
            "ioc_value": "we4g.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 01:37:13",
            "last_seen_utc": "2025-11-20 01:40:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646879": [
        {
            "ioc_value": "mo2or.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 01:29:20",
            "last_seen_utc": "2025-11-20 01:33:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646875": [
        {
            "ioc_value": "ha1in.rec1aimswal1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 01:23:01",
            "last_seen_utc": "2025-11-20 01:29:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646873": [
        {
            "ioc_value": "st3eg.aphrh1tc4h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 01:17:49",
            "last_seen_utc": "2025-11-20 01:19:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646872": [
        {
            "ioc_value": "e1is.aphrh1tc4h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 01:07:57",
            "last_seen_utc": "2025-11-20 01:13:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646871": [
        {
            "ioc_value": "qu1arz.aphrh1tc4h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 00:57:39",
            "last_seen_utc": "2025-11-20 01:04:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646870": [
        {
            "ioc_value": "li2cht.aphrh1tc4h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 00:47:44",
            "last_seen_utc": "2025-11-20 00:52:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646869": [
        {
            "ioc_value": "fl3uss.test6yvarn1sh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 00:38:29",
            "last_seen_utc": "2025-11-20 00:43:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646868": [
        {
            "ioc_value": "be2rg.test6yvarn1sh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 00:27:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646867": [
        {
            "ioc_value": "we1iss.test6yvarn1sh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 00:18:25",
            "last_seen_utc": "2025-11-20 00:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646866": [
        {
            "ioc_value": "t4au.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-20 00:07:09",
            "last_seen_utc": "2025-11-20 00:17:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646861": [
        {
            "ioc_value": "kra2ut.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 23:57:45",
            "last_seen_utc": "2025-11-20 00:00:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646860": [
        {
            "ioc_value": "mi5st.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 23:46:27",
            "last_seen_utc": "2025-11-19 23:52:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646859": [
        {
            "ioc_value": "gl0ow.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 23:37:35",
            "last_seen_utc": "2025-11-19 23:46:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646858": [
        {
            "ioc_value": "wal3d.deane4y5not.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 23:28:50",
            "last_seen_utc": "2025-11-19 23:35:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646857": [
        {
            "ioc_value": "st1ern.bil1sun8en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 23:17:33",
            "last_seen_utc": "2025-11-19 23:19:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646856": [
        {
            "ioc_value": "u9fer.bil1sun8en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 23:07:15",
            "last_seen_utc": "2025-11-19 23:11:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646835": [
        {
            "ioc_value": "ha2fen.bil1sun8en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 22:57:24",
            "last_seen_utc": "2025-11-19 23:03:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646834": [
        {
            "ioc_value": "mo0or.dr0gaguaran.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 22:48:08",
            "last_seen_utc": "2025-11-19 22:55:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646833": [
        {
            "ioc_value": "pf4ad.dr0gaguaran.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 22:37:51",
            "last_seen_utc": "2025-11-19 22:39:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646832": [
        {
            "ioc_value": "ba3ch.dr0gaguaran.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 22:28:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646831": [
        {
            "ioc_value": "wi1nd.dr0gaguaran.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 22:17:46",
            "last_seen_utc": "2025-11-19 22:20:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646830": [
        {
            "ioc_value": "rill.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 22:07:30",
            "last_seen_utc": "2025-11-19 22:12:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646829": [
        {
            "ioc_value": "kamm.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 21:57:44",
            "last_seen_utc": "2025-11-19 22:01:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646827": [
        {
            "ioc_value": "cloud.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 21:47:26",
            "last_seen_utc": "2025-11-19 21:51:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646826": [
        {
            "ioc_value": "falx.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 21:30:32",
            "last_seen_utc": "2025-11-19 21:39:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646825": [
        {
            "ioc_value": "weiss.ve1vetc0ves.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 21:23:11",
            "last_seen_utc": "2025-11-19 21:25:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646823": [
        {
            "ioc_value": "grat.guan0mesca.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 21:11:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646822": [
        {
            "ioc_value": "bach.guan0mesca.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 21:08:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646821": [
        {
            "ioc_value": "eiche.guan0mesca.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 20:53:49",
            "last_seen_utc": "2025-11-19 21:06:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646820": [
        {
            "ioc_value": "wolfe.guan0mesca.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 20:46:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646818": [
        {
            "ioc_value": "korn.f1rst5rup.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 20:37:42",
            "last_seen_utc": "2025-11-19 20:40:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646815": [
        {
            "ioc_value": "fjord.f1rst5rup.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 20:27:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646809": [
        {
            "ioc_value": "rauch.f1rst5rup.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 20:16:36",
            "last_seen_utc": "2025-11-19 20:21:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646808": [
        {
            "ioc_value": "tal.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 20:07:20",
            "last_seen_utc": "2025-11-19 20:09:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646795": [
        {
            "ioc_value": "gleis.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 19:54:29",
            "last_seen_utc": "2025-11-19 19:55:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646794": [
        {
            "ioc_value": "harz.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 19:48:17",
            "last_seen_utc": "2025-11-19 19:52:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646793": [
        {
            "ioc_value": "moos.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 19:37:59",
            "last_seen_utc": "2025-11-19 19:41:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646792": [
        {
            "ioc_value": "adler.capi1aryhold.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 19:23:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646791": [
        {
            "ioc_value": "wald.payc0medy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 19:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646788": [
        {
            "ioc_value": "ukhorizons.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-19 19:14:44",
            "last_seen_utc": "2025-11-19 19:13:20",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115577951786349151",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1646785": [
        {
            "ioc_value": "brise.payc0medy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 19:07:58",
            "last_seen_utc": "2025-11-19 19:11:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646784": [
        {
            "ioc_value": "threadproperty.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-19 19:01:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1646783": [
        {
            "ioc_value": "pfad.payc0medy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 18:57:40",
            "last_seen_utc": "2025-11-19 19:03:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646777": [
        {
            "ioc_value": "sturm.payc0medy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 18:47:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646774": [
        {
            "ioc_value": "licht.cou10sheaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 18:36:33",
            "last_seen_utc": "2025-11-19 18:39:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646773": [
        {
            "ioc_value": "hain.cou10sheaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 18:27:11",
            "last_seen_utc": "2025-11-19 18:35:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646772": [
        {
            "ioc_value": "birch.cou10sheaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 18:16:23",
            "last_seen_utc": "2025-11-19 18:24:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646771": [
        {
            "ioc_value": "dorn.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 18:07:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646766": [
        {
            "ioc_value": "tau.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 17:57:54",
            "last_seen_utc": "2025-11-19 18:06:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646765": [
        {
            "ioc_value": "falke.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 17:50:07",
            "last_seen_utc": "2025-11-19 17:56:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646764": [
        {
            "ioc_value": "weald.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 17:43:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646763": [
        {
            "ioc_value": "stern.fo0operate1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 17:37:36",
            "last_seen_utc": "2025-11-19 17:40:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646762": [
        {
            "ioc_value": "klee.grin5cra7ers.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 17:28:51",
            "last_seen_utc": "2025-11-19 17:29:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646761": [
        {
            "ioc_value": "ufer.grin5cra7ers.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 17:17:33",
            "last_seen_utc": "2025-11-19 17:25:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646759": [
        {
            "ioc_value": "gjt.clashofmaps.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-19 17:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1646760": [
        {
            "ioc_value": "gjt.mummyhildasrice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-19 17:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1646756": [
        {
            "ioc_value": "geist.grin5cra7ers.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 17:07:15",
            "last_seen_utc": "2025-11-19 17:10:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646755": [
        {
            "ioc_value": "moor.immigrant5p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 16:57:27",
            "last_seen_utc": "2025-11-19 17:01:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646754": [
        {
            "ioc_value": "rune.immigrant5p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 16:41:03",
            "last_seen_utc": "2025-11-19 16:52:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646753": [
        {
            "ioc_value": "glade.immigrant5p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 16:37:07",
            "last_seen_utc": "2025-11-19 16:40:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646693": [
        {
            "ioc_value": "app-sanctum.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:30:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646695": [
        {
            "ioc_value": "axlom-app.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:30:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646698": [
        {
            "ioc_value": "app-marginfi.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:30:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646702": [
        {
            "ioc_value": "app-everstake.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:30:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646704": [
        {
            "ioc_value": "transition-gate.help",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:30:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646720": [
        {
            "ioc_value": "wolke.immigrant5p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 16:20:42",
            "last_seen_utc": "2025-11-19 16:30:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646701": [
        {
            "ioc_value": "r7mc8.primurib1er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 16:17:33",
            "last_seen_utc": "2025-11-19 16:18:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646692": [
        {
            "ioc_value": "rift.primurib1er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 16:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646688": [
        {
            "ioc_value": "protection-hub.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:13:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646690": [
        {
            "ioc_value": "flipgg.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:13:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646686": [
        {
            "ioc_value": "store.csmanay.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:12:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646682": [
        {
            "ioc_value": "rdweb.csmanay.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:10:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646683": [
        {
            "ioc_value": "sxwajnextcloud.csmanay.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:10:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646679": [
        {
            "ioc_value": "verify-connection.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 16:06:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646678": [
        {
            "ioc_value": "vrxl3.primurib1er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 16:04:39",
            "last_seen_utc": "2025-11-19 16:05:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646663": [
        {
            "ioc_value": "spark3.primurib1er.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 15:57:25",
            "last_seen_utc": "2025-11-19 15:58:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646662": [
        {
            "ioc_value": "beacon.c0rkpr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 15:54:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646661": [
        {
            "ioc_value": "ynk.c0rkpr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 15:44:42",
            "last_seen_utc": "2025-11-19 15:51:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646660": [
        {
            "ioc_value": "34m37.c0rkpr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 15:37:21",
            "last_seen_utc": "2025-11-19 15:38:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646659": [
        {
            "ioc_value": "resusct.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-19 15:36:12",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646655": [
        {
            "ioc_value": "setforsurerealz.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 15:33:07",
            "last_seen_utc": "2025-12-12 18:39:52",
            "confidence_level": 100,
            "reference": "https://any.run/report/dd754cfe8335072642add9d2ffac00bb868d3baae94cabb582056d1c5311bb21/1fece9b7-3be0-4f52-b862-c07e53114226",
            "tags": "anyrun,c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646656": [
        {
            "ioc_value": "blindersxorrect.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 15:33:07",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://any.run/report/dd754cfe8335072642add9d2ffac00bb868d3baae94cabb582056d1c5311bb21/1fece9b7-3be0-4f52-b862-c07e53114226",
            "tags": "anyrun,c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646657": [
        {
            "ioc_value": "grasshopper3030goals.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 15:33:07",
            "last_seen_utc": "2025-12-12 18:39:51",
            "confidence_level": 100,
            "reference": "https://any.run/report/dd754cfe8335072642add9d2ffac00bb868d3baae94cabb582056d1c5311bb21/1fece9b7-3be0-4f52-b862-c07e53114226",
            "tags": "anyrun,c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646653": [
        {
            "ioc_value": "lr9kw.c0rkpr0tect.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 15:28:06",
            "last_seen_utc": "2025-11-19 15:31:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646640": [
        {
            "ioc_value": "koleporter.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-19 15:18:25",
            "last_seen_utc": "2025-11-19 15:12:01",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115577002913960843",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1646652": [
        {
            "ioc_value": "nova.kalmykvic0te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 15:18:19",
            "last_seen_utc": "2025-11-19 15:21:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646651": [
        {
            "ioc_value": "politics-tower.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-19 15:13:19",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646650": [
        {
            "ioc_value": "winwin24.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 15:13:02",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646649": [
        {
            "ioc_value": "genbloke.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 15:13:01",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646648": [
        {
            "ioc_value": "kjh.servebeer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-19 15:12:44",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646638": [
        {
            "ioc_value": "5f.kalmykvic0te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 15:07:02",
            "last_seen_utc": "2025-11-19 15:11:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646637": [
        {
            "ioc_value": "ww8.kalmykvic0te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 14:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646636": [
        {
            "ioc_value": "vivid8.kalmykvic0te.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 14:46:53",
            "last_seen_utc": "2025-11-19 14:48:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646635": [
        {
            "ioc_value": "jcw.nob0dy5yabky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 14:37:36",
            "last_seen_utc": "2025-11-19 14:38:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646634": [
        {
            "ioc_value": "q5z.nob0dy5yabky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 14:23:44",
            "last_seen_utc": "2025-11-19 14:36:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646633": [
        {
            "ioc_value": "jta2v.nob0dy5yabky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 14:12:26",
            "last_seen_utc": "2025-11-19 14:19:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646632": [
        {
            "ioc_value": "trace.nob0dy5yabky.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 14:07:15",
            "last_seen_utc": "2025-11-19 14:10:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646628": [
        {
            "ioc_value": "wave6.brahtr0phy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 13:57:28",
            "last_seen_utc": "2025-11-19 13:59:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646627": [
        {
            "ioc_value": "l7ks5.brahtr0phy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 13:47:10",
            "last_seen_utc": "2025-11-19 13:52:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646626": [
        {
            "ioc_value": "flux.brahtr0phy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 13:36:54",
            "last_seen_utc": "2025-11-19 13:38:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646615": [
        {
            "ioc_value": "fra.nigeriaafricatime.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-19 13:32:03",
            "last_seen_utc": "2025-11-20 18:18:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1646604": [
        {
            "ioc_value": "blink8.brahtr0phy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 13:27:06",
            "last_seen_utc": "2025-11-19 13:29:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646603": [
        {
            "ioc_value": "echo.galy8phony.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 13:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646598": [
        {
            "ioc_value": "yl56b.galy8phony.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 13:07:33",
            "last_seen_utc": "2025-11-19 13:18:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646595": [
        {
            "ioc_value": "anchor.galy8phony.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 12:58:47",
            "last_seen_utc": "2025-11-19 13:06:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646594": [
        {
            "ioc_value": "5bwm.galy8phony.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 12:47:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646593": [
        {
            "ioc_value": "loom.n0v0se1prew.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 12:38:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646592": [
        {
            "ioc_value": "core.n0v0se1prew.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 12:27:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646591": [
        {
            "ioc_value": "alpha3.n0v0se1prew.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 12:17:14",
            "last_seen_utc": "2025-11-19 12:26:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646589": [
        {
            "ioc_value": "wn.n0v0se1prew.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 12:06:59",
            "last_seen_utc": "2025-11-19 12:11:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646586": [
        {
            "ioc_value": "yq9g.diab4uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 11:58:04",
            "last_seen_utc": "2025-11-19 12:04:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646585": [
        {
            "ioc_value": "wealthyme.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-11-19 11:53:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251119-e69r8syqek",
            "tags": "C2,domain,netwire,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646583": [
        {
            "ioc_value": "oilmoney.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 11:51:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1646578/",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646584": [
        {
            "ioc_value": "godwilling.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 11:51:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1646578/",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646580": [
        {
            "ioc_value": "navox.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 11:45:52",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251119-jgrbtafz5b",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646578": [
        {
            "ioc_value": "godabeg.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 11:45:51",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/251119-kggm2s1qaj",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646577": [
        {
            "ioc_value": "i9.diab4uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 11:44:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646576": [
        {
            "ioc_value": "delta.diab4uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 11:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646575": [
        {
            "ioc_value": "xq9.diab4uette.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 11:27:49",
            "last_seen_utc": "2025-11-19 11:34:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646574": [
        {
            "ioc_value": "ha.amin0mer3ges.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 11:14:30",
            "last_seen_utc": "2025-11-19 11:23:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646573": [
        {
            "ioc_value": "yp.amin0mer3ges.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 11:11:11",
            "last_seen_utc": "2025-11-19 11:12:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646572": [
        {
            "ioc_value": "vale.amin0mer3ges.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 11:07:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646559": [
        {
            "ioc_value": "klif.hollow7ridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 10:53:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646558": [
        {
            "ioc_value": "grove.hollow7ridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 10:53:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646557": [
        {
            "ioc_value": "drb.amin0mer3ges.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 10:52:07",
            "last_seen_utc": "2025-11-19 10:53:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646555": [
        {
            "ioc_value": "weald.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 10:49:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646554": [
        {
            "ioc_value": "korn.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 10:45:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646553": [
        {
            "ioc_value": "rune.spruce5moor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 10:44:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646552": [
        {
            "ioc_value": "quarz.basaltwisp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 10:34:03",
            "last_seen_utc": "2025-11-19 10:53:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646551": [
        {
            "ioc_value": "ardotcharleybuking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-19 10:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.52.133",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646550": [
        {
            "ioc_value": "brutalinfgonzasochi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-19 10:16:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.52.138",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646548": [
        {
            "ioc_value": "ember.basaltwisp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 10:00:38",
            "last_seen_utc": "2025-11-19 10:53:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646547": [
        {
            "ioc_value": "vapr.basaltwisp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 09:48:52",
            "last_seen_utc": "2025-11-19 10:53:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646546": [
        {
            "ioc_value": "rauch.nebulaquelle3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 09:48:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646542": [
        {
            "ioc_value": "glint.basaltwisp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 09:38:36",
            "last_seen_utc": "2025-11-19 10:53:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646540": [
        {
            "ioc_value": "glade.hollow7ridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 09:19:04",
            "last_seen_utc": "2025-11-19 10:53:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646537": [
        {
            "ioc_value": "tal.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 08:59:32",
            "last_seen_utc": "2025-11-19 10:52:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646534": [
        {
            "ioc_value": "brise.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 08:43:48",
            "last_seen_utc": "2025-11-19 10:45:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646531": [
        {
            "ioc_value": "sterm.echo6fern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 08:34:49",
            "last_seen_utc": "2025-11-19 10:45:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646527": [
        {
            "ioc_value": "geist.spruce5moor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 08:11:49",
            "last_seen_utc": "2025-11-19 10:45:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646525": [
        {
            "ioc_value": "sol.clashofmaps.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-19 08:07:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1646526": [
        {
            "ioc_value": "sol.mummyhildasrice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-19 08:07:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1646398": [
        {
            "ioc_value": "bydfiexchange.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 07:57:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake,clickfix",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1646294": [
        {
            "ioc_value": "vcc-library.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-19 07:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/b20a1d0d06b9f5c7e9f2deffbd18de4119ec2c090562e5539c8b0a501154e16d/relations",
            "tags": "stealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1646321": [
        {
            "ioc_value": "digital-marketing-pro-365.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 07:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1816495/1/html#domains",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1646322": [
        {
            "ioc_value": "wee-wee-gachi-master.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 07:57:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1816495/1/html#domains",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1646325": [
        {
            "ioc_value": "newtry.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-11-19 07:57:39",
            "last_seen_utc": "2025-12-11 22:04:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "1",
            "reporter": "tanner"
        }
    ],
    "1646510": [
        {
            "ioc_value": "ufer.spruce5moor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 07:42:57",
            "last_seen_utc": "2025-11-19 10:43:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646509": [
        {
            "ioc_value": "licht.nebulaquelle3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 07:23:28",
            "last_seen_utc": "2025-11-19 10:43:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646508": [
        {
            "ioc_value": "wolfe.nebulaquelle3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 07:03:31",
            "last_seen_utc": "2025-11-19 10:43:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646507": [
        {
            "ioc_value": "eis.nebulaquelle3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 06:42:11",
            "last_seen_utc": "2025-11-19 09:50:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646505": [
        {
            "ioc_value": "submit-offered.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-19 06:35:29",
            "last_seen_utc": "2025-12-12 18:39:24",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646506": [
        {
            "ioc_value": "take-fragrances.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-19 06:35:29",
            "last_seen_utc": "2025-12-12 18:39:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646504": [
        {
            "ioc_value": "thales3033.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 06:34:58",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646503": [
        {
            "ioc_value": "milogviolo.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-19 06:34:45",
            "last_seen_utc": "2025-12-12 18:37:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646485": [
        {
            "ioc_value": "rghirgsrfzjjfsrzj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646486": [
        {
            "ioc_value": "rghirgsrfzjjfsrzjr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646487": [
        {
            "ioc_value": "rghirgsrogddhjtdj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646488": [
        {
            "ioc_value": "rghirgsrogddhjtdjr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646489": [
        {
            "ioc_value": "rghirgsrogrefsesg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646490": [
        {
            "ioc_value": "rghirgsrogrefsesgr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646491": [
        {
            "ioc_value": "rghirgsrogrhdthsr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646492": [
        {
            "ioc_value": "rghirgsrogrhdthsrr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646493": [
        {
            "ioc_value": "rghirgsrogrsfsegh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646494": [
        {
            "ioc_value": "rghirgsrogrsfseghr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646495": [
        {
            "ioc_value": "rghirgsrogrsfzjfsr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646496": [
        {
            "ioc_value": "rghirgsrogrshggirr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646497": [
        {
            "ioc_value": "rghirgsrogrshghsh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646498": [
        {
            "ioc_value": "rghirgsrogrshghshr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646499": [
        {
            "ioc_value": "rghirgsrogrstjgrr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646500": [
        {
            "ioc_value": "rghirgsrogrstjgrrr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646501": [
        {
            "ioc_value": "rghirgsrsrgsreidg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646502": [
        {
            "ioc_value": "rghirgsrsrgsreidgr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-19 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646464": [
        {
            "ioc_value": "bot.sinestreacute.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-19 06:33:35",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646463": [
        {
            "ioc_value": "consultaprocesosramajudicialgov.run.place",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-19 06:33:21",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646462": [
        {
            "ioc_value": "xoilacv.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-19 06:33:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646459": [
        {
            "ioc_value": "cdn.xoilac86s.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-19 06:33:07",
            "last_seen_utc": "2025-11-19 06:33:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646460": [
        {
            "ioc_value": "gatex.www.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-19 06:33:07",
            "last_seen_utc": "2025-12-12 18:38:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646461": [
        {
            "ioc_value": "static.xoilac86s.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-19 06:33:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646456": [
        {
            "ioc_value": "dune.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 06:22:15",
            "last_seen_utc": "2025-11-19 09:22:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646453": [
        {
            "ioc_value": "syonr-23784.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-19 06:04:29",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 100,
            "reference": "https://tria.ge/251119-b882yasrct",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646454": [
        {
            "ioc_value": "interest-weather.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-19 06:04:29",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/251119-bfazfaspas",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646455": [
        {
            "ioc_value": "parties-trance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-19 06:04:29",
            "last_seen_utc": "2025-12-12 18:37:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/251119-avq4jacx8e",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646450": [
        {
            "ioc_value": "huckypet2.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 06:02:17",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251119-bzjexssqcz",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646449": [
        {
            "ioc_value": "huckypet.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-19 06:02:16",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251119-bzjexssqcz",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646447": [
        {
            "ioc_value": "weiss.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 06:01:14",
            "last_seen_utc": "2025-11-19 09:12:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646445": [
        {
            "ioc_value": "udefined30.domainofhonour40.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.tuoni",
            "malware_alias": null,
            "malware_printable": "Tuoni",
            "first_seen_utc": "2025-11-19 05:47:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.morphisec.com/blog/morphisec-thwarts-sophisticated-tuoni-c2-attack-on-us-real-estate-firm/",
            "tags": "c2,tuoni",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646446": [
        {
            "ioc_value": "kupaoquan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.tuoni",
            "malware_alias": null,
            "malware_printable": "Tuoni",
            "first_seen_utc": "2025-11-19 05:47:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.morphisec.com/blog/morphisec-thwarts-sophisticated-tuoni-c2-attack-on-us-real-estate-firm/",
            "tags": "c2,tuoni",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646444": [
        {
            "ioc_value": "kleea.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 05:43:01",
            "last_seen_utc": "2025-11-19 08:43:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646440": [
        {
            "ioc_value": "aptabase.fud2026.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 05:41:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.d3lab.net/gpt-trade-fake-google-play-store-drops-btmob-spyware-and-uasecurity-miner-on-android-devices/",
            "tags": "c2,UASecurityMiner",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646438": [
        {
            "ioc_value": "timeserver.uasecurity.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-19 05:41:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.d3lab.net/gpt-trade-fake-google-play-store-drops-btmob-spyware-and-uasecurity-miner-on-android-devices/",
            "tags": "c2,GPTTrade",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1646435": [
        {
            "ioc_value": "falke.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 05:29:38",
            "last_seen_utc": "2025-11-19 06:22:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646434": [
        {
            "ioc_value": "fjord.kieselufer8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 05:22:13",
            "last_seen_utc": "2025-11-19 06:16:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646433": [
        {
            "ioc_value": "glowe.aurora1hain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 05:08:05",
            "last_seen_utc": "2025-11-19 05:08:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1646431": [
        {
            "ioc_value": "moos.aurora1hain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 04:55:58",
            "last_seen_utc": "2025-11-19 05:04:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646430": [
        {
            "ioc_value": "stern.aurora1hain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 04:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646429": [
        {
            "ioc_value": "rauch.2tannenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 04:37:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646428": [
        {
            "ioc_value": "gleem.2tannenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 04:28:03",
            "last_seen_utc": "2025-11-19 04:37:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646427": [
        {
            "ioc_value": "birhc.2tannenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 04:17:40",
            "last_seen_utc": "2025-11-19 04:27:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646426": [
        {
            "ioc_value": "wolkr.2tannenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 04:07:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646411": [
        {
            "ioc_value": "bruke.s1lvergate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 03:56:31",
            "last_seen_utc": "2025-11-19 04:04:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646410": [
        {
            "ioc_value": "weald.s1lvergate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 03:47:15",
            "last_seen_utc": "2025-11-19 03:47:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646408": [
        {
            "ioc_value": "argent.s1lvergate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 03:37:28",
            "last_seen_utc": "2025-11-19 03:43:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646407": [
        {
            "ioc_value": "flair.firer1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 03:34:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646406": [
        {
            "ioc_value": "cindr.firer1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 03:27:04",
            "last_seen_utc": "2025-11-19 03:33:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646405": [
        {
            "ioc_value": "brige.firer1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 03:18:20",
            "last_seen_utc": "2025-11-19 03:20:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646404": [
        {
            "ioc_value": "ambr.firer1dge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 03:14:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646403": [
        {
            "ioc_value": "sumer.brightden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 03:07:58",
            "last_seen_utc": "2025-11-19 03:13:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646402": [
        {
            "ioc_value": "brisk.brightden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 02:58:04",
            "last_seen_utc": "2025-11-19 03:04:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646401": [
        {
            "ioc_value": "dawne.brightden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 02:47:46",
            "last_seen_utc": "2025-11-19 02:54:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646400": [
        {
            "ioc_value": "gloww.brightden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 02:39:33",
            "last_seen_utc": "2025-11-19 02:43:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646399": [
        {
            "ioc_value": "turne.mistytrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 02:27:22",
            "last_seen_utc": "2025-11-19 02:39:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646397": [
        {
            "ioc_value": "pfth.mistytrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 02:23:36",
            "last_seen_utc": "2025-11-19 02:26:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646396": [
        {
            "ioc_value": "foggy.mistytrai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 02:17:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646395": [
        {
            "ioc_value": "silem.s0ftvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 02:07:05",
            "last_seen_utc": "2025-11-19 02:09:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646392": [
        {
            "ioc_value": "breez.s0ftvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 01:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646390": [
        {
            "ioc_value": "wylde.s0ftvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 01:46:01",
            "last_seen_utc": "2025-11-19 01:48:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646389": [
        {
            "ioc_value": "vally.s0ftvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 01:37:07",
            "last_seen_utc": "2025-11-19 01:42:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646388": [
        {
            "ioc_value": "gusty.rainv1sta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 01:26:40",
            "last_seen_utc": "2025-11-19 01:36:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646387": [
        {
            "ioc_value": "medow.rainv1sta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 01:17:55",
            "last_seen_utc": "2025-11-19 01:24:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646386": [
        {
            "ioc_value": "drizz.rainv1sta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 01:07:37",
            "last_seen_utc": "2025-11-19 01:09:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646385": [
        {
            "ioc_value": "pfed.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 00:57:20",
            "last_seen_utc": "2025-11-19 00:58:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646384": [
        {
            "ioc_value": "wolke.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 00:47:33",
            "last_seen_utc": "2025-11-19 00:53:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646383": [
        {
            "ioc_value": "trakk.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 00:37:16",
            "last_seen_utc": "2025-11-19 00:42:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646382": [
        {
            "ioc_value": "gleem.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 00:28:01",
            "last_seen_utc": "2025-11-19 00:35:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646381": [
        {
            "ioc_value": "harbr.deepv0yage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 00:18:14",
            "last_seen_utc": "2025-11-19 00:25:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646380": [
        {
            "ioc_value": "weald.0akstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-19 00:07:50",
            "last_seen_utc": "2025-11-19 00:18:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646376": [
        {
            "ioc_value": "bruke.0akstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 23:58:03",
            "last_seen_utc": "2025-11-19 00:07:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646375": [
        {
            "ioc_value": "mossy.0akstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 23:47:46",
            "last_seen_utc": "2025-11-18 23:48:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646374": [
        {
            "ioc_value": "rivul.0akstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 23:36:58",
            "last_seen_utc": "2025-11-18 23:41:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646373": [
        {
            "ioc_value": "licth.crysta1shore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 23:27:42",
            "last_seen_utc": "2025-11-18 23:33:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646372": [
        {
            "ioc_value": "quarz.crysta1shore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 23:17:18",
            "last_seen_utc": "2025-11-18 23:19:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646371": [
        {
            "ioc_value": "shoal.crysta1shore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 23:07:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646358": [
        {
            "ioc_value": "boxfile.securefile.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.venom",
            "malware_alias": null,
            "malware_printable": "Venom RAT",
            "first_seen_utc": "2025-11-18 23:00:52",
            "last_seen_utc": "2025-11-19 00:02:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/151.245.195.177+boxfile.securefile.xyz",
            "tags": "AS212238,C2,CDNEXT,censys,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1646356": [
        {
            "ioc_value": "icebetalst.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-11-18 23:00:46",
            "last_seen_utc": "2025-11-20 11:00:34",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.59.72+icebetalst.xyz",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Hookbot",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1646352": [
        {
            "ioc_value": "www.jianxianxt.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-18 23:00:12",
            "last_seen_utc": "2025-12-04 11:00:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.137.8+www.jianxianxt.cn",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1646351": [
        {
            "ioc_value": "tall.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 22:58:16",
            "last_seen_utc": "2025-11-18 23:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646350": [
        {
            "ioc_value": "374y246zera4r.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-18 22:51:56",
            "last_seen_utc": "2025-12-14 11:48:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1646349": [
        {
            "ioc_value": "winde.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 22:46:58",
            "last_seen_utc": "2025-11-18 22:47:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646348": [
        {
            "ioc_value": "glanz.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 22:41:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646347": [
        {
            "ioc_value": "brige.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 22:37:01",
            "last_seen_utc": "2025-11-18 22:41:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646346": [
        {
            "ioc_value": "mooss.moonf1eld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 22:25:42",
            "last_seen_utc": "2025-11-18 22:29:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646345": [
        {
            "ioc_value": "rauch.st0nedrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 22:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646344": [
        {
            "ioc_value": "kleea.st0nedrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 22:17:51",
            "last_seen_utc": "2025-11-18 22:20:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646341": [
        {
            "ioc_value": "sterm.st0nedrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 22:07:33",
            "last_seen_utc": "2025-11-18 22:12:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646340": [
        {
            "ioc_value": "uefer.c1earpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 21:57:38",
            "last_seen_utc": "2025-11-18 22:07:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646338": [
        {
            "ioc_value": "verify-connection.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 21:51:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646336": [
        {
            "ioc_value": "birhc.c1earpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 21:48:22",
            "last_seen_utc": "2025-11-18 21:51:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646334": [
        {
            "ioc_value": "getyourownbook.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 21:41:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646332": [
        {
            "ioc_value": "verify-page.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 21:41:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646331": [
        {
            "ioc_value": "glowe.c1earpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 21:37:03",
            "last_seen_utc": "2025-11-18 21:41:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646330": [
        {
            "ioc_value": "wolkr.c1earpeak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 21:28:18",
            "last_seen_utc": "2025-11-18 21:32:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646329": [
        {
            "ioc_value": "eis.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 21:23:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646328": [
        {
            "ioc_value": "tau.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 21:16:49",
            "last_seen_utc": "2025-11-18 21:20:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646326": [
        {
            "ioc_value": "moos.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 21:08:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646320": [
        {
            "ioc_value": "stern.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 20:57:55",
            "last_seen_utc": "2025-11-18 21:02:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646319": [
        {
            "ioc_value": "glut.l1ghtseed.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 20:47:38",
            "last_seen_utc": "2025-11-18 20:53:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646318": [
        {
            "ioc_value": "fels.w1ndmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 20:44:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646317": [
        {
            "ioc_value": "weg.w1ndmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 20:36:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646316": [
        {
            "ioc_value": "korn.w1ndmark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 20:31:34",
            "last_seen_utc": "2025-11-18 20:33:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646315": [
        {
            "ioc_value": "tal.s0ftwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 20:27:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646314": [
        {
            "ioc_value": "licht.s0ftwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 20:17:31",
            "last_seen_utc": "2025-11-18 20:19:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646313": [
        {
            "ioc_value": "ufer.s0ftwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 20:07:12",
            "last_seen_utc": "2025-11-18 20:17:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646303": [
        {
            "ioc_value": "vendas.securefile.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.venom",
            "malware_alias": null,
            "malware_printable": "Venom RAT",
            "first_seen_utc": "2025-11-18 20:03:20",
            "last_seen_utc": "2025-11-18 23:00:52",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/151.245.195.177+vendas.securefile.xyz",
            "tags": "AS212238,C2,CDNEXT,censys,RAT,Venom",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646293": [
        {
            "ioc_value": "nest.s0ftwind.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 19:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646292": [
        {
            "ioc_value": "grat.brightv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 19:47:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646291": [
        {
            "ioc_value": "wolke.brightv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 19:44:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646290": [
        {
            "ioc_value": "zorn.brightv1be.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 19:37:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646289": [
        {
            "ioc_value": "moos.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 19:32:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646288": [
        {
            "ioc_value": "rauch.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 19:27:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646287": [
        {
            "ioc_value": "harz.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 19:17:35",
            "last_seen_utc": "2025-11-18 19:24:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646286": [
        {
            "ioc_value": "adler.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 19:13:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646285": [
        {
            "ioc_value": "akaishi-sankodo.co.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 19:10:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646284": [
        {
            "ioc_value": "birke.br1ghtf0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 19:07:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646279": [
        {
            "ioc_value": "klee.crystalrun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 18:57:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646276": [
        {
            "ioc_value": "weiss.crystalrun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 18:54:14",
            "last_seen_utc": "2025-11-18 18:55:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646272": [
        {
            "ioc_value": "graphicdesy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-18 18:52:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646270": [
        {
            "ioc_value": "falke.crystalrun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 18:47:29",
            "last_seen_utc": "2025-11-18 18:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646269": [
        {
            "ioc_value": "pfad.crystalrun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 18:38:12",
            "last_seen_utc": "2025-11-18 18:38:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646267": [
        {
            "ioc_value": "fukugyo-paradise.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:31:09",
            "last_seen_utc": "2025-12-09 13:35:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646265": [
        {
            "ioc_value": "hafen.r1verbend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 18:30:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646264": [
        {
            "ioc_value": "zerodegreefoods.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:30:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646262": [
        {
            "ioc_value": "top88t8.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:29:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646260": [
        {
            "ioc_value": "cndirect.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:28:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646259": [
        {
            "ioc_value": "bach.r1verbend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 18:27:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646258": [
        {
            "ioc_value": "aynerstore.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:26:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646256": [
        {
            "ioc_value": "menu-menu.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:26:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646254": [
        {
            "ioc_value": "vyaparionline.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:24:06",
            "last_seen_utc": "2025-12-10 23:57:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646252": [
        {
            "ioc_value": "peacebuildersunite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:20:45",
            "last_seen_utc": "2025-11-22 19:53:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646250": [
        {
            "ioc_value": "petersandorf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:19:01",
            "last_seen_utc": "2025-12-07 20:34:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646248": [
        {
            "ioc_value": "iogkf-seirenkan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:17:10",
            "last_seen_utc": "2025-11-22 18:49:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646247": [
        {
            "ioc_value": "wald.r1verbend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 18:16:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646245": [
        {
            "ioc_value": "peaceofchristcam.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:12:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646243": [
        {
            "ioc_value": "premium.lwk.ie",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:09:41",
            "last_seen_utc": "2025-11-22 16:52:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646239": [
        {
            "ioc_value": "charboroughroadschool.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:08:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646238": [
        {
            "ioc_value": "tau.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 18:08:09",
            "last_seen_utc": "2025-11-18 18:14:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646236": [
        {
            "ioc_value": "datavoice.com.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:07:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646234": [
        {
            "ioc_value": "shinshoryu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:06:26",
            "last_seen_utc": "2025-12-08 19:00:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646230": [
        {
            "ioc_value": "conectionwindowssupport.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-18 18:05:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/c2bf0977fee058344e0a8ab4dec679236a2917d017eb009dcbad622e2213ed7f",
            "tags": "c2,domain,virustotal,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646229": [
        {
            "ioc_value": "myvo.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:05:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646227": [
        {
            "ioc_value": "try.dfixed.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:03:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646226": [
        {
            "ioc_value": "servidoresethernetnew.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-18 18:03:24",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251118-p3eg2aey7g",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646223": [
        {
            "ioc_value": "rajasas35safael6.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-18 18:02:59",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251118-wgzz6sxpdv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646222": [
        {
            "ioc_value": "rajasas35safael5.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-18 18:02:57",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251118-wgzz6sxpdv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646221": [
        {
            "ioc_value": "rajasas35safael4.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-18 18:02:55",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251118-wgzz6sxpdv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646219": [
        {
            "ioc_value": "chimneyrepairgulfbreeze.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:02:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646220": [
        {
            "ioc_value": "rajasas35safael3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-18 18:02:53",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251118-wgzz6sxpdv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646218": [
        {
            "ioc_value": "rajasas35safael2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-18 18:02:50",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251118-wgzz6sxpdv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646214": [
        {
            "ioc_value": "pool-roman.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-18 18:02:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251118-twaygs1lgj",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646213": [
        {
            "ioc_value": "abcp1.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-18 18:02:09",
            "last_seen_utc": "2025-12-12 18:39:24",
            "confidence_level": 100,
            "reference": "https://tria.ge/251118-wf796ag17b",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646211": [
        {
            "ioc_value": "strikerolionaolqnfks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 18:00:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.242.70",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646209": [
        {
            "ioc_value": "littleandlegend.co.nz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 18:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646208": [
        {
            "ioc_value": "hiddenpoly.markets",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:59:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646206": [
        {
            "ioc_value": "gleis.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 17:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646205": [
        {
            "ioc_value": "asiolkijmadikola.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 17:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.30",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646203": [
        {
            "ioc_value": "daftartoto88.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:57:33",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646202": [
        {
            "ioc_value": "avakreplianamame.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 17:56:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1568692/",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646200": [
        {
            "ioc_value": "suite58prive.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:54:45",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646198": [
        {
            "ioc_value": "chakulilipopifikolas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 17:53:28",
            "last_seen_utc": "2025-11-18 17:54:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.26",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646197": [
        {
            "ioc_value": "unique.b-cdn.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:53:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646196": [
        {
            "ioc_value": "tradenexussolution.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:52:40",
            "last_seen_utc": "2025-12-09 13:35:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646194": [
        {
            "ioc_value": "vilorhilokasdhermiol.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 17:52:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.31",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646193": [
        {
            "ioc_value": "adoklixiokloer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 17:51:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.208.153",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646191": [
        {
            "ioc_value": "dichvuuytinhanoi.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:50:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646190": [
        {
            "ioc_value": "artwix.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:48:22",
            "last_seen_utc": "2025-12-07 20:34:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646188": [
        {
            "ioc_value": "sysmaq.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:47:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646186": [
        {
            "ioc_value": "afolpderniolakfduik.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 17:45:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1624297/",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646185": [
        {
            "ioc_value": "thevertexcapital.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:45:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646184": [
        {
            "ioc_value": "krone.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 17:44:28",
            "last_seen_utc": "2025-11-18 17:54:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646182": [
        {
            "ioc_value": "masa-design.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646180": [
        {
            "ioc_value": "takamatsu-genki.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:42:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646178": [
        {
            "ioc_value": "webstasolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:41:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646176": [
        {
            "ioc_value": "sakshstore.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:40:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646174": [
        {
            "ioc_value": "hddadmarketing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:38:42",
            "last_seen_utc": "2025-12-13 15:28:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646173": [
        {
            "ioc_value": "moor.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 17:37:47",
            "last_seen_utc": "2025-11-18 17:39:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646171": [
        {
            "ioc_value": "7seas-discovery.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:36:28",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646169": [
        {
            "ioc_value": "keapexportpros.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:35:32",
            "last_seen_utc": "2025-12-13 15:29:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646167": [
        {
            "ioc_value": "tfslife.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:34:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646165": [
        {
            "ioc_value": "thamiresezic.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:33:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646163": [
        {
            "ioc_value": "labadiradessaouira.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:32:39",
            "last_seen_utc": "2025-11-22 20:36:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646161": [
        {
            "ioc_value": "kasumirebirth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:31:49",
            "last_seen_utc": "2025-12-10 23:57:00",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646159": [
        {
            "ioc_value": "sonatindustries.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:30:41",
            "last_seen_utc": "2025-12-12 18:01:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646157": [
        {
            "ioc_value": "siyaramcorp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:29:06",
            "last_seen_utc": "2025-12-08 19:00:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646155": [
        {
            "ioc_value": "1001lp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:28:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646153": [
        {
            "ioc_value": "mitaigamitsukaru-lab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:27:02",
            "last_seen_utc": "2025-12-13 15:29:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646152": [
        {
            "ioc_value": "kotobanohiroba.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:25:47",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646150": [
        {
            "ioc_value": "kamm.st0nefall.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 17:24:24",
            "last_seen_utc": "2025-11-18 17:35:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646148": [
        {
            "ioc_value": "kenanhasic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:23:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646146": [
        {
            "ioc_value": "territoriodoagro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:22:11",
            "last_seen_utc": "2025-12-09 13:35:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646144": [
        {
            "ioc_value": "amd.tripathlogistics.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646142": [
        {
            "ioc_value": "mister.loans",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646140": [
        {
            "ioc_value": "bola579.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646138": [
        {
            "ioc_value": "tabatasoukenpr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:17:23",
            "last_seen_utc": "2025-12-10 23:57:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646136": [
        {
            "ioc_value": "ufer.starfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 17:15:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646135": [
        {
            "ioc_value": "story-llc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:15:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646133": [
        {
            "ioc_value": "blues-revolution.tokyo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:13:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646131": [
        {
            "ioc_value": "forehomes.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:12:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646129": [
        {
            "ioc_value": "unsagri.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:10:30",
            "last_seen_utc": "2025-12-13 15:29:16",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646127": [
        {
            "ioc_value": "gabeism.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:09:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646125": [
        {
            "ioc_value": "sekai-ryokou.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:07:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646123": [
        {
            "ioc_value": "eiche.starfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 17:06:24",
            "last_seen_utc": "2025-11-18 17:10:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646122": [
        {
            "ioc_value": "louwanjpoujezi.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:06:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646120": [
        {
            "ioc_value": "oklahomasleepfoundation.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:04:49",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646118": [
        {
            "ioc_value": "yorii-machi-trip.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:04:03",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646116": [
        {
            "ioc_value": "mond.starfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 17:02:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646115": [
        {
            "ioc_value": "setlist-blog.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 17:01:57",
            "last_seen_utc": "2025-12-12 18:01:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646112": [
        {
            "ioc_value": "minikayi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:59:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646109": [
        {
            "ioc_value": "truefinancefreedom.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:58:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646107": [
        {
            "ioc_value": "celestialhue.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:57:05",
            "last_seen_utc": "2025-12-12 18:00:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646105": [
        {
            "ioc_value": "ubekwetus.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:56:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646104": [
        {
            "ioc_value": "glanz.c1oudmap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 16:53:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646102": [
        {
            "ioc_value": "sakura-yamato.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:51:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646100": [
        {
            "ioc_value": "shaktibiotech.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:50:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646099": [
        {
            "ioc_value": "upsistem32dat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:49:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646097": [
        {
            "ioc_value": "maciejganski.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:46:57",
            "last_seen_utc": "2025-12-13 15:29:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646095": [
        {
            "ioc_value": "bach.c1oudmap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 16:45:15",
            "last_seen_utc": "2025-11-18 16:47:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646094": [
        {
            "ioc_value": "vciwork.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:45:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646092": [
        {
            "ioc_value": "licenseportal.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:44:23",
            "last_seen_utc": "2025-12-12 18:00:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646090": [
        {
            "ioc_value": "chovgroup.com.triominds.com.ng",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:42:06",
            "last_seen_utc": "2025-12-13 15:28:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646088": [
        {
            "ioc_value": "ratugroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 16:38:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1646087": [
        {
            "ioc_value": "tal.c1oudmap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 16:37:56",
            "last_seen_utc": "2025-11-18 16:40:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646086": [
        {
            "ioc_value": "rhein.c1oudmap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 16:29:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646085": [
        {
            "ioc_value": "ufer.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 16:26:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646084": [
        {
            "ioc_value": "mustdohavetrinmydimo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 16:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.240",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646083": [
        {
            "ioc_value": "stern.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 16:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646078": [
        {
            "ioc_value": "laghuirtinosdek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 16:17:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1971470772750385611",
            "tags": "c2,domain,latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646079": [
        {
            "ioc_value": "darklousdirupas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 16:17:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1971470772750385611",
            "tags": "c2,domain,latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646080": [
        {
            "ioc_value": "hdflksgreklams.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 16:17:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1971470772750385611",
            "tags": "c2,domain,latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646081": [
        {
            "ioc_value": "lalasisifuryglap.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 16:17:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1971470772750385611",
            "tags": "c2,domain,latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646082": [
        {
            "ioc_value": "asakusubinitohas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 16:17:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1971470772750385611",
            "tags": "c2,domain,latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646077": [
        {
            "ioc_value": "faryshopkleyskipi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 16:17:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1971470772750385611",
            "tags": "c2,domain,latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646075": [
        {
            "ioc_value": "automab.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-18 16:06:00",
            "last_seen_utc": "2025-11-21 23:37:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646076": [
        {
            "ioc_value": "catsquo.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-18 16:06:00",
            "last_seen_utc": "2025-11-21 23:37:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1646074": [
        {
            "ioc_value": "moor.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 16:04:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646043": [
        {
            "ioc_value": "www.devopstechnologies.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-11-18 15:55:11",
            "last_seen_utc": "2025-11-18 15:16:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1646047": [
        {
            "ioc_value": "bach.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 15:52:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646046": [
        {
            "ioc_value": "fels.redfie1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 15:47:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646045": [
        {
            "ioc_value": "klee.b1ue5pr1lng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 15:37:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646044": [
        {
            "ioc_value": "wolke.b1ue5pr1lng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 15:28:06",
            "last_seen_utc": "2025-11-18 15:35:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646042": [
        {
            "ioc_value": "rune.b1ue5pr1lng.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 15:11:05",
            "last_seen_utc": "2025-11-18 15:18:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646041": [
        {
            "ioc_value": "wald.wlnd5hore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 15:07:56",
            "last_seen_utc": "2025-11-18 15:09:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646040": [
        {
            "ioc_value": "krone.wlnd5hore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 14:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646039": [
        {
            "ioc_value": "tal.wlnd5hore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 14:44:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646038": [
        {
            "ioc_value": "brise.wlnd5hore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 14:37:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646033": [
        {
            "ioc_value": "dune.c0ldwater.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 14:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646031": [
        {
            "ioc_value": "glanz.c0ldwater.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 14:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646030": [
        {
            "ioc_value": "fjord.c0ldwater.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 14:07:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646029": [
        {
            "ioc_value": "gleam.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 13:57:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646028": [
        {
            "ioc_value": "hain.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 13:46:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646027": [
        {
            "ioc_value": "sturm.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 13:38:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646026": [
        {
            "ioc_value": "weiss.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 13:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646025": [
        {
            "ioc_value": "kreis.9reenpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 13:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646021": [
        {
            "ioc_value": "ger.clashofmaps.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-18 13:14:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1646022": [
        {
            "ioc_value": "ger.mummyhildasrice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-18 13:14:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1646017": [
        {
            "ioc_value": "moor.darkr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 13:06:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646016": [
        {
            "ioc_value": "licht.darkr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 13:01:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646015": [
        {
            "ioc_value": "kamm.darkr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 12:56:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646009": [
        {
            "ioc_value": "www.zp857.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-18 12:48:32",
            "last_seen_utc": "2025-12-14 11:48:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1646008": [
        {
            "ioc_value": "kl.kimlinlin.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-18 12:48:18",
            "last_seen_utc": "2025-12-14 11:48:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1646007": [
        {
            "ioc_value": "enter.xone.la",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-18 12:48:15",
            "last_seen_utc": "2025-12-14 11:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1646006": [
        {
            "ioc_value": "api.google-update.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-18 12:48:07",
            "last_seen_utc": "2025-12-14 11:48:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1646005": [
        {
            "ioc_value": "adler.darkr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 12:47:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646004": [
        {
            "ioc_value": "pfad.br1ght5tar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 12:35:09",
            "last_seen_utc": "2025-11-18 12:35:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646003": [
        {
            "ioc_value": "wolke.br1ght5tar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 12:31:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646002": [
        {
            "ioc_value": "birch.br1ght5tar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 12:27:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1646001": [
        {
            "ioc_value": "glade.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 12:18:01",
            "last_seen_utc": "2025-11-18 12:20:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645999": [
        {
            "ioc_value": "tau.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 12:07:08",
            "last_seen_utc": "2025-11-18 12:16:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645996": [
        {
            "ioc_value": "falke.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 11:57:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645995": [
        {
            "ioc_value": "weald.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 11:47:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645994": [
        {
            "ioc_value": "stern.f0re5tline.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 11:37:40",
            "last_seen_utc": "2025-11-18 11:41:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645993": [
        {
            "ioc_value": "ufer.rap1d5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 11:27:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645992": [
        {
            "ioc_value": "geist.rap1d5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 11:24:43",
            "last_seen_utc": "2025-11-18 11:25:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645991": [
        {
            "ioc_value": "moos.rap1d5t0ne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 11:18:30",
            "last_seen_utc": "2025-11-18 11:21:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645990": [
        {
            "ioc_value": "klee.5ilverm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 11:14:14",
            "last_seen_utc": "2025-11-18 11:16:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645989": [
        {
            "ioc_value": "rune.5ilverm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 11:03:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645965": [
        {
            "ioc_value": "www.youwhui.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-18 11:00:12",
            "last_seen_utc": "2025-11-30 11:00:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.137.8+www.youwhui.cn",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1645964": [
        {
            "ioc_value": "leeleelee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-18 11:00:08",
            "last_seen_utc": "2025-11-18 23:00:10",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/149.88.81.215+leeleelee.xyz",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1645963": [
        {
            "ioc_value": "bach.5ilverm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 10:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645962": [
        {
            "ioc_value": "wolke.5ilverm0on.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 10:55:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645955": [
        {
            "ioc_value": "eiche.harmfu1tw0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 10:46:15",
            "last_seen_utc": "2025-11-18 10:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645954": [
        {
            "ioc_value": "wald.harmfu1tw0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 10:38:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645953": [
        {
            "ioc_value": "ufer.harmfu1tw0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 10:27:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645952": [
        {
            "ioc_value": "glanz.harmfu1tw0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 10:15:45",
            "last_seen_utc": "2025-11-18 10:20:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645951": [
        {
            "ioc_value": "taiga.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 10:11:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645950": [
        {
            "ioc_value": "raven.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 10:07:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645949": [
        {
            "ioc_value": "sturm.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 09:57:34",
            "last_seen_utc": "2025-11-18 09:58:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645948": [
        {
            "ioc_value": "krone.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 09:41:57",
            "last_seen_utc": "2025-11-18 09:48:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645947": [
        {
            "ioc_value": "moos.chankexpe1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 09:27:24",
            "last_seen_utc": "2025-11-18 09:30:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645946": [
        {
            "ioc_value": "kamm.gulag1emur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 09:18:09",
            "last_seen_utc": "2025-11-18 09:20:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645945": [
        {
            "ioc_value": "glow.gulag1emur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 09:03:05",
            "last_seen_utc": "2025-11-18 09:03:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1645944": [
        {
            "ioc_value": "fjord.gulag1emur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 08:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645943": [
        {
            "ioc_value": "xilofonsriugagadlon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-18 08:51:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.245",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645941": [
        {
            "ioc_value": "mond.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 08:49:05",
            "last_seen_utc": "2025-11-18 08:51:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1645938": [
        {
            "ioc_value": "ufer.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 08:37:24",
            "last_seen_utc": "2025-11-18 08:47:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645937": [
        {
            "ioc_value": "weiss.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 08:28:04",
            "last_seen_utc": "2025-11-18 08:32:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645935": [
        {
            "ioc_value": "rdoo22.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-18 08:24:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/8f22a21fb1ed61de32f902697f0e8766ac152a73485cf302b12073db6dcc81a5/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645934": [
        {
            "ioc_value": "dorn.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 08:17:12",
            "last_seen_utc": "2025-11-18 08:18:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645933": [
        {
            "ioc_value": "mrfreshlogs.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-18 08:15:40",
            "last_seen_utc": "2025-12-12 18:39:26",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/4cff4c242546f84b11bd9876c0a68f3ecb0687a4824fa0bd9cdcb6878f51e905/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645932": [
        {
            "ioc_value": "x-xx-x.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-18 08:15:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "XWorm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645930": [
        {
            "ioc_value": "surveillance.steelpanman.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-18 08:07:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "XWorm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645928": [
        {
            "ioc_value": "roy.clashofmaps.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-18 08:07:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1645929": [
        {
            "ioc_value": "roy.mummyhildasrice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-18 08:07:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1645927": [
        {
            "ioc_value": "wolfe.neighb0rrol1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 08:07:27",
            "last_seen_utc": "2025-11-18 08:14:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645905": [
        {
            "ioc_value": "hain.f1anerchan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 07:57:07",
            "last_seen_utc": "2025-11-18 08:02:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645904": [
        {
            "ioc_value": "bach.f1anerchan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 07:47:51",
            "last_seen_utc": "2025-11-18 07:49:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645902": [
        {
            "ioc_value": "wind.f1anerchan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 07:30:17",
            "last_seen_utc": "2025-11-18 07:47:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645901": [
        {
            "ioc_value": "harpygt-37577.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-18 07:21:47",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645898": [
        {
            "ioc_value": "johnsmith0777.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-18 07:21:12",
            "last_seen_utc": "2025-12-12 18:39:24",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645896": [
        {
            "ioc_value": "v2.stope40.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-18 07:19:44",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645897": [
        {
            "ioc_value": "v3.stope40.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-18 07:19:44",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645895": [
        {
            "ioc_value": "gatex.stope40.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-18 07:19:26",
            "last_seen_utc": "2025-12-12 18:38:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645893": [
        {
            "ioc_value": "klee.f1anerchan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 07:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645889": [
        {
            "ioc_value": "tal.p0lys5pear.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 07:08:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645886": [
        {
            "ioc_value": "adler.p0lys5pear.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 06:57:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645885": [
        {
            "ioc_value": "gleam.p0lys5pear.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 06:47:10",
            "last_seen_utc": "2025-11-18 06:54:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645884": [
        {
            "ioc_value": "stern.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 06:32:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645883": [
        {
            "ioc_value": "moor.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 06:22:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645881": [
        {
            "ioc_value": "xlab.ignorelist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-18 06:10:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/Xlab_qax/status/1990382154396872716",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645882": [
        {
            "ioc_value": "krebs.strangled.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-18 06:10:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/Xlab_qax/status/1990382154396872716",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645879": [
        {
            "ioc_value": "mreow.jumpingcrab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-18 06:08:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/d1d1a27962bb28e04d76c2d001cc86f5ccdaf8f439bc70d6891bc27447b746e7/behavior",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645876": [
        {
            "ioc_value": "r-funding.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-18 06:01:55",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251118-cwc96saj4v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645573": [
        {
            "ioc_value": "docs.ledgerpropertiesllc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-18 06:00:38",
            "last_seen_utc": "2025-11-22 10:06:07",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115566376960701140",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1645856": [
        {
            "ioc_value": "falke.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 00:47:36",
            "last_seen_utc": "2025-11-18 00:49:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645855": [
        {
            "ioc_value": "pfad.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 00:38:18",
            "last_seen_utc": "2025-11-18 00:53:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645854": [
        {
            "ioc_value": "cloud.spyingte1ess.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 00:27:01",
            "last_seen_utc": "2025-11-18 00:34:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645853": [
        {
            "ioc_value": "licht.c0nsiumpond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 00:17:13",
            "last_seen_utc": "2025-11-18 00:21:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645852": [
        {
            "ioc_value": "wald.c0nsiumpond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-18 00:07:57",
            "last_seen_utc": "2025-11-18 00:09:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645836": [
        {
            "ioc_value": "ufer.c0nsiumpond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 23:58:10",
            "last_seen_utc": "2025-11-18 00:02:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645835": [
        {
            "ioc_value": "eis.c0nsiumpond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 23:41:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645834": [
        {
            "ioc_value": "weald.ec0nomyfl0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 23:37:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645833": [
        {
            "ioc_value": "tau.ec0nomyfl0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 23:27:43",
            "last_seen_utc": "2025-11-17 23:37:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645832": [
        {
            "ioc_value": "birch.ec0nomyfl0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 23:16:01",
            "last_seen_utc": "2025-11-17 23:22:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645831": [
        {
            "ioc_value": "rune.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 23:12:14",
            "last_seen_utc": "2025-11-17 23:14:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645830": [
        {
            "ioc_value": "korn.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 23:07:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645826": [
        {
            "ioc_value": "www.random.securefile.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.venom",
            "malware_alias": null,
            "malware_printable": "Venom RAT",
            "first_seen_utc": "2025-11-17 23:01:03",
            "last_seen_utc": "2025-11-18 00:03:30",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/151.245.195.177+www.random.securefile.xyz",
            "tags": "AS212238,C2,CDNEXT,censys,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1645784": [
        {
            "ioc_value": "fjord.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 22:57:16",
            "last_seen_utc": "2025-11-17 23:02:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645782": [
        {
            "ioc_value": "ns2.jxalrport.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-17 22:49:00",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645781": [
        {
            "ioc_value": "ns1.jxalrport.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-17 22:48:59",
            "last_seen_utc": "2025-12-14 11:48:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645780": [
        {
            "ioc_value": "glade.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 22:47:00",
            "last_seen_utc": "2025-11-17 22:49:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645779": [
        {
            "ioc_value": "wolke.re5u7coundrel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 22:35:42",
            "last_seen_utc": "2025-11-17 22:39:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645778": [
        {
            "ioc_value": "adler.quirkforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 22:27:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645777": [
        {
            "ioc_value": "weald.quirkforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 22:13:13",
            "last_seen_utc": "2025-11-17 22:19:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645776": [
        {
            "ioc_value": "glanz.quirkforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 22:07:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645775": [
        {
            "ioc_value": "fjord.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 21:52:25",
            "last_seen_utc": "2025-11-17 21:53:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645773": [
        {
            "ioc_value": "rauch.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 21:47:09",
            "last_seen_utc": "2025-11-17 21:49:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645772": [
        {
            "ioc_value": "trackingmyadsas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:46:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645766": [
        {
            "ioc_value": "dune.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 21:37:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645763": [
        {
            "ioc_value": "eco-technic-ls.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-17 21:35:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645762": [
        {
            "ioc_value": "gleis.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 21:28:02",
            "last_seen_utc": "2025-11-17 21:33:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645759": [
        {
            "ioc_value": "naturecontrast.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-17 21:24:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645757": [
        {
            "ioc_value": "apraadhi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-17 21:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645755": [
        {
            "ioc_value": "annaexcitingaffection.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:17:37",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645753": [
        {
            "ioc_value": "vanzz.life",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:16:47",
            "last_seen_utc": "2025-12-11 19:29:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645752": [
        {
            "ioc_value": "anthonylovick.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:16:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645750": [
        {
            "ioc_value": "stern.m0ssplunge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 21:15:42",
            "last_seen_utc": "2025-11-17 21:27:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645748": [
        {
            "ioc_value": "excellencegifts.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:15:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645746": [
        {
            "ioc_value": "zimelnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:14:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645744": [
        {
            "ioc_value": "noriko-a.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:13:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645742": [
        {
            "ioc_value": "propicklocksmiths.com.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:12:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645740": [
        {
            "ioc_value": "25niconail.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:11:40",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645739": [
        {
            "ioc_value": "fantasyporngames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:10:51",
            "last_seen_utc": "2025-12-09 13:35:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645736": [
        {
            "ioc_value": "tomsonking.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:08:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645735": [
        {
            "ioc_value": "taiga.flintpaddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 21:07:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645733": [
        {
            "ioc_value": "dekkking.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:06:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645732": [
        {
            "ioc_value": "afenetangola.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:05:26",
            "last_seen_utc": "2025-12-13 15:28:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645730": [
        {
            "ioc_value": "oelvio.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:04:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645728": [
        {
            "ioc_value": "wr-carind.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:03:13",
            "last_seen_utc": "2025-12-10 23:57:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645726": [
        {
            "ioc_value": "kurasou.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 21:01:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645724": [
        {
            "ioc_value": "bioricoat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:59:37",
            "last_seen_utc": "2025-12-13 15:28:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645722": [
        {
            "ioc_value": "kokua-hair-design.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645720": [
        {
            "ioc_value": "rubic3.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:57:01",
            "last_seen_utc": "2025-12-08 19:00:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645718": [
        {
            "ioc_value": "arboriza21.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:55:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645716": [
        {
            "ioc_value": "wealwaysclose.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:55:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645715": [
        {
            "ioc_value": "ufer.flintpaddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 20:55:02",
            "last_seen_utc": "2025-11-17 21:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645713": [
        {
            "ioc_value": "dmntechnology.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:54:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645711": [
        {
            "ioc_value": "bintariqservices.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:53:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645709": [
        {
            "ioc_value": "epicdawn.org.nutritionaldiversity.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645707": [
        {
            "ioc_value": "test.freeziana.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:50:23",
            "last_seen_utc": "2025-12-11 19:29:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645704": [
        {
            "ioc_value": "cortechsystems.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:49:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645702": [
        {
            "ioc_value": "nhcorporation.jp",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:48:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645701": [
        {
            "ioc_value": "wolke.flintpaddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 20:47:47",
            "last_seen_utc": "2025-11-17 20:53:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645699": [
        {
            "ioc_value": "ladang38.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:47:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645697": [
        {
            "ioc_value": "defiwp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:45:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645695": [
        {
            "ioc_value": "buchla.tokyo",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:45:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645693": [
        {
            "ioc_value": "ckartproductions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:43:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645692": [
        {
            "ioc_value": "birch.flintpaddle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 20:41:36",
            "last_seen_utc": "2025-11-17 20:45:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645690": [
        {
            "ioc_value": "gotmedrovenl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:40:44",
            "last_seen_utc": "2025-12-12 18:00:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645688": [
        {
            "ioc_value": "iogkf-shoobukan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:39:48",
            "last_seen_utc": "2025-11-26 12:55:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645687": [
        {
            "ioc_value": "arenawin48.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:38:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645684": [
        {
            "ioc_value": "soleracademy.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:36:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645683": [
        {
            "ioc_value": "1k.j-0-tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 20:35:22",
            "last_seen_utc": "2025-11-17 20:35:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645681": [
        {
            "ioc_value": "creatnova.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:34:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645679": [
        {
            "ioc_value": "genomics.org.ua",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:33:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645677": [
        {
            "ioc_value": "leedslockandkey.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:30:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645675": [
        {
            "ioc_value": "greenvina.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:29:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645673": [
        {
            "ioc_value": "scientology49.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:28:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645672": [
        {
            "ioc_value": "qm.j-0-tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 20:27:32",
            "last_seen_utc": "2025-11-17 20:31:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645670": [
        {
            "ioc_value": "adfestanteria.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:27:00",
            "last_seen_utc": "2025-11-25 17:22:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645668": [
        {
            "ioc_value": "gdtraders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:24:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645666": [
        {
            "ioc_value": "mtrader5.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:22:57",
            "last_seen_utc": "2025-12-13 15:29:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645665": [
        {
            "ioc_value": "cap-t-cha.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:22:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645663": [
        {
            "ioc_value": "rv.j-0-tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 20:17:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645662": [
        {
            "ioc_value": "usniacorp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:15:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645660": [
        {
            "ioc_value": "aannahomemedcare.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:12:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645658": [
        {
            "ioc_value": "3sl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:11:14",
            "last_seen_utc": "2025-12-08 19:00:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645656": [
        {
            "ioc_value": "haruki-kotsuban.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:10:23",
            "last_seen_utc": "2025-11-25 18:10:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645654": [
        {
            "ioc_value": "tokyo-tape-music-center.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:09:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645652": [
        {
            "ioc_value": "seiho-daigaku.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:07:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645651": [
        {
            "ioc_value": "donmono-hakumai.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:05:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645648": [
        {
            "ioc_value": "ju.j-0-tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 20:04:25",
            "last_seen_utc": "2025-11-17 20:11:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645627": [
        {
            "ioc_value": "sydneyinfo.net.au",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:03:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645620": [
        {
            "ioc_value": "sa2.infinitegame.biz.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:02:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645613": [
        {
            "ioc_value": "sa6.lokernya.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 20:00:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645611": [
        {
            "ioc_value": "shibagod.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 19:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645609": [
        {
            "ioc_value": "vibethink.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 19:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645607": [
        {
            "ioc_value": "nyhcllc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 19:56:10",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645605": [
        {
            "ioc_value": "nyq.orbitalnip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 19:55:09",
            "last_seen_utc": "2025-11-17 19:59:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645604": [
        {
            "ioc_value": "68quen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 19:55:07",
            "last_seen_utc": "2025-12-12 18:00:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645602": [
        {
            "ioc_value": "diamondmusicent.com.ng.mosesogenyi.com.ng",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 19:53:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645600": [
        {
            "ioc_value": "meganeya-momo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 19:51:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645599": [
        {
            "ioc_value": "kas.orbitalnip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 19:46:54",
            "last_seen_utc": "2025-11-17 19:52:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645598": [
        {
            "ioc_value": "3ccw2.orbitalnip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 19:36:06",
            "last_seen_utc": "2025-11-17 19:38:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645597": [
        {
            "ioc_value": "0t.orbitalnip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 19:31:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645596": [
        {
            "ioc_value": "quark0.razor-plume.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 19:25:36",
            "last_seen_utc": "2025-11-17 19:32:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645595": [
        {
            "ioc_value": "uy2k6.razor-plume.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 19:17:51",
            "last_seen_utc": "2025-11-17 19:19:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645593": [
        {
            "ioc_value": "trace.razor-plume.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 19:01:21",
            "last_seen_utc": "2025-11-17 19:11:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645592": [
        {
            "ioc_value": "7k.razor-plume.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 18:57:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645585": [
        {
            "ioc_value": "foflfalflafl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 18:46:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645583": [
        {
            "ioc_value": "aa.evermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 18:44:16",
            "last_seen_utc": "2025-11-17 18:53:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645581": [
        {
            "ioc_value": "ebrk.evermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 18:39:31",
            "last_seen_utc": "2025-11-17 18:44:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645580": [
        {
            "ioc_value": "q4.evermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 18:35:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645579": [
        {
            "ioc_value": "kf2.evermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 18:27:05",
            "last_seen_utc": "2025-11-17 18:28:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645578": [
        {
            "ioc_value": "dripiscoool1-45611.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-17 18:23:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/866e3182712d362a998cf1ef716bbe91657b811f2810b183dddf71ae8361ba89",
            "tags": "c2,domain,Quasar,rat,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645577": [
        {
            "ioc_value": "gjin.ever-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 18:18:20",
            "last_seen_utc": "2025-11-17 18:20:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645576": [
        {
            "ioc_value": "pronik-37794.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-17 18:15:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/dbd768e4f51af127bdf909947930a8be65cc9f947eaf857bc33aad27062ab857",
            "tags": "c2,dcrat,domain,rat,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645574": [
        {
            "ioc_value": "pureeratee.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-17 18:12:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251117-t2t9badj9v",
            "tags": "c2,domain,rat,Remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645575": [
        {
            "ioc_value": "ghooozztttt.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-17 18:12:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251117-t2t9badj9v",
            "tags": "c2,domain,rat,Remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645572": [
        {
            "ioc_value": "hu41o.ever-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 18:08:57",
            "last_seen_utc": "2025-11-17 18:17:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645570": [
        {
            "ioc_value": "xfoxmaildns.stufftoread.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-17 18:02:02",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251117-pfb4dsxmay",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645569": [
        {
            "ioc_value": "hank-oh53.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-17 18:02:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251117-t2t9badj9v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645567": [
        {
            "ioc_value": "vale.ever-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 18:01:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645565": [
        {
            "ioc_value": "yjxm4.ever-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 17:52:25",
            "last_seen_utc": "2025-11-17 17:59:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645564": [
        {
            "ioc_value": "sparkle3.tanglehook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 17:47:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645563": [
        {
            "ioc_value": "o7.tanglehook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 17:36:45",
            "last_seen_utc": "2025-11-17 17:47:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645562": [
        {
            "ioc_value": "oio.tanglehook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 17:27:29",
            "last_seen_utc": "2025-11-17 17:30:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645561": [
        {
            "ioc_value": "g3i6.tanglehook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 17:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645560": [
        {
            "ioc_value": "26e.j0tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 17:14:34",
            "last_seen_utc": "2025-11-17 17:15:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645559": [
        {
            "ioc_value": "flux.j0tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 17:07:19",
            "last_seen_utc": "2025-11-17 17:10:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645558": [
        {
            "ioc_value": "mbwr5.j0tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 17:04:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645557": [
        {
            "ioc_value": "g2.j0tchamber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 16:56:56",
            "last_seen_utc": "2025-11-17 17:01:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645555": [
        {
            "ioc_value": "grizzle.razorplume.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 16:47:10",
            "last_seen_utc": "2025-11-17 16:56:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645553": [
        {
            "ioc_value": "ss.razorplume.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 16:34:50",
            "last_seen_utc": "2025-11-17 16:36:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645552": [
        {
            "ioc_value": "unaltee.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-17 16:24:13",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645551": [
        {
            "ioc_value": "whittle.razorplume.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 16:20:59",
            "last_seen_utc": "2025-11-17 16:27:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645550": [
        {
            "ioc_value": "454.razorplume.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 16:16:49",
            "last_seen_utc": "2025-11-17 16:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645549": [
        {
            "ioc_value": "shift4.plasm-about.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 16:11:37",
            "last_seen_utc": "2025-11-17 16:13:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645548": [
        {
            "ioc_value": "oi.plasm-about.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 16:04:22",
            "last_seen_utc": "2025-11-17 16:07:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645542": [
        {
            "ioc_value": "r4rx.plasm-about.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 15:50:32",
            "last_seen_utc": "2025-11-17 15:53:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645541": [
        {
            "ioc_value": "jzs48.plasm-about.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 15:47:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645540": [
        {
            "ioc_value": "d5.st-1-lt-forge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 15:32:00",
            "last_seen_utc": "2025-11-17 15:38:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645539": [
        {
            "ioc_value": "nova.st-1-lt-forge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 15:21:12",
            "last_seen_utc": "2025-11-17 15:27:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645537": [
        {
            "ioc_value": "rift.st-1-lt-forge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 15:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645536": [
        {
            "ioc_value": "chamber.st-1-lt-forge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 15:06:44",
            "last_seen_utc": "2025-11-17 15:08:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645535": [
        {
            "ioc_value": "di3.cog-whittle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 14:50:20",
            "last_seen_utc": "2025-11-17 14:56:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645528": [
        {
            "ioc_value": "togogeo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-17 13:58:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/9df3636b-41b5-4179-8a19-d73d62274ec0",
            "tags": "c2,infostealer,STALKERLLC,stealer",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1645511": [
        {
            "ioc_value": "mint.cog-whittle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 12:47:08",
            "last_seen_utc": "2025-11-17 12:58:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645510": [
        {
            "ioc_value": "sjld.cog-whittle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 12:38:21",
            "last_seen_utc": "2025-11-17 12:51:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645509": [
        {
            "ioc_value": "node0.cog-whittle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 12:26:01",
            "last_seen_utc": "2025-11-17 12:29:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645508": [
        {
            "ioc_value": "cog.gr1zzlepad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 12:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645507": [
        {
            "ioc_value": "xap.gr1zzlepad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 12:08:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645496": [
        {
            "ioc_value": "wea.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-17 12:01:50",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251117-jzcldafm4t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645494": [
        {
            "ioc_value": "civo.gr1zzlepad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 11:58:53",
            "last_seen_utc": "2025-11-17 12:05:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645491": [
        {
            "ioc_value": "vmr3absd.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-17 11:57:39",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645490": [
        {
            "ioc_value": "trail8.gr1zzlepad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 11:55:44",
            "last_seen_utc": "2025-11-17 11:56:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645489": [
        {
            "ioc_value": "glide2.vexlatch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 11:43:24",
            "last_seen_utc": "2025-11-17 11:44:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645488": [
        {
            "ioc_value": "kerwp.vexlatch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 11:35:39",
            "last_seen_utc": "2025-11-17 11:41:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645487": [
        {
            "ioc_value": "dn8z4.vexlatch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 11:27:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645486": [
        {
            "ioc_value": "plume.vexlatch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 11:14:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645485": [
        {
            "ioc_value": "g3.plasmabout.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 11:09:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645484": [
        {
            "ioc_value": "anchor.plasmabout.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 11:03:58",
            "last_seen_utc": "2025-11-17 11:06:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645479": [
        {
            "ioc_value": "grid.plasmabout.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 11:01:21",
            "last_seen_utc": "2025-11-17 11:02:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645473": [
        {
            "ioc_value": "v5.plasmabout.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 10:51:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645471": [
        {
            "ioc_value": "file.oss-flash.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-17 10:49:38",
            "last_seen_utc": "2025-12-14 11:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645470": [
        {
            "ioc_value": "flp3.st1ltforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 10:43:44",
            "last_seen_utc": "2025-11-17 10:50:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645469": [
        {
            "ioc_value": "pad.st1ltforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 10:37:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645466": [
        {
            "ioc_value": "tr.st1ltforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 10:21:28",
            "last_seen_utc": "2025-11-17 10:31:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645465": [
        {
            "ioc_value": "1efys.st1ltforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 10:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645464": [
        {
            "ioc_value": "labs.cogwhittle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 10:07:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645463": [
        {
            "ioc_value": "71kxr.cogwhittle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 09:54:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645462": [
        {
            "ioc_value": "g4.cogwhittle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 09:43:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645461": [
        {
            "ioc_value": "86.cogwhittle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 09:41:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645460": [
        {
            "ioc_value": "korn.sagehollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 09:30:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645459": [
        {
            "ioc_value": "weiss.sagehollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 09:27:58",
            "last_seen_utc": "2025-11-17 09:28:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645458": [
        {
            "ioc_value": "tau.sagehollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 09:14:38",
            "last_seen_utc": "2025-11-17 09:19:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645457": [
        {
            "ioc_value": "stern.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 09:07:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645456": [
        {
            "ioc_value": "rune.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 08:57:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645454": [
        {
            "ioc_value": "fluss.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 08:47:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645444": [
        {
            "ioc_value": "hor.momentsforme.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-17 08:39:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1645445": [
        {
            "ioc_value": "hor.clashofmaps.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-17 08:39:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1645446": [
        {
            "ioc_value": "frx.clashofmaps.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-17 08:39:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1645443": [
        {
            "ioc_value": "dune.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 08:39:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645431": [
        {
            "ioc_value": "wald.ottercrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 08:37:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645430": [
        {
            "ioc_value": "rauch.stoneharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 08:28:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645428": [
        {
            "ioc_value": "kamm.stoneharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 08:13:10",
            "last_seen_utc": "2025-11-17 08:23:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645427": [
        {
            "ioc_value": "mond.stoneharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 08:06:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645412": [
        {
            "ioc_value": "ufer.stoneharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 07:58:05",
            "last_seen_utc": "2025-11-17 08:04:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645411": [
        {
            "ioc_value": "adler.gladecrown.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 07:47:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645410": [
        {
            "ioc_value": "sturm.gladecrown.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 07:37:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645409": [
        {
            "ioc_value": "birch.gladecrown.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 07:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645408": [
        {
            "ioc_value": "weiss.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 07:18:33",
            "last_seen_utc": "2025-11-17 07:19:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645407": [
        {
            "ioc_value": "bach.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 07:07:09",
            "last_seen_utc": "2025-11-17 07:13:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645406": [
        {
            "ioc_value": "krone.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 06:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645405": [
        {
            "ioc_value": "persistancejs.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-17 06:47:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "zphp",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645404": [
        {
            "ioc_value": "fun-continuity.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-17 06:47:08",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645403": [
        {
            "ioc_value": "tal.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 06:47:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645402": [
        {
            "ioc_value": "jayde.servehttp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-17 06:46:50",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645401": [
        {
            "ioc_value": "domo2222.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-17 06:46:11",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645400": [
        {
            "ioc_value": "v3.nahproject.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-17 06:45:53",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645398": [
        {
            "ioc_value": "wolke.falconmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 06:34:39",
            "last_seen_utc": "2025-11-17 06:35:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1645397": [
        {
            "ioc_value": "licht.bramblequell.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 06:09:14",
            "last_seen_utc": "2025-11-17 06:22:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1645147": [
        {
            "ioc_value": "recenjc.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-17 06:06:44",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1645148": [
        {
            "ioc_value": "familjw.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-17 06:06:43",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1645152": [
        {
            "ioc_value": "account-captchapulse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 06:06:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645154": [
        {
            "ioc_value": "mijkar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 06:06:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645156": [
        {
            "ioc_value": "account-extranetpulse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 06:06:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645160": [
        {
            "ioc_value": "account-partner.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 06:06:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645162": [
        {
            "ioc_value": "account-captchapulse.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 06:06:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking.com,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645165": [
        {
            "ioc_value": "sonyarafferty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 06:06:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645167": [
        {
            "ioc_value": "civicleague.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 06:06:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1645177": [
        {
            "ioc_value": "ommanilegend.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-17 06:06:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.76.190.68+ommanilegend.com",
            "tags": "AS-VULTR,AS20473,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1645196": [
        {
            "ioc_value": "secure.hoststewart.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-17 06:06:26",
            "last_seen_utc": "2025-11-22 10:06:07",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115562130486743785",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1645396": [
        {
            "ioc_value": "suprakinini-50793.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-11-17 06:04:37",
            "last_seen_utc": "2025-12-12 18:40:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/251117-c4brbawpdm",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645395": [
        {
            "ioc_value": "death-christ.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-17 06:02:35",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251117-cxh7tawnhn",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645394": [
        {
            "ioc_value": "winterfall.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-17 06:02:07",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/251117-a3m2vacj41",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1645393": [
        {
            "ioc_value": "eiche.bramblequell.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 05:39:00",
            "last_seen_utc": "2025-11-17 05:43:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645392": [
        {
            "ioc_value": "ufer.bramblequell.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 05:27:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645391": [
        {
            "ioc_value": "fels.bramblequell.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 05:17:48",
            "last_seen_utc": "2025-11-17 05:24:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645390": [
        {
            "ioc_value": "gleis.dawnforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 05:06:59",
            "last_seen_utc": "2025-11-17 05:13:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645389": [
        {
            "ioc_value": "tau.dawnforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 04:57:38",
            "last_seen_utc": "2025-11-17 04:58:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645388": [
        {
            "ioc_value": "stern.dawnforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 04:42:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645387": [
        {
            "ioc_value": "licht.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 04:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645386": [
        {
            "ioc_value": "weald.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 04:27:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645385": [
        {
            "ioc_value": "korn.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 04:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645384": [
        {
            "ioc_value": "bach.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 04:07:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645377": [
        {
            "ioc_value": "nebel.merlincopse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 03:57:16",
            "last_seen_utc": "2025-11-17 03:58:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645376": [
        {
            "ioc_value": "wind.cairnsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 03:46:57",
            "last_seen_utc": "2025-11-17 03:48:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645375": [
        {
            "ioc_value": "adler.cairnsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 03:37:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645373": [
        {
            "ioc_value": "moos.cairnsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 03:27:48",
            "last_seen_utc": "2025-11-17 03:28:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645372": [
        {
            "ioc_value": "tal.heatherpass.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 03:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645371": [
        {
            "ioc_value": "klee.heatherpass.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 03:07:40",
            "last_seen_utc": "2025-11-17 03:14:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645370": [
        {
            "ioc_value": "bach.heatherpass.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 02:57:23",
            "last_seen_utc": "2025-11-17 03:03:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645368": [
        {
            "ioc_value": "api.asduiasd12ab.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-17 02:47:51",
            "last_seen_utc": "2025-12-14 11:48:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1645367": [
        {
            "ioc_value": "wolke.heatherpass.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 02:41:59",
            "last_seen_utc": "2025-11-17 02:48:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645366": [
        {
            "ioc_value": "injj8.kink-bellow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 02:37:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645365": [
        {
            "ioc_value": "gx.braycircuit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 02:27:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645364": [
        {
            "ioc_value": "drift8.braycircuit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 02:17:44",
            "last_seen_utc": "2025-11-17 02:18:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645363": [
        {
            "ioc_value": "quark.braycircuit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 02:07:56",
            "last_seen_utc": "2025-11-17 02:14:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645362": [
        {
            "ioc_value": "jp.braycircuit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 01:57:39",
            "last_seen_utc": "2025-11-17 01:58:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645361": [
        {
            "ioc_value": "bay.spindle-way.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 01:44:48",
            "last_seen_utc": "2025-11-17 01:53:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645360": [
        {
            "ioc_value": "hck.spindle-way.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 01:37:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645359": [
        {
            "ioc_value": "spark.spindle-way.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 01:28:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645358": [
        {
            "ioc_value": "i8.spindle-way.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 01:16:41",
            "last_seen_utc": "2025-11-17 01:25:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645357": [
        {
            "ioc_value": "rift7.quibsnare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 01:06:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645356": [
        {
            "ioc_value": "jx7y.quibsnare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 00:59:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645355": [
        {
            "ioc_value": "6jtg4.quibsnare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 00:53:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645354": [
        {
            "ioc_value": "labs.quibsnare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 00:47:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645353": [
        {
            "ioc_value": "w9el.hover-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 00:35:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645351": [
        {
            "ioc_value": "mrryq.hover-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 00:27:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645197": [
        {
            "ioc_value": "q5ct.hover-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 00:17:49",
            "last_seen_utc": "2025-11-17 00:17:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645195": [
        {
            "ioc_value": "gtl.hover-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-17 00:07:37",
            "last_seen_utc": "2025-11-17 00:13:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645191": [
        {
            "ioc_value": "kvt.gl1nterbay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 23:57:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645190": [
        {
            "ioc_value": "glide.gl1nterbay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 23:47:21",
            "last_seen_utc": "2025-11-16 23:48:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645189": [
        {
            "ioc_value": "circuit.gl1nterbay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 23:36:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645188": [
        {
            "ioc_value": "jkf2.gl1nterbay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 23:26:09",
            "last_seen_utc": "2025-11-16 23:26:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645187": [
        {
            "ioc_value": "gleam.cl1ppleap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 23:17:54",
            "last_seen_utc": "2025-11-16 23:18:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645186": [
        {
            "ioc_value": "zgna.cl1ppleap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 23:07:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645171": [
        {
            "ioc_value": "jov.cl1ppleap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 22:57:47",
            "last_seen_utc": "2025-11-16 22:58:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645170": [
        {
            "ioc_value": "1csr.cl1ppleap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 22:46:29",
            "last_seen_utc": "2025-11-16 22:52:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645168": [
        {
            "ioc_value": "marble5.spindleway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 22:37:38",
            "last_seen_utc": "2025-11-16 22:43:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645164": [
        {
            "ioc_value": "hkngj.spindleway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 22:27:21",
            "last_seen_utc": "2025-11-16 22:35:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645159": [
        {
            "ioc_value": "dl.spindleway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 22:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645158": [
        {
            "ioc_value": "pua4.spindleway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 22:08:16",
            "last_seen_utc": "2025-11-16 22:15:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645150": [
        {
            "ioc_value": "6pz.bray-circuit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 21:57:59",
            "last_seen_utc": "2025-11-16 21:59:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645146": [
        {
            "ioc_value": "crest.bray-circuit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 21:46:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645145": [
        {
            "ioc_value": "node.bray-circuit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 21:37:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645144": [
        {
            "ioc_value": "s8l.bray-circuit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 21:31:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645143": [
        {
            "ioc_value": "flip.tundra-flip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 21:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645142": [
        {
            "ioc_value": "uvu60.tundra-flip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 21:17:30",
            "last_seen_utc": "2025-11-16 21:20:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645140": [
        {
            "ioc_value": "marble.tundra-flip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 21:03:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645139": [
        {
            "ioc_value": "4a.tundra-flip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 20:57:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645138": [
        {
            "ioc_value": "0xwdn.marble-tug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 20:48:11",
            "last_seen_utc": "2025-11-16 20:55:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645137": [
        {
            "ioc_value": "glv7.marble-tug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 20:39:25",
            "last_seen_utc": "2025-11-16 20:43:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645136": [
        {
            "ioc_value": "shard.marble-tug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 20:37:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645135": [
        {
            "ioc_value": "core.s0apthorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 20:28:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645134": [
        {
            "ioc_value": "1l.s0apthorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 20:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645133": [
        {
            "ioc_value": "abz52.s0apthorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 20:07:58",
            "last_seen_utc": "2025-11-16 20:13:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645131": [
        {
            "ioc_value": "mesh.s0apthorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 19:57:37",
            "last_seen_utc": "2025-11-16 20:04:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645130": [
        {
            "ioc_value": "6kdo.hovermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 19:47:20",
            "last_seen_utc": "2025-11-16 19:53:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645129": [
        {
            "ioc_value": "q9.hovermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 19:37:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645128": [
        {
            "ioc_value": "vale.hovermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 19:25:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645127": [
        {
            "ioc_value": "g4.hovermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 19:15:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645114": [
        {
            "ioc_value": "phase3.tundraflip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 19:08:12",
            "last_seen_utc": "2025-11-16 19:15:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1645112": [
        {
            "ioc_value": "club-morgan.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-16 19:01:42",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645110": [
        {
            "ioc_value": "dl.360safe.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-16 19:01:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "shortloader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645111": [
        {
            "ioc_value": "tools.soft.360.cn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-16 19:01:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "shortloader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645105": [
        {
            "ioc_value": "dfgdfghghfhfh.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-16 18:58:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645100": [
        {
            "ioc_value": "suieiusiueiuiuushgf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645101": [
        {
            "ioc_value": "suieiusiueiuiuushgff.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645102": [
        {
            "ioc_value": "suieiusiueiuiuushgfl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645103": [
        {
            "ioc_value": "suieiusiueiuiuushgfr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645104": [
        {
            "ioc_value": "suieiusiueiuiuushgfu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645079": [
        {
            "ioc_value": "sfsiuhieghaughaoehox.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645080": [
        {
            "ioc_value": "sisoefjsuhuhaudhhed.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645081": [
        {
            "ioc_value": "sisoefjsuhuhaudhhedf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645082": [
        {
            "ioc_value": "sisoefjsuhuhaudhhedl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645083": [
        {
            "ioc_value": "sisoefjsuhuhaudhhedr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645084": [
        {
            "ioc_value": "sisoefjsuhuhaudhhedu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645085": [
        {
            "ioc_value": "slpsrgpsrhojifdij.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645086": [
        {
            "ioc_value": "slpsrgpsrhojifdij.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645087": [
        {
            "ioc_value": "slpsrgpsrhojifdij.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645088": [
        {
            "ioc_value": "srgouosehohedohaeoh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645089": [
        {
            "ioc_value": "srgouosehohedohaeohf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645090": [
        {
            "ioc_value": "srgouosehohedohaeohl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645091": [
        {
            "ioc_value": "srgouosehohedohaeohr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645092": [
        {
            "ioc_value": "srgouosehohedohaeohu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645093": [
        {
            "ioc_value": "srgouosehohedohaeohx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645094": [
        {
            "ioc_value": "srndndubsbsifurfd.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645095": [
        {
            "ioc_value": "srndndubsbsifurfd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645096": [
        {
            "ioc_value": "srndndubsbsifurfd.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645097": [
        {
            "ioc_value": "ssofhoseuegsgrfnj.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645098": [
        {
            "ioc_value": "ssofhoseuegsgrfnj.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645099": [
        {
            "ioc_value": "ssofhoseuegsgrfnu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645058": [
        {
            "ioc_value": "rgrshousnodbeuabgrhl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645059": [
        {
            "ioc_value": "rgrshousnodbeuabgrhr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645060": [
        {
            "ioc_value": "rgrshousnodbeuabgrhu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645061": [
        {
            "ioc_value": "rgrshousnodbeuabgrhx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645062": [
        {
            "ioc_value": "rgsouhdoauenodaeufb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645063": [
        {
            "ioc_value": "rgsouhdoauenodaeufbf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645064": [
        {
            "ioc_value": "rgsouhdoauenodaeufbl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645065": [
        {
            "ioc_value": "rgsouhdoauenodaeufbr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645066": [
        {
            "ioc_value": "rgsouhdoauenodaeufbu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645067": [
        {
            "ioc_value": "rgsouhdoauenodaeufbx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645068": [
        {
            "ioc_value": "sfiushidhseiugiuseh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645069": [
        {
            "ioc_value": "sfiushidhseiugiusehf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645070": [
        {
            "ioc_value": "sfiushidhseiugiusehl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645071": [
        {
            "ioc_value": "sfiushidhseiugiusehr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645072": [
        {
            "ioc_value": "sfiushidhseiugiusehu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645073": [
        {
            "ioc_value": "sfiushidhseiugiusehx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645074": [
        {
            "ioc_value": "sfsiuhieghaughaoeho.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645075": [
        {
            "ioc_value": "sfsiuhieghaughaoehof.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645076": [
        {
            "ioc_value": "sfsiuhieghaughaoehol.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645077": [
        {
            "ioc_value": "sfsiuhieghaughaoehor.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645078": [
        {
            "ioc_value": "sfsiuhieghaughaoehou.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645038": [
        {
            "ioc_value": "plpaedjaofheagoahdg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645039": [
        {
            "ioc_value": "plpaedjaofheagoahdgf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645040": [
        {
            "ioc_value": "plpaedjaofheagoahdgl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645041": [
        {
            "ioc_value": "plpaedjaofheagoahdgr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645042": [
        {
            "ioc_value": "plpaedjaofheagoahdgu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645043": [
        {
            "ioc_value": "plpaedjaofheagoahdgx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645044": [
        {
            "ioc_value": "rgijirshisjriijdijh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645045": [
        {
            "ioc_value": "rgijirshisjriijdijhf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645046": [
        {
            "ioc_value": "rgijirshisjriijdijhl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645047": [
        {
            "ioc_value": "rgijirshisjriijdijhr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645048": [
        {
            "ioc_value": "rgijirshisjriijdijhu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645049": [
        {
            "ioc_value": "rgijirshisjriijdijhx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645050": [
        {
            "ioc_value": "rgoonedoauneuoebuae.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645051": [
        {
            "ioc_value": "rgoonedoauneuoebuaef.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645052": [
        {
            "ioc_value": "rgoonedoauneuoebuael.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645053": [
        {
            "ioc_value": "rgoonedoauneuoebuaer.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645054": [
        {
            "ioc_value": "rgoonedoauneuoebuaeu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645055": [
        {
            "ioc_value": "rgoonedoauneuoebuaex.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645056": [
        {
            "ioc_value": "rgrshousnodbeuabgrh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645057": [
        {
            "ioc_value": "rgrshousnodbeuabgrhf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645017": [
        {
            "ioc_value": "oieoaidhhaidhiehhegr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645018": [
        {
            "ioc_value": "oieoaidhhaidhiehhegu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645019": [
        {
            "ioc_value": "oieoaidhhaidhiehhegx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645020": [
        {
            "ioc_value": "opllforgirsoofuhohu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645021": [
        {
            "ioc_value": "opllforgirsoofuhohuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645022": [
        {
            "ioc_value": "opllforgirsoofuhohul.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645023": [
        {
            "ioc_value": "opllforgirsoofuhohur.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645024": [
        {
            "ioc_value": "opllforgirsoofuhohuu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645025": [
        {
            "ioc_value": "opllforgirsoofuhohux.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645026": [
        {
            "ioc_value": "orsodaououaebufbeob.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645027": [
        {
            "ioc_value": "orsodaououaebufbeobf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645028": [
        {
            "ioc_value": "orsodaououaebufbeobl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645029": [
        {
            "ioc_value": "orsodaououaebufbeobr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645030": [
        {
            "ioc_value": "orsodaououaebufbeobu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645031": [
        {
            "ioc_value": "orsodaououaebufbeobx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645032": [
        {
            "ioc_value": "osheoufhusheoghuesd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645033": [
        {
            "ioc_value": "osheoufhusheoghuesdf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645034": [
        {
            "ioc_value": "osheoufhusheoghuesdl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645035": [
        {
            "ioc_value": "osheoufhusheoghuesdr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645036": [
        {
            "ioc_value": "osheoufhusheoghuesdu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645037": [
        {
            "ioc_value": "osheoufhusheoghuesdx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644996": [
        {
            "ioc_value": "oefosfishiudhiusegf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644997": [
        {
            "ioc_value": "oefosfishiudhiusegff.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644998": [
        {
            "ioc_value": "oefosfishiudhiusegfl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644999": [
        {
            "ioc_value": "oefosfishiudhiusegfr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645000": [
        {
            "ioc_value": "oefosfishiudhiusegfu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645001": [
        {
            "ioc_value": "oefosfishiudhiusegfx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645002": [
        {
            "ioc_value": "oeiieieisijdingisgf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645003": [
        {
            "ioc_value": "oeiieieisijdingisgff.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645004": [
        {
            "ioc_value": "oeiieieisijdingisgfl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645005": [
        {
            "ioc_value": "oeiieieisijdingisgfr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645006": [
        {
            "ioc_value": "oeiieieisijdingisgfu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645007": [
        {
            "ioc_value": "oeiieieisijdingisgfx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645008": [
        {
            "ioc_value": "ofheofosugusghuhush.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645009": [
        {
            "ioc_value": "ofheofosugusghuhushf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645010": [
        {
            "ioc_value": "ofheofosugusghuhushl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645011": [
        {
            "ioc_value": "ofheofosugusghuhushr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645012": [
        {
            "ioc_value": "ofheofosugusghuhushu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645013": [
        {
            "ioc_value": "ofheofosugusghuhushx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645014": [
        {
            "ioc_value": "oieoaidhhaidhiehheg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645015": [
        {
            "ioc_value": "oieoaidhhaidhiehhegf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1645016": [
        {
            "ioc_value": "oieoaidhhaidhiehhegl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644976": [
        {
            "ioc_value": "naibfiahdiauehihhref.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644977": [
        {
            "ioc_value": "naibfiahdiauehihhrel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644978": [
        {
            "ioc_value": "naibfiahdiauehihhrer.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644979": [
        {
            "ioc_value": "naibfiahdiauehihhreu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644980": [
        {
            "ioc_value": "naibfiahdiauehihhrex.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644981": [
        {
            "ioc_value": "naiebiaifzgfaezgdzr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644982": [
        {
            "ioc_value": "naiebiaifzgfaezgdzrf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644983": [
        {
            "ioc_value": "naiebiaifzgfaezgdzrl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644984": [
        {
            "ioc_value": "naiebiaifzgfaezgdzrr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644985": [
        {
            "ioc_value": "naiebiaifzgfaezgdzru.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644986": [
        {
            "ioc_value": "naiebiaifzgfaezgdzrx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644987": [
        {
            "ioc_value": "nnososoosjfeuhueu.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644988": [
        {
            "ioc_value": "nnososoosjfeuhueu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644989": [
        {
            "ioc_value": "nnososoosjfeuhueu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644990": [
        {
            "ioc_value": "noeuaoenriusfiruu.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644991": [
        {
            "ioc_value": "noeuaoenriusfiruu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644992": [
        {
            "ioc_value": "noeuaoenriusfiruu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644993": [
        {
            "ioc_value": "nousiieiffgogogoo.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644994": [
        {
            "ioc_value": "nousiieiffgogogoo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644995": [
        {
            "ioc_value": "nousiieiffgogogoo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644954": [
        {
            "ioc_value": "guaeudueaennnaenuenx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644955": [
        {
            "ioc_value": "guhaohadueoanavbvbf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644956": [
        {
            "ioc_value": "guhaohadueoanavbvbff.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644957": [
        {
            "ioc_value": "guhaohadueoanavbvbfl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644958": [
        {
            "ioc_value": "guhaohadueoanavbvbfr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644959": [
        {
            "ioc_value": "guhaohadueoanavbvbfu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644960": [
        {
            "ioc_value": "guhaohadueoanavbvbfx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644961": [
        {
            "ioc_value": "hpptlhptdkoodsokdke.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644962": [
        {
            "ioc_value": "hpptlhptdkoodsokdkef.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644963": [
        {
            "ioc_value": "hpptlhptdkoodsokdkel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644964": [
        {
            "ioc_value": "hpptlhptdkoodsokdker.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644965": [
        {
            "ioc_value": "hpptlhptdkoodsokdkeu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644966": [
        {
            "ioc_value": "hpptlhptdkoodsokdkex.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644967": [
        {
            "ioc_value": "iuirshriuisruruuf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644968": [
        {
            "ioc_value": "iuirshriuisruruuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644969": [
        {
            "ioc_value": "mmginsiridnsinnsgir.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644970": [
        {
            "ioc_value": "mmginsiridnsinnsgirf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644971": [
        {
            "ioc_value": "mmginsiridnsinnsgirl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644972": [
        {
            "ioc_value": "mmginsiridnsinnsgirr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644973": [
        {
            "ioc_value": "mmginsiridnsinnsgiru.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644974": [
        {
            "ioc_value": "mmginsiridnsinnsgirx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644975": [
        {
            "ioc_value": "naibfiahdiauehihhre.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644932": [
        {
            "ioc_value": "gnauobdwobfauogouhef.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644933": [
        {
            "ioc_value": "gnauobdwobfauogouhel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644934": [
        {
            "ioc_value": "gnauobdwobfauogouher.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644935": [
        {
            "ioc_value": "gnauobdwobfauogouheu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644936": [
        {
            "ioc_value": "gnauobdwobfauogouhex.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644937": [
        {
            "ioc_value": "goauhoednoaueouabbe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644938": [
        {
            "ioc_value": "goauhoednoaueouabbef.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644939": [
        {
            "ioc_value": "goauhoednoaueouabbel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644940": [
        {
            "ioc_value": "goauhoednoaueouabber.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644941": [
        {
            "ioc_value": "goauhoednoaueouabbeu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644942": [
        {
            "ioc_value": "goauhoednoaueouabbex.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644943": [
        {
            "ioc_value": "gouaondoaudbaebobgu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644944": [
        {
            "ioc_value": "gouaondoaudbaebobguf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644945": [
        {
            "ioc_value": "gouaondoaudbaebobgul.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644946": [
        {
            "ioc_value": "gouaondoaudbaebobgur.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644947": [
        {
            "ioc_value": "gouaondoaudbaebobguu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644948": [
        {
            "ioc_value": "gouaondoaudbaebobgux.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644949": [
        {
            "ioc_value": "guaeudueaennnaenuen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644950": [
        {
            "ioc_value": "guaeudueaennnaenuenf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644951": [
        {
            "ioc_value": "guaeudueaennnaenuenl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644952": [
        {
            "ioc_value": "guaeudueaennnaenuenr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644953": [
        {
            "ioc_value": "guaeudueaennnaenuenu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644910": [
        {
            "ioc_value": "gjaneaodounaoeongunr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644911": [
        {
            "ioc_value": "gjaneaodounaoeongunu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644912": [
        {
            "ioc_value": "gjaneaodounaoeongunx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644913": [
        {
            "ioc_value": "gmndaudnahgahghaohh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644914": [
        {
            "ioc_value": "gmndaudnahgahghaohhf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644915": [
        {
            "ioc_value": "gmndaudnahgahghaohhl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644916": [
        {
            "ioc_value": "gmndaudnahgahghaohhr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644917": [
        {
            "ioc_value": "gmndaudnahgahghaohhu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644918": [
        {
            "ioc_value": "gmndaudnahgahghaohhx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644919": [
        {
            "ioc_value": "gnaednouebaoubefoub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644920": [
        {
            "ioc_value": "gnaednouebaoubefoubf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644921": [
        {
            "ioc_value": "gnaednouebaoubefoubl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644922": [
        {
            "ioc_value": "gnaednouebaoubefoubr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644923": [
        {
            "ioc_value": "gnaednouebaoubefoubu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644924": [
        {
            "ioc_value": "gnaednouebaoubefoubx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644925": [
        {
            "ioc_value": "gnaoedoaoounauubueu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644926": [
        {
            "ioc_value": "gnaoedoaoounauubueuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644927": [
        {
            "ioc_value": "gnaoedoaoounauubueul.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644928": [
        {
            "ioc_value": "gnaoedoaoounauubueur.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644929": [
        {
            "ioc_value": "gnaoedoaoounauubueuu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644930": [
        {
            "ioc_value": "gnaoedoaoounauubueux.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644931": [
        {
            "ioc_value": "gnauobdwobfauogouhe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644888": [
        {
            "ioc_value": "gboauabedogoaugaehyu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644889": [
        {
            "ioc_value": "gbobaebaodebuoueofu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644890": [
        {
            "ioc_value": "gbobaebaodebuoueofuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644891": [
        {
            "ioc_value": "gbobaebaodebuoueoful.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644892": [
        {
            "ioc_value": "gbobaebaodebuoueofur.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644893": [
        {
            "ioc_value": "gbobaebaodebuoueofuu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644894": [
        {
            "ioc_value": "gbobaebaodebuoueofux.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644895": [
        {
            "ioc_value": "giohuoaehdoueofbaur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644896": [
        {
            "ioc_value": "giohuoaehdoueofbaurf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644897": [
        {
            "ioc_value": "giohuoaehdoueofbaurl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644898": [
        {
            "ioc_value": "giohuoaehdoueofbaurr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644899": [
        {
            "ioc_value": "giohuoaehdoueofbauru.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644900": [
        {
            "ioc_value": "giohuoaehdoueofbaurx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644901": [
        {
            "ioc_value": "giuahfoaoeubfouaena.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644902": [
        {
            "ioc_value": "giuahfoaoeubfouaenaf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644903": [
        {
            "ioc_value": "giuahfoaoeubfouaenal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644904": [
        {
            "ioc_value": "giuahfoaoeubfouaenar.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644905": [
        {
            "ioc_value": "giuahfoaoeubfouaenau.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644906": [
        {
            "ioc_value": "giuahfoaoeubfouaenax.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644907": [
        {
            "ioc_value": "gjaneaodounaoeongun.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644908": [
        {
            "ioc_value": "gjaneaodounaoeongunf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644909": [
        {
            "ioc_value": "gjaneaodounaoeongunl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644867": [
        {
            "ioc_value": "foaeodheuabguaegubrr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644868": [
        {
            "ioc_value": "foaeodheuabguaegubru.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644869": [
        {
            "ioc_value": "foaeodheuabguaegubrx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644870": [
        {
            "ioc_value": "fuaiuebndieufeufu.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644871": [
        {
            "ioc_value": "fuaiuebndieufeufu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644872": [
        {
            "ioc_value": "fuaiuebndieufeufu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644873": [
        {
            "ioc_value": "fuiueufiiehfueghuhf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644874": [
        {
            "ioc_value": "fuiueufiiehfueghuhff.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644875": [
        {
            "ioc_value": "fuiueufiiehfueghuhfl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644876": [
        {
            "ioc_value": "fuiueufiiehfueghuhfr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644877": [
        {
            "ioc_value": "fuiueufiiehfueghuhfu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644878": [
        {
            "ioc_value": "fuiueufiiehfueghuhfx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644879": [
        {
            "ioc_value": "gaeuhdobaoebuagoaoe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644880": [
        {
            "ioc_value": "gaeuhdobaoebuagoaoef.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644881": [
        {
            "ioc_value": "gaeuhdobaoebuagoaoel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644882": [
        {
            "ioc_value": "gaeuhdobaoebuagoaoeu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644883": [
        {
            "ioc_value": "gaeuhdobaoebuagoaoex.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644884": [
        {
            "ioc_value": "gboauabedogoaugaehy.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644885": [
        {
            "ioc_value": "gboauabedogoaugaehyf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644886": [
        {
            "ioc_value": "gboauabedogoaugaehyl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644887": [
        {
            "ioc_value": "gboauabedogoaugaehyr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644842": [
        {
            "ioc_value": "eoguaonedonaodabobgu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644843": [
        {
            "ioc_value": "eoguaonedonaodabobgx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644844": [
        {
            "ioc_value": "eooeoeooejesfiehfii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644845": [
        {
            "ioc_value": "eooeoeooejesfiehfiif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644846": [
        {
            "ioc_value": "eooeoeooejesfiehfiil.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644847": [
        {
            "ioc_value": "eooeoeooejesfiehfiir.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644848": [
        {
            "ioc_value": "eooeoeooejesfiehfiiu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644849": [
        {
            "ioc_value": "eooeoeooejesfiehfiix.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644850": [
        {
            "ioc_value": "eoroooskfogihisrg.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644851": [
        {
            "ioc_value": "eoroooskfogihisrg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644852": [
        {
            "ioc_value": "eoroooskfogihisrg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644853": [
        {
            "ioc_value": "fifiehsueuufidhfi.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644854": [
        {
            "ioc_value": "fifiehsueuufidhfi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644855": [
        {
            "ioc_value": "fifiehsueuufidhfi.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644856": [
        {
            "ioc_value": "fiiauediehduefuge.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644857": [
        {
            "ioc_value": "fiiauediehduefuge.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644858": [
        {
            "ioc_value": "fisiuuiedesubdibesd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644859": [
        {
            "ioc_value": "fisiuuiedesubdibesdf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644860": [
        {
            "ioc_value": "fisiuuiedesubdibesdl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644861": [
        {
            "ioc_value": "fisiuuiedesubdibesdr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644862": [
        {
            "ioc_value": "fisiuuiedesubdibesdu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644863": [
        {
            "ioc_value": "fisiuuiedesubdibesdx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644864": [
        {
            "ioc_value": "foaeodheuabguaegubr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644865": [
        {
            "ioc_value": "foaeodheuabguaegubrf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644866": [
        {
            "ioc_value": "foaeodheuabguaegubrl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644820": [
        {
            "ioc_value": "efiiuehdiahiuediaugx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644821": [
        {
            "ioc_value": "eiifngjfksisiufjf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644822": [
        {
            "ioc_value": "eiifngjfksisiufjf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644823": [
        {
            "ioc_value": "eneebgieeiieieiddrt.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644824": [
        {
            "ioc_value": "eneebgieeiieieiddrtf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644825": [
        {
            "ioc_value": "eneebgieeiieieiddrtl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644826": [
        {
            "ioc_value": "eneebgieeiieieiddrtr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644827": [
        {
            "ioc_value": "eneebgieeiieieiddrtu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644828": [
        {
            "ioc_value": "eneebgieeiieieiddrtx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644829": [
        {
            "ioc_value": "eniaebivaiebifaibef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644830": [
        {
            "ioc_value": "eniaebivaiebifaibeff.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644831": [
        {
            "ioc_value": "eniaebivaiebifaibefl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644832": [
        {
            "ioc_value": "eniaebivaiebifaibefr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644833": [
        {
            "ioc_value": "eniaebivaiebifaibefu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644834": [
        {
            "ioc_value": "eniaebivaiebifaibefx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644835": [
        {
            "ioc_value": "eofihsishihiursgu.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644836": [
        {
            "ioc_value": "eofihsishihiursgu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644837": [
        {
            "ioc_value": "eofihsishihiursgu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644838": [
        {
            "ioc_value": "eoguaonedonaodabobg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644839": [
        {
            "ioc_value": "eoguaonedonaodabobgf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644840": [
        {
            "ioc_value": "eoguaonedonaodabobgl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644841": [
        {
            "ioc_value": "eoguaonedonaodabobgr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644797": [
        {
            "ioc_value": "aiisiaueuefiuhiehgu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644798": [
        {
            "ioc_value": "aiisiaueuefiuhiehguf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644799": [
        {
            "ioc_value": "aiisiaueuefiuhiehgul.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644800": [
        {
            "ioc_value": "aiisiaueuefiuhiehgur.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644801": [
        {
            "ioc_value": "aiisiaueuefiuhiehguu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644802": [
        {
            "ioc_value": "aiisiaueuefiuhiehgux.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644803": [
        {
            "ioc_value": "auaeuiihaehifhahaud.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644804": [
        {
            "ioc_value": "auaeuiihaehifhahaudf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644805": [
        {
            "ioc_value": "auaeuiihaehifhahaudl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644806": [
        {
            "ioc_value": "auaeuiihaehifhahaudr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644807": [
        {
            "ioc_value": "auaeuiihaehifhahaudu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644808": [
        {
            "ioc_value": "auaeuiihaehifhahaudx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644809": [
        {
            "ioc_value": "eaiiakeiohoueghoaur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644810": [
        {
            "ioc_value": "eaiiakeiohoueghoaurf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644811": [
        {
            "ioc_value": "eaiiakeiohoueghoaurl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644812": [
        {
            "ioc_value": "eaiiakeiohoueghoaurr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644813": [
        {
            "ioc_value": "eaiiakeiohoueghoauru.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644814": [
        {
            "ioc_value": "eaiiakeiohoueghoaurx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644815": [
        {
            "ioc_value": "efiiuehdiahiuediaug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644816": [
        {
            "ioc_value": "efiiuehdiahiuediaugf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644817": [
        {
            "ioc_value": "efiiuehdiahiuediaugl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644818": [
        {
            "ioc_value": "efiiuehdiahiuediaugr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644819": [
        {
            "ioc_value": "efiiuehdiahiuediaugu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644773": [
        {
            "ioc_value": "aefaidihabevbabifba.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644774": [
        {
            "ioc_value": "aefaidihabevbabifbaf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644775": [
        {
            "ioc_value": "aefaidihabevbabifbal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644776": [
        {
            "ioc_value": "aefaidihabevbabifbar.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644777": [
        {
            "ioc_value": "aefaidihabevbabifbau.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644778": [
        {
            "ioc_value": "aefaidihabevbabifbax.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644779": [
        {
            "ioc_value": "afaounodouoeuueofua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644780": [
        {
            "ioc_value": "afaounodouoeuueofuaf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644781": [
        {
            "ioc_value": "afaounodouoeuueofual.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644782": [
        {
            "ioc_value": "afaounodouoeuueofuar.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644783": [
        {
            "ioc_value": "afaounodouoeuueofuau.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644784": [
        {
            "ioc_value": "afaounodouoeuueofuax.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644785": [
        {
            "ioc_value": "afeifieuuufufufuf.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644786": [
        {
            "ioc_value": "afeifieuuufufufuf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644787": [
        {
            "ioc_value": "afeifieuuufufufuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644788": [
        {
            "ioc_value": "aiehazegfageigfzgei.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644789": [
        {
            "ioc_value": "aiehazegfageigfzgeif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644790": [
        {
            "ioc_value": "aiehazegfageigfzgeil.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644791": [
        {
            "ioc_value": "aiehazegfageigfzgeir.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644792": [
        {
            "ioc_value": "aiehazegfageigfzgeiu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644793": [
        {
            "ioc_value": "aiehazegfageigfzgeix.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644794": [
        {
            "ioc_value": "aiiaiafrzrueuedur.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644795": [
        {
            "ioc_value": "aiiaiafrzrueuedur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644796": [
        {
            "ioc_value": "aiiaiafrzrueuedur.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644767": [
        {
            "ioc_value": "aaeiauebfaneifuaeif.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644768": [
        {
            "ioc_value": "aaeiauebfaneifuaeiff.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644769": [
        {
            "ioc_value": "aaeiauebfaneifuaeifl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644770": [
        {
            "ioc_value": "aaeiauebfaneifuaeifr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644771": [
        {
            "ioc_value": "aaeiauebfaneifuaeifu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644772": [
        {
            "ioc_value": "aaeiauebfaneifuaeifx.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-16 18:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644421": [
        {
            "ioc_value": "quark7.tundraflip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 18:56:54",
            "last_seen_utc": "2025-11-16 18:58:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644418": [
        {
            "ioc_value": "mientrung.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-16 18:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644419": [
        {
            "ioc_value": "perferctdmng.is",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-16 18:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644420": [
        {
            "ioc_value": "vmr3b.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-16 18:56:26",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644417": [
        {
            "ioc_value": "pakistanytrible.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.icedid",
            "malware_alias": "BokBot,IceID",
            "malware_printable": "IcedID",
            "first_seen_utc": "2025-11-16 18:56:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,icedid",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644414": [
        {
            "ioc_value": "geroees.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.icedid",
            "malware_alias": "BokBot,IceID",
            "malware_printable": "IcedID",
            "first_seen_utc": "2025-11-16 18:56:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,icedid",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644415": [
        {
            "ioc_value": "ghosternew.casa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.icedid",
            "malware_alias": "BokBot,IceID",
            "malware_printable": "IcedID",
            "first_seen_utc": "2025-11-16 18:56:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,icedid",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644416": [
        {
            "ioc_value": "kengurutrible.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.icedid",
            "malware_alias": "BokBot,IceID",
            "malware_printable": "IcedID",
            "first_seen_utc": "2025-11-16 18:56:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,icedid",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644410": [
        {
            "ioc_value": "propxx.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-16 18:55:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644411": [
        {
            "ioc_value": "v2.propxx.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-16 18:55:34",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644412": [
        {
            "ioc_value": "v3.propxx.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-16 18:55:34",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644409": [
        {
            "ioc_value": "oaskaks343.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-16 18:55:33",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644398": [
        {
            "ioc_value": "envio26.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-16 18:54:51",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644399": [
        {
            "ioc_value": "flysky07.giize.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-16 18:54:51",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644400": [
        {
            "ioc_value": "gatex.nahproject.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-16 18:54:51",
            "last_seen_utc": "2025-12-12 18:38:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644401": [
        {
            "ioc_value": "gatex.xoilaczzpzz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-16 18:54:51",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644402": [
        {
            "ioc_value": "v2.nahproject.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-16 18:54:51",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644403": [
        {
            "ioc_value": "ynvppcdzn.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-16 18:54:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1644384": [
        {
            "ioc_value": "ez.tundraflip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 18:47:37",
            "last_seen_utc": "2025-11-16 18:48:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644382": [
        {
            "ioc_value": "gq.tundraflip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 18:37:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644381": [
        {
            "ioc_value": "wn.v0xelspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 18:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644380": [
        {
            "ioc_value": "n8u.v0xelspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 18:17:15",
            "last_seen_utc": "2025-11-16 18:17:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644379": [
        {
            "ioc_value": "eyv.v0xelspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 18:07:34",
            "last_seen_utc": "2025-11-16 18:09:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644376": [
        {
            "ioc_value": "turn-couple.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-16 18:02:44",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-vj22wa1jdl",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644377": [
        {
            "ioc_value": "suprakini3-55449.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-16 18:02:44",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-q44nzssrht",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644373": [
        {
            "ioc_value": "equipment-spam.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-16 18:01:46",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-vzcf6a1kcl",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644372": [
        {
            "ioc_value": "sale-slim.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-16 18:01:45",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-wcn24sgl7w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644371": [
        {
            "ioc_value": "7j.v0xelspark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 17:57:10",
            "last_seen_utc": "2025-11-16 18:05:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644370": [
        {
            "ioc_value": "903.marbletug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 17:48:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644369": [
        {
            "ioc_value": "o4089.marbletug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 17:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644368": [
        {
            "ioc_value": "spindle7.marbletug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 17:36:51",
            "last_seen_utc": "2025-11-16 17:37:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644366": [
        {
            "ioc_value": "9p.marbletug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 17:27:34",
            "last_seen_utc": "2025-11-16 17:27:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644365": [
        {
            "ioc_value": "dorn.prismgrau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 17:17:46",
            "last_seen_utc": "2025-11-16 17:19:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644363": [
        {
            "ioc_value": "moos.prismgrau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 17:07:28",
            "last_seen_utc": "2025-11-16 17:07:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644362": [
        {
            "ioc_value": "weiss.prismgrau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 16:55:39",
            "last_seen_utc": "2025-11-16 17:03:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644361": [
        {
            "ioc_value": "gleis.cometlinde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 16:47:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644360": [
        {
            "ioc_value": "hof.cometlinde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 16:37:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644359": [
        {
            "ioc_value": "memorycompany.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-16 16:32:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c8bfbd74a6505005cda407676c829e388d69b1a4ac9fe2396528d932ed02a30/",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644358": [
        {
            "ioc_value": "truckshat.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-16 16:32:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/ed6b574467d2d80843baabe31962df453faae4cdc8003832d6f5d1be86f5a961/",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644357": [
        {
            "ioc_value": "stern.cometlinde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 16:27:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644355": [
        {
            "ioc_value": "mond.cometlinde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 16:16:56",
            "last_seen_utc": "2025-11-16 16:21:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644353": [
        {
            "ioc_value": "rpwhelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-11-16 16:16:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644354": [
        {
            "ioc_value": "rskpcare.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-11-16 16:16:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644350": [
        {
            "ioc_value": "cellardirection.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-16 16:13:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644351": [
        {
            "ioc_value": "blowfarm.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-16 16:13:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644349": [
        {
            "ioc_value": "stewstamp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-16 16:13:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644348": [
        {
            "ioc_value": "mscloud.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.aurastealer",
            "malware_alias": "AURA Stealer,AURASTEAL",
            "malware_printable": "Aura Stealer",
            "first_seen_utc": "2025-11-16 16:08:26",
            "last_seen_utc": "2025-11-22 10:06:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e48ec0bd3f1c4ce9e13b2a010bdbdd0eac0b33511458478127762fc02d6a1920/",
            "tags": "AURAStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644347": [
        {
            "ioc_value": "brise.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 16:07:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644339": [
        {
            "ioc_value": "glanz.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 15:57:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644337": [
        {
            "ioc_value": "arabianairlines.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-16 15:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5c7b2b9cd957eb1aafa23d0d43a708090eb3cc9fd20ac288485d74c84132d2e6/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644338": [
        {
            "ioc_value": "arabianairlanes.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-16 15:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5c7b2b9cd957eb1aafa23d0d43a708090eb3cc9fd20ac288485d74c84132d2e6/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644332": [
        {
            "ioc_value": "grat.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 15:52:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644330": [
        {
            "ioc_value": "ufer.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 15:45:59",
            "last_seen_utc": "2025-11-16 15:51:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644328": [
        {
            "ioc_value": "lylred.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-16 15:41:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1e46af3ca215225eb82217aed0028cb46ac97fb5631fac9a96a1aa68cd9ce9d1/",
            "tags": "ValkyrieStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644325": [
        {
            "ioc_value": "nacht.shadowfelsen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 15:37:39",
            "last_seen_utc": "2025-11-16 15:42:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644324": [
        {
            "ioc_value": "tru.momentsforme.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-16 15:32:30",
            "last_seen_utc": "2025-11-17 08:39:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644323": [
        {
            "ioc_value": "tal.cedarquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 15:31:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644322": [
        {
            "ioc_value": "bach.cedarquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 15:27:46",
            "last_seen_utc": "2025-11-16 15:29:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644320": [
        {
            "ioc_value": "wald.cedarquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 15:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644319": [
        {
            "ioc_value": "klee.ironwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 15:17:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644318": [
        {
            "ioc_value": "onfireg.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-16 15:16:54",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644313": [
        {
            "ioc_value": "perfecj.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-16 15:16:53",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644314": [
        {
            "ioc_value": "cyclohj.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-16 15:16:53",
            "last_seen_utc": "2025-11-21 23:37:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644315": [
        {
            "ioc_value": "sphecoi.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-16 15:16:53",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644316": [
        {
            "ioc_value": "binderz.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-16 15:16:53",
            "last_seen_utc": "2025-11-21 23:37:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644317": [
        {
            "ioc_value": "gnarlus.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-16 15:16:53",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644312": [
        {
            "ioc_value": "defender-temeerty.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 15:16:20",
            "last_seen_utc": "2025-11-20 14:42:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/903cdf6c4bef90c7bcdacd909cc7e9c2be528a4de785f0aa2c19c6a1e4166a53/",
            "tags": "dropped-by-amadey",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644310": [
        {
            "ioc_value": "telemetry-defender.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 15:14:02",
            "last_seen_utc": "2025-11-20 14:42:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/903cdf6c4bef90c7bcdacd909cc7e9c2be528a4de785f0aa2c19c6a1e4166a53/",
            "tags": "dropped-by-amadey",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644301": [
        {
            "ioc_value": "rauch.ironwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 15:07:06",
            "last_seen_utc": "2025-11-16 15:13:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644300": [
        {
            "ioc_value": "stern.glimmerstrand.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:58:16",
            "last_seen_utc": "2025-11-16 15:04:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644299": [
        {
            "ioc_value": "wolke.glimmerstrand.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:55:06",
            "last_seen_utc": "2025-11-16 14:55:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644294": [
        {
            "ioc_value": "fjord.glimmerstrand.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:46:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644293": [
        {
            "ioc_value": "kamm.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:43:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644291": [
        {
            "ioc_value": "wind.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:37:00",
            "last_seen_utc": "2025-11-16 14:37:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644290": [
        {
            "ioc_value": "nebel.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644289": [
        {
            "ioc_value": "eiche.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:25:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644288": [
        {
            "ioc_value": "falke.ravenkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:21:56",
            "last_seen_utc": "2025-11-16 14:23:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644287": [
        {
            "ioc_value": "hain.cobaltweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:17:45",
            "last_seen_utc": "2025-11-16 14:19:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644286": [
        {
            "ioc_value": "glut.cobaltweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:07:24",
            "last_seen_utc": "2025-11-16 14:12:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644285": [
        {
            "ioc_value": "licht.cobaltweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 14:01:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644284": [
        {
            "ioc_value": "adler.cobaltweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 13:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644283": [
        {
            "ioc_value": "ufer.quartzstollen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 13:47:39",
            "last_seen_utc": "2025-11-16 13:48:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644281": [
        {
            "ioc_value": "pfad.quartzstollen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 13:37:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644280": [
        {
            "ioc_value": "moos.quartzstollen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 13:33:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644279": [
        {
            "ioc_value": "sturm.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 13:26:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644278": [
        {
            "ioc_value": "klee.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 13:17:13",
            "last_seen_utc": "2025-11-16 13:18:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644277": [
        {
            "ioc_value": "tal.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 13:07:57",
            "last_seen_utc": "2025-11-16 13:13:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644276": [
        {
            "ioc_value": "bach.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 13:04:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644275": [
        {
            "ioc_value": "wolke.pinewacht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 12:58:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644271": [
        {
            "ioc_value": "ns4.coppper.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-16 12:48:51",
            "last_seen_utc": "2025-12-14 11:48:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644272": [
        {
            "ioc_value": "ns5.coppper.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-16 12:48:51",
            "last_seen_utc": "2025-12-14 11:48:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644270": [
        {
            "ioc_value": "ns3.coppper.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-16 12:48:50",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644269": [
        {
            "ioc_value": "ns2.coppper.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-16 12:48:48",
            "last_seen_utc": "2025-12-14 11:48:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644267": [
        {
            "ioc_value": "ns1.auv.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-16 12:48:46",
            "last_seen_utc": "2025-12-14 11:48:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644268": [
        {
            "ioc_value": "ns1.coppper.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-16 12:48:46",
            "last_seen_utc": "2025-12-14 11:48:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644266": [
        {
            "ioc_value": "i5013.kink-bellow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 12:47:48",
            "last_seen_utc": "2025-11-16 12:49:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644265": [
        {
            "ioc_value": "hjfng.wavermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 12:37:31",
            "last_seen_utc": "2025-11-16 12:39:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644264": [
        {
            "ioc_value": "byte.wavermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 12:27:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644263": [
        {
            "ioc_value": "quark.wavermint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 12:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644261": [
        {
            "ioc_value": "la-pan-adventures.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 12:09:27",
            "last_seen_utc": "2025-12-12 18:00:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644259": [
        {
            "ioc_value": "you4news.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 12:07:34",
            "last_seen_utc": "2025-12-12 18:01:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644258": [
        {
            "ioc_value": "dzqz.waver-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 12:07:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644256": [
        {
            "ioc_value": "jerkdolls.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 12:06:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644254": [
        {
            "ioc_value": "indianporngames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 12:05:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644252": [
        {
            "ioc_value": "lesbianstimulation.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 12:04:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644250": [
        {
            "ioc_value": "mindcontrolhentaigames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 12:03:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644249": [
        {
            "ioc_value": "useful-divine.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-16 12:03:13",
            "last_seen_utc": "2025-12-12 18:39:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-jlnrgsypft",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644248": [
        {
            "ioc_value": "8.tcp.us-cal-1.ngrok.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-11-16 12:02:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-g3tmysxpbt",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644245": [
        {
            "ioc_value": "ywfqi-138-199-7-236.a.free.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-16 12:02:06",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-lvl1cszpdx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1644243": [
        {
            "ioc_value": "derpixonpartygames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 12:01:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644242": [
        {
            "ioc_value": "levifrenchbulldogs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 12:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644239": [
        {
            "ioc_value": "slaveporngames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644238": [
        {
            "ioc_value": "4y7w.spiicepad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 11:58:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644236": [
        {
            "ioc_value": "valley-of-butterflies.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:57:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644234": [
        {
            "ioc_value": "grewaltech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:55:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644232": [
        {
            "ioc_value": "constructora-alpigroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:54:17",
            "last_seen_utc": "2025-11-17 20:37:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644230": [
        {
            "ioc_value": "melodysexgame.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:52:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644228": [
        {
            "ioc_value": "vrporngamesfree.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:48:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644227": [
        {
            "ioc_value": "oct0t.kink-bellow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 11:48:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644225": [
        {
            "ioc_value": "kingspark.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:45:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644223": [
        {
            "ioc_value": "wakfuck.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:42:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644221": [
        {
            "ioc_value": "refrigeracion.delmondexpress.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:41:14",
            "last_seen_utc": "2025-12-11 19:29:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644219": [
        {
            "ioc_value": "rainbow-terrace.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:39:38",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644218": [
        {
            "ioc_value": "z4cp.waver-mint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 11:38:00",
            "last_seen_utc": "2025-11-16 11:39:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644216": [
        {
            "ioc_value": "orosztorna.hu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:36:32",
            "last_seen_utc": "2025-12-13 15:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644214": [
        {
            "ioc_value": "xxxgames.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:34:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644211": [
        {
            "ioc_value": "furusato-shinshu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:33:12",
            "last_seen_utc": "2025-12-09 13:35:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644210": [
        {
            "ioc_value": "afinelineonline.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:31:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644208": [
        {
            "ioc_value": "pornplaygames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:28:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644205": [
        {
            "ioc_value": "aspirefoundationinc.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:26:47",
            "last_seen_utc": "2025-12-13 15:28:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644204": [
        {
            "ioc_value": "drift.h0bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 11:26:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644202": [
        {
            "ioc_value": "hostel.org.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:25:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644200": [
        {
            "ioc_value": "bestvrsexgames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:24:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644198": [
        {
            "ioc_value": "onlinemobileporngames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644197": [
        {
            "ioc_value": "nova.h0bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 11:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644194": [
        {
            "ioc_value": "avatarporngames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:15:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644192": [
        {
            "ioc_value": "alwedadsa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:13:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644190": [
        {
            "ioc_value": "gocontract.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:12:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644188": [
        {
            "ioc_value": "securiskbrokers.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:10:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644186": [
        {
            "ioc_value": "freeporngamesnocreditcard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:08:51",
            "last_seen_utc": "2025-11-16 11:21:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644184": [
        {
            "ioc_value": "bestandroidsexgames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:07:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644183": [
        {
            "ioc_value": "bud.h0bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 11:07:27",
            "last_seen_utc": "2025-11-16 11:08:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644181": [
        {
            "ioc_value": "agence-immobiliere-lyon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:06:32",
            "last_seen_utc": "2025-11-22 18:23:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644179": [
        {
            "ioc_value": "realvisionworld.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:05:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644177": [
        {
            "ioc_value": "greeneasylife.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:04:47",
            "last_seen_utc": "2025-12-11 19:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644175": [
        {
            "ioc_value": "cloudnax.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:03:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644166": [
        {
            "ioc_value": "biorganic.fit",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:01:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644164": [
        {
            "ioc_value": "nhentaienglish.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 11:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644159": [
        {
            "ioc_value": "reviewsites.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 10:59:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644157": [
        {
            "ioc_value": "pornsimulatorgames.cc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 10:58:32",
            "last_seen_utc": "2025-11-16 11:20:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644156": [
        {
            "ioc_value": "ciku.sn-0-rtling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 10:57:41",
            "last_seen_utc": "2025-11-16 10:57:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644154": [
        {
            "ioc_value": "pinoytoons.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 10:57:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644152": [
        {
            "ioc_value": "dev.tourtrack.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 10:55:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644150": [
        {
            "ioc_value": "thecompanyporngame.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 10:55:05",
            "last_seen_utc": "2025-11-16 11:19:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644148": [
        {
            "ioc_value": "milfinator.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 10:54:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644146": [
        {
            "ioc_value": "ssgroupgurgaon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 10:52:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644144": [
        {
            "ioc_value": "sparkle7.sn-0-rtling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 10:47:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644120": [
        {
            "ioc_value": "qg2j3.sn-0-rtling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 10:37:05",
            "last_seen_utc": "2025-11-16 10:42:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644107": [
        {
            "ioc_value": "xm9v.sn0rtling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 10:27:19",
            "last_seen_utc": "2025-11-16 10:29:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644106": [
        {
            "ioc_value": "phase6.sn0rtling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 10:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644105": [
        {
            "ioc_value": "sky.sn0rtling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 10:09:47",
            "last_seen_utc": "2025-11-16 10:10:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644104": [
        {
            "ioc_value": "k4.torque-bud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 10:04:05",
            "last_seen_utc": "2025-11-16 10:04:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644103": [
        {
            "ioc_value": "morrow.torque-bud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 09:57:46",
            "last_seen_utc": "2025-11-16 09:58:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644102": [
        {
            "ioc_value": "rift5.torque-bud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 09:45:27",
            "last_seen_utc": "2025-11-16 09:46:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644101": [
        {
            "ioc_value": "e9v.morrow-plug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 09:37:38",
            "last_seen_utc": "2025-11-16 09:38:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644100": [
        {
            "ioc_value": "04.morrow-plug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 09:26:19",
            "last_seen_utc": "2025-11-16 09:26:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644099": [
        {
            "ioc_value": "quark.morrow-plug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 09:17:34",
            "last_seen_utc": "2025-11-16 09:17:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644098": [
        {
            "ioc_value": "ykh0q.plixhaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 09:07:17",
            "last_seen_utc": "2025-11-16 09:09:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644097": [
        {
            "ioc_value": "plug.plixhaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 08:56:19",
            "last_seen_utc": "2025-11-16 08:57:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644095": [
        {
            "ioc_value": "trace.plixhaven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 08:48:05",
            "last_seen_utc": "2025-11-16 08:48:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644091": [
        {
            "ioc_value": "g5ph.morrowplug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 08:37:41",
            "last_seen_utc": "2025-11-16 08:38:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644090": [
        {
            "ioc_value": "1tqwn.morrowplug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 08:27:55",
            "last_seen_utc": "2025-11-16 08:28:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644089": [
        {
            "ioc_value": "shard.morrowplug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 08:17:32",
            "last_seen_utc": "2025-11-16 08:17:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644088": [
        {
            "ioc_value": "r4a.h-0-bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 08:07:47",
            "last_seen_utc": "2025-11-16 08:09:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644076": [
        {
            "ioc_value": "f9.h-0-bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 07:57:23",
            "last_seen_utc": "2025-11-16 07:58:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644075": [
        {
            "ioc_value": "cmj3.h-0-bblenet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 07:47:37",
            "last_seen_utc": "2025-11-16 07:48:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1644074": [
        {
            "ioc_value": "starwitchumbraculum.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-16 07:38:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://sandnet.abuse.ch/report/e39cf166b6108553e9a4ec390c2dede7/",
            "tags": "ClickFix,DeerStealer,dropped-by-hijackloader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1644073": [
        {
            "ioc_value": "8ey.jam-crest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 07:37:20",
            "last_seen_utc": "2025-11-16 07:38:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643052": [
        {
            "ioc_value": "worldspaceleague.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:56",
            "last_seen_utc": "2025-12-13 15:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643049": [
        {
            "ioc_value": "mihandyhub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643050": [
        {
            "ioc_value": "18win1.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643047": [
        {
            "ioc_value": "sejtravels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643048": [
        {
            "ioc_value": "pastbsite.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643044": [
        {
            "ioc_value": "pajero888slot.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643046": [
        {
            "ioc_value": "fablabsaigon.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643042": [
        {
            "ioc_value": "ilanjoseph.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:52",
            "last_seen_utc": "2025-12-08 19:00:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643043": [
        {
            "ioc_value": "diamondexportind.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643039": [
        {
            "ioc_value": "doublehomework.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:51",
            "last_seen_utc": "2025-12-11 19:29:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643041": [
        {
            "ioc_value": "tradersmoods.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643036": [
        {
            "ioc_value": "outattheinn.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:50",
            "last_seen_utc": "2025-12-08 19:00:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643037": [
        {
            "ioc_value": "gatesofolympus1000game.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643040": [
        {
            "ioc_value": "povporngames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643038": [
        {
            "ioc_value": "affi-onna.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:47",
            "last_seen_utc": "2025-11-18 18:02:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643033": [
        {
            "ioc_value": "zinchicken.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643035": [
        {
            "ioc_value": "daiwafoods.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643032": [
        {
            "ioc_value": "taixe.ilokafood.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:42",
            "last_seen_utc": "2025-12-13 15:29:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643030": [
        {
            "ioc_value": "rocketfireworks.yswhosting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:41",
            "last_seen_utc": "2025-12-13 15:29:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643031": [
        {
            "ioc_value": "we.teknospd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643029": [
        {
            "ioc_value": "elle.digipeeps.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643019": [
        {
            "ioc_value": "medinbusiness.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643018": [
        {
            "ioc_value": "varktechltd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643020": [
        {
            "ioc_value": "getshelters.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643021": [
        {
            "ioc_value": "ync-web.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643022": [
        {
            "ioc_value": "calismaiznibasvurusu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643023": [
        {
            "ioc_value": "sbpmr.fr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643024": [
        {
            "ioc_value": "oppaimon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643026": [
        {
            "ioc_value": "vodlia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:35",
            "last_seen_utc": "2025-12-11 19:29:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643027": [
        {
            "ioc_value": "frx.kindnessbrand.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-16 07:31:35",
            "last_seen_utc": "2025-11-17 08:39:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/309e492c17a1d7fd2def602262cf408ab5c04219f9d411438309764a365476a3/",
            "tags": "c2,vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1643053": [
        {
            "ioc_value": "yuririn1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:30",
            "last_seen_utc": "2025-11-18 18:04:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643054": [
        {
            "ioc_value": "loongviva.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:30",
            "last_seen_utc": "2025-12-11 19:29:18",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643056": [
        {
            "ioc_value": "sun-star-design.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643058": [
        {
            "ioc_value": "gamecoreadultgames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643057": [
        {
            "ioc_value": "kendo-lesson.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643059": [
        {
            "ioc_value": "buteam.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:28",
            "last_seen_utc": "2025-12-12 18:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643060": [
        {
            "ioc_value": "computersexgames.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643067": [
        {
            "ioc_value": "goupdate.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate,n-able remote tool",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643069": [
        {
            "ioc_value": "updatemicrosoftonline.arkelconstructor.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate,n-able remote tool",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1643070": [
        {
            "ioc_value": "chromeupdate.google.arkelconstructor.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-16 07:31:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate,n-able remote tool",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1644072": [
        {
            "ioc_value": "mjjt.jam-crest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 07:25:00",
            "last_seen_utc": "2025-11-16 07:26:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643998": [
        {
            "ioc_value": "uubb.jam-crest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 07:18:18",
            "last_seen_utc": "2025-11-16 07:19:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643843": [
        {
            "ioc_value": "baf8t.gr-1-tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 07:06:57",
            "last_seen_utc": "2025-11-16 07:07:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643737": [
        {
            "ioc_value": "8po.gr-1-tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 06:57:40",
            "last_seen_utc": "2025-11-16 06:57:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643736": [
        {
            "ioc_value": "0icby.gr-1-tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 06:47:48",
            "last_seen_utc": "2025-11-16 06:49:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643657": [
        {
            "ioc_value": "isv.cr1mpoint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 06:37:31",
            "last_seen_utc": "2025-11-16 06:38:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643568": [
        {
            "ioc_value": "glide.cr1mpoint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 06:27:39",
            "last_seen_utc": "2025-11-16 06:29:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643443": [
        {
            "ioc_value": "jam.cr1mpoint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 06:17:21",
            "last_seen_utc": "2025-11-16 06:19:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643342": [
        {
            "ioc_value": "628.torquebud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 06:07:29",
            "last_seen_utc": "2025-11-16 06:09:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643310": [
        {
            "ioc_value": "jvjduckdns233.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-16 06:01:42",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-cg7v8svpev",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1643311": [
        {
            "ioc_value": "arasik-20044.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-16 06:01:42",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-a95kgavkby",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1643309": [
        {
            "ioc_value": "christmas-historical.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-16 06:01:41",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251116-fdg27a1rhn",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1643166": [
        {
            "ioc_value": "8g8.torquebud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 05:52:02",
            "last_seen_utc": "2025-11-16 05:53:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643165": [
        {
            "ioc_value": "aka.torquebud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 05:47:52",
            "last_seen_utc": "2025-11-16 05:48:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643164": [
        {
            "ioc_value": "2xg.jamcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 05:38:05",
            "last_seen_utc": "2025-11-16 05:40:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643163": [
        {
            "ioc_value": "crest.jamcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 05:21:40",
            "last_seen_utc": "2025-11-16 05:22:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643162": [
        {
            "ioc_value": "6o.jamcrest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 05:17:27",
            "last_seen_utc": "2025-11-16 05:17:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643161": [
        {
            "ioc_value": "labs.gr1tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 05:04:37",
            "last_seen_utc": "2025-11-16 05:05:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643160": [
        {
            "ioc_value": "nova1.gr1tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 04:57:24",
            "last_seen_utc": "2025-11-16 04:57:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643159": [
        {
            "ioc_value": "6nn.gr1tbinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 04:47:08",
            "last_seen_utc": "2025-11-16 04:47:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643158": [
        {
            "ioc_value": "o6.skylintap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 04:39:22",
            "last_seen_utc": "2025-11-16 04:40:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643157": [
        {
            "ioc_value": "8e.skylintap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 04:28:05",
            "last_seen_utc": "2025-11-16 04:29:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643156": [
        {
            "ioc_value": "trail0.skylintap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 04:16:47",
            "last_seen_utc": "2025-11-16 04:17:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643154": [
        {
            "ioc_value": "vyf3.mirthcap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 04:08:03",
            "last_seen_utc": "2025-11-16 04:09:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643141": [
        {
            "ioc_value": "sparkle.mirthcap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 03:57:37",
            "last_seen_utc": "2025-11-16 03:59:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643140": [
        {
            "ioc_value": "15yf.mirthcap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 03:47:52",
            "last_seen_utc": "2025-11-16 03:48:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643139": [
        {
            "ioc_value": "tbck.quartz-leaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 03:37:34",
            "last_seen_utc": "2025-11-16 03:39:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643138": [
        {
            "ioc_value": "qnbtu.quartz-leaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 03:27:17",
            "last_seen_utc": "2025-11-16 03:29:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643137": [
        {
            "ioc_value": "gk.quartz-leaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 03:17:29",
            "last_seen_utc": "2025-11-16 03:17:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643136": [
        {
            "ioc_value": "core5.tweakmire.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 03:07:12",
            "last_seen_utc": "2025-11-16 03:07:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643135": [
        {
            "ioc_value": "2h.tweakmire.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 02:56:54",
            "last_seen_utc": "2025-11-16 02:57:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643134": [
        {
            "ioc_value": "rwz.tweakmire.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 02:48:09",
            "last_seen_utc": "2025-11-16 02:48:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643133": [
        {
            "ioc_value": "92.sp1remoss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 02:37:21",
            "last_seen_utc": "2025-11-16 02:37:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643132": [
        {
            "ioc_value": "drift.sp1remoss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 02:27:59",
            "last_seen_utc": "2025-11-16 02:28:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643131": [
        {
            "ioc_value": "p2bf9.sp1remoss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 02:17:40",
            "last_seen_utc": "2025-11-16 02:18:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643130": [
        {
            "ioc_value": "pulse.harpswitch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 02:07:24",
            "last_seen_utc": "2025-11-16 02:09:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643128": [
        {
            "ioc_value": "8zmw8.harpswitch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 01:58:39",
            "last_seen_utc": "2025-11-16 02:00:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643127": [
        {
            "ioc_value": "7fl06.harpswitch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 01:50:23",
            "last_seen_utc": "2025-11-16 01:51:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643126": [
        {
            "ioc_value": "nova2.quartzleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 01:44:11",
            "last_seen_utc": "2025-11-16 01:44:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643125": [
        {
            "ioc_value": "o3xz6.quartzleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 01:37:33",
            "last_seen_utc": "2025-11-16 01:39:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643104": [
        {
            "ioc_value": "w1.quartzleaf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 01:28:09",
            "last_seen_utc": "2025-11-16 01:30:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643103": [
        {
            "ioc_value": "0z3sa.tweak-mire.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 01:14:11",
            "last_seen_utc": "2025-11-16 06:11:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643102": [
        {
            "ioc_value": "gn.tweak-mire.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 01:07:59",
            "last_seen_utc": "2025-11-16 01:09:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643101": [
        {
            "ioc_value": "labs0.tweak-mire.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 00:57:35",
            "last_seen_utc": "2025-11-16 00:58:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643100": [
        {
            "ioc_value": "phase4.brim-hopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 00:47:49",
            "last_seen_utc": "2025-11-16 00:48:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643099": [
        {
            "ioc_value": "xcmt.brim-hopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 00:37:26",
            "last_seen_utc": "2025-11-16 00:38:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643098": [
        {
            "ioc_value": "glide.brim-hopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 00:27:40",
            "last_seen_utc": "2025-11-16 00:28:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643097": [
        {
            "ioc_value": "trail.ventrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 00:17:17",
            "last_seen_utc": "2025-11-16 00:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643096": [
        {
            "ioc_value": "dap.ventrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-16 00:07:30",
            "last_seen_utc": "2025-11-16 00:09:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643088": [
        {
            "ioc_value": "switch.ventrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 23:57:12",
            "last_seen_utc": "2025-11-15 23:58:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643087": [
        {
            "ioc_value": "hover.cl0udvex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 23:41:49",
            "last_seen_utc": "2025-11-15 23:42:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643086": [
        {
            "ioc_value": "blink.cl0udvex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 23:38:10",
            "last_seen_utc": "2025-11-15 23:39:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643085": [
        {
            "ioc_value": "forge4.cl0udvex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 23:27:51",
            "last_seen_utc": "2025-11-15 23:28:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643084": [
        {
            "ioc_value": "sparkle6.j1gglestone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 23:17:34",
            "last_seen_utc": "2025-11-15 23:18:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643080": [
        {
            "ioc_value": "cap.j1gglestone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 23:01:36",
            "last_seen_utc": "2025-11-15 23:02:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643074": [
        {
            "ioc_value": "wepe.j1gglestone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 22:57:25",
            "last_seen_utc": "2025-11-15 22:57:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643072": [
        {
            "ioc_value": "mesh.s0larbudge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 22:47:33",
            "last_seen_utc": "2025-11-15 22:47:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643071": [
        {
            "ioc_value": "phase0.s0larbudge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 22:37:16",
            "last_seen_utc": "2025-11-15 22:37:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643066": [
        {
            "ioc_value": "cwv2t.s0larbudge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 22:27:20",
            "last_seen_utc": "2025-11-15 22:28:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643065": [
        {
            "ioc_value": "nova.brimhopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 22:18:05",
            "last_seen_utc": "2025-11-15 22:18:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643062": [
        {
            "ioc_value": "ku3.brimhopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 22:07:41",
            "last_seen_utc": "2025-11-15 22:08:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643061": [
        {
            "ioc_value": "trail3.brimhopper.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 21:57:54",
            "last_seen_utc": "2025-11-15 21:59:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643055": [
        {
            "ioc_value": "hammer.granitekamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 21:47:34",
            "last_seen_utc": "2025-11-15 21:48:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643045": [
        {
            "ioc_value": "fluss.granitekamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 21:36:47",
            "last_seen_utc": "2025-11-15 21:37:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643034": [
        {
            "ioc_value": "zorn.granitekamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 21:27:24",
            "last_seen_utc": "2025-11-15 21:29:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643025": [
        {
            "ioc_value": "wolke.granitekamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 21:15:06",
            "last_seen_utc": "2025-11-15 21:16:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643017": [
        {
            "ioc_value": "stern.willowsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 21:03:37",
            "last_seen_utc": "2025-11-15 21:05:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643015": [
        {
            "ioc_value": "dune.willowsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 20:58:00",
            "last_seen_utc": "2025-11-15 20:58:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643013": [
        {
            "ioc_value": "brook.willowsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 20:42:13",
            "last_seen_utc": "2025-11-15 20:42:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643012": [
        {
            "ioc_value": "hafen.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 20:33:52",
            "last_seen_utc": "2025-11-15 20:34:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643011": [
        {
            "ioc_value": "bach.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 20:27:40",
            "last_seen_utc": "2025-11-15 20:28:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643010": [
        {
            "ioc_value": "wind.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 20:17:39",
            "last_seen_utc": "2025-11-15 20:18:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643009": [
        {
            "ioc_value": "moor.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 20:04:19",
            "last_seen_utc": "2025-11-15 20:04:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643006": [
        {
            "ioc_value": "fels.glaciertal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 19:57:35",
            "last_seen_utc": "2025-11-15 19:59:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643005": [
        {
            "ioc_value": "weide.ravenkloster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 19:48:19",
            "last_seen_utc": "2025-11-15 19:49:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643004": [
        {
            "ioc_value": "pfad.ravenkloster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 19:35:27",
            "last_seen_utc": "2025-11-15 19:35:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643003": [
        {
            "ioc_value": "turm.ravenkloster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 19:27:11",
            "last_seen_utc": "2025-11-15 19:29:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643002": [
        {
            "ioc_value": "adler.ravenkloster.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 19:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643001": [
        {
            "ioc_value": "stern.copperalpen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 19:06:49",
            "last_seen_utc": "2025-11-15 19:08:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1643000": [
        {
            "ioc_value": "bach.copperalpen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 18:57:32",
            "last_seen_utc": "2025-11-15 18:59:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642997": [
        {
            "ioc_value": "moor.copperalpen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 18:47:47",
            "last_seen_utc": "2025-11-15 18:49:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642992": [
        {
            "ioc_value": "glade.aurorafels.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 18:32:23",
            "last_seen_utc": "2025-11-15 18:37:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642991": [
        {
            "ioc_value": "wind.aurorafels.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 18:27:39",
            "last_seen_utc": "2025-11-15 18:29:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642990": [
        {
            "ioc_value": "grat.aurorafels.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 18:11:16",
            "last_seen_utc": "2025-11-15 18:13:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642988": [
        {
            "ioc_value": "birch.aurorafels.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 18:06:28",
            "last_seen_utc": "2025-11-15 18:07:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642987": [
        {
            "ioc_value": "ak1.xingxings2.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-15 18:03:43",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-qk8htswqdz",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1642985": [
        {
            "ioc_value": "newssystemcopilotdrivertresmil.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-15 18:01:48",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-vcvzzsaq5x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1642983": [
        {
            "ioc_value": "archive-medical.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-15 18:01:41",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-t71naaap8x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1642982": [
        {
            "ioc_value": "dorn.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 17:58:09",
            "last_seen_utc": "2025-11-15 17:58:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642981": [
        {
            "ioc_value": "falke.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 17:46:51",
            "last_seen_utc": "2025-11-15 17:48:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642980": [
        {
            "ioc_value": "rune.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 17:38:05",
            "last_seen_utc": "2025-11-15 17:39:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642777": [
        {
            "ioc_value": "wald.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 17:27:47",
            "last_seen_utc": "2025-11-15 17:30:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642544": [
        {
            "ioc_value": "nacht.midnightkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 17:17:31",
            "last_seen_utc": "2025-11-15 17:18:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642303": [
        {
            "ioc_value": "nebel.quartzfeder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 17:07:38",
            "last_seen_utc": "2025-11-15 17:09:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642118": [
        {
            "ioc_value": "kamm.quartzfeder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 16:57:20",
            "last_seen_utc": "2025-11-15 16:59:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642008": [
        {
            "ioc_value": "pfad.quartzfeder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 16:50:37",
            "last_seen_utc": "2025-11-15 16:50:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642007": [
        {
            "ioc_value": "korn.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 16:45:21",
            "last_seen_utc": "2025-11-15 16:46:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641599": [
        {
            "ioc_value": "bestmoneytree.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641639": [
        {
            "ioc_value": "chromiumgo.bond",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641642": [
        {
            "ioc_value": "chroeminstant.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641643": [
        {
            "ioc_value": "chromeupdate.download",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641600": [
        {
            "ioc_value": "conqueringtheland.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641601": [
        {
            "ioc_value": "beasteadyhand.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641602": [
        {
            "ioc_value": "urbannewsnow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641604": [
        {
            "ioc_value": "samleapp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641605": [
        {
            "ioc_value": "mondotalk.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641606": [
        {
            "ioc_value": "dnss.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641607": [
        {
            "ioc_value": "egao25.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641608": [
        {
            "ioc_value": "gameofbones.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641609": [
        {
            "ioc_value": "diamondmusicent.com.ng",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:08",
            "last_seen_utc": "2025-11-22 18:12:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641611": [
        {
            "ioc_value": "epfindiauan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641612": [
        {
            "ioc_value": "cargo.aquafex.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:07",
            "last_seen_utc": "2025-12-08 19:00:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641613": [
        {
            "ioc_value": "fuckrabbit.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641614": [
        {
            "ioc_value": "flavorista.branding-bar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:06",
            "last_seen_utc": "2025-11-15 21:08:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641615": [
        {
            "ioc_value": "tildotsignatures.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641617": [
        {
            "ioc_value": "cptchdm.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641618": [
        {
            "ioc_value": "sleepkids.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641619": [
        {
            "ioc_value": "archilabdesigns.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:03",
            "last_seen_utc": "2025-12-09 13:35:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641620": [
        {
            "ioc_value": "super.namatin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641621": [
        {
            "ioc_value": "pokkaloh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641596": [
        {
            "ioc_value": "delix.misecretaria.com.ar",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641598": [
        {
            "ioc_value": "xshby.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:01",
            "last_seen_utc": "2025-11-17 19:54:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641594": [
        {
            "ioc_value": "adultgamesps4.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:00",
            "last_seen_utc": "2025-11-16 11:11:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641595": [
        {
            "ioc_value": "tsutsuifujiko.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:43:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641592": [
        {
            "ioc_value": "abstractoffieldtrialofblackgram.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:42:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641590": [
        {
            "ioc_value": "simmexcontrol.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 16:39:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1642006": [
        {
            "ioc_value": "weald.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 16:38:08",
            "last_seen_utc": "2025-11-15 16:38:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642005": [
        {
            "ioc_value": "rune.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 16:32:24",
            "last_seen_utc": "2025-11-15 16:33:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642004": [
        {
            "ioc_value": "stern.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 16:28:12",
            "last_seen_utc": "2025-11-15 16:29:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642003": [
        {
            "ioc_value": "moor.emberhochland.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 16:22:00",
            "last_seen_utc": "2025-11-15 16:22:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642002": [
        {
            "ioc_value": "tau.stormlaterne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 16:16:48",
            "last_seen_utc": "2025-11-15 16:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1642001": [
        {
            "ioc_value": "bach.stormlaterne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 16:08:02",
            "last_seen_utc": "2025-11-15 16:08:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641994": [
        {
            "ioc_value": "glanz.stormlaterne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 15:57:45",
            "last_seen_utc": "2025-11-15 15:58:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641993": [
        {
            "ioc_value": "wolke.stormlaterne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 15:47:27",
            "last_seen_utc": "2025-11-15 15:48:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641851": [
        {
            "ioc_value": "rift.waveretch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 15:37:41",
            "last_seen_utc": "2025-11-15 15:39:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641692": [
        {
            "ioc_value": "ieqs.waveretch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 15:27:25",
            "last_seen_utc": "2025-11-15 15:28:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641691": [
        {
            "ioc_value": "quark.waveretch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 15:17:06",
            "last_seen_utc": "2025-11-15 15:17:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641690": [
        {
            "ioc_value": "spark8.kn-1-fecast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 15:07:19",
            "last_seen_utc": "2025-11-15 15:07:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641689": [
        {
            "ioc_value": "l8lp.kn-1-fecast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 15:03:09",
            "last_seen_utc": "2025-11-15 15:04:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641685": [
        {
            "ioc_value": "nd9eh.kn-1-fecast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 14:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641684": [
        {
            "ioc_value": "drs.patchvine.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 14:52:47",
            "last_seen_utc": "2025-11-15 14:53:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641683": [
        {
            "ioc_value": "vale.patchvine.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 14:48:06",
            "last_seen_utc": "2025-11-15 14:48:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641682": [
        {
            "ioc_value": "ewgmd.patchvine.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 14:36:39",
            "last_seen_utc": "2025-11-15 14:38:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641681": [
        {
            "ioc_value": "flux.drip-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 14:27:54",
            "last_seen_utc": "2025-11-15 14:33:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641680": [
        {
            "ioc_value": "ly.drip-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 14:17:37",
            "last_seen_utc": "2025-11-15 14:18:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641679": [
        {
            "ioc_value": "98.drip-anchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 14:07:20",
            "last_seen_utc": "2025-11-15 14:12:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641678": [
        {
            "ioc_value": "pulse.scramblehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 13:55:32",
            "last_seen_utc": "2025-11-15 13:56:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641677": [
        {
            "ioc_value": "rah.scramblehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 13:46:15",
            "last_seen_utc": "2025-11-15 13:47:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641676": [
        {
            "ioc_value": "ye.scramblehub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 13:38:30",
            "last_seen_utc": "2025-11-15 13:39:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641675": [
        {
            "ioc_value": "e0.meltquark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 13:33:12",
            "last_seen_utc": "2025-11-15 13:33:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641674": [
        {
            "ioc_value": "fvfsf.meltquark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 13:26:59",
            "last_seen_utc": "2025-11-15 13:28:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641673": [
        {
            "ioc_value": "q9p4.meltquark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 13:18:10",
            "last_seen_utc": "2025-11-15 13:18:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641672": [
        {
            "ioc_value": "he2.g-0-ss-lamp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 13:11:57",
            "last_seen_utc": "2025-11-15 13:13:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641671": [
        {
            "ioc_value": "ylr.g-0-ss-lamp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 13:07:46",
            "last_seen_utc": "2025-11-15 13:08:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641670": [
        {
            "ioc_value": "hover3.g-0-ss-lamp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 12:57:54",
            "last_seen_utc": "2025-11-15 12:58:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641666": [
        {
            "ioc_value": "www.acd852.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-15 12:49:25",
            "last_seen_utc": "2025-12-14 11:48:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1641665": [
        {
            "ioc_value": "kpow.kn1fecast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 12:47:37",
            "last_seen_utc": "2025-11-15 12:49:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641664": [
        {
            "ioc_value": "35k.kn1fecast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 12:37:13",
            "last_seen_utc": "2025-11-15 12:38:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641663": [
        {
            "ioc_value": "beacon1.kn1fecast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 12:27:27",
            "last_seen_utc": "2025-11-15 12:28:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641662": [
        {
            "ioc_value": "1ojva.g0sslamp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 12:17:04",
            "last_seen_utc": "2025-11-15 12:18:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641661": [
        {
            "ioc_value": "lj.g0sslamp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 12:07:22",
            "last_seen_utc": "2025-11-15 12:08:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641659": [
        {
            "ioc_value": "debt-apartment.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-15 12:03:04",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-lbcycaek2t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641658": [
        {
            "ioc_value": "center-lost.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-15 12:03:03",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-lvbjmayrhl",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641655": [
        {
            "ioc_value": "ezpz1.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-15 12:02:01",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-ndnhzazqdk",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641653": [
        {
            "ioc_value": "kamazec-35137.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-15 12:01:44",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-kbw6jsylhk",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641652": [
        {
            "ioc_value": "source-gtk.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-15 12:01:43",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-kdk63asqhy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641651": [
        {
            "ioc_value": "tuesday-gamma.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-15 12:01:42",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-kgztmaymbq",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641648": [
        {
            "ioc_value": "7uo.g0sslamp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 11:57:17",
            "last_seen_utc": "2025-11-15 11:58:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641647": [
        {
            "ioc_value": "yspm.orbitling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 11:47:00",
            "last_seen_utc": "2025-11-15 11:47:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641646": [
        {
            "ioc_value": "f3.orbitling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 11:37:42",
            "last_seen_utc": "2025-11-15 11:37:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641645": [
        {
            "ioc_value": "scramble3.orbitling.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 11:25:52",
            "last_seen_utc": "2025-11-15 11:27:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641644": [
        {
            "ioc_value": "trace.s1nkflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 11:17:38",
            "last_seen_utc": "2025-11-15 11:18:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641640": [
        {
            "ioc_value": "drip2.s1nkflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 11:07:20",
            "last_seen_utc": "2025-11-15 11:08:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641627": [
        {
            "ioc_value": "kans.s1nkflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 10:57:34",
            "last_seen_utc": "2025-11-15 10:58:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641626": [
        {
            "ioc_value": "obte.dripanchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 10:49:19",
            "last_seen_utc": "2025-11-15 10:52:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641625": [
        {
            "ioc_value": "ac3d0ee370745f757.awsglobalaccelerator.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-15 10:48:27",
            "last_seen_utc": "2025-12-14 11:48:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1641624": [
        {
            "ioc_value": "anchor.dripanchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 10:47:11",
            "last_seen_utc": "2025-11-15 10:48:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641623": [
        {
            "ioc_value": "q0ck.dripanchor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 10:36:53",
            "last_seen_utc": "2025-11-15 10:38:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641622": [
        {
            "ioc_value": "x2n.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 10:28:05",
            "last_seen_utc": "2025-11-15 10:29:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641616": [
        {
            "ioc_value": "vibe.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 10:15:46",
            "last_seen_utc": "2025-11-15 10:17:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641610": [
        {
            "ioc_value": "echo5.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 10:08:00",
            "last_seen_utc": "2025-11-15 10:09:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641603": [
        {
            "ioc_value": "pn.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 09:57:44",
            "last_seen_utc": "2025-11-15 09:58:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641597": [
        {
            "ioc_value": "tap6.bestffriend.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 09:47:26",
            "last_seen_utc": "2025-11-15 09:48:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641591": [
        {
            "ioc_value": "x2n.bestffriend.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 09:37:39",
            "last_seen_utc": "2025-11-15 09:38:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641589": [
        {
            "ioc_value": "echo5.bestffriend.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 09:27:21",
            "last_seen_utc": "2025-11-15 09:28:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641586": [
        {
            "ioc_value": "pn.bestffriend.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 09:20:51",
            "last_seen_utc": "2025-11-15 09:25:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641585": [
        {
            "ioc_value": "tap6.bestffriend.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 09:04:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641581": [
        {
            "ioc_value": "mvu5.idealbros.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 08:48:03",
            "last_seen_utc": "2025-11-15 08:49:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641577": [
        {
            "ioc_value": "jet.idealbros.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 08:37:45",
            "last_seen_utc": "2025-11-15 08:38:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641576": [
        {
            "ioc_value": "xsud.idealbros.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 08:33:06",
            "last_seen_utc": "2025-11-15 08:35:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641501": [
        {
            "ioc_value": "bindlib.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-15 06:45:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641454": [
        {
            "ioc_value": "ldasldalsd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 06:45:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641467": [
        {
            "ioc_value": "uploadclient32.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 06:45:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641460": [
        {
            "ioc_value": "sistemdetect.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 06:45:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641452": [
        {
            "ioc_value": "aasdtvcvchcvhhhhh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-15 06:45:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641439": [
        {
            "ioc_value": "drugtrh.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-15 06:45:39",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1641438": [
        {
            "ioc_value": "leathes.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-15 06:45:38",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1641567": [
        {
            "ioc_value": "agosto13.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-15 06:01:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-bjgamaaq8v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641565": [
        {
            "ioc_value": "eg-buzz.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-15 06:01:36",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251115-da8pmaznfv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641564": [
        {
            "ioc_value": "glanz.silvanbruch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 05:17:23",
            "last_seen_utc": "2025-11-15 05:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641563": [
        {
            "ioc_value": "tal.silvanbruch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 05:06:34",
            "last_seen_utc": "2025-11-15 05:08:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641551": [
        {
            "ioc_value": "zorn.silvanbruch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 04:57:19",
            "last_seen_utc": "2025-11-15 04:59:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641550": [
        {
            "ioc_value": "falke.silvanbruch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 04:54:09",
            "last_seen_utc": "2025-11-15 04:54:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641549": [
        {
            "ioc_value": "kreis.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 04:46:56",
            "last_seen_utc": "2025-11-15 04:48:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641548": [
        {
            "ioc_value": "tau.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 04:43:16",
            "last_seen_utc": "2025-11-15 04:44:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641547": [
        {
            "ioc_value": "ufer.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 04:37:04",
            "last_seen_utc": "2025-11-15 04:38:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641546": [
        {
            "ioc_value": "licht.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 04:28:12",
            "last_seen_utc": "2025-11-15 04:28:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641545": [
        {
            "ioc_value": "klee.tundragrund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 04:17:55",
            "last_seen_utc": "2025-11-15 04:19:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641544": [
        {
            "ioc_value": "weald.auroralinde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 04:07:44",
            "last_seen_utc": "2025-11-15 04:07:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641539": [
        {
            "ioc_value": "moos.auroralinde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 03:57:51",
            "last_seen_utc": "2025-11-15 03:58:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641538": [
        {
            "ioc_value": "gleis.auroralinde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 03:47:33",
            "last_seen_utc": "2025-11-15 03:48:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641537": [
        {
            "ioc_value": "hain.maplerand.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 03:37:15",
            "last_seen_utc": "2025-11-15 03:41:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641536": [
        {
            "ioc_value": "stern.maplerand.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 03:35:09",
            "last_seen_utc": "2025-11-15 03:36:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641535": [
        {
            "ioc_value": "kraut.maplerand.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 03:28:23",
            "last_seen_utc": "2025-11-15 03:29:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641534": [
        {
            "ioc_value": "fjord.maplerand.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 03:16:58",
            "last_seen_utc": "2025-11-15 03:18:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641533": [
        {
            "ioc_value": "nebel.zephyrquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 03:08:13",
            "last_seen_utc": "2025-11-15 03:09:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641529": [
        {
            "ioc_value": "bach.zephyrquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 02:57:55",
            "last_seen_utc": "2025-11-15 02:58:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641528": [
        {
            "ioc_value": "rune.zephyrquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 02:47:38",
            "last_seen_utc": "2025-11-15 02:47:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641527": [
        {
            "ioc_value": "farn.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 02:37:51",
            "last_seen_utc": "2025-11-15 02:38:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641526": [
        {
            "ioc_value": "fluss.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 02:21:27",
            "last_seen_utc": "2025-11-15 02:23:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641525": [
        {
            "ioc_value": "stein.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 02:17:17",
            "last_seen_utc": "2025-11-15 02:19:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641524": [
        {
            "ioc_value": "tau.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 02:08:30",
            "last_seen_utc": "2025-11-15 02:09:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641523": [
        {
            "ioc_value": "wald.quillgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 01:57:12",
            "last_seen_utc": "2025-11-15 01:58:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641522": [
        {
            "ioc_value": "dorn.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 01:46:54",
            "last_seen_utc": "2025-11-15 01:50:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641521": [
        {
            "ioc_value": "schild.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 01:35:12",
            "last_seen_utc": "2025-11-15 01:38:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641520": [
        {
            "ioc_value": "licht.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 01:31:57",
            "last_seen_utc": "2025-11-15 01:34:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641519": [
        {
            "ioc_value": "ufer.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 01:21:39",
            "last_seen_utc": "2025-11-15 01:23:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641518": [
        {
            "ioc_value": "pfad.onyxkamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 01:10:50",
            "last_seen_utc": "2025-11-15 01:13:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641517": [
        {
            "ioc_value": "adler.graniteweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 01:07:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641516": [
        {
            "ioc_value": "strom.graniteweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 00:57:49",
            "last_seen_utc": "2025-11-15 00:59:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641515": [
        {
            "ioc_value": "berg.graniteweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 00:47:31",
            "last_seen_utc": "2025-11-15 00:48:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641514": [
        {
            "ioc_value": "weald.saffronhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 00:35:06",
            "last_seen_utc": "2025-11-15 00:36:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641513": [
        {
            "ioc_value": "glut.saffronhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 00:27:22",
            "last_seen_utc": "2025-11-15 00:27:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641512": [
        {
            "ioc_value": "klee.saffronhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 00:16:58",
            "last_seen_utc": "2025-11-15 00:18:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641511": [
        {
            "ioc_value": "moor.saffronhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-15 00:08:13",
            "last_seen_utc": "2025-11-15 00:10:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641505": [
        {
            "ioc_value": "funke.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 23:57:54",
            "last_seen_utc": "2025-11-14 23:59:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641500": [
        {
            "ioc_value": "nebel.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 23:41:30",
            "last_seen_utc": "2025-11-14 23:44:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641499": [
        {
            "ioc_value": "grat.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 23:35:48",
            "last_seen_utc": "2025-11-14 23:39:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641498": [
        {
            "ioc_value": "bach.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 23:30:18",
            "last_seen_utc": "2025-11-14 23:35:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641497": [
        {
            "ioc_value": "wolke.thunderkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 23:25:32",
            "last_seen_utc": "2025-11-14 23:26:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641496": [
        {
            "ioc_value": "rinde.willowgrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 23:17:28",
            "last_seen_utc": "2025-11-14 23:17:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1641495": [
        {
            "ioc_value": "falke.willowgrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 23:05:22",
            "last_seen_utc": "2025-11-14 23:06:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641471": [
        {
            "ioc_value": "capstone.chandlercook.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 23:01:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.41.169.247+capstone.chandlercook.net",
            "tags": "AS396982,C2,censys,GOOGLE-CLOUD-PLATFORM,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1641468": [
        {
            "ioc_value": "moor.willowgrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 22:57:07",
            "last_seen_utc": "2025-11-14 22:58:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641465": [
        {
            "ioc_value": "weiss.solarpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 22:48:18",
            "last_seen_utc": "2025-11-14 22:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641464": [
        {
            "ioc_value": "kamm.solarpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 22:36:59",
            "last_seen_utc": "2025-11-14 22:37:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641463": [
        {
            "ioc_value": "eis.solarpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 22:28:45",
            "last_seen_utc": "2025-11-14 22:30:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641462": [
        {
            "ioc_value": "licht.obsidianufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 22:20:59",
            "last_seen_utc": "2025-11-14 22:22:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641461": [
        {
            "ioc_value": "pfote.obsidianufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 22:12:44",
            "last_seen_utc": "2025-11-14 22:19:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641459": [
        {
            "ioc_value": "sturm.obsidianufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 22:07:33",
            "last_seen_utc": "2025-11-14 22:09:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641457": [
        {
            "ioc_value": "weald.cobaltquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 21:50:39",
            "last_seen_utc": "2025-11-14 21:52:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641456": [
        {
            "ioc_value": "tal.cobaltquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 21:47:29",
            "last_seen_utc": "2025-11-14 21:48:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641451": [
        {
            "ioc_value": "bach.cobaltquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 21:37:12",
            "last_seen_utc": "2025-11-14 21:37:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641450": [
        {
            "ioc_value": "gleis.neonbuche.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 21:25:24",
            "last_seen_utc": "2025-11-14 21:25:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641449": [
        {
            "ioc_value": "korn.neonbuche.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 21:11:01",
            "last_seen_utc": "2025-11-14 21:12:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641446": [
        {
            "ioc_value": "rauch.neonbuche.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 21:06:50",
            "last_seen_utc": "2025-11-14 21:08:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641443": [
        {
            "ioc_value": "eiche.wolkenhof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 20:58:05",
            "last_seen_utc": "2025-11-14 20:59:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641441": [
        {
            "ioc_value": "justamap.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-14 20:56:53",
            "last_seen_utc": "2025-12-14 11:48:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1641437": [
        {
            "ioc_value": "stern.wolkenhof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 20:47:42",
            "last_seen_utc": "2025-11-14 20:49:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641436": [
        {
            "ioc_value": "fjord.wolkenhof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 20:37:54",
            "last_seen_utc": "2025-11-14 20:39:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641434": [
        {
            "ioc_value": "glanz.silverbirke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 20:24:32",
            "last_seen_utc": "2025-11-14 20:26:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641432": [
        {
            "ioc_value": "wolke.silverbirke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 20:17:19",
            "last_seen_utc": "2025-11-14 20:17:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641431": [
        {
            "ioc_value": "dorn.silverbirke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 20:05:30",
            "last_seen_utc": "2025-11-14 20:05:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641412": [
        {
            "ioc_value": "klee.ironweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 19:58:08",
            "last_seen_utc": "2025-11-14 19:59:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641411": [
        {
            "ioc_value": "schirm.ironweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 19:46:19",
            "last_seen_utc": "2025-11-14 19:46:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641410": [
        {
            "ioc_value": "tau.ironweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 19:38:00",
            "last_seen_utc": "2025-11-14 19:39:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641409": [
        {
            "ioc_value": "hain.ravensteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 19:26:42",
            "last_seen_utc": "2025-11-14 19:28:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641408": [
        {
            "ioc_value": "glut.ravensteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 19:17:56",
            "last_seen_utc": "2025-11-14 19:23:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641407": [
        {
            "ioc_value": "ufer.ravensteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 19:07:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641404": [
        {
            "ioc_value": "dampf.flintquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 18:53:17",
            "last_seen_utc": "2025-11-14 19:00:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641403": [
        {
            "ioc_value": "rune.flintquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 18:47:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641401": [
        {
            "ioc_value": "moos.flintquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 18:38:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641400": [
        {
            "ioc_value": "ctr.hazebinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 18:33:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641399": [
        {
            "ioc_value": "nova8.hazebinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 18:27:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641398": [
        {
            "ioc_value": "byte8.hazebinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 18:16:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641396": [
        {
            "ioc_value": "enivomarzo12.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-14 18:01:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251114-wfjxka1jaj",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641395": [
        {
            "ioc_value": "fdsgofgjoefjiooe.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-14 18:01:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251114-sxpmlasrcs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641394": [
        {
            "ioc_value": "core.saffronjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 18:01:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641391": [
        {
            "ioc_value": "1665s.saffronjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 17:53:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641390": [
        {
            "ioc_value": "g0pv.saffronjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 17:47:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641389": [
        {
            "ioc_value": "knot.st1rlingpad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 17:37:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641388": [
        {
            "ioc_value": "11v.st1rlingpad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 17:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641387": [
        {
            "ioc_value": "drop7.st1rlingpad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 17:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641386": [
        {
            "ioc_value": "2v1.lumentwist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 17:07:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641383": [
        {
            "ioc_value": "5z.lumentwist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 16:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641380": [
        {
            "ioc_value": "mail.outlook365.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-14 16:53:17",
            "last_seen_utc": "2025-12-14 11:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1641379": [
        {
            "ioc_value": "5lw6.lumentwist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 16:48:12",
            "last_seen_utc": "2025-11-14 16:55:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641362": [
        {
            "ioc_value": "getinstallclient32.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 16:41:26",
            "last_seen_utc": "2025-11-21 20:42:10",
            "confidence_level": 100,
            "reference": "https://x.com/1nt3l_hunt/status/1989359100300505154?s=20",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "bouhdyd"
        }
    ],
    "1641363": [
        {
            "ioc_value": "verificationsbycapcha.center",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 16:41:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/1nt3l_hunt/status/1989359100300505154?s=20",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "bouhdyd"
        }
    ],
    "1641373": [
        {
            "ioc_value": "magicupdate.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.aurastealer",
            "malware_alias": "AURA Stealer,AURASTEAL",
            "malware_printable": "Aura Stealer",
            "first_seen_utc": "2025-11-14 16:41:24",
            "last_seen_utc": "2025-11-22 10:06:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1322b99e88023bc20d99ba1186518055872ab3322667d2befdae4a3b5379cc9d/",
            "tags": "AuraStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1641374": [
        {
            "ioc_value": "searchagent.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.aurastealer",
            "malware_alias": "AURA Stealer,AURASTEAL",
            "malware_printable": "Aura Stealer",
            "first_seen_utc": "2025-11-14 16:41:23",
            "last_seen_utc": "2025-11-22 10:06:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1322b99e88023bc20d99ba1186518055872ab3322667d2befdae4a3b5379cc9d/",
            "tags": "AuraStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1641377": [
        {
            "ioc_value": "7u.viberspan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 16:37:53",
            "last_seen_utc": "2025-11-14 16:46:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641375": [
        {
            "ioc_value": "module7.viberspan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 16:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641372": [
        {
            "ioc_value": "1wd.viberspan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 16:17:51",
            "last_seen_utc": "2025-11-14 16:19:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641370": [
        {
            "ioc_value": "28xr3.clipmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 16:03:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641364": [
        {
            "ioc_value": "hrtf3.clipmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 15:57:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641361": [
        {
            "ioc_value": "vpcp.clipmorrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 15:43:24",
            "last_seen_utc": "2025-11-14 15:44:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641358": [
        {
            "ioc_value": "xxx.vrolijkecreaties.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-14 15:42:52",
            "last_seen_utc": "2025-11-20 18:49:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1641359": [
        {
            "ioc_value": "xxx.hotelsinnewjerseyatlanticcity.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-14 15:42:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1641355": [
        {
            "ioc_value": "quark.pr0wldrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 15:37:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641354": [
        {
            "ioc_value": "yf.pr0wldrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 15:28:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641353": [
        {
            "ioc_value": "u3z.pr0wldrop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 15:18:09",
            "last_seen_utc": "2025-11-14 15:23:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641352": [
        {
            "ioc_value": "anchor.z1ncspike.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 15:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641351": [
        {
            "ioc_value": "o5.z1ncspike.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 14:57:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641349": [
        {
            "ioc_value": "qvm.z1ncspike.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 14:47:43",
            "last_seen_utc": "2025-11-14 14:53:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641348": [
        {
            "ioc_value": "px.gr1tmodule.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 14:32:20",
            "last_seen_utc": "2025-11-14 14:44:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641347": [
        {
            "ioc_value": "siq.gr1tmodule.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 14:27:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641346": [
        {
            "ioc_value": "tla.gr1tmodule.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 14:17:18",
            "last_seen_utc": "2025-11-14 14:25:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641340": [
        {
            "ioc_value": "srimedhasoft.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-14 14:16:28",
            "last_seen_utc": "2025-11-14 14:12:20",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115548456241734130",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1641338": [
        {
            "ioc_value": "053.knotberry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 14:07:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641337": [
        {
            "ioc_value": "qg3q2.knotberry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 13:57:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641332": [
        {
            "ioc_value": "kruipro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-14 13:47:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/40ec2cb9-7642-4258-be59-de0c24af63ab",
            "tags": "Stealit,StealitStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1641333": [
        {
            "ioc_value": "root.kruipro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-14 13:47:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/40ec2cb9-7642-4258-be59-de0c24af63ab",
            "tags": "Stealit,StealitStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1641336": [
        {
            "ioc_value": "sdh3a.knotberry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 13:46:56",
            "last_seen_utc": "2025-11-14 13:56:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641335": [
        {
            "ioc_value": "orbit.odd-kraken.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 13:34:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641334": [
        {
            "ioc_value": "dock.odd-kraken.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 13:27:52",
            "last_seen_utc": "2025-11-14 13:33:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641331": [
        {
            "ioc_value": "vibesyncvr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-14 13:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Stealit,StealitStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1641330": [
        {
            "ioc_value": "01efv.odd-kraken.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 13:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641329": [
        {
            "ioc_value": "qkund.gleamspan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 13:06:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641323": [
        {
            "ioc_value": "mockerl.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-14 13:02:53",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641324": [
        {
            "ioc_value": "shutsra.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-14 13:02:53",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641325": [
        {
            "ioc_value": "poochse.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-14 13:02:53",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641326": [
        {
            "ioc_value": "oleaceg.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-14 13:02:53",
            "last_seen_utc": "2025-11-25 15:31:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641327": [
        {
            "ioc_value": "notionz.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-14 13:02:53",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641328": [
        {
            "ioc_value": "evasivr.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-14 13:02:53",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641322": [
        {
            "ioc_value": "ml.gleamspan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 13:01:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641320": [
        {
            "ioc_value": "amigor.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-14 12:59:34",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641321": [
        {
            "ioc_value": "audioux.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-14 12:59:34",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641317": [
        {
            "ioc_value": "e8.gleamspan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 12:55:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641316": [
        {
            "ioc_value": "flux0.quant-melt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 12:47:25",
            "last_seen_utc": "2025-11-14 12:54:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641315": [
        {
            "ioc_value": "blink.quant-melt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 12:40:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641314": [
        {
            "ioc_value": "q40eo.quant-melt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 12:32:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641307": [
        {
            "ioc_value": "trail.flintzoo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 12:28:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641306": [
        {
            "ioc_value": "echo.flintzoo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 12:18:20",
            "last_seen_utc": "2025-11-14 12:19:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641304": [
        {
            "ioc_value": "1b8.flintzoo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 12:04:54",
            "last_seen_utc": "2025-11-14 12:13:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641290": [
        {
            "ioc_value": "omgtelecom.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-14 12:03:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "KongTuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641248": [
        {
            "ioc_value": "defupdater.dll",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "apk.alien",
            "malware_alias": "AlienBot",
            "malware_printable": "Alien",
            "first_seen_utc": "2025-11-14 12:03:23",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/vxunderground/",
            "tags": "c2,ClearFake,domain",
            "anonymous": "0",
            "reporter": "Harshk08"
        }
    ],
    "1641302": [
        {
            "ioc_value": "www.smssending.ns1.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.mimikatz",
            "malware_alias": null,
            "malware_printable": "MimiKatz",
            "first_seen_utc": "2025-11-14 12:02:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.62.57.65+www.smssending.ns1.name",
            "tags": "AS62370,C2,censys,hacktool,Mimikatz,open-dir,SNEL",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641299": [
        {
            "ioc_value": "mr24251.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-14 12:01:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251114-h13zaaspgp",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641297": [
        {
            "ioc_value": "confrewdsfgfs.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-14 12:01:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251114-l8at9aymbw",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641295": [
        {
            "ioc_value": "cms0c.st-0-bepress.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 11:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641294": [
        {
            "ioc_value": "nova.st-0-bepress.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 11:47:54",
            "last_seen_utc": "2025-11-14 11:49:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641293": [
        {
            "ioc_value": "bkp.st-0-bepress.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 11:37:30",
            "last_seen_utc": "2025-11-14 11:43:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641292": [
        {
            "ioc_value": "sb.v0xelmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 11:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641289": [
        {
            "ioc_value": "uuf.v0xelmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 11:17:28",
            "last_seen_utc": "2025-11-14 11:17:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641288": [
        {
            "ioc_value": "yw7.v0xelmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 11:06:06",
            "last_seen_utc": "2025-11-14 11:13:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641270": [
        {
            "ioc_value": "www.marmosfinancial.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 11:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/44.244.194.132+www.marmosfinancial.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1641263": [
        {
            "ioc_value": "kna.bl1nkswitch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 10:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641262": [
        {
            "ioc_value": "ceshioa.us.kg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-14 10:53:34",
            "last_seen_utc": "2025-12-14 11:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1641261": [
        {
            "ioc_value": "lmn.bl1nkswitch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 10:42:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641260": [
        {
            "ioc_value": "z5.bl1nkswitch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 10:37:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641259": [
        {
            "ioc_value": "vale.quantmelt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 10:27:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641258": [
        {
            "ioc_value": "6m.quantmelt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 10:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641256": [
        {
            "ioc_value": "u6.quantmelt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 10:06:44",
            "last_seen_utc": "2025-11-14 10:07:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641254": [
        {
            "ioc_value": "wave.flint-zoo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 09:58:29",
            "last_seen_utc": "2025-11-14 10:04:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641252": [
        {
            "ioc_value": "ottobattleskaldthrenody.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.donut_injector",
            "malware_alias": "Donut",
            "malware_printable": "donut_injector",
            "first_seen_utc": "2025-11-14 09:50:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251114-ccgs9azkbp",
            "tags": "c2,domain,donut,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641251": [
        {
            "ioc_value": "whlox.flint-zoo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 09:47:10",
            "last_seen_utc": "2025-11-14 09:48:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641250": [
        {
            "ioc_value": "flux.flint-zoo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 09:36:21",
            "last_seen_utc": "2025-11-14 09:38:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641249": [
        {
            "ioc_value": "w1558.ma-shrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 09:32:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641247": [
        {
            "ioc_value": "2n62w.ma-shrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 09:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641246": [
        {
            "ioc_value": "sparkle9.ma-shrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 09:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641245": [
        {
            "ioc_value": "ploykalofomarixcley.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-14 09:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.208.80",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641244": [
        {
            "ioc_value": "maukateciklodasresm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-14 09:14:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.164",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641243": [
        {
            "ioc_value": "jarcovilokaserdrinok.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-14 09:11:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.166",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641241": [
        {
            "ioc_value": "b53.syrupdock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 09:08:14",
            "last_seen_utc": "2025-11-14 09:09:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641236": [
        {
            "ioc_value": "pulse8.syrupdock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 08:57:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641235": [
        {
            "ioc_value": "byte.syrupdock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 08:47:39",
            "last_seen_utc": "2025-11-14 08:53:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641233": [
        {
            "ioc_value": "6zbr.protohush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 08:35:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641231": [
        {
            "ioc_value": "sd.r.banana.vu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-14 08:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1641232": [
        {
            "ioc_value": "ug.andreeamunteanu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-14 08:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1641227": [
        {
            "ioc_value": "vdj3j.protohush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 08:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641218": [
        {
            "ioc_value": "0315.protohush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 08:23:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641217": [
        {
            "ioc_value": "0op3s.oddkraken.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 08:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641201": [
        {
            "ioc_value": "shanghai.googledns.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "apk.ahmyth",
            "malware_alias": null,
            "malware_printable": "AhMyth",
            "first_seen_utc": "2025-11-14 08:11:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/vxunderground/",
            "tags": null,
            "anonymous": "0",
            "reporter": "Harshk08"
        }
    ],
    "1641216": [
        {
            "ioc_value": "shift.oddkraken.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 08:08:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641202": [
        {
            "ioc_value": "3z1s.oddkraken.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 07:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641200": [
        {
            "ioc_value": "zoo.st0bepress.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 07:49:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641198": [
        {
            "ioc_value": "www.dwf1579.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.pumabot",
            "malware_alias": null,
            "malware_printable": "PumaBot",
            "first_seen_utc": "2025-11-14 07:48:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/857d463c693b5c80236eff885408ce3ddbfc45f94e9a5022fe67ebbc090ba151/",
            "tags": "PumaBot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1641195": [
        {
            "ioc_value": "ter.vrolijkecreaties.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-14 07:46:37",
            "last_seen_utc": "2025-11-20 18:49:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1641196": [
        {
            "ioc_value": "ter.hotelsinjacksonvillefl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-14 07:46:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1641192": [
        {
            "ioc_value": "gleam.st0bepress.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 07:39:21",
            "last_seen_utc": "2025-11-14 07:47:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1641000": [
        {
            "ioc_value": "nakaizu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-14 07:38:41",
            "last_seen_utc": "2025-11-14 06:15:44",
            "confidence_level": 100,
            "reference": "",
            "tags": "KongTuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641002": [
        {
            "ioc_value": "fcontrols.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641008": [
        {
            "ioc_value": "dcontrols.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641009": [
        {
            "ioc_value": "infernolo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641012": [
        {
            "ioc_value": "hcontrol.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641018": [
        {
            "ioc_value": "3accdomain3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update,xHamster",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641060": [
        {
            "ioc_value": "asdtvcvchcvhhhhh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641061": [
        {
            "ioc_value": "xxclglglglklgkxlc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641064": [
        {
            "ioc_value": "appasdmdamsdmasd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641067": [
        {
            "ioc_value": "ototaikfffkf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641072": [
        {
            "ioc_value": "updateday.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:38:26",
            "last_seen_utc": "2025-11-22 21:21:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "apk,Fake Software",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1641088": [
        {
            "ioc_value": "bal-rewards.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-14 07:38:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "dropper,miner,persistence,rat,worm",
            "anonymous": "0",
            "reporter": "XiAnzheng"
        }
    ],
    "1640998": [
        {
            "ioc_value": "cpanel.fjfrey.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-14 07:36:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115544431524627272",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1640987": [
        {
            "ioc_value": "puffyclaw2008.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-14 07:36:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/b716fa3dbbfd5873cd5d2cd1a2f26310ed10963781cc47e2aa0b062dc85275ef/",
            "tags": "MaskGramStealer,SvitStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1640944": [
        {
            "ioc_value": "catlover-pawpaw504.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-14 07:36:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/b716fa3dbbfd5873cd5d2cd1a2f26310ed10963781cc47e2aa0b062dc85275ef/relations",
            "tags": "SvitStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1640945": [
        {
            "ioc_value": "easternwhiskerholdings.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-14 07:36:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/b716fa3dbbfd5873cd5d2cd1a2f26310ed10963781cc47e2aa0b062dc85275ef/relations",
            "tags": "SvitStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1641191": [
        {
            "ioc_value": "hover.st0bepress.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 07:27:36",
            "last_seen_utc": "2025-11-14 07:33:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641190": [
        {
            "ioc_value": "trust007-44490.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-11-14 07:23:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,pulsar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641182": [
        {
            "ioc_value": "0iz7q.mashrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 07:17:45",
            "last_seen_utc": "2025-11-16 06:10:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1641181": [
        {
            "ioc_value": "lnk1man.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-14 07:14:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641178": [
        {
            "ioc_value": "hx.mashrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 07:07:30",
            "last_seen_utc": "2025-11-14 07:14:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641177": [
        {
            "ioc_value": "anchor.mashrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 06:57:13",
            "last_seen_utc": "2025-11-14 06:57:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641176": [
        {
            "ioc_value": "gleam.obsidianpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 06:47:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641175": [
        {
            "ioc_value": "birch.obsidianpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 06:38:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641174": [
        {
            "ioc_value": "eis.obsidianpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 06:28:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641173": [
        {
            "ioc_value": "glanz.ravenquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 06:18:48",
            "last_seen_utc": "2025-11-14 06:23:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641169": [
        {
            "ioc_value": "rcdoncu1906.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-14 06:15:04",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641170": [
        {
            "ioc_value": "remcos26.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-14 06:15:04",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641166": [
        {
            "ioc_value": "cybersecuritefrance.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-14 06:14:41",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641167": [
        {
            "ioc_value": "quantaservices.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-14 06:14:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641168": [
        {
            "ioc_value": "vr3b.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-14 06:14:41",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641160": [
        {
            "ioc_value": "closeconection.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-14 06:13:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641161": [
        {
            "ioc_value": "effects-animation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-14 06:13:25",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641162": [
        {
            "ioc_value": "rafaborre27.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-14 06:13:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641163": [
        {
            "ioc_value": "v2.otisgrand.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-14 06:13:25",
            "last_seen_utc": "2025-12-12 18:38:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641164": [
        {
            "ioc_value": "v3.otisgrand.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-14 06:13:25",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641156": [
        {
            "ioc_value": "xerrrload08.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-11-14 06:12:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cryptbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641152": [
        {
            "ioc_value": "brentwood-operatic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-14 06:12:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641153": [
        {
            "ioc_value": "gatex.brentwood-operatic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-14 06:12:00",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641154": [
        {
            "ioc_value": "gatex.otisgrand.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-14 06:12:00",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641155": [
        {
            "ioc_value": "shop.atrishop.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-14 06:12:00",
            "last_seen_utc": "2025-12-12 18:38:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1641142": [
        {
            "ioc_value": "ufer.ravenquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 06:07:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641139": [
        {
            "ioc_value": "msi25.dynnamn.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-14 06:01:36",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251114-drzhaatqhs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1641138": [
        {
            "ioc_value": "klee.ravenquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 05:57:49",
            "last_seen_utc": "2025-11-14 05:59:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641137": [
        {
            "ioc_value": "weiss.cedarberg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 05:47:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641136": [
        {
            "ioc_value": "pfote.cedarberg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 05:37:32",
            "last_seen_utc": "2025-11-14 05:38:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641135": [
        {
            "ioc_value": "sturm.cedarberg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 05:27:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641134": [
        {
            "ioc_value": "krone.frostweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 05:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641133": [
        {
            "ioc_value": "tal.frostweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 05:07:15",
            "last_seen_utc": "2025-11-14 05:13:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641132": [
        {
            "ioc_value": "licht.frostweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 04:56:00",
            "last_seen_utc": "2025-11-14 04:57:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641131": [
        {
            "ioc_value": "rune.auricfluss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 04:49:03",
            "last_seen_utc": "2025-11-14 04:53:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641130": [
        {
            "ioc_value": "wind.auricfluss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 04:38:21",
            "last_seen_utc": "2025-11-14 04:38:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641129": [
        {
            "ioc_value": "hafen.auricfluss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 04:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641128": [
        {
            "ioc_value": "eiche.neonkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 04:17:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641127": [
        {
            "ioc_value": "moor.neonkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 04:07:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641118": [
        {
            "ioc_value": "gleis.neonkiefer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 03:57:16",
            "last_seen_utc": "2025-11-14 04:04:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641117": [
        {
            "ioc_value": "fels.cobaltspore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 03:48:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641116": [
        {
            "ioc_value": "tau.cobaltspore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 03:37:09",
            "last_seen_utc": "2025-11-14 03:37:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641115": [
        {
            "ioc_value": "birch.cobaltspore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 03:27:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641114": [
        {
            "ioc_value": "nacht.quartzfuchs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 03:17:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641112": [
        {
            "ioc_value": "kamm.quartzfuchs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 03:07:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641110": [
        {
            "ioc_value": "adler.quartzfuchs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 02:57:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641109": [
        {
            "ioc_value": "glut.emberweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 02:50:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641108": [
        {
            "ioc_value": "4gef4km41aysc.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-14 02:47:51",
            "last_seen_utc": "2025-11-23 15:49:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1641107": [
        {
            "ioc_value": "bach.emberweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 02:47:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641106": [
        {
            "ioc_value": "stern.emberweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 02:43:20",
            "last_seen_utc": "2025-11-14 02:44:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641105": [
        {
            "ioc_value": "moos.thundergrove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 02:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641104": [
        {
            "ioc_value": "pfad.thundergrove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 02:27:16",
            "last_seen_utc": "2025-11-14 02:33:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641103": [
        {
            "ioc_value": "wolke.thundergrove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 02:17:00",
            "last_seen_utc": "2025-11-14 02:24:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641101": [
        {
            "ioc_value": "zorn.boulderfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 02:08:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641099": [
        {
            "ioc_value": "licht.boulderfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 01:57:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641098": [
        {
            "ioc_value": "stein.boulderfield.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 01:47:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641097": [
        {
            "ioc_value": "ufer.thrushmere.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 01:37:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641096": [
        {
            "ioc_value": "moos.thrushmere.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 01:27:29",
            "last_seen_utc": "2025-11-14 01:33:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641095": [
        {
            "ioc_value": "falke.thrushmere.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 01:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641094": [
        {
            "ioc_value": "korn.ashriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 01:07:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641090": [
        {
            "ioc_value": "fjord.ashriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 00:57:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641089": [
        {
            "ioc_value": "rauch.ashriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 00:47:09",
            "last_seen_utc": "2025-11-14 00:50:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641087": [
        {
            "ioc_value": "pfad.yewhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 00:36:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641086": [
        {
            "ioc_value": "weiss.yewhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 00:28:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641085": [
        {
            "ioc_value": "nacht.yewhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 00:24:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641084": [
        {
            "ioc_value": "hafen.rowanstead.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 00:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641083": [
        {
            "ioc_value": "wald.rowanstead.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 00:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641074": [
        {
            "ioc_value": "rune.acornhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-14 00:02:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641073": [
        {
            "ioc_value": "nebel.acornhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 23:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641071": [
        {
            "ioc_value": "ufer.acornhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 23:47:30",
            "last_seen_utc": "2025-11-13 23:54:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641066": [
        {
            "ioc_value": "moos.ivyvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 23:38:13",
            "last_seen_utc": "2025-11-13 23:39:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641058": [
        {
            "ioc_value": "gleis.ivyvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 23:28:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641057": [
        {
            "ioc_value": "adler.ivyvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 23:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641056": [
        {
            "ioc_value": "kamm.titanbirch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 23:17:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641055": [
        {
            "ioc_value": "tau.titanbirch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 23:06:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641023": [
        {
            "ioc_value": "glanz.titanbirch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 22:57:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641022": [
        {
            "ioc_value": "stern.platinumvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 22:47:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641021": [
        {
            "ioc_value": "eiche.platinumvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 22:44:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641020": [
        {
            "ioc_value": "moor.platinumvale.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 22:37:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641019": [
        {
            "ioc_value": "stahl.goldtalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 22:27:27",
            "last_seen_utc": "2025-11-13 22:28:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1641015": [
        {
            "ioc_value": "klee.goldtalon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 22:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640999": [
        {
            "ioc_value": "stern.brinewald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 21:12:51",
            "last_seen_utc": "2025-11-13 21:28:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640997": [
        {
            "ioc_value": "moor.brinewald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 21:07:39",
            "last_seen_utc": "2025-11-13 21:08:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640994": [
        {
            "ioc_value": "hafen.brinewald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 20:56:18",
            "last_seen_utc": "2025-11-13 20:59:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640992": [
        {
            "ioc_value": "weald.slatefalke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 20:47:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640990": [
        {
            "ioc_value": "dorn.slatefalke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 20:37:14",
            "last_seen_utc": "2025-11-13 20:46:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640986": [
        {
            "ioc_value": "krone.slatefalke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 20:27:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640985": [
        {
            "ioc_value": "blitz.elmfalter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 20:18:08",
            "last_seen_utc": "2025-11-13 20:27:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640984": [
        {
            "ioc_value": "tau.elmfalter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 20:07:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640977": [
        {
            "ioc_value": "wolke.elmfalter.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 19:55:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640976": [
        {
            "ioc_value": "klee.walnutsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 19:44:34",
            "last_seen_utc": "2025-11-13 19:51:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640975": [
        {
            "ioc_value": "rune.walnutsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 19:30:14",
            "last_seen_utc": "2025-11-13 19:33:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640974": [
        {
            "ioc_value": "bach.walnutsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 19:27:31",
            "last_seen_utc": "2025-11-13 19:29:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640973": [
        {
            "ioc_value": "eiche.oryxbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 19:17:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640971": [
        {
            "ioc_value": "fels.oryxbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 19:07:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640970": [
        {
            "ioc_value": "licht.oryxbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 18:57:05",
            "last_seen_utc": "2025-11-13 19:03:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640965": [
        {
            "ioc_value": "nebel.eiderquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 18:47:42",
            "last_seen_utc": "2025-11-13 18:52:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640963": [
        {
            "ioc_value": "glut.eiderquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 18:37:55",
            "last_seen_utc": "2025-11-13 18:38:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640962": [
        {
            "ioc_value": "ufer.eiderquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 18:27:32",
            "last_seen_utc": "2025-11-13 18:29:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640961": [
        {
            "ioc_value": "harz.ferretpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 18:17:45",
            "last_seen_utc": "2025-11-13 18:17:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640960": [
        {
            "ioc_value": "weiss.ferretpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 18:03:22",
            "last_seen_utc": "2025-11-13 18:09:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640959": [
        {
            "ioc_value": "dscrba7gv.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-13 18:02:55",
            "last_seen_utc": "2025-11-13 18:02:56",
            "confidence_level": 100,
            "reference": "https://tria.ge/251113-vj7x5aaj4z",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1640957": [
        {
            "ioc_value": "appsupdate.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 18:01:34",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251113-svgtzasrem",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1640955": [
        {
            "ioc_value": "adler.ferretpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 17:58:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640953": [
        {
            "ioc_value": "stern.hearthwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 17:47:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640952": [
        {
            "ioc_value": "gleis.hearthwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 17:37:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640951": [
        {
            "ioc_value": "rauch.hearthwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 17:28:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640947": [
        {
            "ioc_value": "kamm.knollhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 17:17:52",
            "last_seen_utc": "2025-11-13 17:25:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640946": [
        {
            "ioc_value": "moor.knollhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 17:08:37",
            "last_seen_utc": "2025-11-13 17:15:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640942": [
        {
            "ioc_value": "fjord.knollhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 16:58:50",
            "last_seen_utc": "2025-11-13 17:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640941": [
        {
            "ioc_value": "tau.sprigkompass.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 16:57:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640940": [
        {
            "ioc_value": "birch.sprigkompass.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 16:53:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640937": [
        {
            "ioc_value": "lat.vrolijkecreaties.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-13 16:51:56",
            "last_seen_utc": "2025-11-20 18:49:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1640938": [
        {
            "ioc_value": "lat.hotelsinjacksonvillefl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-13 16:51:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1640934": [
        {
            "ioc_value": "wolke.sprigkompass.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 16:44:13",
            "last_seen_utc": "2025-11-13 16:44:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640933": [
        {
            "ioc_value": "orbit9.warpclutch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 16:37:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640932": [
        {
            "ioc_value": "0kj3.warpclutch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 16:27:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640931": [
        {
            "ioc_value": "spark.warpclutch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 16:17:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640930": [
        {
            "ioc_value": "dyy.raven-flux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 16:08:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640923": [
        {
            "ioc_value": "trace4.raven-flux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 15:57:43",
            "last_seen_utc": "2025-11-13 16:03:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640922": [
        {
            "ioc_value": "spark6.raven-flux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 15:47:57",
            "last_seen_utc": "2025-11-13 15:51:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640921": [
        {
            "ioc_value": "b71yl.pulseknob.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 15:37:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640901": [
        {
            "ioc_value": "centaurustermas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-13 15:32:11",
            "last_seen_utc": "2025-11-13 14:05:48",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115542768731282934",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1640906": [
        {
            "ioc_value": "www.iconconsultants.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-13 15:32:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115542768731282934",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1640914": [
        {
            "ioc_value": "playarena.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-13 15:32:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "GenesisStealer,infostealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1640920": [
        {
            "ioc_value": "nib.pulseknob.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 15:27:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640919": [
        {
            "ioc_value": "84w7.pulseknob.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 15:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640918": [
        {
            "ioc_value": "v3kxh.nib-snap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 15:10:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640917": [
        {
            "ioc_value": "nt3e.nib-snap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 14:57:22",
            "last_seen_utc": "2025-11-13 15:08:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640913": [
        {
            "ioc_value": "rift.nib-snap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 14:41:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640912": [
        {
            "ioc_value": "anchor.foamswitch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 14:37:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640911": [
        {
            "ioc_value": "blink.foamswitch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 14:28:01",
            "last_seen_utc": "2025-11-13 14:33:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640910": [
        {
            "ioc_value": "l93r.foamswitch.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 14:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640909": [
        {
            "ioc_value": "8ab.sketchloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 14:16:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640908": [
        {
            "ioc_value": "2eq.sketchloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 14:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640899": [
        {
            "ioc_value": "yx80.sketchloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 13:57:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640898": [
        {
            "ioc_value": "sih4.ravenflux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 13:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640897": [
        {
            "ioc_value": "dlr.ravenflux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 13:37:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640896": [
        {
            "ioc_value": "trail3.ravenflux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 13:21:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640895": [
        {
            "ioc_value": "node3.sketch-loom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 13:13:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640894": [
        {
            "ioc_value": "wk.sketch-loom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 13:07:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640893": [
        {
            "ioc_value": "3xh.sketch-loom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 12:57:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640878": [
        {
            "ioc_value": "trqinghkme.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-13 12:50:00",
            "last_seen_utc": "2025-12-14 09:48:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1640876": [
        {
            "ioc_value": "dmp.netsolutionpoint.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-13 12:49:47",
            "last_seen_utc": "2025-12-14 11:48:05",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1640877": [
        {
            "ioc_value": "drive.netsolutionpoint.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-13 12:49:47",
            "last_seen_utc": "2025-12-14 11:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1640875": [
        {
            "ioc_value": "cloud.netsolutionpoint.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-13 12:49:42",
            "last_seen_utc": "2025-12-14 11:48:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1640874": [
        {
            "ioc_value": "0i.pulse-knob.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 12:48:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640873": [
        {
            "ioc_value": "niggabjiggy184.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 12:41:20",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-zmc95svkgw",
            "tags": "c2,domain,rat,Remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1640872": [
        {
            "ioc_value": "qcq8.pulse-knob.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 12:39:44",
            "last_seen_utc": "2025-11-13 12:41:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640871": [
        {
            "ioc_value": "1yd0a.pulse-knob.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 12:37:38",
            "last_seen_utc": "2025-11-13 12:37:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640870": [
        {
            "ioc_value": "quartz3.quartz-flip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 12:28:50",
            "last_seen_utc": "2025-11-13 12:34:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640822": [
        {
            "ioc_value": "vlr.quartz-flip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 12:17:29",
            "last_seen_utc": "2025-11-13 12:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640821": [
        {
            "ioc_value": "hg.quartz-flip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 12:07:15",
            "last_seen_utc": "2025-11-13 12:13:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640804": [
        {
            "ioc_value": "trackboxing.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-13 12:01:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251113-ls1ezadx6e",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1640801": [
        {
            "ioc_value": "envioremcosanta.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 12:01:36",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251113-lgmdzawraj",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1640802": [
        {
            "ioc_value": "belulunelubukekekbuekkkebdhhkekekjdhfjdj.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 12:01:36",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251113-knrftscy8e",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1640800": [
        {
            "ioc_value": "p2.nibsnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 11:57:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640799": [
        {
            "ioc_value": "9fwu4.nibsnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 11:47:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640798": [
        {
            "ioc_value": "ctf.nibsnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 11:30:44",
            "last_seen_utc": "2025-11-13 11:44:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640797": [
        {
            "ioc_value": "rsw.g0b1ncore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 11:28:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640796": [
        {
            "ioc_value": "vmzts.g0b1ncore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 11:17:47",
            "last_seen_utc": "2025-11-13 11:18:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640795": [
        {
            "ioc_value": "dro.g0b1ncore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 11:04:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640783": [
        {
            "ioc_value": "crest.zeromint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 10:53:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640774": [
        {
            "ioc_value": "eri.vrolijkecreaties.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-13 10:50:24",
            "last_seen_utc": "2025-11-20 18:49:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1640765": [
        {
            "ioc_value": "sketch.zeromint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 10:47:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640764": [
        {
            "ioc_value": "91.zeromint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 10:37:34",
            "last_seen_utc": "2025-11-13 10:44:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640763": [
        {
            "ioc_value": "1apde.zeromint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 10:27:16",
            "last_seen_utc": "2025-11-13 10:28:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640762": [
        {
            "ioc_value": "wsyu.t1nkerbay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 10:23:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640761": [
        {
            "ioc_value": "j0gxn.t1nkerbay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 10:12:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1640760": [
        {
            "ioc_value": "foam.t1nkerbay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 10:08:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639872": [
        {
            "ioc_value": "vitasdrudalokistok.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-13 10:01:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.162",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639871": [
        {
            "ioc_value": "rackklousdiksonmauf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-13 10:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.165",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639870": [
        {
            "ioc_value": "tokjikoladutrack.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-13 09:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.163",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639869": [
        {
            "ioc_value": "flux3.t1nkerbay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 09:57:44",
            "last_seen_utc": "2025-11-13 10:03:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639866": [
        {
            "ioc_value": "marmasd.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:36",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639867": [
        {
            "ioc_value": "invesgz.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:36",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639868": [
        {
            "ioc_value": "drywabq.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:36",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639856": [
        {
            "ioc_value": "blennia.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-11-21 23:37:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639857": [
        {
            "ioc_value": "basedo.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639858": [
        {
            "ioc_value": "hymenri.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639859": [
        {
            "ioc_value": "snowcjw.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639860": [
        {
            "ioc_value": "contiho.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639861": [
        {
            "ioc_value": "orgiaep.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639862": [
        {
            "ioc_value": "deactlr.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-12-12 12:55:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639863": [
        {
            "ioc_value": "politxh.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-11-25 15:31:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639864": [
        {
            "ioc_value": "trimoci.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-11-21 23:37:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639865": [
        {
            "ioc_value": "suspeva.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-13 09:52:35",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639855": [
        {
            "ioc_value": "loom.quartzflip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 09:47:57",
            "last_seen_utc": "2025-11-13 09:49:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639854": [
        {
            "ioc_value": "st6.quartzflip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 09:37:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639853": [
        {
            "ioc_value": "orbit.quartzflip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 09:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639852": [
        {
            "ioc_value": "bw.quartzflip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 09:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639851": [
        {
            "ioc_value": "8nbw6.shevypro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 09:08:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639849": [
        {
            "ioc_value": "66.shevypro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 08:57:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639848": [
        {
            "ioc_value": "pulse.shevypro.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 08:45:58",
            "last_seen_utc": "2025-11-13 08:56:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639845": [
        {
            "ioc_value": "bcidaho.bromleyhealthmanagement.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-13 08:03:07",
            "last_seen_utc": "2025-11-13 11:01:02",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.221.71.243+bcidaho.bromleyhealthmanagement.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639833": [
        {
            "ioc_value": "dja.vrolijkecreaties.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-13 07:41:46",
            "last_seen_utc": "2025-11-20 18:49:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639834": [
        {
            "ioc_value": "dja.hotelsinjacksonvillefl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-13 07:41:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639830": [
        {
            "ioc_value": "hover.trickilygrey.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 07:08:12",
            "last_seen_utc": "2025-11-13 07:20:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639829": [
        {
            "ioc_value": "beacon6.trickilygrey.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 06:57:54",
            "last_seen_utc": "2025-11-13 06:57:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639828": [
        {
            "ioc_value": "blink.trickilygrey.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 06:46:50",
            "last_seen_utc": "2025-11-13 06:53:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639822": [
        {
            "ioc_value": "node3.trickilygrey.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 06:33:09",
            "last_seen_utc": "2025-11-13 06:34:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639821": [
        {
            "ioc_value": "reechel.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-13 06:27:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "landupdate808",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639820": [
        {
            "ioc_value": "hcm-technology.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-13 06:27:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Gholoader,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639819": [
        {
            "ioc_value": "week-ut.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-13 06:26:36",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639818": [
        {
            "ioc_value": "www.blazingelectricz.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 06:26:16",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639814": [
        {
            "ioc_value": "agosto20.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 06:26:15",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639815": [
        {
            "ioc_value": "api25.didns.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 06:26:15",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639816": [
        {
            "ioc_value": "www.blazingelectricz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 06:26:15",
            "last_seen_utc": "2025-12-12 18:39:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639817": [
        {
            "ioc_value": "www.blazingelectricz.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 06:26:15",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639808": [
        {
            "ioc_value": "465669107.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-13 06:25:39",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639809": [
        {
            "ioc_value": "byteflowing1337.github.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-13 06:25:39",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639810": [
        {
            "ioc_value": "octubre212024.giize.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-13 06:25:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639811": [
        {
            "ioc_value": "pinganxzen.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-13 06:25:39",
            "last_seen_utc": "2025-12-12 18:38:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639812": [
        {
            "ioc_value": "rupper9.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-13 06:25:39",
            "last_seen_utc": "2025-12-12 18:38:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639802": [
        {
            "ioc_value": "api.foodbyte.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-13 06:24:51",
            "last_seen_utc": "2025-12-12 18:38:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639803": [
        {
            "ioc_value": "atri.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-13 06:24:51",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639804": [
        {
            "ioc_value": "foodbyte.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-13 06:24:51",
            "last_seen_utc": "2025-12-12 18:38:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639805": [
        {
            "ioc_value": "shop.atri.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-13 06:24:51",
            "last_seen_utc": "2025-12-12 18:38:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639806": [
        {
            "ioc_value": "hotels-atmospheric.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-13 06:24:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639797": [
        {
            "ioc_value": "proud17.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 06:01:36",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251113-e97r2sgq8s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639793": [
        {
            "ioc_value": "proud.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 06:01:35",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251113-e97r2sgq8s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639792": [
        {
            "ioc_value": "proudsoldier.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-13 06:01:34",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251113-e97r2sgq8s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639790": [
        {
            "ioc_value": "s5.inktrap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 05:36:40",
            "last_seen_utc": "2025-11-13 05:43:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639789": [
        {
            "ioc_value": "phase0.inktrap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 05:27:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639788": [
        {
            "ioc_value": "gleam.inktrap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 05:17:37",
            "last_seen_utc": "2025-11-13 05:23:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639787": [
        {
            "ioc_value": "lqsvi.inktrap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 05:08:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639786": [
        {
            "ioc_value": "quark.papervolt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 04:57:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639706": [
        {
            "ioc_value": "updatesbrows.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-13 04:54:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1639717": [
        {
            "ioc_value": "bcidaho.247supportsolutions.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-13 04:54:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/44.244.194.132+bcidaho.247supportsolutions.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1639785": [
        {
            "ioc_value": "bd.papervolt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 04:47:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639784": [
        {
            "ioc_value": "pulse.papervolt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 04:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639783": [
        {
            "ioc_value": "mesh.papervolt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 04:27:11",
            "last_seen_utc": "2025-11-13 04:29:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639782": [
        {
            "ioc_value": "es.jaxdrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 04:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639781": [
        {
            "ioc_value": "nut.jaxdrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 04:08:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639779": [
        {
            "ioc_value": "windows-updates-check.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-13 04:02:17",
            "last_seen_utc": "2025-11-13 11:01:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.38.20.224+windows-updates-check.com",
            "tags": "AS215659,C2,censys,MOEMOEKYUN,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639778": [
        {
            "ioc_value": "mukphol.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-13 04:02:16",
            "last_seen_utc": "2025-11-13 11:01:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/119.59.104.22+mukphol.com",
            "tags": "AS56067,C2,censys,METRABYTE-TH,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639773": [
        {
            "ioc_value": "v1.jaxdrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 03:57:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639772": [
        {
            "ioc_value": "byte.jaxdrill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 03:47:59",
            "last_seen_utc": "2025-11-13 03:48:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639771": [
        {
            "ioc_value": "vale.zenith-snap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 03:36:32",
            "last_seen_utc": "2025-11-13 03:43:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639770": [
        {
            "ioc_value": "rift.zenith-snap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 03:27:16",
            "last_seen_utc": "2025-11-13 03:27:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639769": [
        {
            "ioc_value": "012.zenith-snap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 03:18:32",
            "last_seen_utc": "2025-11-13 03:24:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639768": [
        {
            "ioc_value": "qzq.zenith-snap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 03:08:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639767": [
        {
            "ioc_value": "02au.echozig.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 02:57:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639765": [
        {
            "ioc_value": "c0.echozig.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 02:48:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639764": [
        {
            "ioc_value": "nz.echozig.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 02:37:48",
            "last_seen_utc": "2025-11-13 02:38:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639763": [
        {
            "ioc_value": "xqgn6.echozig.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 02:27:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639762": [
        {
            "ioc_value": "drift.wreckly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 02:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639761": [
        {
            "ioc_value": "grid6.wreckly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 02:07:46",
            "last_seen_utc": "2025-11-13 02:11:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639760": [
        {
            "ioc_value": "4q.wreckly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 01:57:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639759": [
        {
            "ioc_value": "7r.wreckly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 01:47:06",
            "last_seen_utc": "2025-11-13 01:53:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639758": [
        {
            "ioc_value": "loom7.fr0gpulse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 01:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639757": [
        {
            "ioc_value": "fyi67.fr0gpulse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 01:32:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639755": [
        {
            "ioc_value": "loom3.fr0gpulse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 01:26:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639754": [
        {
            "ioc_value": "71f9.fr0gpulse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 01:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639753": [
        {
            "ioc_value": "crest.miragepad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 01:07:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639752": [
        {
            "ioc_value": "orbit1.miragepad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 00:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639751": [
        {
            "ioc_value": "crest4.miragepad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 00:47:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639749": [
        {
            "ioc_value": "5cg77.miragepad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 00:37:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639748": [
        {
            "ioc_value": "f1o.twistnova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 00:31:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639747": [
        {
            "ioc_value": "sparkle.twistnova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 00:27:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639746": [
        {
            "ioc_value": "vi.twistnova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 00:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639745": [
        {
            "ioc_value": "glide.twistnova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 00:10:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639744": [
        {
            "ioc_value": "suz.mirage-pad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-13 00:07:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639737": [
        {
            "ioc_value": "2z.mirage-pad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 23:57:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639736": [
        {
            "ioc_value": "frqyt.gl-1-tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 23:51:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639735": [
        {
            "ioc_value": "daw.gl-1-tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 23:47:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639734": [
        {
            "ioc_value": "core.gl-1-tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 23:37:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639733": [
        {
            "ioc_value": "y9w7.gl-1-tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 23:27:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639732": [
        {
            "ioc_value": "q1f1p.twist-nova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 23:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639731": [
        {
            "ioc_value": "ux.twist-nova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 23:07:19",
            "last_seen_utc": "2025-11-12 23:10:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639715": [
        {
            "ioc_value": "2tkvw.twist-nova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 22:57:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639713": [
        {
            "ioc_value": "server.dczu.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-12 22:48:07",
            "last_seen_utc": "2025-12-14 11:48:16",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1639712": [
        {
            "ioc_value": "gynar.twist-nova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 22:47:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639711": [
        {
            "ioc_value": "phase.bash-glider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 22:36:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639710": [
        {
            "ioc_value": "shift.bash-glider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 22:28:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639709": [
        {
            "ioc_value": "jet.bash-glider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 22:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639707": [
        {
            "ioc_value": "grid.bash-glider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 22:02:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639705": [
        {
            "ioc_value": "loom.vorticeye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 21:52:40",
            "last_seen_utc": "2025-11-12 21:54:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639702": [
        {
            "ioc_value": "echo.vorticeye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 21:47:52",
            "last_seen_utc": "2025-11-12 21:48:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639701": [
        {
            "ioc_value": "node.vorticeye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 21:37:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639496": [
        {
            "ioc_value": "echo9.vorticeye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 21:21:08",
            "last_seen_utc": "2025-11-12 21:28:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639495": [
        {
            "ioc_value": "v3d1.st3elflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 21:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639493": [
        {
            "ioc_value": "trace.st3elflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 21:08:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639491": [
        {
            "ioc_value": "y5i1.st3elflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 20:56:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639490": [
        {
            "ioc_value": "nova1.st3elflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 20:48:03",
            "last_seen_utc": "2025-11-12 20:54:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639489": [
        {
            "ioc_value": "vector.zenithsnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 20:37:46",
            "last_seen_utc": "2025-11-12 20:39:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639488": [
        {
            "ioc_value": "nova.zenithsnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 20:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639487": [
        {
            "ioc_value": "4r1i.zenithsnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 20:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639486": [
        {
            "ioc_value": "wave.zenithsnap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 20:07:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639476": [
        {
            "ioc_value": "wave6.gl1tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 19:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639475": [
        {
            "ioc_value": "lz3y.gl1tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 19:47:07",
            "last_seen_utc": "2025-11-12 19:54:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639474": [
        {
            "ioc_value": "bp6.gl1tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 19:37:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639473": [
        {
            "ioc_value": "l5sd.gl1tchgarden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 19:24:00",
            "last_seen_utc": "2025-11-12 19:29:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639472": [
        {
            "ioc_value": "16.bashglider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 19:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639471": [
        {
            "ioc_value": "8bg.bashglider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 19:02:48",
            "last_seen_utc": "2025-11-12 19:09:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639469": [
        {
            "ioc_value": "rnxgc.bashglider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 18:57:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639467": [
        {
            "ioc_value": "zil.bashglider.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 18:47:44",
            "last_seen_utc": "2025-11-12 18:52:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639466": [
        {
            "ioc_value": "kamm.starfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 18:37:22",
            "last_seen_utc": "2025-11-12 18:39:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639465": [
        {
            "ioc_value": "weiss.starfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 18:28:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639464": [
        {
            "ioc_value": "glow.starfiare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 18:18:18",
            "last_seen_utc": "2025-11-12 18:19:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639463": [
        {
            "ioc_value": "licht.cioudbr1nk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 18:08:50",
            "last_seen_utc": "2025-11-12 18:14:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639461": [
        {
            "ioc_value": "zephalon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-11-12 18:06:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1812404/0/html",
            "tags": "c2,domain,joesandbox,Oyster",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639462": [
        {
            "ioc_value": "tedbutz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-11-12 18:06:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1812404/0/html",
            "tags": "c2,domain,joesandbox,Oyster",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639459": [
        {
            "ioc_value": "nonoono1.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-12 18:01:37",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251112-pd9xmsxnat",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639458": [
        {
            "ioc_value": "there-vendor.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-12 18:01:22",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251112-vb3nfa1pew",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639450": [
        {
            "ioc_value": "benefits.cheapguys.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-12 17:45:30",
            "last_seen_utc": "2025-11-13 06:27:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115537830625025661",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1639454": [
        {
            "ioc_value": "dta.vrolijkecreaties.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 17:26:46",
            "last_seen_utc": "2025-11-20 18:49:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639455": [
        {
            "ioc_value": "dta.holidayuklastminute.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 17:26:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639210": [
        {
            "ioc_value": "hugfornow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 17:03:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1639209": [
        {
            "ioc_value": "fallmusicfestival.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 17:03:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1639208": [
        {
            "ioc_value": "pawprintspublishingllc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 17:03:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1639207": [
        {
            "ioc_value": "nora-bs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 17:03:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1639206": [
        {
            "ioc_value": "drsaputo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 17:03:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1639203": [
        {
            "ioc_value": "addisartist.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 17:03:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1639202": [
        {
            "ioc_value": "pbcustomercare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 17:03:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1639422": [
        {
            "ioc_value": "frostshiledr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-12 17:03:05",
            "last_seen_utc": "2025-11-12 14:12:50",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115537134370433758",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1639448": [
        {
            "ioc_value": "adeyqa.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-11-12 16:36:02",
            "last_seen_utc": "2025-12-11 23:48:04",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=adeyqa.net",
            "tags": "Amadey,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1639418": [
        {
            "ioc_value": "quasar.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-12 12:03:19",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251112-m8zztaav5g",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639412": [
        {
            "ioc_value": "rajasas35safael1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-12 12:01:30",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251112-mkj9fsh18e",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1639395": [
        {
            "ioc_value": "productos.luxurestudiio.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-12 11:05:30",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639369": [
        {
            "ioc_value": "6ewct49g.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-12 11:03:59",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639251": [
        {
            "ioc_value": "ir.holidaysuklastminute.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 09:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639252": [
        {
            "ioc_value": "i9.fabiankorte.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 09:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639253": [
        {
            "ioc_value": "t.v.holidayuklastminute.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 09:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639254": [
        {
            "ioc_value": "tiv.vrolijkecreaties.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 09:19:00",
            "last_seen_utc": "2025-11-20 18:49:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639246": [
        {
            "ioc_value": "rx.fabiankorte.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 09:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639247": [
        {
            "ioc_value": "rx.holidayuklastminute.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 09:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639248": [
        {
            "ioc_value": "pk.fabiankorte.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 09:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639249": [
        {
            "ioc_value": "pk.holidaysuklastminute.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 09:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639250": [
        {
            "ioc_value": "ir.fabiankorte.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-12 09:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1639201": [
        {
            "ioc_value": "boymoder.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.ngioweb",
            "malware_alias": null,
            "malware_printable": "Ngioweb",
            "first_seen_utc": "2025-11-12 08:26:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/3f2c0e2becb201a5b2cd23b66deaa39b78fbea6cdc64e539edb442b99f5373d4/",
            "tags": "Ngioweb",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638759": [
        {
            "ioc_value": "cmevents.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 08:23:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1638761": [
        {
            "ioc_value": "doyarkaissela.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 08:23:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1638762": [
        {
            "ioc_value": "groupewadesecurity.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 08:23:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1638763": [
        {
            "ioc_value": "sahb.com.pk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 08:23:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1638764": [
        {
            "ioc_value": "virhtechgmbh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 08:23:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1638765": [
        {
            "ioc_value": "sportsstories.gr",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-12 08:23:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Fake OS Update",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1638774": [
        {
            "ioc_value": "archives.kathmandutribune.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-12 08:22:38",
            "last_seen_utc": "2025-11-13 06:27:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115532888755398670",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1639200": [
        {
            "ioc_value": "fjord.cioudbr1nk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 08:07:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639189": [
        {
            "ioc_value": "geist.cioudbr1nk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 07:57:13",
            "last_seen_utc": "2025-11-12 07:57:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639188": [
        {
            "ioc_value": "klee.embertarn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 07:44:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639187": [
        {
            "ioc_value": "pfad.embertarn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 07:38:36",
            "last_seen_utc": "2025-11-12 07:43:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639186": [
        {
            "ioc_value": "moos.embertarn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 07:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639185": [
        {
            "ioc_value": "rune.ic0n1cforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 07:18:01",
            "last_seen_utc": "2025-11-12 07:18:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639184": [
        {
            "ioc_value": "birch.ic0n1cforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 07:07:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639183": [
        {
            "ioc_value": "wolke.ic0n1cforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 06:58:26",
            "last_seen_utc": "2025-11-12 07:00:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1639181": [
        {
            "ioc_value": "dt1.automotosport.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.zloader",
            "malware_alias": "DELoader,SILENTNIGHT,Terdot",
            "malware_printable": "Zloader",
            "first_seen_utc": "2025-11-12 06:50:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "zloader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639182": [
        {
            "ioc_value": "adsmarks.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.zloader",
            "malware_alias": "DELoader,SILENTNIGHT,Terdot",
            "malware_printable": "Zloader",
            "first_seen_utc": "2025-11-12 06:50:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "zloader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639179": [
        {
            "ioc_value": "rfast.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-12 06:49:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639166": [
        {
            "ioc_value": "uefuaebfauoeug.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639167": [
        {
            "ioc_value": "uoaeogauhduadhug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639168": [
        {
            "ioc_value": "uoaeogauhduadhug.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639169": [
        {
            "ioc_value": "usifusurfbbuguruf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639170": [
        {
            "ioc_value": "usifusurfbbugurug.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639171": [
        {
            "ioc_value": "usifusurfbbuguruo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639172": [
        {
            "ioc_value": "usifusurfbbugurux.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639173": [
        {
            "ioc_value": "wdkowdohwodhfhfg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639174": [
        {
            "ioc_value": "wdkowdohwodhfhfk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639175": [
        {
            "ioc_value": "wdkowdohwodhfhfm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639176": [
        {
            "ioc_value": "wduufbaueeubffgg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639177": [
        {
            "ioc_value": "wduufbaueeubffgk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639178": [
        {
            "ioc_value": "wduufbaueeubffgm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639145": [
        {
            "ioc_value": "ofhhusrugsrhgurhf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639146": [
        {
            "ioc_value": "ofhhusrugsrhgurhg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639147": [
        {
            "ioc_value": "ofhhusrugsrhgurho.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639148": [
        {
            "ioc_value": "ofhhusrugsrhgurhx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639149": [
        {
            "ioc_value": "ohsufsiuesiuhuhgf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639150": [
        {
            "ioc_value": "ohsufsiuesiuhuhgg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639151": [
        {
            "ioc_value": "ohsufsiuesiuhuhgo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639152": [
        {
            "ioc_value": "ohsufsiuesiuhuhgx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639153": [
        {
            "ioc_value": "okdoekeoehghaoeg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639154": [
        {
            "ioc_value": "okdoekeoehghaoek.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639155": [
        {
            "ioc_value": "okdoekeoehghaoem.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639156": [
        {
            "ioc_value": "plpanaifheaighai.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639157": [
        {
            "ioc_value": "plpanaifheaighai.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639158": [
        {
            "ioc_value": "plpoiupakludkosa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639159": [
        {
            "ioc_value": "plpoiupakludkosa.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639160": [
        {
            "ioc_value": "seuufhehfueugheg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639161": [
        {
            "ioc_value": "seuufhehfueughek.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639162": [
        {
            "ioc_value": "seuufhehfueughem.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639163": [
        {
            "ioc_value": "shufourfhrufhu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639164": [
        {
            "ioc_value": "srgbsuirbfubuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639165": [
        {
            "ioc_value": "tookddiwijdiss.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639123": [
        {
            "ioc_value": "gaueudbuwdbuguug.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639124": [
        {
            "ioc_value": "gaueudbuwdbuguuk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639125": [
        {
            "ioc_value": "gaueudbuwdbuguum.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639126": [
        {
            "ioc_value": "giaeijeidgieua.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639127": [
        {
            "ioc_value": "gnnaneieaojoagisf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639128": [
        {
            "ioc_value": "gnnaneieaojoagisg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639129": [
        {
            "ioc_value": "gnnaneieaojoagiso.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639130": [
        {
            "ioc_value": "gnnaneieaojoagisx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639131": [
        {
            "ioc_value": "iaefiazefgizagdgf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639132": [
        {
            "ioc_value": "iaefiazefgizagdgg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639133": [
        {
            "ioc_value": "iaefiazefgizagdgo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639134": [
        {
            "ioc_value": "iaefiazefgizagdgx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639135": [
        {
            "ioc_value": "ibufhhuofouaes.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639136": [
        {
            "ioc_value": "iuefgauiaiduihgs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639137": [
        {
            "ioc_value": "iuefgauiaiduihgs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639138": [
        {
            "ioc_value": "koksfegkosoefh.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639139": [
        {
            "ioc_value": "lopiaoeufgaeid.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639140": [
        {
            "ioc_value": "maeobnaoefhgoajo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639141": [
        {
            "ioc_value": "maeobnaoefhgoajo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639142": [
        {
            "ioc_value": "nfbaeiudhaiedhhgf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639143": [
        {
            "ioc_value": "oefheahfueghuh.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639144": [
        {
            "ioc_value": "oehfeoaufhuufs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639102": [
        {
            "ioc_value": "fafhoafouehfuh.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639103": [
        {
            "ioc_value": "faugzeazdezgzgfg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639104": [
        {
            "ioc_value": "faugzeazdezgzgfk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639105": [
        {
            "ioc_value": "faugzeazdezgzgfm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639106": [
        {
            "ioc_value": "feauhueudughuurg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639107": [
        {
            "ioc_value": "feauhueudughuurk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639108": [
        {
            "ioc_value": "feauhueudughuurm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639109": [
        {
            "ioc_value": "feuhdeuhduhuehdg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639110": [
        {
            "ioc_value": "feuhdeuhduhuehdk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639111": [
        {
            "ioc_value": "fheuhdwdzwgzdggg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639112": [
        {
            "ioc_value": "fheuhdwdzwgzdggk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639113": [
        {
            "ioc_value": "fheuhdwdzwgzdggm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639114": [
        {
            "ioc_value": "gaeifiuheiuhauhdf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639115": [
        {
            "ioc_value": "gaeifiuheiuhauhdg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639116": [
        {
            "ioc_value": "gaeifiuheiuhauhdo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639117": [
        {
            "ioc_value": "gaeifiuheiuhauhdx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639118": [
        {
            "ioc_value": "gaeuhaiuhfihehfsf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639119": [
        {
            "ioc_value": "gaeuhaiuhfihehfsg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639120": [
        {
            "ioc_value": "gaeuhaiuhfihehfso.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639121": [
        {
            "ioc_value": "gaeuhaiuhfihehfsx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639122": [
        {
            "ioc_value": "gauehfeohfefhu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639082": [
        {
            "ioc_value": "eafueudzefverrgg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639083": [
        {
            "ioc_value": "eafueudzefverrgk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639084": [
        {
            "ioc_value": "eafueudzefverrgm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639085": [
        {
            "ioc_value": "eaueaoeufuufhs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639086": [
        {
            "ioc_value": "eauebfuiaefubg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639087": [
        {
            "ioc_value": "edhuaudhuedugufg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639088": [
        {
            "ioc_value": "edhuaudhuedugufk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639089": [
        {
            "ioc_value": "edhuaudhuedugufm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639090": [
        {
            "ioc_value": "efaeduvedvzfufug.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639091": [
        {
            "ioc_value": "efaeduvedvzfufuk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639092": [
        {
            "ioc_value": "efaeduvedvzfufum.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639093": [
        {
            "ioc_value": "efeuafubeubaefug.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639094": [
        {
            "ioc_value": "efeuafubeubaefuk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639095": [
        {
            "ioc_value": "efeuafubeubaefum.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639096": [
        {
            "ioc_value": "efuheruhdehduhgg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639097": [
        {
            "ioc_value": "efuheruhdehduhgk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639098": [
        {
            "ioc_value": "efuheruhdehduhgm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639099": [
        {
            "ioc_value": "egubeauefaeufu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639100": [
        {
            "ioc_value": "eoufaoeuhoauengi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639101": [
        {
            "ioc_value": "faeuhoaoiehrhd.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639059": [
        {
            "ioc_value": "ashihsijaediaehf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639060": [
        {
            "ioc_value": "aufheuafoaheuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639061": [
        {
            "ioc_value": "babfaehfuehfuh.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639062": [
        {
            "ioc_value": "baeiaeueauieis.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639063": [
        {
            "ioc_value": "bafaejidjaiehfgsf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639064": [
        {
            "ioc_value": "bafaejidjaiehfgsg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639065": [
        {
            "ioc_value": "bafaejidjaiehfgso.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639066": [
        {
            "ioc_value": "bafaejidjaiehfgsx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639067": [
        {
            "ioc_value": "bafbeiahighgii.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639068": [
        {
            "ioc_value": "bbfaeuuhfiaehf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639069": [
        {
            "ioc_value": "booomaahuuoooapl.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639070": [
        {
            "ioc_value": "booomaahuuoooapl.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639071": [
        {
            "ioc_value": "bsigsifrruhhgd.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639072": [
        {
            "ioc_value": "buieubfiuebuuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639073": [
        {
            "ioc_value": "deauduafzgezzfgg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639074": [
        {
            "ioc_value": "deauduafzgezzfgk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639075": [
        {
            "ioc_value": "deauduafzgezzfgm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639076": [
        {
            "ioc_value": "eaffuebudbeudbbg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639077": [
        {
            "ioc_value": "eaffuebudbeudbbk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639078": [
        {
            "ioc_value": "eaffuebudbeudbbm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639079": [
        {
            "ioc_value": "eafuebdbedbedggg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639080": [
        {
            "ioc_value": "eafuebdbedbedggk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639081": [
        {
            "ioc_value": "eafuebdbedbedggm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639041": [
        {
            "ioc_value": "aefoahefuaehfu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639042": [
        {
            "ioc_value": "aefoheaofefhuu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639043": [
        {
            "ioc_value": "aehfiaheifuedhgsf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639044": [
        {
            "ioc_value": "aehfiaheifuedhgsg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639045": [
        {
            "ioc_value": "aehfiaheifuedhgso.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639046": [
        {
            "ioc_value": "aeifuaeiuafbuu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639047": [
        {
            "ioc_value": "aeigaeizfaizef.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639048": [
        {
            "ioc_value": "aeiziaezieidiebg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639049": [
        {
            "ioc_value": "aeiziaezieidiebg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639050": [
        {
            "ioc_value": "aeubaefefbuuss.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639051": [
        {
            "ioc_value": "afueufuefueifo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639052": [
        {
            "ioc_value": "agnediuaeuidhegsf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639053": [
        {
            "ioc_value": "agnediuaeuidhegsg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639054": [
        {
            "ioc_value": "agnediuaeuidhegso.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639055": [
        {
            "ioc_value": "agnediuaeuidhegsx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639056": [
        {
            "ioc_value": "aneoeauhiazegfiz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639057": [
        {
            "ioc_value": "aneoeauhiazegfiz.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639058": [
        {
            "ioc_value": "ashihsijaediaehf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-12 06:48:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1639040": [
        {
            "ioc_value": "fjord.ny4lp8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 06:47:39",
            "last_seen_utc": "2025-11-12 06:49:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638884": [
        {
            "ioc_value": "kaaris-29384.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-12 06:44:32",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638878": [
        {
            "ioc_value": "gatex.nixt.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-12 06:43:44",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638879": [
        {
            "ioc_value": "gatex.sociall.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-12 06:43:44",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638880": [
        {
            "ioc_value": "gatex.xoilaczzazz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-12 06:43:44",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638881": [
        {
            "ioc_value": "tsklloops.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-12 06:43:44",
            "last_seen_utc": "2025-12-12 18:38:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638875": [
        {
            "ioc_value": "kamm.ny4lp8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 06:37:18",
            "last_seen_utc": "2025-11-12 06:38:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638874": [
        {
            "ioc_value": "moos.ny4lp8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 06:27:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638873": [
        {
            "ioc_value": "glow.l2-1-w2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 06:17:15",
            "last_seen_utc": "2025-11-12 06:22:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638872": [
        {
            "ioc_value": "rune.l2-1-w2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 06:06:58",
            "last_seen_utc": "2025-11-12 06:14:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638871": [
        {
            "ioc_value": "craftmatrix.giize.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-12 06:01:48",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251112-ejvd2aynds",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638870": [
        {
            "ioc_value": "wald.l2-1-w2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 06:00:16",
            "last_seen_utc": "2025-11-12 06:00:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638869": [
        {
            "ioc_value": "rift.riftcog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 05:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638868": [
        {
            "ioc_value": "cc.riftcog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 05:47:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638867": [
        {
            "ioc_value": "79.riftcog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 05:37:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638866": [
        {
            "ioc_value": "trail.rumble-kin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 05:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638865": [
        {
            "ioc_value": "hwv.rumble-kin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 05:17:26",
            "last_seen_utc": "2025-11-12 05:26:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638864": [
        {
            "ioc_value": "byte.rumble-kin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 05:07:10",
            "last_seen_utc": "2025-11-12 05:17:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638863": [
        {
            "ioc_value": "kaf.c0sm1cweld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 04:51:16",
            "last_seen_utc": "2025-11-12 04:54:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638862": [
        {
            "ioc_value": "6m4.c0sm1cweld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 04:47:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638861": [
        {
            "ioc_value": "sparkle.c0sm1cweld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 04:36:48",
            "last_seen_utc": "2025-11-12 04:38:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638860": [
        {
            "ioc_value": "trail5.rift-cog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 04:28:03",
            "last_seen_utc": "2025-11-12 04:28:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638859": [
        {
            "ioc_value": "dj2op.rift-cog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 04:17:39",
            "last_seen_utc": "2025-11-12 04:19:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638858": [
        {
            "ioc_value": "burst.rift-cog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 04:07:59",
            "last_seen_utc": "2025-11-12 04:09:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638849": [
        {
            "ioc_value": "7plpf.spryvolt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 03:57:30",
            "last_seen_utc": "2025-11-12 04:01:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638847": [
        {
            "ioc_value": "esa.spryvolt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 03:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638846": [
        {
            "ioc_value": "labs.spryvolt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 03:35:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638845": [
        {
            "ioc_value": "trail3.knackquill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 03:27:07",
            "last_seen_utc": "2025-11-12 03:28:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638844": [
        {
            "ioc_value": "gv8.knackquill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 03:18:22",
            "last_seen_utc": "2025-11-12 03:19:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638843": [
        {
            "ioc_value": "7q.knackquill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 03:08:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638842": [
        {
            "ioc_value": "loom5.rumblekin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 02:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638839": [
        {
            "ioc_value": "labs.eonlinesuccess.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-12 02:51:19",
            "last_seen_utc": "2025-12-14 11:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638838": [
        {
            "ioc_value": "host-winds.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-12 02:51:17",
            "last_seen_utc": "2025-12-13 13:49:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638837": [
        {
            "ioc_value": "edu.eonlinesuccess.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-12 02:51:15",
            "last_seen_utc": "2025-12-14 11:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638836": [
        {
            "ioc_value": "courses.eonlinesuccess.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-12 02:51:13",
            "last_seen_utc": "2025-12-14 11:48:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638835": [
        {
            "ioc_value": "ignite6.rumblekin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 02:47:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638834": [
        {
            "ioc_value": "quark1.rumblekin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 02:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638833": [
        {
            "ioc_value": "u1yee.spry-volt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 02:27:45",
            "last_seen_utc": "2025-11-12 02:33:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638832": [
        {
            "ioc_value": "kz17u.spry-volt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 02:17:28",
            "last_seen_utc": "2025-11-12 02:22:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638831": [
        {
            "ioc_value": "blink.spry-volt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 02:07:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638829": [
        {
            "ioc_value": "b8.c-0-sm-1-cweld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 01:57:22",
            "last_seen_utc": "2025-11-12 02:02:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638828": [
        {
            "ioc_value": "ggww.c-0-sm-1-cweld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 01:48:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638826": [
        {
            "ioc_value": "v8im.c-0-sm-1-cweld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 01:37:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638825": [
        {
            "ioc_value": "quark5.glitch-pact.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 01:27:43",
            "last_seen_utc": "2025-11-12 01:34:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638824": [
        {
            "ioc_value": "fyp.glitch-pact.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 01:17:57",
            "last_seen_utc": "2025-11-12 01:19:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638823": [
        {
            "ioc_value": "1olj.glitch-pact.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 01:07:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638822": [
        {
            "ioc_value": "hiv8.polywhiz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 00:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638821": [
        {
            "ioc_value": "2yn.polywhiz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 00:47:28",
            "last_seen_utc": "2025-11-12 00:50:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638820": [
        {
            "ioc_value": "nova7.polywhiz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 00:37:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638819": [
        {
            "ioc_value": "xi.v3ctorplum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 00:28:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638818": [
        {
            "ioc_value": "vector.v3ctorplum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 00:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638817": [
        {
            "ioc_value": "7qti.v3ctorplum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-12 00:08:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638813": [
        {
            "ioc_value": "q2q.joltberry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 23:57:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638812": [
        {
            "ioc_value": "grid.joltberry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 23:49:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638811": [
        {
            "ioc_value": "forge.joltberry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 23:37:50",
            "last_seen_utc": "2025-11-11 23:38:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638810": [
        {
            "ioc_value": "vale4.zenbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 23:27:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638809": [
        {
            "ioc_value": "g6ur4.zenbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 23:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638808": [
        {
            "ioc_value": "crest.zenbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 23:07:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638794": [
        {
            "ioc_value": "thvs.glitchpact.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 22:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638793": [
        {
            "ioc_value": "shift2.glitchpact.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 22:48:11",
            "last_seen_utc": "2025-11-11 22:49:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638792": [
        {
            "ioc_value": "q6lhy.glitchpact.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 22:36:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638790": [
        {
            "ioc_value": "23jn.fluxcrate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 22:28:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638789": [
        {
            "ioc_value": "yq2z.fluxcrate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 22:19:52",
            "last_seen_utc": "2025-11-11 22:24:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638787": [
        {
            "ioc_value": "byte2.fluxcrate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 22:07:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638785": [
        {
            "ioc_value": "ock.turbotap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 21:57:29",
            "last_seen_utc": "2025-11-11 22:04:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638784": [
        {
            "ioc_value": "73k03.turbotap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 21:47:43",
            "last_seen_utc": "2025-11-11 21:53:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638783": [
        {
            "ioc_value": "7ws9g.turbotap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 21:37:23",
            "last_seen_utc": "2025-11-11 21:37:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638782": [
        {
            "ioc_value": "oe723.b-3-aconz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 21:27:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638781": [
        {
            "ioc_value": "3o9.b-3-aconz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 21:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638780": [
        {
            "ioc_value": "gvh.b-3-aconz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 21:08:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638779": [
        {
            "ioc_value": "7mj20.turbo-tap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 20:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638778": [
        {
            "ioc_value": "orbit2.turbo-tap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 20:47:58",
            "last_seen_utc": "2025-11-11 20:54:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638777": [
        {
            "ioc_value": "mi.turbo-tap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 20:37:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638776": [
        {
            "ioc_value": "forge9.codecog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 20:28:24",
            "last_seen_utc": "2025-11-11 20:31:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638775": [
        {
            "ioc_value": "rto.codecog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 20:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638773": [
        {
            "ioc_value": "ib.codecog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 20:07:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638770": [
        {
            "ioc_value": "j0.b3aconz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 19:57:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638769": [
        {
            "ioc_value": "2n.b3aconz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 19:44:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638768": [
        {
            "ioc_value": "x2u4v.b3aconz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 19:40:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638760": [
        {
            "ioc_value": "phase7.zimloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 19:24:39",
            "last_seen_utc": "2025-11-11 19:33:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638758": [
        {
            "ioc_value": "q7dj.zimloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 19:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638756": [
        {
            "ioc_value": "jet.zimloop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 19:07:34",
            "last_seen_utc": "2025-11-11 19:08:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638755": [
        {
            "ioc_value": "krk.halfquark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 18:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638752": [
        {
            "ioc_value": "490.halfquark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 18:47:24",
            "last_seen_utc": "2025-11-11 18:54:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638746": [
        {
            "ioc_value": "8o6.halfquark.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 18:38:07",
            "last_seen_utc": "2025-11-11 18:43:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638745": [
        {
            "ioc_value": "mb3.acidwrench.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 18:27:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638744": [
        {
            "ioc_value": "loom.acidwrench.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 18:17:02",
            "last_seen_utc": "2025-11-11 18:18:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638743": [
        {
            "ioc_value": "pooun.acidwrench.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 18:12:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638742": [
        {
            "ioc_value": "b0t.drift-meadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 18:08:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638739": [
        {
            "ioc_value": "ax20258888.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-11 18:03:27",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251111-wege2shq8v",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638737": [
        {
            "ioc_value": "StreamerBonFire.1cooldns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-11 18:01:46",
            "last_seen_utc": "2025-12-12 18:38:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251111-pvj3jswlhz",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638736": [
        {
            "ioc_value": "miloquilla.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-11 18:01:45",
            "last_seen_utc": "2025-12-12 18:38:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251111-sga49sfq61",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638735": [
        {
            "ioc_value": "hufhhfgfuandununcudcnjdncjndcnjdchdhfuan.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-11 18:01:32",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251111-s9svsaypb1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638733": [
        {
            "ioc_value": "log-surplus.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-11 18:01:22",
            "last_seen_utc": "2025-12-12 18:39:23",
            "confidence_level": 100,
            "reference": "https://tria.ge/251111-srk28axrbr",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638731": [
        {
            "ioc_value": "n7y.drift-meadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 17:56:52",
            "last_seen_utc": "2025-11-11 18:03:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638697": [
        {
            "ioc_value": "byspotikfy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-11 17:51:38",
            "last_seen_utc": "2025-11-11 15:12:04",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115531704850510626",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1638702": [
        {
            "ioc_value": "howelllanddevelopment.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-11 17:51:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115531704850510626",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1638729": [
        {
            "ioc_value": "flow.drift-meadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 17:45:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638728": [
        {
            "ioc_value": "z3x.drift-meadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 17:31:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638727": [
        {
            "ioc_value": "m2q.storm-ripple.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 17:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638726": [
        {
            "ioc_value": "p1k.storm-ripple.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 17:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638725": [
        {
            "ioc_value": "stormy.storm-ripple.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 17:05:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638724": [
        {
            "ioc_value": "r4t.storm-ripple.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 16:57:04",
            "last_seen_utc": "2025-11-11 17:04:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638723": [
        {
            "ioc_value": "q5x.crystalcavern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 16:41:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638722": [
        {
            "ioc_value": "v6n.crystalcavern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 16:36:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638721": [
        {
            "ioc_value": "gleam.crystalcavern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 16:26:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638720": [
        {
            "ioc_value": "c2r.crystalcavern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 16:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638717": [
        {
            "ioc_value": "s9p.driftmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 16:07:05",
            "last_seen_utc": "2025-11-11 16:08:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638707": [
        {
            "ioc_value": "meadow.driftmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 15:57:18",
            "last_seen_utc": "2025-11-11 15:57:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638706": [
        {
            "ioc_value": "l0v.driftmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 15:45:26",
            "last_seen_utc": "2025-11-11 15:49:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638705": [
        {
            "ioc_value": "w3b.driftmeadow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 15:37:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638704": [
        {
            "ioc_value": "h7x.glimmerstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 15:27:23",
            "last_seen_utc": "2025-11-11 15:28:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638703": [
        {
            "ioc_value": "r2m.glimmerstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 15:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638695": [
        {
            "ioc_value": "spark.glimmerstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 15:01:43",
            "last_seen_utc": "2025-11-11 15:07:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638694": [
        {
            "ioc_value": "g4v.glimmerstone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 14:56:25",
            "last_seen_utc": "2025-11-11 14:56:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638693": [
        {
            "ioc_value": "dawn.emberfrontier.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 14:43:34",
            "last_seen_utc": "2025-11-11 14:46:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638691": [
        {
            "ioc_value": "f8t.emberfrontier.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 14:33:50",
            "last_seen_utc": "2025-11-11 14:39:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638690": [
        {
            "ioc_value": "q1r.emberfrontier.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 14:23:24",
            "last_seen_utc": "2025-11-11 14:23:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638688": [
        {
            "ioc_value": "ember.emberfrontier.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 14:17:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638687": [
        {
            "ioc_value": "h2p.rivermote.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 14:07:25",
            "last_seen_utc": "2025-11-11 14:12:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638685": [
        {
            "ioc_value": "n4s.rivermote.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 13:55:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638684": [
        {
            "ioc_value": "wave.rivermote.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 13:50:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638683": [
        {
            "ioc_value": "t9d.rivermote.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 13:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638682": [
        {
            "ioc_value": "z8n2.st0nesurge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 13:37:58",
            "last_seen_utc": "2025-11-11 13:43:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638681": [
        {
            "ioc_value": "rift.st0nesurge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 13:27:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638680": [
        {
            "ioc_value": "m5k.st0nesurge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 13:18:55",
            "last_seen_utc": "2025-11-11 13:19:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638679": [
        {
            "ioc_value": "x3y.st0nesurge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 13:15:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638678": [
        {
            "ioc_value": "q7z.opalhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 13:12:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638677": [
        {
            "ioc_value": "bloom.opalhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 13:04:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638675": [
        {
            "ioc_value": "r0c.opalhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 12:57:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638674": [
        {
            "ioc_value": "shadowqueueflow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-11 12:53:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638673": [
        {
            "ioc_value": "l2u.opalhollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 12:48:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638672": [
        {
            "ioc_value": "v3n2.opal-hollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 12:37:21",
            "last_seen_utc": "2025-11-11 12:37:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638671": [
        {
            "ioc_value": "g8f.opal-hollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 12:28:01",
            "last_seen_utc": "2025-11-11 12:29:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638670": [
        {
            "ioc_value": "mist.opal-hollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 12:24:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638669": [
        {
            "ioc_value": "p2q.opal-hollow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 12:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638668": [
        {
            "ioc_value": "sun.drift-bay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 12:07:56",
            "last_seen_utc": "2025-11-11 12:13:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638667": [
        {
            "ioc_value": "hours-morrison.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-11 12:03:05",
            "last_seen_utc": "2025-12-12 18:39:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/251111-mgdmhatlgz",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638657": [
        {
            "ioc_value": "x5m.drift-bay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 11:57:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638656": [
        {
            "ioc_value": "k9r2.drift-bay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 11:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638655": [
        {
            "ioc_value": "fh.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 11:37:43",
            "last_seen_utc": "2025-11-11 11:39:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638653": [
        {
            "ioc_value": "iqht.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 11:27:25",
            "last_seen_utc": "2025-11-11 11:36:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638630": [
        {
            "ioc_value": "cronapiworkersvc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-11 11:09:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1638652": [
        {
            "ioc_value": "o3b.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 11:07:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638632": [
        {
            "ioc_value": "j6wk.gyrodesk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 10:55:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638631": [
        {
            "ioc_value": "bot.windy.wtf",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-11 10:52:03",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0757c866d5c7562c3f53d5afac838ea9b4e1621824f1c6195128091619d48082/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638628": [
        {
            "ioc_value": "www.nfdws.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-11 10:48:57",
            "last_seen_utc": "2025-12-14 11:48:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638627": [
        {
            "ioc_value": "y3a81.gyrodesk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 10:47:51",
            "last_seen_utc": "2025-11-11 10:48:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638625": [
        {
            "ioc_value": "core.gyrodesk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 10:35:01",
            "last_seen_utc": "2025-11-11 10:36:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638624": [
        {
            "ioc_value": "r54v.qu1rkfuse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 10:27:47",
            "last_seen_utc": "2025-11-11 10:28:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638623": [
        {
            "ioc_value": "2iz.qu1rkfuse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 10:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638284": [
        {
            "ioc_value": "flosinjs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-11 10:17:01",
            "last_seen_utc": "2025-11-10 19:08:24",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115526971785072487",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1638289": [
        {
            "ioc_value": "eco-technic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-11 10:16:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115526971785072487",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1638621": [
        {
            "ioc_value": "137z.qu1rkfuse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 10:07:47",
            "last_seen_utc": "2025-11-11 10:07:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638616": [
        {
            "ioc_value": "flux.qu1rkfuse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 09:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638615": [
        {
            "ioc_value": "blink.v1b3forge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 09:48:40",
            "last_seen_utc": "2025-11-11 09:49:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638614": [
        {
            "ioc_value": "glaug.v1b3forge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 09:39:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638613": [
        {
            "ioc_value": "yoz.v1b3forge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 09:28:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638612": [
        {
            "ioc_value": "vbq6.v1b3forge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 09:19:58",
            "last_seen_utc": "2025-11-11 09:20:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1638611": [
        {
            "ioc_value": "f9r.v0rt3xlab.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 09:01:48",
            "last_seen_utc": "2025-11-11 09:13:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638610": [
        {
            "ioc_value": "grid.v0rt3xlab.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 08:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638605": [
        {
            "ioc_value": "vcv.v0rt3xlab.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 08:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638601": [
        {
            "ioc_value": "2n6w.v0rt3xlab.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 08:37:49",
            "last_seen_utc": "2025-11-11 08:38:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638600": [
        {
            "ioc_value": "4ym.gyro-desk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 08:27:30",
            "last_seen_utc": "2025-11-11 08:34:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638599": [
        {
            "ioc_value": "ignite.gyro-desk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 08:18:19",
            "last_seen_utc": "2025-11-11 08:19:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638598": [
        {
            "ioc_value": "anchor0.gyro-desk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 08:06:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638584": [
        {
            "ioc_value": "zzto.gyro-desk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 07:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638583": [
        {
            "ioc_value": "filojaspergloplas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-11 07:50:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.27",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638582": [
        {
            "ioc_value": "sisternoybabuyeriklow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-11 07:49:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.29",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638581": [
        {
            "ioc_value": "byte3.b1tcrush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 07:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638580": [
        {
            "ioc_value": "biklomanymonerteotr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-11 07:48:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.28",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638579": [
        {
            "ioc_value": "kashrykkskcjfkkdks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-11-11 07:45:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.243.102",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638577": [
        {
            "ioc_value": "shadowqueueflow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-11 07:43:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638578": [
        {
            "ioc_value": "diariodetaubateregiao.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-11 07:43:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638573": [
        {
            "ioc_value": "grandthl.grandthl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-11 07:42:19",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638574": [
        {
            "ioc_value": "mpannukwunaanuomo.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-11 07:42:19",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638575": [
        {
            "ioc_value": "winningisamust285.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-11 07:42:19",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638566": [
        {
            "ioc_value": "srgsiuhedufiusif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638567": [
        {
            "ioc_value": "srgsiuhedufiusy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638568": [
        {
            "ioc_value": "sriuedueiuiefgif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638569": [
        {
            "ioc_value": "sriuedueiuiefgy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638570": [
        {
            "ioc_value": "uaihefiuieagugif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638571": [
        {
            "ioc_value": "utdifguizdidizif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638572": [
        {
            "ioc_value": "utdifguizdidizy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638548": [
        {
            "ioc_value": "sefuhsuifhishffo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638549": [
        {
            "ioc_value": "sefuhsuifhishfif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638550": [
        {
            "ioc_value": "sefuhsuifhishfy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638551": [
        {
            "ioc_value": "seiiamefiaigaeif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638552": [
        {
            "ioc_value": "seiiamefiaigaey.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638553": [
        {
            "ioc_value": "sfiushiudneineif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638554": [
        {
            "ioc_value": "sfiushiudneiney.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638555": [
        {
            "ioc_value": "sfuhseidueiihfif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638556": [
        {
            "ioc_value": "sfuhseidueiihfy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638557": [
        {
            "ioc_value": "sirfuhsihfiugrif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638558": [
        {
            "ioc_value": "sirfuhsihfiugry.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638559": [
        {
            "ioc_value": "sisfiusnrsruisif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638560": [
        {
            "ioc_value": "siufhseifhurgrif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638561": [
        {
            "ioc_value": "siufhseifhurgry.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638562": [
        {
            "ioc_value": "sndiuenidniueiif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638563": [
        {
            "ioc_value": "soijodneoiauoeif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638564": [
        {
            "ioc_value": "srgsifijsjigjhif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638565": [
        {
            "ioc_value": "srgsifijsjigjhy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638547": [
        {
            "ioc_value": "ofeideinieghihy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638533": [
        {
            "ioc_value": "fiueafnuieniuaif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638534": [
        {
            "ioc_value": "fiueafnuieniuay.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638535": [
        {
            "ioc_value": "fiuehiaueifuiiif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638536": [
        {
            "ioc_value": "fiuehiaueifuiiy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638537": [
        {
            "ioc_value": "fnauendaieghidif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638538": [
        {
            "ioc_value": "fsoufsefenugnuif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638539": [
        {
            "ioc_value": "fsoufsefenugnuy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638540": [
        {
            "ioc_value": "giuediaudnudunif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638541": [
        {
            "ioc_value": "iandiwuiwnnuguif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638542": [
        {
            "ioc_value": "iandiwuiwnnuguy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638543": [
        {
            "ioc_value": "ifuhaeiuaeuigrif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638544": [
        {
            "ioc_value": "ifuhaeiuaeuigry.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638545": [
        {
            "ioc_value": "iusrhiufhsirurif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638546": [
        {
            "ioc_value": "ofeideinieghihif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638522": [
        {
            "ioc_value": "botbox.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638523": [
        {
            "ioc_value": "diowiwiiwinfifif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638524": [
        {
            "ioc_value": "diowiwiiwinfify.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638525": [
        {
            "ioc_value": "eaojefiuaugueuif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638526": [
        {
            "ioc_value": "eioeiufuisefniif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638527": [
        {
            "ioc_value": "eiufhiedniunegif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638528": [
        {
            "ioc_value": "eiufhiedniunegy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638529": [
        {
            "ioc_value": "ffoeefsheuesihif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638530": [
        {
            "ioc_value": "fieooeoafheifiif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638531": [
        {
            "ioc_value": "fisiejdajijejgif.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638532": [
        {
            "ioc_value": "fisiejdajijejgy.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-11 07:42:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638430": [
        {
            "ioc_value": "bot.thorcc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-11 07:41:03",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638431": [
        {
            "ioc_value": "cnc.erebusc2.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-11 07:41:03",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638429": [
        {
            "ioc_value": "onlysunset.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-11 07:40:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638422": [
        {
            "ioc_value": "listing-bracelets.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-11 07:39:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638423": [
        {
            "ioc_value": "miloquilla.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-11 07:39:41",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638424": [
        {
            "ioc_value": "v2.xoilaczzazz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-11 07:39:41",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638425": [
        {
            "ioc_value": "v3.xoilaczzazz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-11 07:39:41",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638419": [
        {
            "ioc_value": "zs.b1tcrush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 07:38:06",
            "last_seen_utc": "2025-11-11 07:38:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638416": [
        {
            "ioc_value": "c9b8v.b1tcrush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 07:27:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638415": [
        {
            "ioc_value": "wkck4.b1tcrush.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 07:18:03",
            "last_seen_utc": "2025-11-11 07:20:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638414": [
        {
            "ioc_value": "6h7s.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 07:07:31",
            "last_seen_utc": "2025-11-11 07:17:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638413": [
        {
            "ioc_value": "i0.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 06:57:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638412": [
        {
            "ioc_value": "orbit.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 06:47:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638411": [
        {
            "ioc_value": "2m42.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 06:33:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638410": [
        {
            "ioc_value": "shift.gyrodesk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 06:27:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638409": [
        {
            "ioc_value": "5nyo.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 06:16:56",
            "last_seen_utc": "2025-11-11 06:23:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638407": [
        {
            "ioc_value": "computer-table.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-11 06:05:11",
            "last_seen_utc": "2025-12-12 18:39:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/251111-bewjraxldv",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638404": [
        {
            "ioc_value": "o5r.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 06:02:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638403": [
        {
            "ioc_value": "h0p9.zap-kinetic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 05:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638402": [
        {
            "ioc_value": "node3.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 05:47:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638401": [
        {
            "ioc_value": "phase7.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 05:37:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638400": [
        {
            "ioc_value": "1t1v5.proxyjet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 05:27:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638399": [
        {
            "ioc_value": "va.deltasync.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 05:17:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638398": [
        {
            "ioc_value": "loom.deltasync.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 05:06:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638397": [
        {
            "ioc_value": "mn.deltasync.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 04:51:02",
            "last_seen_utc": "2025-11-11 04:53:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638396": [
        {
            "ioc_value": "ak.kairosmix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 04:41:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638394": [
        {
            "ioc_value": "8f2q.kairosmix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 04:37:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638393": [
        {
            "ioc_value": "phase5.kairosmix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 04:27:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638392": [
        {
            "ioc_value": "xxzu.plum-wav-ru.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 04:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638391": [
        {
            "ioc_value": "p6b.plum-wav-ru.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 04:07:48",
            "last_seen_utc": "2025-11-11 04:08:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638370": [
        {
            "ioc_value": "cg.plum-wav-ru.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 03:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638369": [
        {
            "ioc_value": "rift.zapkinetic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 03:47:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638368": [
        {
            "ioc_value": "cwc.zapkinetic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 03:37:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638367": [
        {
            "ioc_value": "vector.zapkinetic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 03:27:05",
            "last_seen_utc": "2025-11-11 03:33:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638366": [
        {
            "ioc_value": "drift.brambleholt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 03:14:46",
            "last_seen_utc": "2025-11-11 03:20:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638365": [
        {
            "ioc_value": "ircq.brambleholt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 03:08:02",
            "last_seen_utc": "2025-11-11 03:09:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638364": [
        {
            "ioc_value": "r0q.brambleholt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 02:57:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638360": [
        {
            "ioc_value": "microsoft-schtask.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-11 02:48:34",
            "last_seen_utc": "2025-12-14 11:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638359": [
        {
            "ioc_value": "csstatus.0nlinecc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-11 02:48:29",
            "last_seen_utc": "2025-12-14 11:48:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638357": [
        {
            "ioc_value": "back.softwarecommerce.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-11 02:48:26",
            "last_seen_utc": "2025-12-14 11:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638358": [
        {
            "ioc_value": "backoffice.softwarecommerce.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-11 02:48:26",
            "last_seen_utc": "2025-12-14 11:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638356": [
        {
            "ioc_value": "api.softwarecommerce.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-11 02:48:25",
            "last_seen_utc": "2025-12-14 11:48:02",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638355": [
        {
            "ioc_value": "21.stormcairn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 02:47:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638354": [
        {
            "ioc_value": "t7x.stormcairn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 02:31:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638353": [
        {
            "ioc_value": "rchh0.stormcairn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 02:28:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638352": [
        {
            "ioc_value": "brook.ember-glade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 01:47:42",
            "last_seen_utc": "2025-11-11 02:03:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638351": [
        {
            "ioc_value": "bl2eu.ember-glade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 01:37:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638350": [
        {
            "ioc_value": "qpn.ember-glade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 01:27:37",
            "last_seen_utc": "2025-11-11 01:28:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638349": [
        {
            "ioc_value": "glen.g0ldenspire.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 01:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638348": [
        {
            "ioc_value": "dfh.g0ldenspire.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 01:07:34",
            "last_seen_utc": "2025-11-11 01:09:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638347": [
        {
            "ioc_value": "lhf.g0ldenspire.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 00:57:16",
            "last_seen_utc": "2025-11-11 01:05:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638346": [
        {
            "ioc_value": "04ck.fr0stharrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 00:48:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638345": [
        {
            "ioc_value": "shade.fr0stharrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 00:36:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638344": [
        {
            "ioc_value": "vlrbq.fr0stharrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-11 00:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638339": [
        {
            "ioc_value": "flood.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-11 00:01:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.199.109.153+flood.ink",
            "tags": "AS54113,C2,censys,FASTLY,panel,Phantom,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638295": [
        {
            "ioc_value": "f5.night-bloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 19:57:53",
            "last_seen_utc": "2025-11-10 20:08:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638294": [
        {
            "ioc_value": "glade.night-bloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 19:48:06",
            "last_seen_utc": "2025-11-10 19:53:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638293": [
        {
            "ioc_value": "0ti.night-bloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 19:37:48",
            "last_seen_utc": "2025-11-10 19:43:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638292": [
        {
            "ioc_value": "ember.sh4d0wmere.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 19:26:30",
            "last_seen_utc": "2025-11-10 19:32:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638291": [
        {
            "ioc_value": "thorn.sh4d0wmere.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 19:21:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638265": [
        {
            "ioc_value": "dnsoksasa42424.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-10 18:01:28",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-qd3n1ayman",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638266": [
        {
            "ioc_value": "dnsalahsoso.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-10 18:01:28",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-plr2ssgk6x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638263": [
        {
            "ioc_value": "dau8ojire7paosr3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-10 18:01:22",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-s5ga7ahp8s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638264": [
        {
            "ioc_value": "dau8ojire7paosr4.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-10 18:01:22",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-s5ga7ahp8s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638261": [
        {
            "ioc_value": "dau8ojire7paosr1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-10 18:01:21",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-s5ga7ahp8s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638262": [
        {
            "ioc_value": "dau8ojire7paosr2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-10 18:01:21",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-s5ga7ahp8s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638259": [
        {
            "ioc_value": "hahhahahdauh-46698.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-10 18:01:13",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-st6fya1jgy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638258": [
        {
            "ioc_value": "choice-thompson.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-10 18:01:12",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-t9w3wa1pgw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638246": [
        {
            "ioc_value": "www.novamint.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-10 16:23:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1811470/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638247": [
        {
            "ioc_value": "www.theciphera.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-10 16:23:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1811470/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638248": [
        {
            "ioc_value": "www.clearairways1st.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-10 16:23:26",
            "last_seen_utc": "2025-11-10 16:23:26",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1811470/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638241": [
        {
            "ioc_value": "www.foxbet69.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-10 16:23:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1811470/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638242": [
        {
            "ioc_value": "www.rocketkava.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-10 16:23:25",
            "last_seen_utc": "2025-11-10 16:23:25",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1811470/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638243": [
        {
            "ioc_value": "www.nonamesms.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-10 16:23:25",
            "last_seen_utc": "2025-11-10 16:23:26",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1811470/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638244": [
        {
            "ioc_value": "www.trazeo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-10 16:23:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1811470/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638245": [
        {
            "ioc_value": "www.buymydomain.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-10 16:23:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1811470/0/html",
            "tags": "c2,domain,Formbook,joesandbox",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638235": [
        {
            "ioc_value": "secret-api.feriwaale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-10 16:02:54",
            "last_seen_utc": "2025-11-10 23:00:35",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/206.189.138.99+secret-api.feriwaale.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638192": [
        {
            "ioc_value": "ak1.xingxings.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-10 15:53:54",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 88,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1638225": [
        {
            "ioc_value": "lumen.sh4d0wmere.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 14:46:50",
            "last_seen_utc": "2025-11-10 15:08:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638224": [
        {
            "ioc_value": "pike.ci2udforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 14:27:18",
            "last_seen_utc": "2025-11-10 14:44:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638223": [
        {
            "ioc_value": "moor.ci2udforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 14:18:59",
            "last_seen_utc": "2025-11-10 14:25:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638222": [
        {
            "ioc_value": "nxe.ci2udforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 14:08:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638221": [
        {
            "ioc_value": "hsew.m1stwander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 13:57:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638220": [
        {
            "ioc_value": "crest.m1stwander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 13:54:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638219": [
        {
            "ioc_value": "haze.m1stwander.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 13:42:56",
            "last_seen_utc": "2025-11-10 13:49:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638218": [
        {
            "ioc_value": "jp6.ic0n1cshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 13:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638217": [
        {
            "ioc_value": "dygn8.ic0n1cshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 13:28:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638216": [
        {
            "ioc_value": "am89.ic0n1cshore.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 13:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638215": [
        {
            "ioc_value": "t0.emberglade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 13:17:31",
            "last_seen_utc": "2025-11-10 13:25:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638214": [
        {
            "ioc_value": "silver.emberglade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 13:07:14",
            "last_seen_utc": "2025-11-10 13:16:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638213": [
        {
            "ioc_value": "32.emberglade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 12:57:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638212": [
        {
            "ioc_value": "7e8g.brambleforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 12:48:12",
            "last_seen_utc": "2025-11-10 12:57:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638211": [
        {
            "ioc_value": "ixo.brambleforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 12:38:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638210": [
        {
            "ioc_value": "nb.brambleforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 12:25:04",
            "last_seen_utc": "2025-11-10 12:37:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638209": [
        {
            "ioc_value": "5a0.ember-cross.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 12:17:50",
            "last_seen_utc": "2025-11-10 12:23:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638208": [
        {
            "ioc_value": "25ow.ember-cross.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 12:07:37",
            "last_seen_utc": "2025-11-10 12:13:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638202": [
        {
            "ioc_value": "colleststride.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-10 12:01:13",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-jsmsrstkcm",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638203": [
        {
            "ioc_value": "feelloosctoery.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-10 12:01:13",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-jsmsrstkcm",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638199": [
        {
            "ioc_value": "executive-difficulty.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-10 12:01:12",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-l7pa9awlan",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638200": [
        {
            "ioc_value": "sgmzsw4rj64nb.mooo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-10 12:01:12",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-l2rt7awjgl",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638201": [
        {
            "ioc_value": "rasbeencollect.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-10 12:01:12",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-jsmsrstkcm",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1638196": [
        {
            "ioc_value": "ufel.ember-cross.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 11:57:46",
            "last_seen_utc": "2025-11-10 12:04:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638195": [
        {
            "ioc_value": "fpzu.ic0n1cvalley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 11:45:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638194": [
        {
            "ioc_value": "sj6b.ic0n1cvalley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 11:41:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638193": [
        {
            "ioc_value": "j60.ic0n1cvalley.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 11:38:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638191": [
        {
            "ioc_value": "ptk.0-pal-summit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 11:29:19",
            "last_seen_utc": "2025-11-10 11:30:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638190": [
        {
            "ioc_value": "ch.0-pal-summit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 11:21:05",
            "last_seen_utc": "2025-11-10 11:22:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638189": [
        {
            "ioc_value": "fox.0-pal-summit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 11:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638188": [
        {
            "ioc_value": "wp.frost-wilder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 11:14:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638186": [
        {
            "ioc_value": "drift.frost-wilder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 11:04:58",
            "last_seen_utc": "2025-11-10 11:13:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638171": [
        {
            "ioc_value": "www.feft234321.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-10 11:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.229.126.183+www.feft234321.xyz",
            "tags": "AS139659,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1638170": [
        {
            "ioc_value": "br.frost-wilder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 10:57:44",
            "last_seen_utc": "2025-11-10 11:04:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638168": [
        {
            "ioc_value": "csonxwhattest12137.oss-cn-beijing.aliyuncs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-10 10:49:23",
            "last_seen_utc": "2025-12-10 09:49:23",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1638167": [
        {
            "ioc_value": "oak.0palsummit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 10:40:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638166": [
        {
            "ioc_value": "hocn9.0palsummit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 10:37:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638165": [
        {
            "ioc_value": "lumen.0palsummit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 10:27:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638164": [
        {
            "ioc_value": "echo.embercross.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 10:15:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638163": [
        {
            "ioc_value": "marsh.embercross.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 10:12:26",
            "last_seen_utc": "2025-11-10 10:15:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638162": [
        {
            "ioc_value": "irodx.embercross.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 10:08:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638161": [
        {
            "ioc_value": "sage.m-1-dnightr-0-ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 09:52:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638158": [
        {
            "ioc_value": "north.m-1-dnightr-0-ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 09:47:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638157": [
        {
            "ioc_value": "zoy.m-1-dnightr-0-ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 09:43:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638156": [
        {
            "ioc_value": "flare.frost-wilder.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 09:37:13",
            "last_seen_utc": "2025-11-10 09:38:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638155": [
        {
            "ioc_value": "glow.frost-wilder.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 09:29:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638154": [
        {
            "ioc_value": "a753l.frost-wilder.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 09:26:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638153": [
        {
            "ioc_value": "4shn.t1decrystai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 09:17:33",
            "last_seen_utc": "2025-11-10 09:18:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638152": [
        {
            "ioc_value": "epq8.t1decrystai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 09:07:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638151": [
        {
            "ioc_value": "vnvqj.t1decrystai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 08:57:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638138": [
        {
            "ioc_value": "rift.cioudharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 08:44:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638137": [
        {
            "ioc_value": "vale.cioudharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 08:37:24",
            "last_seen_utc": "2025-11-10 08:43:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638136": [
        {
            "ioc_value": "pine.cioudharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 08:27:07",
            "last_seen_utc": "2025-11-10 08:27:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638135": [
        {
            "ioc_value": "ib.stormglade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 08:18:21",
            "last_seen_utc": "2025-11-10 08:23:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638134": [
        {
            "ioc_value": "tiq.stormglade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 08:08:07",
            "last_seen_utc": "2025-11-10 08:09:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638119": [
        {
            "ioc_value": "crest.stormglade.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 07:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637439": [
        {
            "ioc_value": "casuapw.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:57",
            "last_seen_utc": "2025-11-21 23:37:31",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637440": [
        {
            "ioc_value": "diapsxi.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:57",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637441": [
        {
            "ioc_value": "concoct.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:57",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637442": [
        {
            "ioc_value": "fourtaa.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:56",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637444": [
        {
            "ioc_value": "pastrzc.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:55",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637443": [
        {
            "ioc_value": "reddedi.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:54",
            "last_seen_utc": "2025-11-25 15:31:38",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637446": [
        {
            "ioc_value": "parensm.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:53",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637445": [
        {
            "ioc_value": "pollaug.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:52",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637447": [
        {
            "ioc_value": "pursecm.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:52",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637448": [
        {
            "ioc_value": "plateom.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:51",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637449": [
        {
            "ioc_value": "russiuo.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:50",
            "last_seen_utc": "2025-11-25 15:31:38",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637450": [
        {
            "ioc_value": "tilliwp.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:50",
            "last_seen_utc": "2025-11-21 23:37:31",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637665": [
        {
            "ioc_value": "diveuleq.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:50",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637668": [
        {
            "ioc_value": "underem.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:49",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637669": [
        {
            "ioc_value": "hawkibnh.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:48",
            "last_seen_utc": "2025-11-16 22:14:20",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1637672": [
        {
            "ioc_value": "cycvmix.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-10 07:51:48",
            "last_seen_utc": "2025-11-16 22:14:20",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1638118": [
        {
            "ioc_value": "x1.m1dnightr0ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 07:48:01",
            "last_seen_utc": "2025-11-10 07:51:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638117": [
        {
            "ioc_value": "9n.m1dnightr0ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 07:37:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638116": [
        {
            "ioc_value": "h1d.m1dnightr0ad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 07:27:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638115": [
        {
            "ioc_value": "mica.frostwilder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 07:15:36",
            "last_seen_utc": "2025-11-10 07:26:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638114": [
        {
            "ioc_value": "bh.frostwilder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 07:08:23",
            "last_seen_utc": "2025-11-10 07:12:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1638113": [
        {
            "ioc_value": "epicport0304km-39818.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-10 06:59:41",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638110": [
        {
            "ioc_value": "servercode.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-10 06:59:03",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638106": [
        {
            "ioc_value": "xawihouneouabkuon.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638107": [
        {
            "ioc_value": "xawihouneouabkuon.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638108": [
        {
            "ioc_value": "xawihouneouabkuon.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638089": [
        {
            "ioc_value": "uikibihurbgubcnns.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638090": [
        {
            "ioc_value": "uikibihurbgubcnns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638091": [
        {
            "ioc_value": "uikibihurbgubcnns.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638092": [
        {
            "ioc_value": "uikibihurbgubcnns.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638093": [
        {
            "ioc_value": "uikibihurbgubcnns.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638094": [
        {
            "ioc_value": "uikibihurbgubcnns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638095": [
        {
            "ioc_value": "uikibihurbgubcnns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638096": [
        {
            "ioc_value": "uikibihurbgubcnns.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638097": [
        {
            "ioc_value": "uikibihurbgubcnns.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638098": [
        {
            "ioc_value": "uikibihurbgubcnns.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638099": [
        {
            "ioc_value": "xawihouneouabkuon.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638100": [
        {
            "ioc_value": "xawihouneouabkuon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638101": [
        {
            "ioc_value": "xawihouneouabkuon.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638102": [
        {
            "ioc_value": "xawihouneouabkuon.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638103": [
        {
            "ioc_value": "xawihouneouabkuon.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638104": [
        {
            "ioc_value": "xawihouneouabkuon.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638105": [
        {
            "ioc_value": "xawihouneouabkuon.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638073": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638074": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638075": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638076": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638077": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638078": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638079": [
        {
            "ioc_value": "oujaneianfoaenonae.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638080": [
        {
            "ioc_value": "oujaneianfoaenonae.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638081": [
        {
            "ioc_value": "oujaneianfoaenonae.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638082": [
        {
            "ioc_value": "oujaneianfoaenonae.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638083": [
        {
            "ioc_value": "oujaneianfoaenonae.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638084": [
        {
            "ioc_value": "oujaneianfoaenonae.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638085": [
        {
            "ioc_value": "oujaneianfoaenonae.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638086": [
        {
            "ioc_value": "oujaneianfoaenonae.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638087": [
        {
            "ioc_value": "oujaneianfoaenonae.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638088": [
        {
            "ioc_value": "oujaneianfoaenonae.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638057": [
        {
            "ioc_value": "ouaneubkuaeencune.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638058": [
        {
            "ioc_value": "ouaneubkuaeencune.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638059": [
        {
            "ioc_value": "ougoeuauenacnuaef.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638060": [
        {
            "ioc_value": "ougoeuauenacnuaef.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638061": [
        {
            "ioc_value": "ougoeuauenacnuaef.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638062": [
        {
            "ioc_value": "ougoeuauenacnuaef.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638063": [
        {
            "ioc_value": "ougoeuauenacnuaef.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638064": [
        {
            "ioc_value": "ougoeuauenacnuaef.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638065": [
        {
            "ioc_value": "ougoeuauenacnuaef.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638066": [
        {
            "ioc_value": "ougoeuauenacnuaef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638067": [
        {
            "ioc_value": "ougoeuauenacnuaef.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638068": [
        {
            "ioc_value": "ougoeuauenacnuaef.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638069": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638070": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638071": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638072": [
        {
            "ioc_value": "ouiufhauebfkiurufiu.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638040": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638041": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638042": [
        {
            "ioc_value": "oplplaepojoajeoacnb.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638043": [
        {
            "ioc_value": "oplplaepojoajeoacnb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638044": [
        {
            "ioc_value": "oplplaepojoajeoacnb.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638045": [
        {
            "ioc_value": "oplplaepojoajeoacnb.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638046": [
        {
            "ioc_value": "oplplaepojoajeoacnb.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638047": [
        {
            "ioc_value": "oplplaepojoajeoacnb.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638048": [
        {
            "ioc_value": "oplplaepojoajeoacnb.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638049": [
        {
            "ioc_value": "oplplaepojoajeoacnb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638050": [
        {
            "ioc_value": "oplplaepojoajeoacnb.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638051": [
        {
            "ioc_value": "oplplaepojoajeoacnb.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638052": [
        {
            "ioc_value": "ouaneubkuaeencune.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638053": [
        {
            "ioc_value": "ouaneubkuaeencune.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638054": [
        {
            "ioc_value": "ouaneubkuaeencune.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638055": [
        {
            "ioc_value": "ouaneubkuaeencune.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638056": [
        {
            "ioc_value": "ouaneubkuaeencune.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638023": [
        {
            "ioc_value": "oaihegohoaneouaec.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638024": [
        {
            "ioc_value": "oaihegohoaneouaec.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638025": [
        {
            "ioc_value": "oeafhouaueunenuf.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638026": [
        {
            "ioc_value": "oeafhouaueunenuf.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638027": [
        {
            "ioc_value": "oeafhouaueunenuf.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638028": [
        {
            "ioc_value": "oeafhouaueunenuf.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638029": [
        {
            "ioc_value": "oeafhouaueunenuf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638030": [
        {
            "ioc_value": "oeafhouaueunenuf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638031": [
        {
            "ioc_value": "oeafhouaueunenuf.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638032": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638033": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638034": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638035": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638036": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638037": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638038": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638039": [
        {
            "ioc_value": "ofhaenjakbhkiabfu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638006": [
        {
            "ioc_value": "oaguahuoeohuanoen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638007": [
        {
            "ioc_value": "oaguahuoeohuanoen.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638008": [
        {
            "ioc_value": "oaguahuoeohuanoen.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638009": [
        {
            "ioc_value": "oaguahuoeohuanoen.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638010": [
        {
            "ioc_value": "oaguahuoeohuanoen.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638011": [
        {
            "ioc_value": "oaguahuoeohuanoen.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638012": [
        {
            "ioc_value": "oaguahuoeohuanoen.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638013": [
        {
            "ioc_value": "oaguahuoeohuanoen.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638014": [
        {
            "ioc_value": "oaguahuoeohuanoen.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638015": [
        {
            "ioc_value": "oaihegohoaneouaec.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638016": [
        {
            "ioc_value": "oaihegohoaneouaec.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638017": [
        {
            "ioc_value": "oaihegohoaneouaec.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638018": [
        {
            "ioc_value": "oaihegohoaneouaec.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638019": [
        {
            "ioc_value": "oaihegohoaneouaec.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638020": [
        {
            "ioc_value": "oaihegohoaneouaec.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638021": [
        {
            "ioc_value": "oaihegohoaneouaec.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638022": [
        {
            "ioc_value": "oaihegohoaneouaec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637990": [
        {
            "ioc_value": "nygieiieiihhigis.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637991": [
        {
            "ioc_value": "nygieiieiihhigis.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637992": [
        {
            "ioc_value": "nygieiieiihhigis.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637993": [
        {
            "ioc_value": "nygieiieiihhigis.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637994": [
        {
            "ioc_value": "nygieiieiihhigis.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637995": [
        {
            "ioc_value": "oaehfuankjbknycbk.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637996": [
        {
            "ioc_value": "oaehfuankjbknycbk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637997": [
        {
            "ioc_value": "oaehfuankjbknycbk.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637998": [
        {
            "ioc_value": "oaehfuankjbknycbk.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637999": [
        {
            "ioc_value": "oaehfuankjbknycbk.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638000": [
        {
            "ioc_value": "oaehfuankjbknycbk.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638001": [
        {
            "ioc_value": "oaehfuankjbknycbk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638002": [
        {
            "ioc_value": "oaehfuankjbknycbk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638003": [
        {
            "ioc_value": "oaehfuankjbknycbk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638004": [
        {
            "ioc_value": "oaehfuankjbknycbk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1638005": [
        {
            "ioc_value": "oaguahuoeohuanoen.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637974": [
        {
            "ioc_value": "mokoaehaeihgiaheih.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637975": [
        {
            "ioc_value": "najbkiukghieuhae.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637976": [
        {
            "ioc_value": "najbkiukghieuhae.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637977": [
        {
            "ioc_value": "najbkiukghieuhae.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637978": [
        {
            "ioc_value": "najbkiukghieuhae.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637979": [
        {
            "ioc_value": "najbkiukghieuhae.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637980": [
        {
            "ioc_value": "najbkiukghieuhae.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637981": [
        {
            "ioc_value": "najbkiukghieuhae.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637982": [
        {
            "ioc_value": "najbkiukghieuhae.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637983": [
        {
            "ioc_value": "najbkiukghieuhae.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637984": [
        {
            "ioc_value": "najbkiukghieuhae.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637985": [
        {
            "ioc_value": "nygieiieiihhigis.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637986": [
        {
            "ioc_value": "nygieiieiihhigis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637987": [
        {
            "ioc_value": "nygieiieiihhigis.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637988": [
        {
            "ioc_value": "nygieiieiihhigis.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637989": [
        {
            "ioc_value": "nygieiieiihhigis.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637958": [
        {
            "ioc_value": "ieouzyibyihiusjjf.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637959": [
        {
            "ioc_value": "ieouzyibyihiusjjf.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637960": [
        {
            "ioc_value": "ieouzyibyihiusjjf.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637961": [
        {
            "ioc_value": "ieouzyibyihiusjjf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637962": [
        {
            "ioc_value": "ieouzyibyihiusjjf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637963": [
        {
            "ioc_value": "ieouzyibyihiusjjf.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637964": [
        {
            "ioc_value": "izdbuhcucuuzfz.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637965": [
        {
            "ioc_value": "izdbuhcucuuzfz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637966": [
        {
            "ioc_value": "izdbuhcucuuzfz.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637967": [
        {
            "ioc_value": "izdbuhcucuuzfz.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637968": [
        {
            "ioc_value": "izdbuhcucuuzfz.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637969": [
        {
            "ioc_value": "izdbuhcucuuzfz.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637970": [
        {
            "ioc_value": "izdbuhcucuuzfz.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637971": [
        {
            "ioc_value": "izdbuhcucuuzfz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637972": [
        {
            "ioc_value": "izdbuhcucuuzfz.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637973": [
        {
            "ioc_value": "izdbuhcucuuzfz.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637956": [
        {
            "ioc_value": "ieouzyibyihiusjjf.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637957": [
        {
            "ioc_value": "ieouzyibyihiusjjf.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637950": [
        {
            "ioc_value": "gohorghosrsohgsri.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637951": [
        {
            "ioc_value": "gohorghosrsohgsri.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637952": [
        {
            "ioc_value": "gohorghosrsohgsri.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637953": [
        {
            "ioc_value": "gohorghosrsohgsri.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637954": [
        {
            "ioc_value": "ieouzyibyihiusjjf.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637955": [
        {
            "ioc_value": "ieouzyibyihiusjjf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637935": [
        {
            "ioc_value": "gaoheoundauebuaeik.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637936": [
        {
            "ioc_value": "gaoheoundauebuaeik.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637937": [
        {
            "ioc_value": "gaoheoundauebuaeik.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637938": [
        {
            "ioc_value": "gaoheoundauebuaeik.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637939": [
        {
            "ioc_value": "gaoheoundauebuaeik.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637940": [
        {
            "ioc_value": "gaoheoundauebuaeik.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637941": [
        {
            "ioc_value": "gaoheoundauebuaeik.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637942": [
        {
            "ioc_value": "gaoheoundauebuaeik.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637943": [
        {
            "ioc_value": "gaoheoundauebuaeik.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637944": [
        {
            "ioc_value": "gohorghosrsohgsri.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637945": [
        {
            "ioc_value": "gohorghosrsohgsri.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637946": [
        {
            "ioc_value": "gohorghosrsohgsri.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637947": [
        {
            "ioc_value": "gohorghosrsohgsri.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637948": [
        {
            "ioc_value": "gohorghosrsohgsri.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637949": [
        {
            "ioc_value": "gohorghosrsohgsri.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:58:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637919": [
        {
            "ioc_value": "fauefahefucunuancne.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637920": [
        {
            "ioc_value": "fauefahefucunuancne.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637921": [
        {
            "ioc_value": "fauefahefucunuancne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637922": [
        {
            "ioc_value": "fauefahefucunuancne.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637923": [
        {
            "ioc_value": "fauefahefucunuancne.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637924": [
        {
            "ioc_value": "fouaoeuhfoauco.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637925": [
        {
            "ioc_value": "fouaoeuhfoauco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637926": [
        {
            "ioc_value": "fouaoeuhfoauco.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637927": [
        {
            "ioc_value": "fouaoeuhfoauco.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637928": [
        {
            "ioc_value": "fouaoeuhfoauco.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637929": [
        {
            "ioc_value": "fouaoeuhfoauco.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637930": [
        {
            "ioc_value": "fouaoeuhfoauco.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637931": [
        {
            "ioc_value": "fouaoeuhfoauco.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637932": [
        {
            "ioc_value": "fouaoeuhfoauco.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637933": [
        {
            "ioc_value": "fouaoeuhfoauco.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637934": [
        {
            "ioc_value": "gaoheoundauebuaeik.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637904": [
        {
            "ioc_value": "auonxunxiybkybdcbb.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637905": [
        {
            "ioc_value": "auonxunxiybkybdcbb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637906": [
        {
            "ioc_value": "auonxunxiybkybdcbb.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637907": [
        {
            "ioc_value": "auonxunxiybkybdcbb.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637908": [
        {
            "ioc_value": "auonxunxiybkybdcbb.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637909": [
        {
            "ioc_value": "auonxunxiybkybdcbb.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637910": [
        {
            "ioc_value": "auonxunxiybkybdcbb.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637911": [
        {
            "ioc_value": "auonxunxiybkybdcbb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637912": [
        {
            "ioc_value": "auonxunxiybkybdcbb.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637913": [
        {
            "ioc_value": "auonxunxiybkybdcbb.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637914": [
        {
            "ioc_value": "fauefahefucunuancne.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637915": [
        {
            "ioc_value": "fauefahefucunuancne.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637916": [
        {
            "ioc_value": "fauefahefucunuancne.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637917": [
        {
            "ioc_value": "fauefahefucunuancne.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637918": [
        {
            "ioc_value": "fauefahefucunuancne.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637889": [
        {
            "ioc_value": "aueaskksdfufiisi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637890": [
        {
            "ioc_value": "aueaskksdfufiisi.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637891": [
        {
            "ioc_value": "aueaskksdfufiisi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637892": [
        {
            "ioc_value": "aueaskksdfufiisi.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637893": [
        {
            "ioc_value": "aueaskksdfufiisi.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637894": [
        {
            "ioc_value": "auebubjkyiuebiubk.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637895": [
        {
            "ioc_value": "auebubjkyiuebiubk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637896": [
        {
            "ioc_value": "auebubjkyiuebiubk.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637897": [
        {
            "ioc_value": "auebubjkyiuebiubk.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637898": [
        {
            "ioc_value": "auebubjkyiuebiubk.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637899": [
        {
            "ioc_value": "auebubjkyiuebiubk.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637900": [
        {
            "ioc_value": "auebubjkyiuebiubk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637901": [
        {
            "ioc_value": "auebubjkyiuebiubk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637902": [
        {
            "ioc_value": "auebubjkyiuebiubk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637903": [
        {
            "ioc_value": "auebubjkyiuebiubk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637874": [
        {
            "ioc_value": "aofuouahudhhoaedu.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637875": [
        {
            "ioc_value": "aofuouahudhhoaedu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637876": [
        {
            "ioc_value": "aofuouahudhhoaedu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637877": [
        {
            "ioc_value": "aofuouahudhhoaedu.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637878": [
        {
            "ioc_value": "aofuouahudhhoaedu.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637879": [
        {
            "ioc_value": "aofuouahudhhoaedu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637880": [
        {
            "ioc_value": "aofuouahudhhoaedu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": "2025-11-12 21:18:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637881": [
        {
            "ioc_value": "aofuouahudhhoaedu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637882": [
        {
            "ioc_value": "aofuouahudhhoaedu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637883": [
        {
            "ioc_value": "aofuouahudhhoaedu.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637884": [
        {
            "ioc_value": "aueaskksdfufiisi.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637885": [
        {
            "ioc_value": "aueaskksdfufiisi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637886": [
        {
            "ioc_value": "aueaskksdfufiisi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637887": [
        {
            "ioc_value": "aueaskksdfufiisi.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637888": [
        {
            "ioc_value": "aueaskksdfufiisi.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637859": [
        {
            "ioc_value": "aoeihoaenajnciba.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637860": [
        {
            "ioc_value": "aoeihoaenajnciba.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637861": [
        {
            "ioc_value": "aoeihoaenajnciba.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637862": [
        {
            "ioc_value": "aoeihoaenajnciba.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637863": [
        {
            "ioc_value": "aoeihoaenajnciba.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637864": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637865": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637866": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637867": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637868": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637869": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637870": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637871": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637872": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637873": [
        {
            "ioc_value": "aoeoaunnbkjuafuuak.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637844": [
        {
            "ioc_value": "afeouhonwuxsfaf.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637845": [
        {
            "ioc_value": "afeouhonwuxsfaf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637846": [
        {
            "ioc_value": "afeouhonwuxsfaf.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637847": [
        {
            "ioc_value": "afeouhonwuxsfaf.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637848": [
        {
            "ioc_value": "afeouhonwuxsfaf.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637849": [
        {
            "ioc_value": "afeouhonwuxsfaf.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637850": [
        {
            "ioc_value": "afeouhonwuxsfaf.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637851": [
        {
            "ioc_value": "afeouhonwuxsfaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637852": [
        {
            "ioc_value": "afeouhonwuxsfaf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637853": [
        {
            "ioc_value": "afeouhonwuxsfaf.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637854": [
        {
            "ioc_value": "aoeihoaenajnciba.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637855": [
        {
            "ioc_value": "aoeihoaenajnciba.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637856": [
        {
            "ioc_value": "aoeihoaenajnciba.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637857": [
        {
            "ioc_value": "aoeihoaenajnciba.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637858": [
        {
            "ioc_value": "aoeihoaenajnciba.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637830": [
        {
            "ioc_value": "aefohouaencouea.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637831": [
        {
            "ioc_value": "aefohouaencouea.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637832": [
        {
            "ioc_value": "aefohouaencouea.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637833": [
        {
            "ioc_value": "aefohouaencouea.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637834": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637835": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637836": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637837": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637838": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637839": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637840": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637841": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637842": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637843": [
        {
            "ioc_value": "aeofhoaucnkjaneubk.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637815": [
        {
            "ioc_value": "aauauauauauahuuuab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637816": [
        {
            "ioc_value": "aauauauauauahuuuab.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637817": [
        {
            "ioc_value": "aauauauauauahuuuab.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637818": [
        {
            "ioc_value": "aauauauauauahuuuab.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637819": [
        {
            "ioc_value": "aauauauauauahuuuab.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637820": [
        {
            "ioc_value": "aauauauauauahuuuab.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637821": [
        {
            "ioc_value": "aauauauauauahuuuab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637822": [
        {
            "ioc_value": "aauauauauauahuuuab.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637823": [
        {
            "ioc_value": "aauauauauauahuuuab.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637824": [
        {
            "ioc_value": "aefohouaencouea.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637825": [
        {
            "ioc_value": "aefohouaencouea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637826": [
        {
            "ioc_value": "aefohouaencouea.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637827": [
        {
            "ioc_value": "aefohouaencouea.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637828": [
        {
            "ioc_value": "aefohouaencouea.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637829": [
        {
            "ioc_value": "aefohouaencouea.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637814": [
        {
            "ioc_value": "aauauauauauahuuuab.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-10 06:57:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637813": [
        {
            "ioc_value": "0i.frostwilder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 06:57:17",
            "last_seen_utc": "2025-11-10 07:08:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637803": [
        {
            "ioc_value": "server6.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637804": [
        {
            "ioc_value": "server7.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637805": [
        {
            "ioc_value": "server7.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637806": [
        {
            "ioc_value": "server7.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637807": [
        {
            "ioc_value": "server8.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637808": [
        {
            "ioc_value": "server8.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637809": [
        {
            "ioc_value": "server8.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637810": [
        {
            "ioc_value": "server9.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637811": [
        {
            "ioc_value": "server9.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637812": [
        {
            "ioc_value": "server9.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637787": [
        {
            "ioc_value": "server10.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637788": [
        {
            "ioc_value": "server10.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637789": [
        {
            "ioc_value": "server2.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637790": [
        {
            "ioc_value": "server2.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637791": [
        {
            "ioc_value": "server2.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637792": [
        {
            "ioc_value": "server3.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637793": [
        {
            "ioc_value": "server3.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637794": [
        {
            "ioc_value": "server3.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637795": [
        {
            "ioc_value": "server4.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637796": [
        {
            "ioc_value": "server4.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637797": [
        {
            "ioc_value": "server4.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637798": [
        {
            "ioc_value": "server5.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637799": [
        {
            "ioc_value": "server5.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637800": [
        {
            "ioc_value": "server5.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637801": [
        {
            "ioc_value": "server6.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637802": [
        {
            "ioc_value": "server6.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637782": [
        {
            "ioc_value": "chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637783": [
        {
            "ioc_value": "server1.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637784": [
        {
            "ioc_value": "server1.nameiusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637785": [
        {
            "ioc_value": "server1.opsiters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637786": [
        {
            "ioc_value": "server10.chrlerym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-11-10 06:57:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637777": [
        {
            "ioc_value": "abusara2001.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-10 06:56:06",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637776": [
        {
            "ioc_value": "cerionetya.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.buer",
            "malware_alias": "Buerloader,RustyBuer",
            "malware_printable": "Buer",
            "first_seen_utc": "2025-11-10 06:55:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "buerloader,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637772": [
        {
            "ioc_value": "wolke.oakensiegel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 06:44:56",
            "last_seen_utc": "2025-11-10 06:52:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637771": [
        {
            "ioc_value": "rune.oakensiegel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 06:31:00",
            "last_seen_utc": "2025-11-10 06:43:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637770": [
        {
            "ioc_value": "wald.oakensiegel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 06:23:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637769": [
        {
            "ioc_value": "krone.argonbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637768": [
        {
            "ioc_value": "licht.argonbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 06:07:44",
            "last_seen_utc": "2025-11-10 06:13:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637764": [
        {
            "ioc_value": "free-legislative.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-10 06:01:07",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251110-gjfxracl3v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637763": [
        {
            "ioc_value": "moor.argonbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 05:57:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637762": [
        {
            "ioc_value": "tau.ibexweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 05:47:36",
            "last_seen_utc": "2025-11-10 05:52:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637761": [
        {
            "ioc_value": "glanz.ibexweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 05:37:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637760": [
        {
            "ioc_value": "eiche.ibexweald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 05:26:58",
            "last_seen_utc": "2025-11-10 05:29:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637757": [
        {
            "ioc_value": "frost.dovemantel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 05:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637756": [
        {
            "ioc_value": "grat.dovemantel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 05:07:55",
            "last_seen_utc": "2025-11-10 05:09:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637754": [
        {
            "ioc_value": "hafen.dovemantel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 04:57:39",
            "last_seen_utc": "2025-11-10 05:03:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637753": [
        {
            "ioc_value": "pfad.elmquarry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 04:47:50",
            "last_seen_utc": "2025-11-10 04:48:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637752": [
        {
            "ioc_value": "fjord.elmquarry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 04:37:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637751": [
        {
            "ioc_value": "weiss.elmquarry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 04:27:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637750": [
        {
            "ioc_value": "stern.prairiewolf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 04:16:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637739": [
        {
            "ioc_value": "bach.prairiewolf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 04:01:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637738": [
        {
            "ioc_value": "nebel.prairiewolf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 03:57:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637737": [
        {
            "ioc_value": "gleam.xenonridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 03:48:08",
            "last_seen_utc": "2025-11-10 03:52:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637736": [
        {
            "ioc_value": "kamm.xenonridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 03:35:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637735": [
        {
            "ioc_value": "tal.xenonridge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 03:28:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637734": [
        {
            "ioc_value": "birch.sparrowdock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 03:17:47",
            "last_seen_utc": "2025-11-10 03:27:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637733": [
        {
            "ioc_value": "moor.sparrowdock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 03:07:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637732": [
        {
            "ioc_value": "blitz.sparrowdock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 02:56:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637731": [
        {
            "ioc_value": "adler.anvilklee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 02:47:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637730": [
        {
            "ioc_value": "ufer.anvilklee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 02:37:09",
            "last_seen_utc": "2025-11-10 02:42:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637729": [
        {
            "ioc_value": "stein.anvilklee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 02:27:21",
            "last_seen_utc": "2025-11-10 02:29:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637728": [
        {
            "ioc_value": "rauch.nimbusforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 02:15:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637727": [
        {
            "ioc_value": "glade.nimbusforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 02:08:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637726": [
        {
            "ioc_value": "wolke.nimbusforge.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 01:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637725": [
        {
            "ioc_value": "wind.sageufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 01:47:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637724": [
        {
            "ioc_value": "moor.sageufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 01:37:31",
            "last_seen_utc": "2025-11-10 01:38:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637723": [
        {
            "ioc_value": "fels.sageufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 01:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637722": [
        {
            "ioc_value": "bach.echohang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 01:17:20",
            "last_seen_utc": "2025-11-10 01:17:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637721": [
        {
            "ioc_value": "krone.echohang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 01:07:33",
            "last_seen_utc": "2025-11-10 01:09:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637720": [
        {
            "ioc_value": "moos.echohang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 00:57:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637719": [
        {
            "ioc_value": "fels.shadowtal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 00:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637718": [
        {
            "ioc_value": "ufer.shadowtal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 00:38:01",
            "last_seen_utc": "2025-11-10 00:39:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637717": [
        {
            "ioc_value": "nacht.shadowtal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 00:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637716": [
        {
            "ioc_value": "pfad.crimsonwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 00:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637714": [
        {
            "ioc_value": "grat.crimsonwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-10 00:07:39",
            "last_seen_utc": "2025-11-10 00:08:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637707": [
        {
            "ioc_value": "eis.crimsonwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 23:57:20",
            "last_seen_utc": "2025-11-09 23:58:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637706": [
        {
            "ioc_value": "stern.quartzhain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 23:47:33",
            "last_seen_utc": "2025-11-09 23:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637705": [
        {
            "ioc_value": "eiche.quartzhain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 23:31:07",
            "last_seen_utc": "2025-11-09 23:42:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637704": [
        {
            "ioc_value": "glut.quartzhain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 23:26:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637703": [
        {
            "ioc_value": "moos.granitebach.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 23:17:09",
            "last_seen_utc": "2025-11-09 23:19:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637702": [
        {
            "ioc_value": "adler.granitebach.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 23:03:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637690": [
        {
            "ioc_value": "sturm.granitebach.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 22:53:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637686": [
        {
            "ioc_value": "fjord.copperhang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 22:41:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637684": [
        {
            "ioc_value": "wald.copperhang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 22:37:20",
            "last_seen_utc": "2025-11-09 22:40:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637680": [
        {
            "ioc_value": "eis.copperhang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 22:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637679": [
        {
            "ioc_value": "pat.microsoft-telemetry.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.resolver_rat",
            "malware_alias": "PureHVNC,ResolverRAT",
            "malware_printable": "PureRAT",
            "first_seen_utc": "2025-11-09 22:26:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1806876/0/html",
            "tags": "c2,domain,joesandbox,PureRAT,rat,ResolverRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637678": [
        {
            "ioc_value": "cnr.microsoft-telemetry.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.coinminer",
            "malware_alias": null,
            "malware_printable": "Coinminer",
            "first_seen_utc": "2025-11-09 22:22:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://any.run/report/001b0cc8c936c9ae511779738d2ebd5412f03ce656e1fb64151271b2e1908eb6/73a91521-7066-4715-bf64-841cc0b3a190",
            "tags": "anyrun,c2,Coinminer,domain",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637677": [
        {
            "ioc_value": "dorn.steelpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 22:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637674": [
        {
            "ioc_value": "tau.steelpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 22:07:16",
            "last_seen_utc": "2025-11-09 22:14:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637670": [
        {
            "ioc_value": "rauch.steelpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 21:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637666": [
        {
            "ioc_value": "gleis.atlasufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 21:47:11",
            "last_seen_utc": "2025-11-09 21:47:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637664": [
        {
            "ioc_value": "stern.atlasufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 21:37:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637663": [
        {
            "ioc_value": "moor.atlasufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 21:28:00",
            "last_seen_utc": "2025-11-09 21:33:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637662": [
        {
            "ioc_value": "birch.orionfeld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 21:11:13",
            "last_seen_utc": "2025-11-09 21:16:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637661": [
        {
            "ioc_value": "klee.orionfeld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 21:00:26",
            "last_seen_utc": "2025-11-09 21:02:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637660": [
        {
            "ioc_value": "wolke.orionfeld.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 20:57:16",
            "last_seen_utc": "2025-11-09 20:58:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637657": [
        {
            "ioc_value": "05xg.br-1-ar-wild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 20:43:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637656": [
        {
            "ioc_value": "cliff.br-1-ar-wild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 20:37:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637655": [
        {
            "ioc_value": "fern.br-1-ar-wild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 20:28:17",
            "last_seen_utc": "2025-11-09 20:29:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637654": [
        {
            "ioc_value": "ax.m0onforger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 20:17:59",
            "last_seen_utc": "2025-11-09 20:25:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637653": [
        {
            "ioc_value": "lbgxn.m0onforger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 20:07:42",
            "last_seen_utc": "2025-11-09 20:13:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637648": [
        {
            "ioc_value": "9l.m0onforger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 19:57:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637641": [
        {
            "ioc_value": "hover4.ember-trail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 19:44:34",
            "last_seen_utc": "2025-11-09 19:45:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637622": [
        {
            "ioc_value": "gaouehaehfoaeajrsl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637623": [
        {
            "ioc_value": "gaouehaehfoaeajrso.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637624": [
        {
            "ioc_value": "gaouehaehfoaeajrsp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637625": [
        {
            "ioc_value": "geauhouefheuutiiie.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637626": [
        {
            "ioc_value": "geauhouefheuutiiik.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637627": [
        {
            "ioc_value": "geauhouefheuutiiio.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637628": [
        {
            "ioc_value": "geauhouefheuutiiip.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637629": [
        {
            "ioc_value": "huaeokaefoaeguaehe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637630": [
        {
            "ioc_value": "huaeokaefoaeguaehk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637631": [
        {
            "ioc_value": "huaeokaefoaeguaeho.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637632": [
        {
            "ioc_value": "huaeokaefoaeguaehp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637633": [
        {
            "ioc_value": "rzhsudhugugfugugse.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637634": [
        {
            "ioc_value": "rzhsudhugugfugugsk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637635": [
        {
            "ioc_value": "rzhsudhugugfugugso.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637636": [
        {
            "ioc_value": "rzhsudhugugfugugsp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637637": [
        {
            "ioc_value": "urusurofhsorhfuuhk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637638": [
        {
            "ioc_value": "urusurofhsorhfuuhl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637639": [
        {
            "ioc_value": "urusurofhsorhfuuho.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637640": [
        {
            "ioc_value": "urusurofhsorhfuuhp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637594": [
        {
            "ioc_value": "eaeuafhuaegfugeudk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637595": [
        {
            "ioc_value": "eaeuafhuaegfugeudl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637596": [
        {
            "ioc_value": "eaeuafhuaegfugeudo.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637597": [
        {
            "ioc_value": "eaeuafhuaegfugeudp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637598": [
        {
            "ioc_value": "eguaheoghouughahse.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637599": [
        {
            "ioc_value": "eguaheoghouughahsk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637600": [
        {
            "ioc_value": "eguaheoghouughahsl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637601": [
        {
            "ioc_value": "eguaheoghouughahso.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637602": [
        {
            "ioc_value": "eguaheoghouughahsp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637603": [
        {
            "ioc_value": "gaghpaheiafhjefije.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637604": [
        {
            "ioc_value": "gaghpaheiafhjefijk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637605": [
        {
            "ioc_value": "gaghpaheiafhjefijl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637606": [
        {
            "ioc_value": "gaghpaheiafhjefijo.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637607": [
        {
            "ioc_value": "gaoehuoaoefhuhfuge.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637608": [
        {
            "ioc_value": "gaoehuoaoefhuhfugk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637609": [
        {
            "ioc_value": "gaoehuoaoefhuhfugl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637610": [
        {
            "ioc_value": "gaoehuoaoefhuhfugo.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637611": [
        {
            "ioc_value": "gaoehuoaoefhuhfugp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637612": [
        {
            "ioc_value": "gaoheeuofhefefhute.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637613": [
        {
            "ioc_value": "gaoheeuofhefefhutk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637614": [
        {
            "ioc_value": "gaoheeuofhefefhutl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637615": [
        {
            "ioc_value": "gaoheeuofhefefhuto.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637616": [
        {
            "ioc_value": "gaohrhurhuhruhfsde.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637617": [
        {
            "ioc_value": "gaohrhurhuhruhfsdk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637618": [
        {
            "ioc_value": "gaohrhurhuhruhfsdl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637619": [
        {
            "ioc_value": "gaohrhurhuhruhfsdp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637620": [
        {
            "ioc_value": "gaouehaehfoaeajrse.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637621": [
        {
            "ioc_value": "gaouehaehfoaeajrsk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637566": [
        {
            "ioc_value": "aeufuaehfiuehfuhfe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637567": [
        {
            "ioc_value": "aeufuaehfiuehfuhfk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637568": [
        {
            "ioc_value": "aeufuaehfiuehfuhfo.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637569": [
        {
            "ioc_value": "aeufuaehfiuehfuhfp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637570": [
        {
            "ioc_value": "afaeigaifgsgrhhafe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637571": [
        {
            "ioc_value": "afaeigaifgsgrhhafk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637572": [
        {
            "ioc_value": "afaeigaifgsgrhhafl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637573": [
        {
            "ioc_value": "afaeigaifgsgrhhafo.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637574": [
        {
            "ioc_value": "afaeigaifgsgrhhafp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637575": [
        {
            "ioc_value": "afaigaeigieufuifie.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637576": [
        {
            "ioc_value": "afaigaeigieufuifik.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637577": [
        {
            "ioc_value": "afaigaeigieufuifil.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637578": [
        {
            "ioc_value": "afaigaeigieufuifio.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637579": [
        {
            "ioc_value": "afaigaeigieufuifip.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637580": [
        {
            "ioc_value": "befaheaiudeuhughge.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637581": [
        {
            "ioc_value": "befaheaiudeuhughgk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637582": [
        {
            "ioc_value": "befaheaiudeuhughgl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637583": [
        {
            "ioc_value": "befaheaiudeuhughgo.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637584": [
        {
            "ioc_value": "befaheaiudeuhughgp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637585": [
        {
            "ioc_value": "bfagzzezgaegzgfaie.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637586": [
        {
            "ioc_value": "bfagzzezgaegzgfaik.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637587": [
        {
            "ioc_value": "bfagzzezgaegzgfail.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637588": [
        {
            "ioc_value": "bfagzzezgaegzgfaip.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637589": [
        {
            "ioc_value": "daedagheauehfuuhfe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637590": [
        {
            "ioc_value": "daedagheauehfuuhfk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637591": [
        {
            "ioc_value": "daedagheauehfuuhfo.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637592": [
        {
            "ioc_value": "daedagheauehfuuhfp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637593": [
        {
            "ioc_value": "eaeuafhuaegfugeude.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637554": [
        {
            "ioc_value": "aegohaohuoruitiiee.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637555": [
        {
            "ioc_value": "aegohaohuoruitiiek.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637556": [
        {
            "ioc_value": "aegohaohuoruitiiel.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637557": [
        {
            "ioc_value": "aegohaohuoruitiieo.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637558": [
        {
            "ioc_value": "aegohaohuoruitiiep.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637559": [
        {
            "ioc_value": "aeifaeifhutuhuhuse.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637560": [
        {
            "ioc_value": "aeifaeifhutuhuhusk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637561": [
        {
            "ioc_value": "aeoughaoheguaoehde.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637562": [
        {
            "ioc_value": "aeoughaoheguaoehdk.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637563": [
        {
            "ioc_value": "aeoughaoheguaoehdl.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637564": [
        {
            "ioc_value": "aeoughaoheguaoehdo.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637565": [
        {
            "ioc_value": "aeoughaoheguaoehdp.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-09 19:43:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637454": [
        {
            "ioc_value": "draft21.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-09 19:43:01",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637437": [
        {
            "ioc_value": "gl.ember-trail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 19:37:19",
            "last_seen_utc": "2025-11-09 19:39:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637434": [
        {
            "ioc_value": "1j.ember-trail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 19:27:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637432": [
        {
            "ioc_value": "meadow0.ic0n1cbrook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 19:13:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637431": [
        {
            "ioc_value": "mlq1.ic0n1cbrook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 19:07:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637430": [
        {
            "ioc_value": "0zf5z.ic0n1cbrook.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 18:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637426": [
        {
            "ioc_value": "mto.gi-0-wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 18:46:02",
            "last_seen_utc": "2025-11-09 18:53:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637425": [
        {
            "ioc_value": "6gx.gi-0-wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 18:37:47",
            "last_seen_utc": "2025-11-09 18:44:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637424": [
        {
            "ioc_value": "hfcv.gi-0-wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 18:20:50",
            "last_seen_utc": "2025-11-09 18:30:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637423": [
        {
            "ioc_value": "xzh.nightwharf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 18:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637422": [
        {
            "ioc_value": "3c7.nightwharf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 18:07:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637421": [
        {
            "ioc_value": "yusuf36.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-11-09 18:03:23",
            "last_seen_utc": "2025-12-12 18:40:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-tscynsfn41",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637418": [
        {
            "ioc_value": "enjoy-char.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-09 18:01:26",
            "last_seen_utc": "2025-12-12 18:37:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-v964hs1nak",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637417": [
        {
            "ioc_value": "9hctu.nightwharf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 17:54:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637416": [
        {
            "ioc_value": "ad9vh.gi0wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 17:46:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637415": [
        {
            "ioc_value": "z14.gi0wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 17:37:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637414": [
        {
            "ioc_value": "drift.gi0wmarsh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 17:35:00",
            "last_seen_utc": "2025-11-09 17:36:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637413": [
        {
            "ioc_value": "wild.stormharrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 17:27:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637412": [
        {
            "ioc_value": "willow.stormharrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 17:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637411": [
        {
            "ioc_value": "thorn.stormharrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 17:03:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637410": [
        {
            "ioc_value": "sdjyu.m-0-on-forger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 16:57:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637409": [
        {
            "ioc_value": "loom.m-0-on-forger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 16:47:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637408": [
        {
            "ioc_value": "spark.m-0-on-forger.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 16:37:20",
            "last_seen_utc": "2025-11-09 16:38:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637407": [
        {
            "ioc_value": "glow.wind-barrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 16:28:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637406": [
        {
            "ioc_value": "a31a.wind-barrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 16:16:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637405": [
        {
            "ioc_value": "dhy.wind-barrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 16:06:22",
            "last_seen_utc": "2025-11-09 16:09:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637396": [
        {
            "ioc_value": "dune.storm-harrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 15:57:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637394": [
        {
            "ioc_value": "hu.storm-harrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 15:44:09",
            "last_seen_utc": "2025-11-09 15:49:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637393": [
        {
            "ioc_value": "di.storm-harrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 15:32:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637392": [
        {
            "ioc_value": "uirs.br1arwild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 15:24:34",
            "last_seen_utc": "2025-11-09 15:26:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637391": [
        {
            "ioc_value": "bloom.br1arwild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 15:17:50",
            "last_seen_utc": "2025-11-09 15:18:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637390": [
        {
            "ioc_value": "j0n.br1arwild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 15:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637389": [
        {
            "ioc_value": "brook.cinderloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 14:54:41",
            "last_seen_utc": "2025-11-09 14:55:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637388": [
        {
            "ioc_value": "vale0.cinderloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 14:48:24",
            "last_seen_utc": "2025-11-09 14:49:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637387": [
        {
            "ioc_value": "wharf.cinderloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 14:37:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637382": [
        {
            "ioc_value": "77.windbarrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 14:25:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637378": [
        {
            "ioc_value": "rps7g.windbarrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 14:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637375": [
        {
            "ioc_value": "7ih.windbarrow.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 14:07:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637371": [
        {
            "ioc_value": "hover.fr0stciiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 13:57:55",
            "last_seen_utc": "2025-11-09 14:03:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637366": [
        {
            "ioc_value": "f4.fr0stciiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 13:47:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637362": [
        {
            "ioc_value": "uf6qo.fr0stciiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 13:32:15",
            "last_seen_utc": "2025-11-09 13:37:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637359": [
        {
            "ioc_value": "pwmt.embertrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 13:27:33",
            "last_seen_utc": "2025-11-09 13:29:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637356": [
        {
            "ioc_value": "gift.embertrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 13:15:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637353": [
        {
            "ioc_value": "igf.embertrail.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 13:07:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637352": [
        {
            "ioc_value": "api.goodfatherbab.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-11-09 13:07:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.vmray.com/analyses/_vt/aa6a1ab0320c/report/",
            "tags": "c2,domain,Rhadamanthys,stealer,vmray",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637350": [
        {
            "ioc_value": "mist0.icy-moth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 12:58:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637345": [
        {
            "ioc_value": "3xlu.icy-moth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 12:46:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637344": [
        {
            "ioc_value": "vtbg5.icy-moth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 12:39:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637343": [
        {
            "ioc_value": "rv4sh.frost-fox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 12:38:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637342": [
        {
            "ioc_value": "5f2zf.frost-fox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 12:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637341": [
        {
            "ioc_value": "rp.frost-fox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 12:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637340": [
        {
            "ioc_value": "cecio.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:11:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "asyncrat,c2,censys,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637335": [
        {
            "ioc_value": "travelok.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:11:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "asyncrat,c2,censys,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637336": [
        {
            "ioc_value": "marketings.mysynology.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:11:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "asyncrat,c2,censys,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637337": [
        {
            "ioc_value": "installinfo.dynu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:11:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "asyncrat,c2,censys,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637338": [
        {
            "ioc_value": "decorcom.ddnsguru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:11:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "asyncrat,c2,censys,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637339": [
        {
            "ioc_value": "pureworkcom.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:11:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "asyncrat,c2,censys,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637330": [
        {
            "ioc_value": "companies.bumbleshrimp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:08:00",
            "last_seen_utc": "2025-11-09 12:11:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637331": [
        {
            "ioc_value": "romanticweb.dynu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:08:00",
            "last_seen_utc": "2025-11-09 12:11:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637332": [
        {
            "ioc_value": "travel.bumbleshrimp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:08:00",
            "last_seen_utc": "2025-11-09 12:11:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637333": [
        {
            "ioc_value": "homelog.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:08:00",
            "last_seen_utc": "2025-11-09 12:11:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637334": [
        {
            "ioc_value": "daysincome.ddnsguru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:08:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637324": [
        {
            "ioc_value": "nayaink1990.dynu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:07:59",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637325": [
        {
            "ioc_value": "babyblue.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:07:59",
            "last_seen_utc": "2025-11-09 12:11:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637326": [
        {
            "ioc_value": "sufcompany.ddnsguru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637327": [
        {
            "ioc_value": "homelog2002.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637328": [
        {
            "ioc_value": "beautyandbeef.dyndns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637329": [
        {
            "ioc_value": "leetboy.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:07:59",
            "last_seen_utc": "2025-11-09 12:11:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.20.182.18",
            "tags": "AsyncRAT,c2,censys,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637323": [
        {
            "ioc_value": "60w.lake-spry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 12:07:27",
            "last_seen_utc": "2025-11-09 12:12:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637322": [
        {
            "ioc_value": "investment-entirely.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-09 12:02:09",
            "last_seen_utc": "2025-12-12 18:39:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-mjjxasvjhp",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637321": [
        {
            "ioc_value": "huge-killer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 12:01:25",
            "last_seen_utc": "2025-11-09 12:01:26",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-nbbrdstqbw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637320": [
        {
            "ioc_value": "astromattel.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-09 12:01:15",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-m6ynzatpg1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637318": [
        {
            "ioc_value": "standoffgey-42127.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-09 12:01:08",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-m42mvavncp",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637319": [
        {
            "ioc_value": "cut-carry.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-09 12:01:08",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-laxlcstnbm",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637317": [
        {
            "ioc_value": "pigb.lake-spry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 11:58:07",
            "last_seen_utc": "2025-11-09 11:59:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637315": [
        {
            "ioc_value": "tc.lake-spry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 11:48:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637310": [
        {
            "ioc_value": "7tq70.rock-bay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 11:38:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637304": [
        {
            "ioc_value": "littlekitty.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-11-09 11:28:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.6.115+littlekitty.at",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,odyssey,panel,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637302": [
        {
            "ioc_value": "4v.rock-bay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 11:27:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637300": [
        {
            "ioc_value": "gale2.rock-bay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 11:17:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637299": [
        {
            "ioc_value": "snow5.sm-0-kewood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 11:06:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637290": [
        {
            "ioc_value": "a3.sm-0-kewood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 10:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637289": [
        {
            "ioc_value": "w4.sm-0-kewood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 10:51:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637287": [
        {
            "ioc_value": "88c2.pyroclay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 10:47:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637286": [
        {
            "ioc_value": "y4k.pyroclay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 10:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637285": [
        {
            "ioc_value": "4d.pyroclay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 10:33:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637284": [
        {
            "ioc_value": "w0umz.s0ftfern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 10:27:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637283": [
        {
            "ioc_value": "i6gx6.s0ftfern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 10:16:16",
            "last_seen_utc": "2025-11-09 10:25:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637281": [
        {
            "ioc_value": "shade.s0ftfern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 10:06:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637280": [
        {
            "ioc_value": "ib.lakespry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 09:58:10",
            "last_seen_utc": "2025-11-09 10:06:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637279": [
        {
            "ioc_value": "vale.lakespry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 09:55:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637278": [
        {
            "ioc_value": "r349.lakespry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 09:47:45",
            "last_seen_utc": "2025-11-09 09:53:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637277": [
        {
            "ioc_value": "86.bl1zpond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 09:43:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637276": [
        {
            "ioc_value": "gk0.bl1zpond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 09:37:52",
            "last_seen_utc": "2025-11-09 09:38:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637275": [
        {
            "ioc_value": "hush5.bl1zpond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 09:27:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637273": [
        {
            "ioc_value": "xhw.icymoth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 09:12:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637272": [
        {
            "ioc_value": "t6s.icymoth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 09:08:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637270": [
        {
            "ioc_value": "ajml.icymoth.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 08:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637266": [
        {
            "ioc_value": "l3.sm0kewood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 08:40:56",
            "last_seen_utc": "2025-11-09 08:43:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637265": [
        {
            "ioc_value": "spark7.sm0kewood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 08:37:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637264": [
        {
            "ioc_value": "mist7.sm0kewood.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 08:30:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637263": [
        {
            "ioc_value": "1g.windowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 08:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637262": [
        {
            "ioc_value": "fnnl.windowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637261": [
        {
            "ioc_value": "willow9.windowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 08:09:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637253": [
        {
            "ioc_value": "drift.frostfox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 07:57:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637248": [
        {
            "ioc_value": "botnet.hqdata.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-09 07:55:50",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637245": [
        {
            "ioc_value": "football-reflect.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-09 07:55:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637246": [
        {
            "ioc_value": "v2.xoilaczzzfz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-09 07:55:03",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637247": [
        {
            "ioc_value": "v3.xoilaczzzfz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-09 07:55:03",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637237": [
        {
            "ioc_value": "aperture-48940.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 07:54:32",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637238": [
        {
            "ioc_value": "kw.atrishop.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 07:54:32",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637239": [
        {
            "ioc_value": "left-cure.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 07:54:32",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637240": [
        {
            "ioc_value": "startmenuexperiencehosting.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 07:54:32",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637241": [
        {
            "ioc_value": "xoilaczzzfz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 07:54:32",
            "last_seen_utc": "2025-11-09 07:55:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1637142": [
        {
            "ioc_value": "hlojonar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-09 07:49:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1637143": [
        {
            "ioc_value": "nubiloma.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-09 07:49:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1637233": [
        {
            "ioc_value": "koh2.frostfox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 07:47:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637231": [
        {
            "ioc_value": "brook.frostfox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 07:37:11",
            "last_seen_utc": "2025-11-09 07:41:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637230": [
        {
            "ioc_value": "stern.willowufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 07:27:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637229": [
        {
            "ioc_value": "moos.willowufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 07:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637228": [
        {
            "ioc_value": "adler.willowufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 07:10:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637226": [
        {
            "ioc_value": "klee.cometpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 07:06:56",
            "last_seen_utc": "2025-11-09 07:08:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637225": [
        {
            "ioc_value": "gleis.cometpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 06:58:10",
            "last_seen_utc": "2025-11-09 07:00:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637224": [
        {
            "ioc_value": "mond.cometpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 06:47:51",
            "last_seen_utc": "2025-11-09 06:53:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637223": [
        {
            "ioc_value": "glut.ravenkamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 06:37:34",
            "last_seen_utc": "2025-11-09 06:39:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637222": [
        {
            "ioc_value": "wind.ravenkamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 06:27:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637221": [
        {
            "ioc_value": "ufer.ravenkamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 06:19:29",
            "last_seen_utc": "2025-11-09 06:21:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637220": [
        {
            "ioc_value": "nacht.stormgrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 06:12:14",
            "last_seen_utc": "2025-11-09 06:18:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637219": [
        {
            "ioc_value": "blatt.stormgrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 06:07:33",
            "last_seen_utc": "2025-11-09 06:09:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637216": [
        {
            "ioc_value": "ydbao2.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-09 06:02:34",
            "last_seen_utc": "2025-12-12 18:40:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-d7lalazmer",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637214": [
        {
            "ioc_value": "envioansyr.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-09 06:01:15",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-a7c3faxrgk",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637211": [
        {
            "ioc_value": "editor-okay.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-09 06:01:02",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251109-e1bcgsdx7g",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637210": [
        {
            "ioc_value": "eis.stormgrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 05:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637209": [
        {
            "ioc_value": "wolke.polarhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 05:48:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637208": [
        {
            "ioc_value": "tau.polarhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 05:38:07",
            "last_seen_utc": "2025-11-09 05:45:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637207": [
        {
            "ioc_value": "fjord.polarhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 05:27:48",
            "last_seen_utc": "2025-11-09 05:34:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637206": [
        {
            "ioc_value": "wolfe.pixelbuche.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 05:18:01",
            "last_seen_utc": "2025-11-09 05:19:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637205": [
        {
            "ioc_value": "birch.pixelbuche.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 05:07:44",
            "last_seen_utc": "2025-11-09 05:08:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637204": [
        {
            "ioc_value": "stern.pixelbuche.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 04:57:26",
            "last_seen_utc": "2025-11-09 05:04:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637203": [
        {
            "ioc_value": "fauna.driftkrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 04:47:38",
            "last_seen_utc": "2025-11-09 04:55:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637202": [
        {
            "ioc_value": "nebel.driftkrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 04:38:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637201": [
        {
            "ioc_value": "gleis.driftkrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 04:27:29",
            "last_seen_utc": "2025-11-09 04:29:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637200": [
        {
            "ioc_value": "sturm.glaciergrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 04:17:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637199": [
        {
            "ioc_value": "alpen.glaciergrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 04:05:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637191": [
        {
            "ioc_value": "fels.glaciergrat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 03:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637190": [
        {
            "ioc_value": "moor.frostgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 03:46:47",
            "last_seen_utc": "2025-11-09 03:49:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637189": [
        {
            "ioc_value": "sonne.frostgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 03:37:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637188": [
        {
            "ioc_value": "dampf.frostgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 03:20:38",
            "last_seen_utc": "2025-11-09 03:22:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637187": [
        {
            "ioc_value": "quarz.ashenkrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 03:17:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637186": [
        {
            "ioc_value": "wolke.ashenkrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 03:09:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637185": [
        {
            "ioc_value": "glut.ashenkrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 02:58:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637181": [
        {
            "ioc_value": "prod.setupcloudos.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-09 02:48:30",
            "last_seen_utc": "2025-12-14 11:48:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1637182": [
        {
            "ioc_value": "searchmtcn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-09 02:48:30",
            "last_seen_utc": "2025-12-11 19:56:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1637180": [
        {
            "ioc_value": "wind.cedarsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 02:48:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637179": [
        {
            "ioc_value": "app.setupcloudos.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-09 02:48:16",
            "last_seen_utc": "2025-12-14 11:48:02",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1637177": [
        {
            "ioc_value": "ufer.cedarsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 02:38:02",
            "last_seen_utc": "2025-11-09 02:48:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637176": [
        {
            "ioc_value": "nacht.cedarsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 02:27:44",
            "last_seen_utc": "2025-11-09 02:28:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637175": [
        {
            "ioc_value": "zorn.brassgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 02:16:54",
            "last_seen_utc": "2025-11-09 02:24:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637174": [
        {
            "ioc_value": "klee.brassgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 02:07:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637173": [
        {
            "ioc_value": "eiche.brassgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 01:57:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637172": [
        {
            "ioc_value": "dorn.ironklippe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 01:47:31",
            "last_seen_utc": "2025-11-09 01:48:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637171": [
        {
            "ioc_value": "harz.ironklippe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 01:36:16",
            "last_seen_utc": "2025-11-09 01:43:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637170": [
        {
            "ioc_value": "blitz.ironklippe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 01:24:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637169": [
        {
            "ioc_value": "rauch.swiftgasse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 01:17:01",
            "last_seen_utc": "2025-11-09 01:24:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637168": [
        {
            "ioc_value": "tau.swiftgasse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 01:07:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637167": [
        {
            "ioc_value": "moos.swiftgasse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 00:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637166": [
        {
            "ioc_value": "geist.quillwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 00:45:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637165": [
        {
            "ioc_value": "fjord.quillwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 00:37:51",
            "last_seen_utc": "2025-11-09 00:44:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637164": [
        {
            "ioc_value": "wolke.quillwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 00:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637163": [
        {
            "ioc_value": "fx.sn0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 00:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637162": [
        {
            "ioc_value": "t3.sn0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-09 00:07:22",
            "last_seen_utc": "2025-11-09 00:08:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637160": [
        {
            "ioc_value": "srs01.sn0wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 23:57:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637159": [
        {
            "ioc_value": "80deo.oak-ember.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 23:49:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637158": [
        {
            "ioc_value": "2xado.oak-ember.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 23:41:54",
            "last_seen_utc": "2025-11-08 23:49:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637157": [
        {
            "ioc_value": "qcn6.oak-ember.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 23:38:07",
            "last_seen_utc": "2025-11-08 23:39:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637156": [
        {
            "ioc_value": "eiyxc.fl0wbud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 23:27:49",
            "last_seen_utc": "2025-11-08 23:28:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637155": [
        {
            "ioc_value": "b4.fl0wbud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 23:18:33",
            "last_seen_utc": "2025-11-08 23:19:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637150": [
        {
            "ioc_value": "2qn80.fl0wbud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 23:00:37",
            "last_seen_utc": "2025-11-08 23:02:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637144": [
        {
            "ioc_value": "21k2.fl-0-wbud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 22:51:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637140": [
        {
            "ioc_value": "uy4g.fl-0-wbud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 22:41:31",
            "last_seen_utc": "2025-11-08 22:48:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637139": [
        {
            "ioc_value": "o6.fl-0-wbud.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 22:37:21",
            "last_seen_utc": "2025-11-08 22:37:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637138": [
        {
            "ioc_value": "v42le.fog-map.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 22:27:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637137": [
        {
            "ioc_value": "e4.fog-map.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 22:17:15",
            "last_seen_utc": "2025-11-08 22:22:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637136": [
        {
            "ioc_value": "6jr.fog-map.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 22:01:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637135": [
        {
            "ioc_value": "v5w.r1mrock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 21:59:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637134": [
        {
            "ioc_value": "hd1p.r1mrock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 21:55:00",
            "last_seen_utc": "2025-11-08 21:59:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637133": [
        {
            "ioc_value": "pkc.r1mrock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 21:52:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637132": [
        {
            "ioc_value": "kzw.lakeray.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 21:47:39",
            "last_seen_utc": "2025-11-08 21:50:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637130": [
        {
            "ioc_value": "0zjkg.lakeray.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 21:32:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637129": [
        {
            "ioc_value": "kwxwi.lakeray.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 21:29:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637128": [
        {
            "ioc_value": "u8.sn-0-wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 21:26:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637127": [
        {
            "ioc_value": "g2.sn-0-wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 21:17:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637126": [
        {
            "ioc_value": "kp.sn-0-wmint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 21:07:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637125": [
        {
            "ioc_value": "br.r-1-mrock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 20:55:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637124": [
        {
            "ioc_value": "5jxd.r-1-mrock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 20:47:16",
            "last_seen_utc": "2025-11-08 20:48:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637123": [
        {
            "ioc_value": "ped.r-1-mrock.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 20:32:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637122": [
        {
            "ioc_value": "asgp2.lake-ray.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 20:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637121": [
        {
            "ioc_value": "0gk.lake-ray.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 20:17:55",
            "last_seen_utc": "2025-11-08 20:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637120": [
        {
            "ioc_value": "os0.pooflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 20:11:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637119": [
        {
            "ioc_value": "2luj.pooflare.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 20:03:28",
            "last_seen_utc": "2025-11-08 20:05:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637110": [
        {
            "ioc_value": "39o1.oakember.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 19:57:45",
            "last_seen_utc": "2025-11-08 19:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637109": [
        {
            "ioc_value": "14myx.oakember.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 19:47:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637108": [
        {
            "ioc_value": "u18t.oakember.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 19:37:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637107": [
        {
            "ioc_value": "cp.skyaxe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 19:28:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637106": [
        {
            "ioc_value": "k0w2j.skyaxe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 19:21:08",
            "last_seen_utc": "2025-11-08 19:22:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637105": [
        {
            "ioc_value": "e5.skyaxe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 19:16:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637104": [
        {
            "ioc_value": "x2r.icetap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 19:09:12",
            "last_seen_utc": "2025-11-08 19:09:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637103": [
        {
            "ioc_value": "jbp.icetap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 18:54:20",
            "last_seen_utc": "2025-11-08 19:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637095": [
        {
            "ioc_value": "14ba.fogmap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 17:46:58",
            "last_seen_utc": "2025-11-08 18:04:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637094": [
        {
            "ioc_value": "eu5.fogmap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 17:43:48",
            "last_seen_utc": "2025-11-08 17:45:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637093": [
        {
            "ioc_value": "mr5.fogmap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 17:38:05",
            "last_seen_utc": "2025-11-08 17:38:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637092": [
        {
            "ioc_value": "11.clear-fog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 17:28:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637091": [
        {
            "ioc_value": "xmn.clear-fog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 17:16:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637090": [
        {
            "ioc_value": "lmy0.clear-fog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 17:13:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637089": [
        {
            "ioc_value": "ei.sun-hill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 17:07:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637088": [
        {
            "ioc_value": "jfn.sun-hill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 16:56:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637086": [
        {
            "ioc_value": "nn15s.sun-hill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 16:52:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637085": [
        {
            "ioc_value": "1u74z.moss-owl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 16:47:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637083": [
        {
            "ioc_value": "nxc.moss-owl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 16:36:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637082": [
        {
            "ioc_value": "enq.moss-owl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 16:28:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637081": [
        {
            "ioc_value": "0okm8.dew-root.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 16:17:59",
            "last_seen_utc": "2025-11-08 16:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637079": [
        {
            "ioc_value": "h5.dew-root.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 16:07:43",
            "last_seen_utc": "2025-11-08 16:09:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637060": [
        {
            "ioc_value": "2x9mv.dew-root.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 15:57:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637059": [
        {
            "ioc_value": "8vpz.r0ckveil.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 15:45:34",
            "last_seen_utc": "2025-11-08 15:49:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636919": [
        {
            "ioc_value": "ecohaus.webd.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-08 15:38:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "asyncthecatlol"
        }
    ],
    "1637058": [
        {
            "ioc_value": "ma.r0ckveil.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 15:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637057": [
        {
            "ioc_value": "ojxk.r0ckveil.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 15:27:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637056": [
        {
            "ioc_value": "f4vc.clearfog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 15:17:14",
            "last_seen_utc": "2025-11-08 15:23:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637055": [
        {
            "ioc_value": "g4h.clearfog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 15:11:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637054": [
        {
            "ioc_value": "weo.clearfog.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 15:08:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637053": [
        {
            "ioc_value": "g60.1ronpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 14:55:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637052": [
        {
            "ioc_value": "dvi.1ronpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 14:47:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637051": [
        {
            "ioc_value": "n5.1ronpath.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 14:37:49",
            "last_seen_utc": "2025-11-08 14:40:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637047": [
        {
            "ioc_value": "4jx.mossowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 14:27:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637045": [
        {
            "ioc_value": "super-mega-shop-2025-online.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-11-08 14:21:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1810479/0/iochtml",
            "tags": "c2,domain,joesandbox,stealc,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637044": [
        {
            "ioc_value": "v5.mossowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 14:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637039": [
        {
            "ioc_value": "g7.mossowl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 14:09:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637038": [
        {
            "ioc_value": "api.nostragand.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-11-08 14:08:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1809357/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637037": [
        {
            "ioc_value": "livehostingers.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-11-08 14:06:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1809797/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637035": [
        {
            "ioc_value": "domendominator.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-11-08 14:04:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1809797/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637030": [
        {
            "ioc_value": "5rq9.t1nystar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 13:55:34",
            "last_seen_utc": "2025-11-08 14:01:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637019": [
        {
            "ioc_value": "policxu.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:33",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637020": [
        {
            "ioc_value": "organbq.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:33",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637021": [
        {
            "ioc_value": "hermoae.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:33",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637022": [
        {
            "ioc_value": "fatbaem.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:33",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637023": [
        {
            "ioc_value": "auricpp.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:33",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637024": [
        {
            "ioc_value": "superko.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:33",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637025": [
        {
            "ioc_value": "stronpn.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:33",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637026": [
        {
            "ioc_value": "solemfk.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:33",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637027": [
        {
            "ioc_value": "winter-snow.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:33",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637017": [
        {
            "ioc_value": "saddlbo.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:32",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637018": [
        {
            "ioc_value": "bluescm.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:50:32",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637016": [
        {
            "ioc_value": "mw9k.t1nystar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 13:47:18",
            "last_seen_utc": "2025-11-08 13:51:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637015": [
        {
            "ioc_value": "84.t1nystar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 13:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637014": [
        {
            "ioc_value": "nync.g0ldnest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 13:31:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637013": [
        {
            "ioc_value": "3uv.g0ldnest.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 13:12:13",
            "last_seen_utc": "2025-11-08 13:18:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637003": [
        {
            "ioc_value": "passkby.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-17 16:24:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637004": [
        {
            "ioc_value": "thirskk.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-17 16:24:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637005": [
        {
            "ioc_value": "upperat.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-17 16:24:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637006": [
        {
            "ioc_value": "hoseaza.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-17 16:24:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637007": [
        {
            "ioc_value": "gentiax.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-17 16:24:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637008": [
        {
            "ioc_value": "genusix.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-17 16:24:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637009": [
        {
            "ioc_value": "biddyoz.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-17 16:24:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637010": [
        {
            "ioc_value": "olibaeq.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-17 16:24:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637011": [
        {
            "ioc_value": "auldlxm.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637012": [
        {
            "ioc_value": "exterminal.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-08 13:09:35",
            "last_seen_utc": "2025-11-25 15:31:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1637002": [
        {
            "ioc_value": "cb3yh.ic3gate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 13:08:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1637000": [
        {
            "ioc_value": "75qk.ic3gate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 12:57:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636999": [
        {
            "ioc_value": "d6ksj.ic3gate.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 12:45:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636996": [
        {
            "ioc_value": "xa3q.dewroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 12:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636987": [
        {
            "ioc_value": "y714.dewroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 12:28:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636985": [
        {
            "ioc_value": "0mf.dewroot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 12:17:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636984": [
        {
            "ioc_value": "5ye8.n0rthw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 12:07:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636979": [
        {
            "ioc_value": "ed-rn.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-08 12:01:57",
            "last_seen_utc": "2025-12-12 18:39:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/251108-kang1swmdl",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1636973": [
        {
            "ioc_value": "tungsahurchik228-49806.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-08 12:01:00",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251108-lrcyaawqhq",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1636974": [
        {
            "ioc_value": "index-hall.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-08 12:01:00",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251108-j9w3rswmcr",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1636962": [
        {
            "ioc_value": "srd.n0rthw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 11:56:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636956": [
        {
            "ioc_value": "ix1.undernet.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-08 11:56:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "botnet,IRC,ssh",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1636957": [
        {
            "ioc_value": "ix2.undernet.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-08 11:56:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "botnet,IRC,ssh",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1636958": [
        {
            "ioc_value": "ashburn.va.us.undernet.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-08 11:56:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "botnet,IRC,ssh",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1636959": [
        {
            "ioc_value": "bucharest.ro.eu.undernet.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-08 11:56:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "botnet,IRC,ssh",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1636960": [
        {
            "ioc_value": "budapest.hu.eu.undernet.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-08 11:56:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "botnet,IRC,ssh",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1636961": [
        {
            "ioc_value": "chicago.il.us.undernet.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-08 11:56:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "botnet,IRC,ssh",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1636955": [
        {
            "ioc_value": "5h.n0rthw1nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 11:48:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636954": [
        {
            "ioc_value": "k9jc.n-0-rthw-1-nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 11:37:49",
            "last_seen_utc": "2025-11-08 11:38:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636953": [
        {
            "ioc_value": "xpkyb.n-0-rthw-1-nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 11:32:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636952": [
        {
            "ioc_value": "fnw9.n-0-rthw-1-nd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 11:27:54",
            "last_seen_utc": "2025-11-08 11:28:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636951": [
        {
            "ioc_value": "3j6cb.ic0n1ctrove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 11:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636950": [
        {
            "ioc_value": "bynbv.ic0n1ctrove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 11:06:42",
            "last_seen_utc": "2025-11-08 11:12:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636949": [
        {
            "ioc_value": "59gwy.ic0n1ctrove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 11:03:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636930": [
        {
            "ioc_value": "cs4.starforged.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636929": [
        {
            "ioc_value": "42s.starforged.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:55:34",
            "last_seen_utc": "2025-11-08 10:59:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636928": [
        {
            "ioc_value": "x5.starforged.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:51:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636927": [
        {
            "ioc_value": "microsharepolnt.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-08 10:48:40",
            "last_seen_utc": "2025-12-14 11:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1636926": [
        {
            "ioc_value": "kocs45.916919.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-08 10:48:39",
            "last_seen_utc": "2025-12-11 19:56:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1636925": [
        {
            "ioc_value": "js.driftshad0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636924": [
        {
            "ioc_value": "tz.driftshad0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:45:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636923": [
        {
            "ioc_value": "3a.driftshad0w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:42:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636922": [
        {
            "ioc_value": "rfrz.emberharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:37:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636921": [
        {
            "ioc_value": "zz5.emberharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:31:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636918": [
        {
            "ioc_value": "c4v9.emberharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:27:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636916": [
        {
            "ioc_value": "2hk8u.drift-shad-0-w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:15:50",
            "last_seen_utc": "2025-11-08 10:18:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636915": [
        {
            "ioc_value": "9zpya.drift-shad-0-w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 10:08:05",
            "last_seen_utc": "2025-11-08 10:14:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636913": [
        {
            "ioc_value": "i9.hiringimmediatelyjobs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-08 09:59:27",
            "last_seen_utc": "2025-11-12 09:19:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,vidar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636912": [
        {
            "ioc_value": "lasxz.drift-shad-0-w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 09:54:44",
            "last_seen_utc": "2025-11-08 09:55:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636911": [
        {
            "ioc_value": "zt.ember-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 09:47:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636909": [
        {
            "ioc_value": "te.ember-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 09:37:31",
            "last_seen_utc": "2025-11-08 09:46:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636908": [
        {
            "ioc_value": "f7r3e.ember-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 09:29:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636907": [
        {
            "ioc_value": "w0eh.copperlattice.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 09:25:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636906": [
        {
            "ioc_value": "wk.copperlattice.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 09:22:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636905": [
        {
            "ioc_value": "5vyg.copperlattice.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 09:16:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636904": [
        {
            "ioc_value": "x1rje.horizonbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 09:05:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636900": [
        {
            "ioc_value": "natsu213dz213-46328.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-08 08:57:50",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636901": [
        {
            "ioc_value": "sawkech-38774.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-08 08:57:50",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636902": [
        {
            "ioc_value": "HIAMEGO-48377.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-08 08:57:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636894": [
        {
            "ioc_value": "enviojs2025.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-08 08:56:48",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636895": [
        {
            "ioc_value": "goldmoney.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-08 08:56:48",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636887": [
        {
            "ioc_value": "zeaigfiagefagfzgi.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636888": [
        {
            "ioc_value": "zeaigfiagefagfzgi.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636889": [
        {
            "ioc_value": "zeaigfiagefagfzgi.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636890": [
        {
            "ioc_value": "zeaigfiagefagfzgi.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636891": [
        {
            "ioc_value": "zeaigfiagefagfzgi.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636892": [
        {
            "ioc_value": "zeaigfiagefagfzgi.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636893": [
        {
            "ioc_value": "zeaigfiagefagfzgi.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636863": [
        {
            "ioc_value": "uoiaefnouegiajifj.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636864": [
        {
            "ioc_value": "uoiaefnouegiajifj.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636865": [
        {
            "ioc_value": "urusurofhsorhfuuhl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636866": [
        {
            "ioc_value": "urusurofhsorhfuuhm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636867": [
        {
            "ioc_value": "urusurofhsorhfuuhr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636868": [
        {
            "ioc_value": "urusurofhsorhfuuhu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636869": [
        {
            "ioc_value": "zeaigfiagefagfzgi.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636870": [
        {
            "ioc_value": "zeaigfiagefagfzgi.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636871": [
        {
            "ioc_value": "zeaigfiagefagfzgi.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636872": [
        {
            "ioc_value": "zeaigfiagefagfzgi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636873": [
        {
            "ioc_value": "zeaigfiagefagfzgi.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636874": [
        {
            "ioc_value": "zeaigfiagefagfzgi.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636875": [
        {
            "ioc_value": "zeaigfiagefagfzgi.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636876": [
        {
            "ioc_value": "zeaigfiagefagfzgi.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636877": [
        {
            "ioc_value": "zeaigfiagefagfzgi.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636878": [
        {
            "ioc_value": "zeaigfiagefagfzgi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636879": [
        {
            "ioc_value": "zeaigfiagefagfzgi.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636880": [
        {
            "ioc_value": "zeaigfiagefagfzgi.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636881": [
        {
            "ioc_value": "zeaigfiagefagfzgi.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636882": [
        {
            "ioc_value": "zeaigfiagefagfzgi.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636883": [
        {
            "ioc_value": "zeaigfiagefagfzgi.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636884": [
        {
            "ioc_value": "zeaigfiagefagfzgi.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636885": [
        {
            "ioc_value": "zeaigfiagefagfzgi.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636886": [
        {
            "ioc_value": "zeaigfiagefagfzgi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636841": [
        {
            "ioc_value": "uoiaefnouegiajifj.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636842": [
        {
            "ioc_value": "uoiaefnouegiajifj.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636843": [
        {
            "ioc_value": "uoiaefnouegiajifj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636844": [
        {
            "ioc_value": "uoiaefnouegiajifj.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636845": [
        {
            "ioc_value": "uoiaefnouegiajifj.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636846": [
        {
            "ioc_value": "uoiaefnouegiajifj.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636847": [
        {
            "ioc_value": "uoiaefnouegiajifj.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636848": [
        {
            "ioc_value": "uoiaefnouegiajifj.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636849": [
        {
            "ioc_value": "uoiaefnouegiajifj.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636850": [
        {
            "ioc_value": "uoiaefnouegiajifj.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636851": [
        {
            "ioc_value": "uoiaefnouegiajifj.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636852": [
        {
            "ioc_value": "uoiaefnouegiajifj.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636853": [
        {
            "ioc_value": "uoiaefnouegiajifj.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636854": [
        {
            "ioc_value": "uoiaefnouegiajifj.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636855": [
        {
            "ioc_value": "uoiaefnouegiajifj.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636856": [
        {
            "ioc_value": "uoiaefnouegiajifj.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636857": [
        {
            "ioc_value": "uoiaefnouegiajifj.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636858": [
        {
            "ioc_value": "uoiaefnouegiajifj.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636859": [
        {
            "ioc_value": "uoiaefnouegiajifj.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636860": [
        {
            "ioc_value": "uoiaefnouegiajifj.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636861": [
        {
            "ioc_value": "uoiaefnouegiajifj.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636862": [
        {
            "ioc_value": "uoiaefnouegiajifj.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636820": [
        {
            "ioc_value": "siiifibiiegiiciib.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636821": [
        {
            "ioc_value": "siiifibiiegiiciib.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636822": [
        {
            "ioc_value": "siiifibiiegiiciib.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636823": [
        {
            "ioc_value": "siiifibiiegiiciib.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636824": [
        {
            "ioc_value": "siiifibiiegiiciib.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636825": [
        {
            "ioc_value": "siiifibiiegiiciib.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636826": [
        {
            "ioc_value": "siiifibiiegiiciib.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636827": [
        {
            "ioc_value": "siiifibiiegiiciib.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636828": [
        {
            "ioc_value": "siiifibiiegiiciib.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636829": [
        {
            "ioc_value": "siiifibiiegiiciib.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636830": [
        {
            "ioc_value": "siiifibiiegiiciib.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636831": [
        {
            "ioc_value": "siiifibiiegiiciib.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636832": [
        {
            "ioc_value": "siiifibiiegiiciib.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636833": [
        {
            "ioc_value": "siiifibiiegiiciib.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636834": [
        {
            "ioc_value": "siiifibiiegiiciib.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636835": [
        {
            "ioc_value": "siiifibiiegiiciib.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636836": [
        {
            "ioc_value": "siiifibiiegiiciib.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636837": [
        {
            "ioc_value": "siiifibiiegiiciib.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636838": [
        {
            "ioc_value": "siiifibiiegiiciib.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636839": [
        {
            "ioc_value": "siiifibiiegiiciib.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636840": [
        {
            "ioc_value": "uoiaefnouegiajifj.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636797": [
        {
            "ioc_value": "rohgoruhgsorhugih.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636798": [
        {
            "ioc_value": "rohgoruhgsorhugih.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636799": [
        {
            "ioc_value": "rohgoruhgsorhugih.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636800": [
        {
            "ioc_value": "rohgoruhgsorhugih.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636801": [
        {
            "ioc_value": "rohgoruhgsorhugih.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636802": [
        {
            "ioc_value": "rohgoruhgsorhugih.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636803": [
        {
            "ioc_value": "rohgoruhgsorhugih.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636804": [
        {
            "ioc_value": "rohgoruhgsorhugih.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636805": [
        {
            "ioc_value": "rohgoruhgsorhugih.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636806": [
        {
            "ioc_value": "rohgoruhgsorhugih.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636807": [
        {
            "ioc_value": "rohgoruhgsorhugih.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636808": [
        {
            "ioc_value": "rohgoruhgsorhugih.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636809": [
        {
            "ioc_value": "rohgoruhgsorhugih.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636810": [
        {
            "ioc_value": "rzhsudhugugfugugsm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636811": [
        {
            "ioc_value": "rzhsudhugugfugugsr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636812": [
        {
            "ioc_value": "rzhsudhugugfugugss.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636813": [
        {
            "ioc_value": "rzhsudhugugfugugsu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636814": [
        {
            "ioc_value": "siiifibiiegiiciib.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636815": [
        {
            "ioc_value": "siiifibiiegiiciib.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636816": [
        {
            "ioc_value": "siiifibiiegiiciib.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636817": [
        {
            "ioc_value": "siiifibiiegiiciib.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636818": [
        {
            "ioc_value": "siiifibiiegiiciib.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636819": [
        {
            "ioc_value": "siiifibiiegiiciib.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636773": [
        {
            "ioc_value": "oeihefoeaboeubfuo.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636774": [
        {
            "ioc_value": "oeihefoeaboeubfuo.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636775": [
        {
            "ioc_value": "oeihefoeaboeubfuo.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636776": [
        {
            "ioc_value": "oeihefoeaboeubfuo.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636777": [
        {
            "ioc_value": "oeihefoeaboeubfuo.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636778": [
        {
            "ioc_value": "oeihefoeaboeubfuo.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636779": [
        {
            "ioc_value": "oeihefoeaboeubfuo.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636780": [
        {
            "ioc_value": "oeihefoeaboeubfuo.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636781": [
        {
            "ioc_value": "oeihefoeaboeubfuo.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636782": [
        {
            "ioc_value": "oeihefoeaboeubfuo.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636783": [
        {
            "ioc_value": "oeihefoeaboeubfuo.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636784": [
        {
            "ioc_value": "oeihefoeaboeubfuo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636785": [
        {
            "ioc_value": "oeihefoeaboeubfuo.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636786": [
        {
            "ioc_value": "oeihefoeaboeubfuo.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636787": [
        {
            "ioc_value": "oeihefoeaboeubfuo.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636788": [
        {
            "ioc_value": "rohgoruhgsorhugih.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636789": [
        {
            "ioc_value": "rohgoruhgsorhugih.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636790": [
        {
            "ioc_value": "rohgoruhgsorhugih.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636791": [
        {
            "ioc_value": "rohgoruhgsorhugih.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636792": [
        {
            "ioc_value": "rohgoruhgsorhugih.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636793": [
        {
            "ioc_value": "rohgoruhgsorhugih.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636794": [
        {
            "ioc_value": "rohgoruhgsorhugih.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636795": [
        {
            "ioc_value": "rohgoruhgsorhugih.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636796": [
        {
            "ioc_value": "rohgoruhgsorhugih.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636750": [
        {
            "ioc_value": "oeboufanecoauegfe.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636751": [
        {
            "ioc_value": "oeboufanecoauegfe.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636752": [
        {
            "ioc_value": "oeboufanecoauegfe.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636753": [
        {
            "ioc_value": "oeboufanecoauegfe.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636754": [
        {
            "ioc_value": "oeboufanecoauegfe.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636755": [
        {
            "ioc_value": "oeboufanecoauegfe.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636756": [
        {
            "ioc_value": "oeboufanecoauegfe.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636757": [
        {
            "ioc_value": "oeboufanecoauegfe.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636758": [
        {
            "ioc_value": "oeboufanecoauegfe.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636759": [
        {
            "ioc_value": "oeboufanecoauegfe.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636760": [
        {
            "ioc_value": "oeboufanecoauegfe.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636761": [
        {
            "ioc_value": "oeboufanecoauegfe.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636762": [
        {
            "ioc_value": "oeboufanecoauegfe.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636763": [
        {
            "ioc_value": "oeboufanecoauegfe.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636764": [
        {
            "ioc_value": "oeihefoeaboeubfuo.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636765": [
        {
            "ioc_value": "oeihefoeaboeubfuo.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636766": [
        {
            "ioc_value": "oeihefoeaboeubfuo.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636767": [
        {
            "ioc_value": "oeihefoeaboeubfuo.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636768": [
        {
            "ioc_value": "oeihefoeaboeubfuo.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636769": [
        {
            "ioc_value": "oeihefoeaboeubfuo.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636770": [
        {
            "ioc_value": "oeihefoeaboeubfuo.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636771": [
        {
            "ioc_value": "oeihefoeaboeubfuo.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636772": [
        {
            "ioc_value": "oeihefoeaboeubfuo.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636727": [
        {
            "ioc_value": "oeabocbeogoaehgoi.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636728": [
        {
            "ioc_value": "oeabocbeogoaehgoi.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636729": [
        {
            "ioc_value": "oeabocbeogoaehgoi.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636730": [
        {
            "ioc_value": "oeabocbeogoaehgoi.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636731": [
        {
            "ioc_value": "oeabocbeogoaehgoi.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636732": [
        {
            "ioc_value": "oeabocbeogoaehgoi.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636733": [
        {
            "ioc_value": "oeabocbeogoaehgoi.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636734": [
        {
            "ioc_value": "oeabocbeogoaehgoi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636735": [
        {
            "ioc_value": "oeabocbeogoaehgoi.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636736": [
        {
            "ioc_value": "oeabocbeogoaehgoi.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636737": [
        {
            "ioc_value": "oeabocbeogoaehgoi.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636738": [
        {
            "ioc_value": "oeabocbeogoaehgoi.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636739": [
        {
            "ioc_value": "oeboufanecoauegfe.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636740": [
        {
            "ioc_value": "oeboufanecoauegfe.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636741": [
        {
            "ioc_value": "oeboufanecoauegfe.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636742": [
        {
            "ioc_value": "oeboufanecoauegfe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": "2025-11-18 07:20:54",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636743": [
        {
            "ioc_value": "oeboufanecoauegfe.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636744": [
        {
            "ioc_value": "oeboufanecoauegfe.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636745": [
        {
            "ioc_value": "oeboufanecoauegfe.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636746": [
        {
            "ioc_value": "oeboufanecoauegfe.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636747": [
        {
            "ioc_value": "oeboufanecoauegfe.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636748": [
        {
            "ioc_value": "oeboufanecoauegfe.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636749": [
        {
            "ioc_value": "oeboufanecoauegfe.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636704": [
        {
            "ioc_value": "oahefaefoehgfueuu.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636705": [
        {
            "ioc_value": "oahefaefoehgfueuu.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636706": [
        {
            "ioc_value": "oahefaefoehgfueuu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": "2025-11-09 19:43:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636707": [
        {
            "ioc_value": "oahefaefoehgfueuu.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636708": [
        {
            "ioc_value": "oahefaefoehgfueuu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636709": [
        {
            "ioc_value": "oahefaefoehgfueuu.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636710": [
        {
            "ioc_value": "oahefaefoehgfueuu.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636711": [
        {
            "ioc_value": "oahefaefoehgfueuu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": "2025-11-10 06:58:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636712": [
        {
            "ioc_value": "oahefaefoehgfueuu.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636713": [
        {
            "ioc_value": "oahefaefoehgfueuu.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636714": [
        {
            "ioc_value": "oeabocbeogoaehgoi.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636715": [
        {
            "ioc_value": "oeabocbeogoaehgoi.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636716": [
        {
            "ioc_value": "oeabocbeogoaehgoi.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636717": [
        {
            "ioc_value": "oeabocbeogoaehgoi.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636718": [
        {
            "ioc_value": "oeabocbeogoaehgoi.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636719": [
        {
            "ioc_value": "oeabocbeogoaehgoi.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636720": [
        {
            "ioc_value": "oeabocbeogoaehgoi.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636721": [
        {
            "ioc_value": "oeabocbeogoaehgoi.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636722": [
        {
            "ioc_value": "oeabocbeogoaehgoi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636723": [
        {
            "ioc_value": "oeabocbeogoaehgoi.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636724": [
        {
            "ioc_value": "oeabocbeogoaehgoi.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636725": [
        {
            "ioc_value": "oeabocbeogoaehgoi.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636726": [
        {
            "ioc_value": "oeabocbeogoaehgoi.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636682": [
        {
            "ioc_value": "iugeaifeifauegeai.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636683": [
        {
            "ioc_value": "iugeaifeifauegeai.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636684": [
        {
            "ioc_value": "iugeaifeifauegeai.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636685": [
        {
            "ioc_value": "iugeaifeifauegeai.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636686": [
        {
            "ioc_value": "iugeaifeifauegeai.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636687": [
        {
            "ioc_value": "iugeaifeifauegeai.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636688": [
        {
            "ioc_value": "iugeaifeifauegeai.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636689": [
        {
            "ioc_value": "oahefaefoehgfueuu.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636690": [
        {
            "ioc_value": "oahefaefoehgfueuu.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636691": [
        {
            "ioc_value": "oahefaefoehgfueuu.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636692": [
        {
            "ioc_value": "oahefaefoehgfueuu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636693": [
        {
            "ioc_value": "oahefaefoehgfueuu.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636694": [
        {
            "ioc_value": "oahefaefoehgfueuu.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636695": [
        {
            "ioc_value": "oahefaefoehgfueuu.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636696": [
        {
            "ioc_value": "oahefaefoehgfueuu.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636697": [
        {
            "ioc_value": "oahefaefoehgfueuu.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636698": [
        {
            "ioc_value": "oahefaefoehgfueuu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636699": [
        {
            "ioc_value": "oahefaefoehgfueuu.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636700": [
        {
            "ioc_value": "oahefaefoehgfueuu.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636701": [
        {
            "ioc_value": "oahefaefoehgfueuu.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636702": [
        {
            "ioc_value": "oahefaefoehgfueuu.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636703": [
        {
            "ioc_value": "oahefaefoehgfueuu.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636659": [
        {
            "ioc_value": "iapghahpnpnapcipa.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636660": [
        {
            "ioc_value": "iapghahpnpnapcipa.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636661": [
        {
            "ioc_value": "iapghahpnpnapcipa.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636662": [
        {
            "ioc_value": "iapghahpnpnapcipa.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636663": [
        {
            "ioc_value": "iapghahpnpnapcipa.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636664": [
        {
            "ioc_value": "iugeaifeifauegeai.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636665": [
        {
            "ioc_value": "iugeaifeifauegeai.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636666": [
        {
            "ioc_value": "iugeaifeifauegeai.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636667": [
        {
            "ioc_value": "iugeaifeifauegeai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636668": [
        {
            "ioc_value": "iugeaifeifauegeai.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636669": [
        {
            "ioc_value": "iugeaifeifauegeai.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636670": [
        {
            "ioc_value": "iugeaifeifauegeai.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636671": [
        {
            "ioc_value": "iugeaifeifauegeai.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636672": [
        {
            "ioc_value": "iugeaifeifauegeai.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636673": [
        {
            "ioc_value": "iugeaifeifauegeai.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636674": [
        {
            "ioc_value": "iugeaifeifauegeai.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636675": [
        {
            "ioc_value": "iugeaifeifauegeai.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636676": [
        {
            "ioc_value": "iugeaifeifauegeai.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636677": [
        {
            "ioc_value": "iugeaifeifauegeai.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636678": [
        {
            "ioc_value": "iugeaifeifauegeai.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636679": [
        {
            "ioc_value": "iugeaifeifauegeai.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636680": [
        {
            "ioc_value": "iugeaifeifauegeai.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636681": [
        {
            "ioc_value": "iugeaifeifauegeai.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636637": [
        {
            "ioc_value": "huaeokaefoaeguaehm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636638": [
        {
            "ioc_value": "huaeokaefoaeguaehr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636639": [
        {
            "ioc_value": "huaeokaefoaeguaehu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636640": [
        {
            "ioc_value": "iapghahpnpnapcipa.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636641": [
        {
            "ioc_value": "iapghahpnpnapcipa.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636642": [
        {
            "ioc_value": "iapghahpnpnapcipa.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636643": [
        {
            "ioc_value": "iapghahpnpnapcipa.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636644": [
        {
            "ioc_value": "iapghahpnpnapcipa.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636645": [
        {
            "ioc_value": "iapghahpnpnapcipa.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636646": [
        {
            "ioc_value": "iapghahpnpnapcipa.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636647": [
        {
            "ioc_value": "iapghahpnpnapcipa.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636648": [
        {
            "ioc_value": "iapghahpnpnapcipa.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636649": [
        {
            "ioc_value": "iapghahpnpnapcipa.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636650": [
        {
            "ioc_value": "iapghahpnpnapcipa.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636651": [
        {
            "ioc_value": "iapghahpnpnapcipa.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636652": [
        {
            "ioc_value": "iapghahpnpnapcipa.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636653": [
        {
            "ioc_value": "iapghahpnpnapcipa.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636654": [
        {
            "ioc_value": "iapghahpnpnapcipa.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636655": [
        {
            "ioc_value": "iapghahpnpnapcipa.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636656": [
        {
            "ioc_value": "iapghahpnpnapcipa.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636657": [
        {
            "ioc_value": "iapghahpnpnapcipa.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636658": [
        {
            "ioc_value": "iapghahpnpnapcipa.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636615": [
        {
            "ioc_value": "goiaegodbuebieibg.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636616": [
        {
            "ioc_value": "goiaegodbuebieibg.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636617": [
        {
            "ioc_value": "goiaegodbuebieibg.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636618": [
        {
            "ioc_value": "goiaegodbuebieibg.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636619": [
        {
            "ioc_value": "goiaegodbuebieibg.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636620": [
        {
            "ioc_value": "goiaegodbuebieibg.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636621": [
        {
            "ioc_value": "goiaegodbuebieibg.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636622": [
        {
            "ioc_value": "goiaegodbuebieibg.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636623": [
        {
            "ioc_value": "goiaegodbuebieibg.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636624": [
        {
            "ioc_value": "goiaegodbuebieibg.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636625": [
        {
            "ioc_value": "goiaegodbuebieibg.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636626": [
        {
            "ioc_value": "goiaegodbuebieibg.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636627": [
        {
            "ioc_value": "goiaegodbuebieibg.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636628": [
        {
            "ioc_value": "goiaegodbuebieibg.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636629": [
        {
            "ioc_value": "goiaegodbuebieibg.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636630": [
        {
            "ioc_value": "goiaegodbuebieibg.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636631": [
        {
            "ioc_value": "goiaegodbuebieibg.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636632": [
        {
            "ioc_value": "goiaegodbuebieibg.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636633": [
        {
            "ioc_value": "goiaegodbuebieibg.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636634": [
        {
            "ioc_value": "goiaegodbuebieibg.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636635": [
        {
            "ioc_value": "goiaegodbuebieibg.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636636": [
        {
            "ioc_value": "huaeokaefoaeguaehl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636594": [
        {
            "ioc_value": "gaoehuoaoefhuhfugs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636595": [
        {
            "ioc_value": "gaoehuoaoefhuhfugu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636596": [
        {
            "ioc_value": "gaoheeuofhefefhutl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636597": [
        {
            "ioc_value": "gaoheeuofhefefhutm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636598": [
        {
            "ioc_value": "gaoheeuofhefefhutr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636599": [
        {
            "ioc_value": "gaoheeuofhefefhuts.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636600": [
        {
            "ioc_value": "gaoheeuofhefefhutu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636601": [
        {
            "ioc_value": "gaohrhurhuhruhfsdl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636602": [
        {
            "ioc_value": "gaohrhurhuhruhfsdm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636603": [
        {
            "ioc_value": "gaohrhurhuhruhfsdr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636604": [
        {
            "ioc_value": "gaohrhurhuhruhfsdu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636605": [
        {
            "ioc_value": "gaouehaehfoaeajrsm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636606": [
        {
            "ioc_value": "gaouehaehfoaeajrsr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636607": [
        {
            "ioc_value": "gaouehaehfoaeajrss.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636608": [
        {
            "ioc_value": "gaouehaehfoaeajrsu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636609": [
        {
            "ioc_value": "geauhouefheuutiiim.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636610": [
        {
            "ioc_value": "geauhouefheuutiiir.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636611": [
        {
            "ioc_value": "geauhouefheuutiiis.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636612": [
        {
            "ioc_value": "geauhouefheuutiiiu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636613": [
        {
            "ioc_value": "goiaegodbuebieibg.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636614": [
        {
            "ioc_value": "goiaegodbuebieibg.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636571": [
        {
            "ioc_value": "eoahegohaeohgeehr.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636572": [
        {
            "ioc_value": "eoahegohaeohgeehr.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636573": [
        {
            "ioc_value": "eoahegohaeohgeehr.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636574": [
        {
            "ioc_value": "eoahegohaeohgeehr.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": "2025-11-17 06:46:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636575": [
        {
            "ioc_value": "eoahegohaeohgeehr.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636576": [
        {
            "ioc_value": "eoahegohaeohgeehr.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636577": [
        {
            "ioc_value": "eoahegohaeohgeehr.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636578": [
        {
            "ioc_value": "eoahegohaeohgeehr.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636579": [
        {
            "ioc_value": "eoahegohaeohgeehr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636580": [
        {
            "ioc_value": "eoahegohaeohgeehr.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636581": [
        {
            "ioc_value": "eoahegohaeohgeehr.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636582": [
        {
            "ioc_value": "eoahegohaeohgeehr.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636583": [
        {
            "ioc_value": "eoahegohaeohgeehr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636584": [
        {
            "ioc_value": "eoahegohaeohgeehr.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636585": [
        {
            "ioc_value": "eoahegohaeohgeehr.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636586": [
        {
            "ioc_value": "gaghpaheiafhjefijl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636587": [
        {
            "ioc_value": "gaghpaheiafhjefijm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636588": [
        {
            "ioc_value": "gaghpaheiafhjefijr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636589": [
        {
            "ioc_value": "gaghpaheiafhjefijs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636590": [
        {
            "ioc_value": "gaghpaheiafhjefiju.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636591": [
        {
            "ioc_value": "gaoehuoaoefhuhfugl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636592": [
        {
            "ioc_value": "gaoehuoaoefhuhfugm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636593": [
        {
            "ioc_value": "gaoehuoaoefhuhfugr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636548": [
        {
            "ioc_value": "eghoabeogbuaeofua.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636549": [
        {
            "ioc_value": "eghoabeogbuaeofua.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636550": [
        {
            "ioc_value": "eghoabeogbuaeofua.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636551": [
        {
            "ioc_value": "eghoabeogbuaeofua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636552": [
        {
            "ioc_value": "eghoabeogbuaeofua.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636553": [
        {
            "ioc_value": "eghoabeogbuaeofua.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636554": [
        {
            "ioc_value": "eghoabeogbuaeofua.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636555": [
        {
            "ioc_value": "eghoabeogbuaeofua.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636556": [
        {
            "ioc_value": "eguaheoghouughahsm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636557": [
        {
            "ioc_value": "eguaheoghouughahsr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636558": [
        {
            "ioc_value": "eguaheoghouughahss.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636559": [
        {
            "ioc_value": "eguaheoghouughahsu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636560": [
        {
            "ioc_value": "eoahegohaeohgeehr.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636561": [
        {
            "ioc_value": "eoahegohaeohgeehr.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636562": [
        {
            "ioc_value": "eoahegohaeohgeehr.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": "2025-11-16 18:58:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636563": [
        {
            "ioc_value": "eoahegohaeohgeehr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636564": [
        {
            "ioc_value": "eoahegohaeohgeehr.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636565": [
        {
            "ioc_value": "eoahegohaeohgeehr.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636566": [
        {
            "ioc_value": "eoahegohaeohgeehr.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636567": [
        {
            "ioc_value": "eoahegohaeohgeehr.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636568": [
        {
            "ioc_value": "eoahegohaeohgeehr.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636569": [
        {
            "ioc_value": "eoahegohaeohgeehr.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636570": [
        {
            "ioc_value": "eoahegohaeohgeehr.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636527": [
        {
            "ioc_value": "eaeuafhuaegfugeudl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636528": [
        {
            "ioc_value": "eaeuafhuaegfugeudm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636529": [
        {
            "ioc_value": "eaeuafhuaegfugeudr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636530": [
        {
            "ioc_value": "eaeuafhuaegfugeuds.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636531": [
        {
            "ioc_value": "eaeuafhuaegfugeudu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636532": [
        {
            "ioc_value": "eghoabeogbuaeofua.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636533": [
        {
            "ioc_value": "eghoabeogbuaeofua.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636534": [
        {
            "ioc_value": "eghoabeogbuaeofua.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636535": [
        {
            "ioc_value": "eghoabeogbuaeofua.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636536": [
        {
            "ioc_value": "eghoabeogbuaeofua.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636537": [
        {
            "ioc_value": "eghoabeogbuaeofua.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636538": [
        {
            "ioc_value": "eghoabeogbuaeofua.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636539": [
        {
            "ioc_value": "eghoabeogbuaeofua.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636540": [
        {
            "ioc_value": "eghoabeogbuaeofua.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636541": [
        {
            "ioc_value": "eghoabeogbuaeofua.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636542": [
        {
            "ioc_value": "eghoabeogbuaeofua.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636543": [
        {
            "ioc_value": "eghoabeogbuaeofua.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636544": [
        {
            "ioc_value": "eghoabeogbuaeofua.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636545": [
        {
            "ioc_value": "eghoabeogbuaeofua.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636546": [
        {
            "ioc_value": "eghoabeogbuaeofua.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636547": [
        {
            "ioc_value": "eghoabeogbuaeofua.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636506": [
        {
            "ioc_value": "auoegfiaefuageudn.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636507": [
        {
            "ioc_value": "auoegfiaefuageudn.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636508": [
        {
            "ioc_value": "auoegfiaefuageudn.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636509": [
        {
            "ioc_value": "auoegfiaefuageudn.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636510": [
        {
            "ioc_value": "auoegfiaefuageudn.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636511": [
        {
            "ioc_value": "auoegfiaefuageudn.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636512": [
        {
            "ioc_value": "auoegfiaefuageudn.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636513": [
        {
            "ioc_value": "auoegfiaefuageudn.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636514": [
        {
            "ioc_value": "befaheaiudeuhughgl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636515": [
        {
            "ioc_value": "befaheaiudeuhughgm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636516": [
        {
            "ioc_value": "befaheaiudeuhughgr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636517": [
        {
            "ioc_value": "befaheaiudeuhughgs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636518": [
        {
            "ioc_value": "bfagzzezgaegzgfail.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636519": [
        {
            "ioc_value": "bfagzzezgaegzgfaim.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636520": [
        {
            "ioc_value": "bfagzzezgaegzgfair.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636521": [
        {
            "ioc_value": "bfagzzezgaegzgfais.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636522": [
        {
            "ioc_value": "bfagzzezgaegzgfaiu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636523": [
        {
            "ioc_value": "daedagheauehfuuhfl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636524": [
        {
            "ioc_value": "daedagheauehfuuhfm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636525": [
        {
            "ioc_value": "daedagheauehfuuhfr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636526": [
        {
            "ioc_value": "daedagheauehfuuhfs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636483": [
        {
            "ioc_value": "ageihehaioeoaiegj.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636484": [
        {
            "ioc_value": "ageihehaioeoaiegj.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636485": [
        {
            "ioc_value": "ageihehaioeoaiegj.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636486": [
        {
            "ioc_value": "ageihehaioeoaiegj.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636487": [
        {
            "ioc_value": "ageihehaioeoaiegj.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636488": [
        {
            "ioc_value": "ageihehaioeoaiegj.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636489": [
        {
            "ioc_value": "auoegfiaefuageudn.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636490": [
        {
            "ioc_value": "auoegfiaefuageudn.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636491": [
        {
            "ioc_value": "auoegfiaefuageudn.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636492": [
        {
            "ioc_value": "auoegfiaefuageudn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636493": [
        {
            "ioc_value": "auoegfiaefuageudn.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636494": [
        {
            "ioc_value": "auoegfiaefuageudn.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636495": [
        {
            "ioc_value": "auoegfiaefuageudn.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636496": [
        {
            "ioc_value": "auoegfiaefuageudn.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636497": [
        {
            "ioc_value": "auoegfiaefuageudn.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636498": [
        {
            "ioc_value": "auoegfiaefuageudn.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636499": [
        {
            "ioc_value": "auoegfiaefuageudn.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636500": [
        {
            "ioc_value": "auoegfiaefuageudn.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636501": [
        {
            "ioc_value": "auoegfiaefuageudn.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636502": [
        {
            "ioc_value": "auoegfiaefuageudn.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": "2025-11-09 19:43:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636503": [
        {
            "ioc_value": "auoegfiaefuageudn.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636504": [
        {
            "ioc_value": "auoegfiaefuageudn.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636505": [
        {
            "ioc_value": "auoegfiaefuageudn.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636461": [
        {
            "ioc_value": "afaigaeigieufuifis.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636462": [
        {
            "ioc_value": "afaigaeigieufuifiu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636463": [
        {
            "ioc_value": "ageihehaioeoaiegj.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636464": [
        {
            "ioc_value": "ageihehaioeoaiegj.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636465": [
        {
            "ioc_value": "ageihehaioeoaiegj.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636466": [
        {
            "ioc_value": "ageihehaioeoaiegj.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636467": [
        {
            "ioc_value": "ageihehaioeoaiegj.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636468": [
        {
            "ioc_value": "ageihehaioeoaiegj.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636469": [
        {
            "ioc_value": "ageihehaioeoaiegj.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636470": [
        {
            "ioc_value": "ageihehaioeoaiegj.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636471": [
        {
            "ioc_value": "ageihehaioeoaiegj.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636472": [
        {
            "ioc_value": "ageihehaioeoaiegj.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636473": [
        {
            "ioc_value": "ageihehaioeoaiegj.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636474": [
        {
            "ioc_value": "ageihehaioeoaiegj.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636475": [
        {
            "ioc_value": "ageihehaioeoaiegj.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636476": [
        {
            "ioc_value": "ageihehaioeoaiegj.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636477": [
        {
            "ioc_value": "ageihehaioeoaiegj.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636478": [
        {
            "ioc_value": "ageihehaioeoaiegj.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636479": [
        {
            "ioc_value": "ageihehaioeoaiegj.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636480": [
        {
            "ioc_value": "ageihehaioeoaiegj.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636481": [
        {
            "ioc_value": "ageihehaioeoaiegj.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636482": [
        {
            "ioc_value": "ageihehaioeoaiegj.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636440": [
        {
            "ioc_value": "aeifaeifhutuhuhusm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636441": [
        {
            "ioc_value": "aeifaeifhutuhuhusr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636442": [
        {
            "ioc_value": "aeifaeifhutuhuhusu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636443": [
        {
            "ioc_value": "aeoughaoheguaoehdl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636444": [
        {
            "ioc_value": "aeoughaoheguaoehdm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636445": [
        {
            "ioc_value": "aeoughaoheguaoehdr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636446": [
        {
            "ioc_value": "aeoughaoheguaoehds.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636447": [
        {
            "ioc_value": "aeoughaoheguaoehdu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636448": [
        {
            "ioc_value": "aeufuaehfiuehfuhfl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636449": [
        {
            "ioc_value": "aeufuaehfiuehfuhfm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636450": [
        {
            "ioc_value": "aeufuaehfiuehfuhfr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636451": [
        {
            "ioc_value": "aeufuaehfiuehfuhfs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636452": [
        {
            "ioc_value": "aeufuaehfiuehfuhfu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636453": [
        {
            "ioc_value": "afaeigaifgsgrhhafl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636454": [
        {
            "ioc_value": "afaeigaifgsgrhhafm.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636455": [
        {
            "ioc_value": "afaeigaifgsgrhhafr.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636456": [
        {
            "ioc_value": "afaeigaifgsgrhhafs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636457": [
        {
            "ioc_value": "afaeigaifgsgrhhafu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636458": [
        {
            "ioc_value": "afaigaeigieufuifil.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636459": [
        {
            "ioc_value": "afaigaeigieufuifim.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636460": [
        {
            "ioc_value": "afaigaeigieufuifir.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636418": [
        {
            "ioc_value": "aefobfboabobfaoua.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636419": [
        {
            "ioc_value": "aefobfboabobfaoua.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636420": [
        {
            "ioc_value": "aefobfboabobfaoua.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636421": [
        {
            "ioc_value": "aefobfboabobfaoua.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636422": [
        {
            "ioc_value": "aefobfboabobfaoua.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636423": [
        {
            "ioc_value": "aefobfboabobfaoua.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636424": [
        {
            "ioc_value": "aefobfboabobfaoua.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636425": [
        {
            "ioc_value": "aefobfboabobfaoua.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636426": [
        {
            "ioc_value": "aefobfboabobfaoua.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636427": [
        {
            "ioc_value": "aefobfboabobfaoua.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636428": [
        {
            "ioc_value": "aefobfboabobfaoua.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636429": [
        {
            "ioc_value": "aefobfboabobfaoua.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636430": [
        {
            "ioc_value": "aefobfboabobfaoua.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636431": [
        {
            "ioc_value": "aefobfboabobfaoua.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636432": [
        {
            "ioc_value": "aefobfboabobfaoua.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636433": [
        {
            "ioc_value": "aefobfboabobfaoua.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636434": [
        {
            "ioc_value": "aegohaohuoruitiiel.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636435": [
        {
            "ioc_value": "aegohaohuoruitiiem.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636436": [
        {
            "ioc_value": "aegohaohuoruitiier.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636437": [
        {
            "ioc_value": "aegohaohuoruitiies.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636438": [
        {
            "ioc_value": "aegohaohuoruitiieu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636439": [
        {
            "ioc_value": "aeifaeifhutuhuhusl.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636396": [
        {
            "ioc_value": "abvainvienvaiebai.kz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636397": [
        {
            "ioc_value": "abvainvienvaiebai.lu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636398": [
        {
            "ioc_value": "abvainvienvaiebai.md",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636399": [
        {
            "ioc_value": "abvainvienvaiebai.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636400": [
        {
            "ioc_value": "abvainvienvaiebai.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636401": [
        {
            "ioc_value": "abvainvienvaiebai.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636402": [
        {
            "ioc_value": "abvainvienvaiebai.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636403": [
        {
            "ioc_value": "abvainvienvaiebai.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636404": [
        {
            "ioc_value": "abvainvienvaiebai.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636405": [
        {
            "ioc_value": "abvainvienvaiebai.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636406": [
        {
            "ioc_value": "abvainvienvaiebai.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636407": [
        {
            "ioc_value": "abvainvienvaiebai.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636408": [
        {
            "ioc_value": "abvainvienvaiebai.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636409": [
        {
            "ioc_value": "aefobfboabobfaoua.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636410": [
        {
            "ioc_value": "aefobfboabobfaoua.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636411": [
        {
            "ioc_value": "aefobfboabobfaoua.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636412": [
        {
            "ioc_value": "aefobfboabobfaoua.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636413": [
        {
            "ioc_value": "aefobfboabobfaoua.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636414": [
        {
            "ioc_value": "aefobfboabobfaoua.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636415": [
        {
            "ioc_value": "aefobfboabobfaoua.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636416": [
        {
            "ioc_value": "aefobfboabobfaoua.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636417": [
        {
            "ioc_value": "aefobfboabobfaoua.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636384": [
        {
            "ioc_value": "abvainvienvaiebai.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636385": [
        {
            "ioc_value": "abvainvienvaiebai.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636386": [
        {
            "ioc_value": "abvainvienvaiebai.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636387": [
        {
            "ioc_value": "abvainvienvaiebai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636388": [
        {
            "ioc_value": "abvainvienvaiebai.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636389": [
        {
            "ioc_value": "abvainvienvaiebai.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636390": [
        {
            "ioc_value": "abvainvienvaiebai.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636391": [
        {
            "ioc_value": "abvainvienvaiebai.gr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636392": [
        {
            "ioc_value": "abvainvienvaiebai.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636393": [
        {
            "ioc_value": "abvainvienvaiebai.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636394": [
        {
            "ioc_value": "abvainvienvaiebai.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636395": [
        {
            "ioc_value": "abvainvienvaiebai.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-08 08:56:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636263": [
        {
            "ioc_value": "cqf47.horizonbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 08:55:03",
            "last_seen_utc": "2025-11-08 09:02:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636262": [
        {
            "ioc_value": "seznam.accesscam.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-08 08:54:43",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636261": [
        {
            "ioc_value": "rony.publicvm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-08 08:54:42",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1636254": [
        {
            "ioc_value": "6lz.horizonbloom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 08:50:51",
            "last_seen_utc": "2025-11-08 08:54:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636252": [
        {
            "ioc_value": "gk.silversummit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 08:47:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636245": [
        {
            "ioc_value": "geskw.silversummit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 08:37:56",
            "last_seen_utc": "2025-11-08 08:38:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636244": [
        {
            "ioc_value": "swa.silversummit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 08:30:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636243": [
        {
            "ioc_value": "7b9o0.fr0stp1llar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 08:28:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636242": [
        {
            "ioc_value": "a8eq.fr0stp1llar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 08:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636241": [
        {
            "ioc_value": "lkyb.fr0stp1llar.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 08:14:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636239": [
        {
            "ioc_value": "gqu3.brightvoyage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 08:07:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636224": [
        {
            "ioc_value": "mreow.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-08 07:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "asyncthecatlol"
        }
    ],
    "1636225": [
        {
            "ioc_value": "mreow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-08 07:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "asyncthecatlol"
        }
    ],
    "1636233": [
        {
            "ioc_value": "zkefi.brightvoyage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 07:57:36",
            "last_seen_utc": "2025-11-08 07:59:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636230": [
        {
            "ioc_value": "medialito.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-11-08 07:52:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1636231": [
        {
            "ioc_value": "cmcare.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-11-08 07:52:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1636232": [
        {
            "ioc_value": "www.gtjoin.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-11-08 07:52:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1636226": [
        {
            "ioc_value": "suitsoap.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-08 07:50:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1636227": [
        {
            "ioc_value": "framestove.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-08 07:50:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1636228": [
        {
            "ioc_value": "plasticstem.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-08 07:50:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1636229": [
        {
            "ioc_value": "bloodscarf.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-11-08 07:50:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1636223": [
        {
            "ioc_value": "p0.brightvoyage.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 07:45:18",
            "last_seen_utc": "2025-11-08 07:50:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636116": [
        {
            "ioc_value": "solomand.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-08 07:38:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1636119": [
        {
            "ioc_value": "chrmeupdate.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-08 07:38:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1636120": [
        {
            "ioc_value": "pixelnoased.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-08 07:38:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1636124": [
        {
            "ioc_value": "journeywekk.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-08 07:38:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1636222": [
        {
            "ioc_value": "stern.emberkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 07:38:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636057": [
        {
            "ioc_value": "files.parsonspaving.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-08 07:36:48",
            "last_seen_utc": "2025-11-13 06:27:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115510003745129952",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1636080": [
        {
            "ioc_value": "capckutapk.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-08 07:36:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "xQeR"
        }
    ],
    "1636193": [
        {
            "ioc_value": "glut.emberkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 07:21:06",
            "last_seen_utc": "2025-11-08 07:36:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636192": [
        {
            "ioc_value": "feuer.emberkranz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 07:15:44",
            "last_seen_utc": "2025-11-08 07:15:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636191": [
        {
            "ioc_value": "spark.flintwerder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 07:03:23",
            "last_seen_utc": "2025-11-08 07:07:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636190": [
        {
            "ioc_value": "rauch.flintwerder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 06:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636189": [
        {
            "ioc_value": "stein.flintwerder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 06:47:25",
            "last_seen_utc": "2025-11-08 06:48:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636188": [
        {
            "ioc_value": "wind.zirconweg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 06:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636187": [
        {
            "ioc_value": "ufer.zirconweg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 06:27:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636186": [
        {
            "ioc_value": "pfad.zirconweg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 06:17:29",
            "last_seen_utc": "2025-11-08 06:18:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636185": [
        {
            "ioc_value": "grat.citrinewald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 06:07:04",
            "last_seen_utc": "2025-11-08 06:08:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636181": [
        {
            "ioc_value": "licht.citrinewald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 05:56:46",
            "last_seen_utc": "2025-11-08 06:04:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636180": [
        {
            "ioc_value": "amber.citrinewald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 05:48:00",
            "last_seen_utc": "2025-11-08 05:48:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636179": [
        {
            "ioc_value": "bach.jasperhain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 05:37:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636178": [
        {
            "ioc_value": "rune.jasperhain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 05:27:53",
            "last_seen_utc": "2025-11-08 05:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636177": [
        {
            "ioc_value": "moor.jasperhain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 05:17:35",
            "last_seen_utc": "2025-11-08 05:25:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636176": [
        {
            "ioc_value": "glow.rubyraum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 05:08:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636175": [
        {
            "ioc_value": "raum.rubyraum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 04:57:30",
            "last_seen_utc": "2025-11-08 04:59:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636174": [
        {
            "ioc_value": "ruby.rubyraum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 04:47:11",
            "last_seen_utc": "2025-11-08 04:53:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636173": [
        {
            "ioc_value": "gruen.jadeecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 04:36:53",
            "last_seen_utc": "2025-11-08 04:42:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636172": [
        {
            "ioc_value": "ecke.jadeecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 04:28:07",
            "last_seen_utc": "2025-11-08 04:30:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636171": [
        {
            "ioc_value": "jade.jadeecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 04:17:53",
            "last_seen_utc": "2025-11-08 04:24:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636166": [
        {
            "ioc_value": "wind.hawkmast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 04:01:55",
            "last_seen_utc": "2025-11-08 04:07:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636163": [
        {
            "ioc_value": "mast.hawkmast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 03:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636162": [
        {
            "ioc_value": "hawk.hawkmast.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 03:46:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636161": [
        {
            "ioc_value": "nacht.owlflug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 03:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636160": [
        {
            "ioc_value": "flug.owlflug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 03:41:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636159": [
        {
            "ioc_value": "0er.owlflug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 03:37:17",
            "last_seen_utc": "2025-11-08 03:38:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636158": [
        {
            "ioc_value": "0ver.heronturm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 03:27:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636157": [
        {
            "ioc_value": "23.heronturm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 03:17:10",
            "last_seen_utc": "2025-11-08 03:17:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636156": [
        {
            "ioc_value": "1on.heronturm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 03:04:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636155": [
        {
            "ioc_value": "segel.pumaschiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 03:02:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636154": [
        {
            "ioc_value": "schiff.pumaschiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 02:52:53",
            "last_seen_utc": "2025-11-08 02:54:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636152": [
        {
            "ioc_value": "puma.pumaschiff.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 02:47:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636151": [
        {
            "ioc_value": "claw.tigerzaun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 02:37:54",
            "last_seen_utc": "2025-11-08 02:39:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636150": [
        {
            "ioc_value": "zaun.tigerzaun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 02:22:30",
            "last_seen_utc": "2025-11-08 02:28:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636149": [
        {
            "ioc_value": "tiger.tigerzaun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 02:17:17",
            "last_seen_utc": "2025-11-08 02:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636148": [
        {
            "ioc_value": "flug.cranezeit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 02:07:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636147": [
        {
            "ioc_value": "zeit.cranezeit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 01:57:05",
            "last_seen_utc": "2025-11-08 01:59:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636146": [
        {
            "ioc_value": "crane.cranezeit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 01:48:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636144": [
        {
            "ioc_value": "wolke.cloudkreis.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 01:31:55",
            "last_seen_utc": "2025-11-08 01:39:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636143": [
        {
            "ioc_value": "kreis.cloudkreis.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 01:28:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636142": [
        {
            "ioc_value": "cloud.cloudkreis.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 01:17:56",
            "last_seen_utc": "2025-11-08 01:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636141": [
        {
            "ioc_value": "sturm.rainrad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 01:06:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636140": [
        {
            "ioc_value": "rad.rainrad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 00:57:49",
            "last_seen_utc": "2025-11-08 01:03:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636139": [
        {
            "ioc_value": "rain.rainrad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 00:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636138": [
        {
            "ioc_value": "ufer.otterweg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 00:38:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636137": [
        {
            "ioc_value": "weg.otterweg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 00:27:26",
            "last_seen_utc": "2025-11-08 00:30:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636136": [
        {
            "ioc_value": "otter.otterweg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 00:13:04",
            "last_seen_utc": "2025-11-08 00:25:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636135": [
        {
            "ioc_value": "stein.badgerfels.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-08 00:07:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636129": [
        {
            "ioc_value": "fels.badgerfels.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 23:58:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636128": [
        {
            "ioc_value": "badger.badgerfels.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 23:44:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636127": [
        {
            "ioc_value": "feld.harewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 23:37:54",
            "last_seen_utc": "2025-11-07 23:38:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636122": [
        {
            "ioc_value": "winkel.harewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 23:27:34",
            "last_seen_utc": "2025-11-07 23:28:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636115": [
        {
            "ioc_value": "hare.harewinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 23:18:18",
            "last_seen_utc": "2025-11-07 23:24:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636114": [
        {
            "ioc_value": "wald.martenhain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 23:08:30",
            "last_seen_utc": "2025-11-07 23:11:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636098": [
        {
            "ioc_value": "hain.martenhain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 22:59:14",
            "last_seen_utc": "2025-11-07 23:06:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636097": [
        {
            "ioc_value": "marten.martenhain.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 22:49:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636096": [
        {
            "ioc_value": "pfad.stoatgasse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 22:46:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636095": [
        {
            "ioc_value": "stoat.stoatgasse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 22:38:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636094": [
        {
            "ioc_value": "gasse.stoatgasse.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 22:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636093": [
        {
            "ioc_value": "peak.eaglekrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 22:15:54",
            "last_seen_utc": "2025-11-07 22:27:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636092": [
        {
            "ioc_value": "krone.eaglekrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 22:09:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636091": [
        {
            "ioc_value": "adler.eaglekrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 22:02:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636090": [
        {
            "ioc_value": "ufer.wrenhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 22:00:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636089": [
        {
            "ioc_value": "hafen.wrenhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 21:56:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636088": [
        {
            "ioc_value": "wren.wrenhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 21:50:23",
            "last_seen_utc": "2025-11-07 21:53:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636087": [
        {
            "ioc_value": "eiche.boargrund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 21:47:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636086": [
        {
            "ioc_value": "wild.boargrund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 21:37:26",
            "last_seen_utc": "2025-11-07 21:38:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636085": [
        {
            "ioc_value": "hain.boargrund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 21:27:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636084": [
        {
            "ioc_value": "heath.beechmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 21:17:12",
            "last_seen_utc": "2025-11-07 21:18:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636083": [
        {
            "ioc_value": "moor.beechmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 21:07:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636081": [
        {
            "ioc_value": "birch.beechmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 20:57:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636079": [
        {
            "ioc_value": "fluss.nickelweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 20:49:43",
            "last_seen_utc": "2025-11-07 20:50:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636078": [
        {
            "ioc_value": "wald.nickelweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 20:43:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636077": [
        {
            "ioc_value": "erz.nickelweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 20:32:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636076": [
        {
            "ioc_value": "4q.rubyraum.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 20:25:48",
            "last_seen_utc": "2025-11-07 20:32:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636075": [
        {
            "ioc_value": "frost.icylotus.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 20:14:28",
            "last_seen_utc": "2025-11-07 20:21:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636074": [
        {
            "ioc_value": "eis.icylotus.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 20:08:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636065": [
        {
            "ioc_value": "weave.m00nweaver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:59:30",
            "last_seen_utc": "2025-11-07 20:08:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636064": [
        {
            "ioc_value": "nacht.m00nweaver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:56:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636063": [
        {
            "ioc_value": "gale.m00nweaver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:48:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636062": [
        {
            "ioc_value": "mond.m00nweaver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:45:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636061": [
        {
            "ioc_value": "mist.1ittleriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:41:32",
            "last_seen_utc": "2025-11-07 19:43:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636060": [
        {
            "ioc_value": "stern.1ittleriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:36:20",
            "last_seen_utc": "2025-11-07 19:36:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636059": [
        {
            "ioc_value": "fluss.1ittleriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:20:57",
            "last_seen_utc": "2025-11-07 19:27:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636058": [
        {
            "ioc_value": "oak.1ittleriver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:13:10",
            "last_seen_utc": "2025-11-07 19:14:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636056": [
        {
            "ioc_value": "r0sebioom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:11:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636055": [
        {
            "ioc_value": "ciearstream.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 19:03:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636054": [
        {
            "ioc_value": "whisper-lake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 18:56:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636051": [
        {
            "ioc_value": "silent-grove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 18:51:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636046": [
        {
            "ioc_value": "copperwerft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 18:48:41",
            "last_seen_utc": "2025-11-07 18:49:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636041": [
        {
            "ioc_value": "neonheide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 18:45:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636039": [
        {
            "ioc_value": "thunderforst.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 18:37:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636038": [
        {
            "ioc_value": "flintwiese.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 18:26:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636037": [
        {
            "ioc_value": "solarfracht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 18:21:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636036": [
        {
            "ioc_value": "zephyrsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 18:10:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636035": [
        {
            "ioc_value": "ironbucht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 18:05:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636034": [
        {
            "ioc_value": "adult-understanding.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-11-07 18:03:10",
            "last_seen_utc": "2025-12-12 18:40:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/251107-s8tqpagk9x",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1636029": [
        {
            "ioc_value": "markaug.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-07 18:01:10",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251107-s2t3wasnfl",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1636028": [
        {
            "ioc_value": "abstract-intake.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 18:01:01",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251107-trz2tasrfm",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1636027": [
        {
            "ioc_value": "mpykaug5o.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 18:01:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251107-tq323ssrer",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1636026": [
        {
            "ioc_value": "brassufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 17:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636025": [
        {
            "ioc_value": "starmarkt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 17:50:41",
            "last_seen_utc": "2025-11-07 17:52:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636024": [
        {
            "ioc_value": "beartor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 17:47:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636022": [
        {
            "ioc_value": "quartzdamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 17:31:38",
            "last_seen_utc": "2025-11-07 17:32:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636021": [
        {
            "ioc_value": "peridotgarten.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 17:27:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636020": [
        {
            "ioc_value": "berylhammer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 17:10:26",
            "last_seen_utc": "2025-11-07 17:21:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636019": [
        {
            "ioc_value": "garnetschmiede.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 17:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636018": [
        {
            "ioc_value": "ebonyecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 16:58:00",
            "last_seen_utc": "2025-11-07 16:58:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636017": [
        {
            "ioc_value": "pearlkrone.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 16:48:13",
            "last_seen_utc": "2025-11-07 16:51:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636016": [
        {
            "ioc_value": "duskpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 16:39:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636015": [
        {
            "ioc_value": "dawnanker.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 16:30:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636014": [
        {
            "ioc_value": "mistgraben.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 16:22:55",
            "last_seen_utc": "2025-11-07 16:22:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636013": [
        {
            "ioc_value": "astralwiese.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 16:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636012": [
        {
            "ioc_value": "maplequelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 16:13:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636011": [
        {
            "ioc_value": "cedarhafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 16:09:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636010": [
        {
            "ioc_value": "orbitkamm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 16:06:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1636007": [
        {
            "ioc_value": "ik.fabiankorte.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-07 16:05:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1636008": [
        {
            "ioc_value": "qq.hiringimmediatelyjobs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-07 16:05:37",
            "last_seen_utc": "2025-11-08 09:59:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1635995": [
        {
            "ioc_value": "basaltstern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635994": [
        {
            "ioc_value": "mossufer.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:52:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635993": [
        {
            "ioc_value": "prismboden.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:48:32",
            "last_seen_utc": "2025-11-07 15:49:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635992": [
        {
            "ioc_value": "ravenwehr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:43:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635991": [
        {
            "ioc_value": "thistletal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:37:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635990": [
        {
            "ioc_value": "embergrund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:27:14",
            "last_seen_utc": "2025-11-07 15:32:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635989": [
        {
            "ioc_value": "m0thlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:25:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635988": [
        {
            "ioc_value": "br1mbay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635987": [
        {
            "ioc_value": "giowrust.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:17:25",
            "last_seen_utc": "2025-11-07 15:19:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1635965": [
        {
            "ioc_value": "virtvan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-07 15:09:34",
            "last_seen_utc": "2025-11-10 18:50:32",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115508577276891826",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1635986": [
        {
            "ioc_value": "ic3hill.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:08:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635985": [
        {
            "ioc_value": "redfern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 15:06:46",
            "last_seen_utc": "2025-11-07 15:07:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635984": [
        {
            "ioc_value": "quietwhite.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 14:55:58",
            "last_seen_utc": "2025-11-07 15:03:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635983": [
        {
            "ioc_value": "fox3den.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 14:46:54",
            "last_seen_utc": "2025-11-07 14:54:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635982": [
        {
            "ioc_value": "stormoak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 14:38:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635981": [
        {
            "ioc_value": "p1nefour.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 14:35:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635980": [
        {
            "ioc_value": "agatehof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 14:27:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635979": [
        {
            "ioc_value": "fjordkante.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 14:23:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635978": [
        {
            "ioc_value": "mesaweide.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 14:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635977": [
        {
            "ioc_value": "glyphsteg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 14:17:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635976": [
        {
            "ioc_value": "runesonne.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 14:08:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635975": [
        {
            "ioc_value": "topazrand.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:57:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635974": [
        {
            "ioc_value": "canyonsturm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:51:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635973": [
        {
            "ioc_value": "spruceinsel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:47:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635972": [
        {
            "ioc_value": "kestrelwinkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:42:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635971": [
        {
            "ioc_value": "pinezirkel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:35:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635970": [
        {
            "ioc_value": "valeschild.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:28:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635969": [
        {
            "ioc_value": "auricklang.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:23:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635968": [
        {
            "ioc_value": "oasisfuchs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:16:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635963": [
        {
            "ioc_value": "kilnberg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:07:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635962": [
        {
            "ioc_value": "lynxdelta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 13:04:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635961": [
        {
            "ioc_value": "grovebach.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 12:57:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635960": [
        {
            "ioc_value": "xin.hc666.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-07 12:55:51",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635930": [
        {
            "ioc_value": "updated-odds.gi.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-11-07 12:55:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635926": [
        {
            "ioc_value": "adsdadadad.ddnsgeek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635927": [
        {
            "ioc_value": "ajshgdhjfgasthjydyufasghjfdafsgudgfhjasgfjh.satyr.wtf",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635913": [
        {
            "ioc_value": "mistermal.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.extreme_rat",
            "malware_alias": "ExtRat",
            "malware_printable": "Xtreme RAT",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635914": [
        {
            "ioc_value": "report.nullrouted.wtf",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635915": [
        {
            "ioc_value": "boratfiction.vipcncnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635916": [
        {
            "ioc_value": "paratodos.spamhaussupport.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635917": [
        {
            "ioc_value": "psycholife.accessdennied.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635918": [
        {
            "ioc_value": "ahahahahahajs.unproxy.st",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635919": [
        {
            "ioc_value": "convac123.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635920": [
        {
            "ioc_value": "morte.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635921": [
        {
            "ioc_value": "1saadqdwdqd.camdvr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635922": [
        {
            "ioc_value": "asdkdakd.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635923": [
        {
            "ioc_value": "botevecc.boteve.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635924": [
        {
            "ioc_value": "ewwfwedd.ooguy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635925": [
        {
            "ioc_value": "sdsksdkldsd.accesscam.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 12:55:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635906": [
        {
            "ioc_value": "xplfalcon1.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-11-07 12:55:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635907": [
        {
            "ioc_value": "destinywatch.chickenkiller.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-11-07 12:55:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635908": [
        {
            "ioc_value": "hostnummer1number1.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-11-07 12:55:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635909": [
        {
            "ioc_value": "ovideloo.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-11-07 12:55:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635910": [
        {
            "ioc_value": "rango.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-11-07 12:55:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635911": [
        {
            "ioc_value": "bodybuilding.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-11-07 12:55:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635888": [
        {
            "ioc_value": "mortyhacks.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-11-07 12:55:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635889": [
        {
            "ioc_value": "spynetfodao.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-11-07 12:55:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635883": [
        {
            "ioc_value": "f60vinnie75.city",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-11-07 12:55:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635884": [
        {
            "ioc_value": "taileenanahi.company",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-11-07 12:55:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635885": [
        {
            "ioc_value": "h5441eqzey.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-11-07 12:55:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635886": [
        {
            "ioc_value": "thtmagics21.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-11-07 12:55:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635887": [
        {
            "ioc_value": "azizsadak.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-11-07 12:55:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635872": [
        {
            "ioc_value": "gufhhfhddddddddddddddddjjjjjfjfiijndnudn.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-07 12:55:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635869": [
        {
            "ioc_value": "result673.airdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-07 12:55:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635870": [
        {
            "ioc_value": "chimusgen.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-07 12:55:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635871": [
        {
            "ioc_value": "nightnoghwednesdaymanaagerxxxxx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-07 12:55:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635866": [
        {
            "ioc_value": "round-districts.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635867": [
        {
            "ioc_value": "street-golf.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635868": [
        {
            "ioc_value": "ready-andorra.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635857": [
        {
            "ioc_value": "plan-railroad.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635858": [
        {
            "ioc_value": "parts-almost.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635859": [
        {
            "ioc_value": "yourself-berry.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635860": [
        {
            "ioc_value": "goods-hilton.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635861": [
        {
            "ioc_value": "benefits-blocking.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635862": [
        {
            "ioc_value": "provide-abu.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635863": [
        {
            "ioc_value": "taken-housewives.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635864": [
        {
            "ioc_value": "input-conduct.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635865": [
        {
            "ioc_value": "envioxword20.mysynology.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635850": [
        {
            "ioc_value": "rootkitow-webkillez.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635851": [
        {
            "ioc_value": "china-sec.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635852": [
        {
            "ioc_value": "lyrics-host.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635853": [
        {
            "ioc_value": "windows-mine.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635854": [
        {
            "ioc_value": "y783hdhf.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635855": [
        {
            "ioc_value": "effect-unless.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635856": [
        {
            "ioc_value": "browser-real.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 12:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635801": [
        {
            "ioc_value": "connff99.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635802": [
        {
            "ioc_value": "standard-graduate.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635803": [
        {
            "ioc_value": "xoilaczzzez.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635804": [
        {
            "ioc_value": "gatex.xoilaczzzez.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635805": [
        {
            "ioc_value": "v3.xoilaczzzez.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635806": [
        {
            "ioc_value": "v2.xoilaczzzez.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635807": [
        {
            "ioc_value": "wood-visits.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635789": [
        {
            "ioc_value": "gatex.xoilaczzzdz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635790": [
        {
            "ioc_value": "aliado1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635791": [
        {
            "ioc_value": "v3.xoilaczzzdz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635792": [
        {
            "ioc_value": "connff77.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635793": [
        {
            "ioc_value": "8kdan394.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635794": [
        {
            "ioc_value": "envi03-10.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635795": [
        {
            "ioc_value": "v2.xoilaczzzdz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635796": [
        {
            "ioc_value": "services-msc.selfip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635797": [
        {
            "ioc_value": "in-ul.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635798": [
        {
            "ioc_value": "oska123-58079.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635799": [
        {
            "ioc_value": "mobilmoe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635800": [
        {
            "ioc_value": "connff88.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 12:55:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635786": [
        {
            "ioc_value": "islands-instance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-07 12:55:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635787": [
        {
            "ioc_value": "group-atm.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-07 12:55:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635788": [
        {
            "ioc_value": "shoes-each.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-07 12:55:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "7November2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1635762": [
        {
            "ioc_value": "services.datasystemconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-07 12:48:42",
            "last_seen_utc": "2025-12-14 11:48:16",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1635763": [
        {
            "ioc_value": "support.seodevserver.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-07 12:48:42",
            "last_seen_utc": "2025-12-08 21:55:32",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1635761": [
        {
            "ioc_value": "int.datasystemconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-07 12:48:35",
            "last_seen_utc": "2025-12-14 11:48:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1635760": [
        {
            "ioc_value": "console.seodevserver.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-07 12:48:32",
            "last_seen_utc": "2025-12-08 21:54:46",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1635759": [
        {
            "ioc_value": "chat.seodevserver.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-07 12:48:29",
            "last_seen_utc": "2025-12-08 21:54:45",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1635758": [
        {
            "ioc_value": "backend.datasystemconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-07 12:48:28",
            "last_seen_utc": "2025-12-14 11:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1635757": [
        {
            "ioc_value": "foxklippe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 12:47:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635756": [
        {
            "ioc_value": "stellarblick.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 12:37:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635747": [
        {
            "ioc_value": "eclipsenebel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 12:28:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635746": [
        {
            "ioc_value": "lilacdorn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 12:17:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635743": [
        {
            "ioc_value": "toueafhuoaefhefu.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635744": [
        {
            "ioc_value": "tpleflpokadkeoot.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635745": [
        {
            "ioc_value": "tploaeieifuebaub.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635733": [
        {
            "ioc_value": "teuaueufuanbbgbg.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635734": [
        {
            "ioc_value": "tezaeazdgzegdget.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635735": [
        {
            "ioc_value": "tfubaebeanfienfi.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635736": [
        {
            "ioc_value": "tganieeidiehgihe.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635737": [
        {
            "ioc_value": "tgauheudbbchaiii.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635738": [
        {
            "ioc_value": "tinbeafbiaebfiie.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635739": [
        {
            "ioc_value": "tlpaenimonadfueh.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635740": [
        {
            "ioc_value": "tnabeuffhshsueur.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635741": [
        {
            "ioc_value": "toeghaiofiehfihf.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635742": [
        {
            "ioc_value": "toirgsiorgididii.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635723": [
        {
            "ioc_value": "soueafhuoaefhefu.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635724": [
        {
            "ioc_value": "spleflpokadkeoot.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635725": [
        {
            "ioc_value": "sploaeieifuebaub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635726": [
        {
            "ioc_value": "tadbabbabefnefmf.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635727": [
        {
            "ioc_value": "taedvezdeahfhuea.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635728": [
        {
            "ioc_value": "taefneabdmemdnaf.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635729": [
        {
            "ioc_value": "tauedaiednaibduf.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635730": [
        {
            "ioc_value": "tbdadnmolaedbfau.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635731": [
        {
            "ioc_value": "tefiaeieiififnnf.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635732": [
        {
            "ioc_value": "tefiefijiejdijef.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635714": [
        {
            "ioc_value": "sezaeazdgzegdget.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635715": [
        {
            "ioc_value": "sfubaebeanfienfi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635716": [
        {
            "ioc_value": "sganieeidiehgihe.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635717": [
        {
            "ioc_value": "sgauheudbbchaiii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635718": [
        {
            "ioc_value": "sinbeafbiaebfiie.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635719": [
        {
            "ioc_value": "slpaenimonadfueh.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635720": [
        {
            "ioc_value": "snabeuffhshsueur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635721": [
        {
            "ioc_value": "soeghaiofiehfihf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635722": [
        {
            "ioc_value": "soirgsiorgididii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635704": [
        {
            "ioc_value": "npleflpokadkeoot.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635705": [
        {
            "ioc_value": "nploaeieifuebaub.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635706": [
        {
            "ioc_value": "sadbabbabefnefmf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635707": [
        {
            "ioc_value": "saedvezdeahfhuea.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635708": [
        {
            "ioc_value": "saefneabdmemdnaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635709": [
        {
            "ioc_value": "sauedaiednaibduf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635710": [
        {
            "ioc_value": "sbdadnmolaedbfau.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635711": [
        {
            "ioc_value": "sefiaeieiififnnf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635712": [
        {
            "ioc_value": "sefiefijiejdijef.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635713": [
        {
            "ioc_value": "seuaueufuanbbgbg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635694": [
        {
            "ioc_value": "nezaeazdgzegdget.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": "2025-11-10 06:58:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635695": [
        {
            "ioc_value": "nfubaebeanfienfi.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635696": [
        {
            "ioc_value": "nganieeidiehgihe.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635697": [
        {
            "ioc_value": "ngauheudbbchaiii.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635698": [
        {
            "ioc_value": "ninbeafbiaebfiie.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635699": [
        {
            "ioc_value": "nlpaenimonadfueh.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635700": [
        {
            "ioc_value": "nnabeuffhshsueur.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635701": [
        {
            "ioc_value": "noeghaiofiehfihf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635702": [
        {
            "ioc_value": "noirgsiorgididii.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635703": [
        {
            "ioc_value": "noueafhuoaefhefu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635683": [
        {
            "ioc_value": "loueafhuoaefhefu.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635684": [
        {
            "ioc_value": "lpleflpokadkeoot.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635685": [
        {
            "ioc_value": "lploaeieifuebaub.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635686": [
        {
            "ioc_value": "nadbabbabefnefmf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635687": [
        {
            "ioc_value": "naedvezdeahfhuea.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635688": [
        {
            "ioc_value": "naefneabdmemdnaf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635689": [
        {
            "ioc_value": "nauedaiednaibduf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": "2025-11-09 07:56:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635690": [
        {
            "ioc_value": "nbdadnmolaedbfau.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635691": [
        {
            "ioc_value": "nefiaeieiififnnf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635692": [
        {
            "ioc_value": "nefiefijiejdijef.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635693": [
        {
            "ioc_value": "neuaueufuanbbgbg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635673": [
        {
            "ioc_value": "leuaueufuanbbgbg.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635674": [
        {
            "ioc_value": "lezaeazdgzegdget.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635675": [
        {
            "ioc_value": "lfubaebeanfienfi.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635676": [
        {
            "ioc_value": "lganieeidiehgihe.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635677": [
        {
            "ioc_value": "lgauheudbbchaiii.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635678": [
        {
            "ioc_value": "linbeafbiaebfiie.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635679": [
        {
            "ioc_value": "llpaenimonadfueh.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635680": [
        {
            "ioc_value": "lnabeuffhshsueur.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635681": [
        {
            "ioc_value": "loeghaiofiehfihf.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635682": [
        {
            "ioc_value": "loirgsiorgididii.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635663": [
        {
            "ioc_value": "eoueafhuoaefhefu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635664": [
        {
            "ioc_value": "epleflpokadkeoot.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635665": [
        {
            "ioc_value": "eploaeieifuebaub.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635666": [
        {
            "ioc_value": "ladbabbabefnefmf.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635667": [
        {
            "ioc_value": "laedvezdeahfhuea.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635668": [
        {
            "ioc_value": "laefneabdmemdnaf.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635669": [
        {
            "ioc_value": "lauedaiednaibduf.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635670": [
        {
            "ioc_value": "lbdadnmolaedbfau.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635671": [
        {
            "ioc_value": "lefiaeieiififnnf.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635672": [
        {
            "ioc_value": "lefiefijiejdijef.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635655": [
        {
            "ioc_value": "efubaebeanfienfi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635656": [
        {
            "ioc_value": "eganieeidiehgihe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635657": [
        {
            "ioc_value": "egauheudbbchaiii.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635658": [
        {
            "ioc_value": "einbeafbiaebfiie.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635659": [
        {
            "ioc_value": "elpaenimonadfueh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635660": [
        {
            "ioc_value": "enabeuffhshsueur.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635661": [
        {
            "ioc_value": "eoeghaiofiehfihf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635662": [
        {
            "ioc_value": "eoirgsiorgididii.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635647": [
        {
            "ioc_value": "eaedvezdeahfhuea.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635648": [
        {
            "ioc_value": "eaefneabdmemdnaf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635649": [
        {
            "ioc_value": "eauedaiednaibduf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635650": [
        {
            "ioc_value": "ebdadnmolaedbfau.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635651": [
        {
            "ioc_value": "eefiaeieiififnnf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635652": [
        {
            "ioc_value": "eefiefijiejdijef.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635653": [
        {
            "ioc_value": "eeuaueufuanbbgbg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635654": [
        {
            "ioc_value": "eezaeazdgzegdget.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635646": [
        {
            "ioc_value": "eadbabbabefnefmf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 12:11:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635543": [
        {
            "ioc_value": "violetmoos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 12:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635535": [
        {
            "ioc_value": "makelifecomehardsoteemannogofitfeedhimfa.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-07 12:01:00",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251107-m4y7qatjhz",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1635534": [
        {
            "ioc_value": "quantumrinde.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 11:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635532": [
        {
            "ioc_value": "hello-squiblydoo-do-you-like-kitties.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-07 11:52:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635533": [
        {
            "ioc_value": "summerandsilver.co.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-07 11:52:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635518": [
        {
            "ioc_value": "4j1.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 11:37:40",
            "last_seen_utc": "2025-11-07 11:38:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635517": [
        {
            "ioc_value": "m7.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 11:28:22",
            "last_seen_utc": "2025-11-07 11:30:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635516": [
        {
            "ioc_value": "qtf.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 11:17:28",
            "last_seen_utc": "2025-11-07 11:19:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635515": [
        {
            "ioc_value": "g8p.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 11:07:24",
            "last_seen_utc": "2025-11-07 11:13:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635490": [
        {
            "ioc_value": "3fp.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 10:57:58",
            "last_seen_utc": "2025-11-07 11:06:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635489": [
        {
            "ioc_value": "mrpatate.myddns.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-07 10:48:38",
            "last_seen_utc": "2025-11-13 15:48:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1635488": [
        {
            "ioc_value": "daj.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 10:48:05",
            "last_seen_utc": "2025-11-07 10:54:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635487": [
        {
            "ioc_value": "10.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 10:38:04",
            "last_seen_utc": "2025-11-07 10:46:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635486": [
        {
            "ioc_value": "w1i.glacierbruecke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 10:28:08",
            "last_seen_utc": "2025-11-07 10:37:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635485": [
        {
            "ioc_value": "l3.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 10:19:00",
            "last_seen_utc": "2025-11-07 10:25:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635484": [
        {
            "ioc_value": "8343.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 10:08:40",
            "last_seen_utc": "2025-11-07 10:11:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635483": [
        {
            "ioc_value": "sbeo.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 09:51:45",
            "last_seen_utc": "2025-11-07 10:07:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635482": [
        {
            "ioc_value": "j4.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 09:18:11",
            "last_seen_utc": "2025-11-07 09:23:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635481": [
        {
            "ioc_value": "bv9.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 09:06:52",
            "last_seen_utc": "2025-11-07 09:09:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635479": [
        {
            "ioc_value": "q7.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 08:52:31",
            "last_seen_utc": "2025-11-07 09:01:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635475": [
        {
            "ioc_value": "wp6.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 08:27:40",
            "last_seen_utc": "2025-11-07 08:38:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635474": [
        {
            "ioc_value": "uhz.basaltwerk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 08:17:53",
            "last_seen_utc": "2025-11-07 08:23:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635473": [
        {
            "ioc_value": "3t.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 08:07:37",
            "last_seen_utc": "2025-11-07 08:08:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635456": [
        {
            "ioc_value": "qq.fabiankorte.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-07 07:59:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1635454": [
        {
            "ioc_value": "74.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 07:57:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635453": [
        {
            "ioc_value": "9ls.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 07:47:29",
            "last_seen_utc": "2025-11-07 07:51:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635451": [
        {
            "ioc_value": "hrjob-forward-build.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-11-07 07:39:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,hookbot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635450": [
        {
            "ioc_value": "mi.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 07:37:10",
            "last_seen_utc": "2025-11-07 07:38:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635448": [
        {
            "ioc_value": "3hg.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 07:28:24",
            "last_seen_utc": "2025-11-07 07:34:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635447": [
        {
            "ioc_value": "ehu.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 07:18:07",
            "last_seen_utc": "2025-11-07 07:23:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634674": [
        {
            "ioc_value": "saeam.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-07 07:11:41",
            "last_seen_utc": "2025-11-07 06:20:02",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115504320268441818",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1634695": [
        {
            "ioc_value": "images.nestledinniagara.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-07 07:11:39",
            "last_seen_utc": "2025-11-13 06:27:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115504807284237508",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1635446": [
        {
            "ioc_value": "bq.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 07:07:47",
            "last_seen_utc": "2025-11-07 07:09:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635445": [
        {
            "ioc_value": "4r.bramblestrom.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 06:58:02",
            "last_seen_utc": "2025-11-07 07:03:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635443": [
        {
            "ioc_value": "k2m.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 06:47:45",
            "last_seen_utc": "2025-11-07 06:48:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635442": [
        {
            "ioc_value": "p0x.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 06:37:21",
            "last_seen_utc": "2025-11-07 06:39:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635440": [
        {
            "ioc_value": "oz.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 06:29:34",
            "last_seen_utc": "2025-11-07 06:34:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635438": [
        {
            "ioc_value": "sportewindows.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-07 06:19:23",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635418": [
        {
            "ioc_value": "teuaueudgs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635419": [
        {
            "ioc_value": "teubeufubg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635420": [
        {
            "ioc_value": "tiaeufaehe.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635421": [
        {
            "ioc_value": "tieieieros.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635422": [
        {
            "ioc_value": "tiheiufisd.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635423": [
        {
            "ioc_value": "tniaeninie.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635424": [
        {
            "ioc_value": "wbaeubuegs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635425": [
        {
            "ioc_value": "weoghehofu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635426": [
        {
            "ioc_value": "weuaueudgs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635427": [
        {
            "ioc_value": "weubeufubg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635428": [
        {
            "ioc_value": "wiaeufaehe.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635429": [
        {
            "ioc_value": "wieieieros.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635430": [
        {
            "ioc_value": "wiheiufisd.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635431": [
        {
            "ioc_value": "wniaeninie.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635432": [
        {
            "ioc_value": "xbaeubuegs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635433": [
        {
            "ioc_value": "xeoghehofu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635434": [
        {
            "ioc_value": "xiaeufaehe.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635435": [
        {
            "ioc_value": "xieieieros.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635436": [
        {
            "ioc_value": "xiheiufisd.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635437": [
        {
            "ioc_value": "xniaeninie.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635408": [
        {
            "ioc_value": "abaeubuegs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635409": [
        {
            "ioc_value": "aeoghehofu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635410": [
        {
            "ioc_value": "aeuaueudgs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635411": [
        {
            "ioc_value": "aeubeufubg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635412": [
        {
            "ioc_value": "aiaeufaehe.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635413": [
        {
            "ioc_value": "aieieieros.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635414": [
        {
            "ioc_value": "aiheiufisd.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635415": [
        {
            "ioc_value": "aniaeninie.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635416": [
        {
            "ioc_value": "tbaeubuegs.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635417": [
        {
            "ioc_value": "teoghehofu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-11-07 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635377": [
        {
            "ioc_value": "mortex.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-07 06:18:19",
            "last_seen_utc": "2025-12-12 18:40:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635376": [
        {
            "ioc_value": "v3r.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 06:18:07",
            "last_seen_utc": "2025-11-07 06:18:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1635363": [
        {
            "ioc_value": "www.ulfstreammotors.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635364": [
        {
            "ioc_value": "www.undquantumfusion.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635365": [
        {
            "ioc_value": "www.utfitsstyle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635366": [
        {
            "ioc_value": "www.uungro.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635367": [
        {
            "ioc_value": "www.vctwatchs.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635368": [
        {
            "ioc_value": "www.vspool.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635369": [
        {
            "ioc_value": "www.xtraklimatyzacje.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635370": [
        {
            "ioc_value": "www.ya288.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635371": [
        {
            "ioc_value": "www.yj775.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635372": [
        {
            "ioc_value": "www.ymronmississippi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635373": [
        {
            "ioc_value": "www.yrrkh.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635374": [
        {
            "ioc_value": "www.yunyou44.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635375": [
        {
            "ioc_value": "www.zeitgeistguard.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635362": [
        {
            "ioc_value": "www.ubady.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635346": [
        {
            "ioc_value": "www.site-flow.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635347": [
        {
            "ioc_value": "www.smzwgaegeglszxfb.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635348": [
        {
            "ioc_value": "www.stifffatty.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635349": [
        {
            "ioc_value": "www.syicollc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635350": [
        {
            "ioc_value": "www.t7hjzd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635351": [
        {
            "ioc_value": "www.tar-mfo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635352": [
        {
            "ioc_value": "www.telier-moode.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635353": [
        {
            "ioc_value": "www.tephanievoneuw.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635354": [
        {
            "ioc_value": "www.thequbitcoin.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635355": [
        {
            "ioc_value": "www.thfa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635356": [
        {
            "ioc_value": "www.tlctechnical.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635357": [
        {
            "ioc_value": "www.tokeno6a.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635358": [
        {
            "ioc_value": "www.topcryptocasinos.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635359": [
        {
            "ioc_value": "www.toryprintacademy.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635360": [
        {
            "ioc_value": "www.tylechicescape.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635361": [
        {
            "ioc_value": "www.u59ga.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635327": [
        {
            "ioc_value": "www.oreadybusiness.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635328": [
        {
            "ioc_value": "www.otelgoldenheart.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635329": [
        {
            "ioc_value": "www.ouse-renovation-design-1.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635330": [
        {
            "ioc_value": "www.pagesetupsystem.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635331": [
        {
            "ioc_value": "www.phonenumberleak.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635332": [
        {
            "ioc_value": "www.pixplay777.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635333": [
        {
            "ioc_value": "www.pmb26.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635334": [
        {
            "ioc_value": "www.pragma123-777.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635335": [
        {
            "ioc_value": "www.qgsnsc.org.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635336": [
        {
            "ioc_value": "www.raghealthtech.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635337": [
        {
            "ioc_value": "www.rdsrb.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635338": [
        {
            "ioc_value": "www.rganimalsmx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635339": [
        {
            "ioc_value": "www.rinturo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635340": [
        {
            "ioc_value": "www.rqprwa20.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635341": [
        {
            "ioc_value": "www.rrinfanticidal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635342": [
        {
            "ioc_value": "www.samavet.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635343": [
        {
            "ioc_value": "www.sb5g6ku.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635344": [
        {
            "ioc_value": "www.scmcm.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635345": [
        {
            "ioc_value": "www.seqmachineryhireresale.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635308": [
        {
            "ioc_value": "www.kurepier.house",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635309": [
        {
            "ioc_value": "www.larityhrco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635310": [
        {
            "ioc_value": "www.layoutbank.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635311": [
        {
            "ioc_value": "www.laywin159.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635312": [
        {
            "ioc_value": "www.lbtvod930.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635313": [
        {
            "ioc_value": "www.lounge.cash",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635314": [
        {
            "ioc_value": "www.louwhigraig.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635315": [
        {
            "ioc_value": "www.moneynode.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635316": [
        {
            "ioc_value": "www.mpn22surabaya.sch.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635317": [
        {
            "ioc_value": "www.nnmm.beauty",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635318": [
        {
            "ioc_value": "www.notourdns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635319": [
        {
            "ioc_value": "www.nselfiber.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635320": [
        {
            "ioc_value": "www.nthsxsuccess.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635321": [
        {
            "ioc_value": "www.ntrinsicoutboundfirm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635322": [
        {
            "ioc_value": "www.nuoria.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635323": [
        {
            "ioc_value": "www.ogagix.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635324": [
        {
            "ioc_value": "www.olombiabestcoffee.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635325": [
        {
            "ioc_value": "www.onus-connect.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635326": [
        {
            "ioc_value": "www.onvexphone.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635290": [
        {
            "ioc_value": "www.gitim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635291": [
        {
            "ioc_value": "www.gtwin9.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635292": [
        {
            "ioc_value": "www.hardware.bio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635293": [
        {
            "ioc_value": "www.harmaciechamplain-orange.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635294": [
        {
            "ioc_value": "www.heliosvoltaics.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635295": [
        {
            "ioc_value": "www.himsygroveadventures.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635296": [
        {
            "ioc_value": "www.hx671.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635297": [
        {
            "ioc_value": "www.hyperliquid-app.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635298": [
        {
            "ioc_value": "www.ibelimity.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635299": [
        {
            "ioc_value": "www.imguillorytampa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635300": [
        {
            "ioc_value": "www.imyfpshmxxnis.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635301": [
        {
            "ioc_value": "www.indspark.fitness",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635302": [
        {
            "ioc_value": "www.ingse258.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635303": [
        {
            "ioc_value": "www.irtualhouse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635304": [
        {
            "ioc_value": "www.itchspellanddrops.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635305": [
        {
            "ioc_value": "www.jwv8d.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635306": [
        {
            "ioc_value": "www.keber.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635307": [
        {
            "ioc_value": "www.ks70yx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635271": [
        {
            "ioc_value": "www.ccentricseahorse.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635272": [
        {
            "ioc_value": "www.clermonttreeservice.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635273": [
        {
            "ioc_value": "www.cyber-security-jobs-60364.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635274": [
        {
            "ioc_value": "www.djzbgu.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635275": [
        {
            "ioc_value": "www.ealthislife.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635276": [
        {
            "ioc_value": "www.ealthmindsettoday.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635277": [
        {
            "ioc_value": "www.eercoin.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635278": [
        {
            "ioc_value": "www.emanticvalue.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635279": [
        {
            "ioc_value": "www.enzoshop.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635280": [
        {
            "ioc_value": "www.etsynapseint.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635281": [
        {
            "ioc_value": "www.ewafricakitchen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635282": [
        {
            "ioc_value": "www.ewataslotbet60.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635283": [
        {
            "ioc_value": "www.ewishamilton.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635284": [
        {
            "ioc_value": "www.exclusivity-music.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635285": [
        {
            "ioc_value": "www.fdhlg.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635286": [
        {
            "ioc_value": "www.fjoztwcountry.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635287": [
        {
            "ioc_value": "www.fkeeper.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635288": [
        {
            "ioc_value": "www.fkm88e.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635289": [
        {
            "ioc_value": "www.fsworld.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635251": [
        {
            "ioc_value": "www.58e0as.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635252": [
        {
            "ioc_value": "www.94ozgcgq8ai.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635253": [
        {
            "ioc_value": "www.acnotworking.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635254": [
        {
            "ioc_value": "www.agtagshop.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635255": [
        {
            "ioc_value": "www.akryb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635256": [
        {
            "ioc_value": "www.aljhomeimprovementllc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635257": [
        {
            "ioc_value": "www.amara99.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635258": [
        {
            "ioc_value": "www.anantapro.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635259": [
        {
            "ioc_value": "www.androseltium.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635260": [
        {
            "ioc_value": "www.arktmaastricht.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635261": [
        {
            "ioc_value": "www.arryyeni-bossseo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635262": [
        {
            "ioc_value": "www.ashionbay.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635263": [
        {
            "ioc_value": "www.ashvostro.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635264": [
        {
            "ioc_value": "www.atthunsane.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635265": [
        {
            "ioc_value": "www.avesandersonevents.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635266": [
        {
            "ioc_value": "www.aviagro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635267": [
        {
            "ioc_value": "www.bor-trading.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635268": [
        {
            "ioc_value": "www.bw447.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635269": [
        {
            "ioc_value": "www.capitalsmg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635270": [
        {
            "ioc_value": "www.carewelltechinsurance.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635246": [
        {
            "ioc_value": "www.117a.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635247": [
        {
            "ioc_value": "www.1475p.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635248": [
        {
            "ioc_value": "www.21581.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635249": [
        {
            "ioc_value": "www.371q.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635250": [
        {
            "ioc_value": "www.483650885622.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-07 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635115": [
        {
            "ioc_value": "flowers-lounge.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-07 06:17:03",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635114": [
        {
            "ioc_value": "diyarbakir.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-11-07 06:16:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635113": [
        {
            "ioc_value": "nuevos2025.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 06:16:37",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1635088": [
        {
            "ioc_value": "h1p.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 06:07:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634984": [
        {
            "ioc_value": "ansy20225.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-07 06:01:10",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251107-fy2mbs1lgr",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634983": [
        {
            "ioc_value": "blessbebenard21.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-07 06:01:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251107-b35gkaylbn",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634982": [
        {
            "ioc_value": "scvpdnfej.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-07 06:00:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251107-dab1nahp8x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634974": [
        {
            "ioc_value": "so.horizonspur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 05:57:54",
            "last_seen_utc": "2025-11-07 06:02:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634973": [
        {
            "ioc_value": "h4n.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 05:48:07",
            "last_seen_utc": "2025-11-07 05:53:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634972": [
        {
            "ioc_value": "xk.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 05:37:49",
            "last_seen_utc": "2025-11-07 05:39:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634971": [
        {
            "ioc_value": "p2k.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 05:28:02",
            "last_seen_utc": "2025-11-07 05:35:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634970": [
        {
            "ioc_value": "c3r.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 05:17:43",
            "last_seen_utc": "2025-11-07 05:21:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634969": [
        {
            "ioc_value": "w92.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 05:07:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634968": [
        {
            "ioc_value": "be.phoenixbogen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 04:57:36",
            "last_seen_utc": "2025-11-07 04:59:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634967": [
        {
            "ioc_value": "c9.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 04:47:18",
            "last_seen_utc": "2025-11-07 04:49:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634966": [
        {
            "ioc_value": "tqf.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 04:36:59",
            "last_seen_utc": "2025-11-07 04:41:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634965": [
        {
            "ioc_value": "z1.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 04:27:12",
            "last_seen_utc": "2025-11-07 04:34:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634964": [
        {
            "ioc_value": "bd2.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 04:17:56",
            "last_seen_utc": "2025-11-07 04:20:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634963": [
        {
            "ioc_value": "q7m.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 04:08:30",
            "last_seen_utc": "2025-11-07 04:11:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634961": [
        {
            "ioc_value": "gs.crystalmoor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 03:57:50",
            "last_seen_utc": "2025-11-07 04:01:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634960": [
        {
            "ioc_value": "t7z.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 03:47:32",
            "last_seen_utc": "2025-11-07 03:49:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634959": [
        {
            "ioc_value": "bqk.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 03:37:45",
            "last_seen_utc": "2025-11-07 03:41:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634958": [
        {
            "ioc_value": "x2.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 03:27:27",
            "last_seen_utc": "2025-11-07 03:30:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634957": [
        {
            "ioc_value": "pc4.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 03:17:09",
            "last_seen_utc": "2025-11-07 03:24:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634749": [
        {
            "ioc_value": "m8q.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 03:07:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634746": [
        {
            "ioc_value": "aj.saffronkern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 02:57:05",
            "last_seen_utc": "2025-11-07 02:57:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634741": [
        {
            "ioc_value": "gdatasoftvare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-07 02:48:32",
            "last_seen_utc": "2025-12-14 11:48:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1634740": [
        {
            "ioc_value": "z0r.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 02:47:18",
            "last_seen_utc": "2025-11-07 02:49:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634739": [
        {
            "ioc_value": "nq5.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 02:37:49",
            "last_seen_utc": "2025-11-07 02:46:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634737": [
        {
            "ioc_value": "d34.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 02:20:17",
            "last_seen_utc": "2025-11-07 02:21:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634736": [
        {
            "ioc_value": "w9.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 02:07:34",
            "last_seen_utc": "2025-11-07 02:11:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634735": [
        {
            "ioc_value": "k7x.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 01:58:17",
            "last_seen_utc": "2025-11-07 02:00:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634734": [
        {
            "ioc_value": "f2a.nebularanke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 01:47:29",
            "last_seen_utc": "2025-11-07 01:49:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634733": [
        {
            "ioc_value": "z7.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 01:38:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634732": [
        {
            "ioc_value": "v2r.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 01:27:19",
            "last_seen_utc": "2025-11-07 01:29:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634728": [
        {
            "ioc_value": "c4n.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 01:16:57",
            "last_seen_utc": "2025-11-07 01:26:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634727": [
        {
            "ioc_value": "yxm4.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 01:07:39",
            "last_seen_utc": "2025-11-07 01:16:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634726": [
        {
            "ioc_value": "t3q.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 00:57:51",
            "last_seen_utc": "2025-11-07 01:04:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634725": [
        {
            "ioc_value": "k2v.whisperlake.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 00:47:33",
            "last_seen_utc": "2025-11-07 00:52:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634724": [
        {
            "ioc_value": "rz4.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 00:37:46",
            "last_seen_utc": "2025-11-07 00:39:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634723": [
        {
            "ioc_value": "h9m.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 00:27:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634722": [
        {
            "ioc_value": "x1p.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 00:18:06",
            "last_seen_utc": "2025-11-07 00:20:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634721": [
        {
            "ioc_value": "q2k.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-07 00:07:21",
            "last_seen_utc": "2025-11-07 00:10:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634718": [
        {
            "ioc_value": "m9x.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 23:57:52",
            "last_seen_utc": "2025-11-07 00:00:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634717": [
        {
            "ioc_value": "ab7.sunny-harbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 23:42:29",
            "last_seen_utc": "2025-11-06 23:47:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634706": [
        {
            "ioc_value": "brightsilk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 22:57:34",
            "last_seen_utc": "2025-11-06 22:59:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634705": [
        {
            "ioc_value": "serenapoint.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 22:48:17",
            "last_seen_utc": "2025-11-06 22:51:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634704": [
        {
            "ioc_value": "ic0nicr1ver.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 22:36:58",
            "last_seen_utc": "2025-11-06 22:47:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634703": [
        {
            "ioc_value": "shadow-grove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 22:28:12",
            "last_seen_utc": "2025-11-06 22:32:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634702": [
        {
            "ioc_value": "crystal-berry.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 22:16:54",
            "last_seen_utc": "2025-11-06 22:27:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634701": [
        {
            "ioc_value": "m0onsh1nebay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 22:08:06",
            "last_seen_utc": "2025-11-06 22:14:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634700": [
        {
            "ioc_value": "sunnyharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 21:57:47",
            "last_seen_utc": "2025-11-06 22:01:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634699": [
        {
            "ioc_value": "serena-point.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 21:47:30",
            "last_seen_utc": "2025-11-06 21:53:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634698": [
        {
            "ioc_value": "dawn-mirror.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 21:37:42",
            "last_seen_utc": "2025-11-06 21:38:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634697": [
        {
            "ioc_value": "mighty-flora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 21:27:25",
            "last_seen_utc": "2025-11-06 21:30:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634696": [
        {
            "ioc_value": "shadowgrove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 21:17:07",
            "last_seen_utc": "2025-11-06 21:18:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634694": [
        {
            "ioc_value": "1unarpetal.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 21:07:20",
            "last_seen_utc": "2025-11-06 21:13:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634693": [
        {
            "ioc_value": "dawnmirror.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 20:57:03",
            "last_seen_utc": "2025-11-06 21:01:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634692": [
        {
            "ioc_value": "mightyflora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 20:46:45",
            "last_seen_utc": "2025-11-06 20:56:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634691": [
        {
            "ioc_value": "mintnord.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 20:36:57",
            "last_seen_utc": "2025-11-06 20:38:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634689": [
        {
            "ioc_value": "cindertau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 20:27:38",
            "last_seen_utc": "2025-11-06 20:29:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634688": [
        {
            "ioc_value": "indigowelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 20:17:52",
            "last_seen_utc": "2025-11-06 20:21:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634686": [
        {
            "ioc_value": "ambergeist.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 20:07:33",
            "last_seen_utc": "2025-11-06 20:12:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634685": [
        {
            "ioc_value": "poisson6026.dedyn.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-06 20:02:02",
            "last_seen_utc": "2025-11-06 23:00:54",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/163.5.121.34+poisson6026.dedyn.io",
            "tags": "AS207992,C2,censys,FEELB,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634684": [
        {
            "ioc_value": "filigrane-dossier.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-11-06 20:01:59",
            "last_seen_utc": "2025-11-06 23:00:51",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.53.234+filigrane-dossier.com",
            "tags": "AS214943,C2,censys,Hookbot,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634682": [
        {
            "ioc_value": "zenithspitze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 19:58:17",
            "last_seen_utc": "2025-11-06 20:03:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634681": [
        {
            "ioc_value": "gladeeiche.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 19:48:29",
            "last_seen_utc": "2025-11-06 19:50:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634680": [
        {
            "ioc_value": "vectorblitz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 19:32:36",
            "last_seen_utc": "2025-11-06 19:33:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634678": [
        {
            "ioc_value": "echozauber.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 19:27:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634677": [
        {
            "ioc_value": "tidalschatten.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 19:16:59",
            "last_seen_utc": "2025-11-06 19:24:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634676": [
        {
            "ioc_value": "emberkiesel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 19:08:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634669": [
        {
            "ioc_value": "s1ev.amberr-0-ck-et.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 18:48:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634633": [
        {
            "ioc_value": "ovs.amberr-0-ck-et.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 18:37:36",
            "last_seen_utc": "2025-11-06 18:52:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634632": [
        {
            "ioc_value": "8cj.amberr-0-ck-et.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 18:27:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634631": [
        {
            "ioc_value": "h40.amberr-0-ck-et.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 18:17:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634630": [
        {
            "ioc_value": "bz.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 18:06:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634627": [
        {
            "ioc_value": "shopping-administrative.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-06 18:01:10",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251106-qlqdmsxpgn",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634626": [
        {
            "ioc_value": "n-ea.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-06 18:01:09",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251106-t5e9kazkgm",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634625": [
        {
            "ioc_value": "johndoessssss-32696.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-06 18:01:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251106-vkazsacl3z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634624": [
        {
            "ioc_value": "cq.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 17:57:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634623": [
        {
            "ioc_value": "fb.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 17:47:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634622": [
        {
            "ioc_value": "j0h.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 17:37:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634621": [
        {
            "ioc_value": "0b.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 17:27:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634620": [
        {
            "ioc_value": "14.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 17:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634619": [
        {
            "ioc_value": "fsrm.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 17:07:36",
            "last_seen_utc": "2025-11-06 17:13:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634618": [
        {
            "ioc_value": "fhp.lilacsilo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:57:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634615": [
        {
            "ioc_value": "hy.fabiankorte.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-06 16:56:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1634616": [
        {
            "ioc_value": "hy.fundsreclaimllc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-06 16:56:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1634608": [
        {
            "ioc_value": "g1t4.starmarkt.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634607": [
        {
            "ioc_value": "silicon-moss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:46:30",
            "last_seen_utc": "2025-11-06 16:47:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634605": [
        {
            "ioc_value": "orbitkrone.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:38:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634604": [
        {
            "ioc_value": "soniccobalt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:35:11",
            "last_seen_utc": "2025-11-06 16:44:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634603": [
        {
            "ioc_value": "k8x1.starmarkt.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:32:50",
            "last_seen_utc": "2025-11-06 16:44:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634602": [
        {
            "ioc_value": "lotioniron.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:26:56",
            "last_seen_utc": "2025-11-06 16:32:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634601": [
        {
            "ioc_value": "driftfels.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:24:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634600": [
        {
            "ioc_value": "siliconmoss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:17:09",
            "last_seen_utc": "2025-11-06 16:24:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634599": [
        {
            "ioc_value": "r0b3.starmarkt.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:12:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634598": [
        {
            "ioc_value": "pixel-orbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:07:21",
            "last_seen_utc": "2025-11-06 16:12:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634596": [
        {
            "ioc_value": "1v0ry51gnai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 16:02:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634588": [
        {
            "ioc_value": "solarviolet.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:58:59",
            "last_seen_utc": "2025-11-06 16:00:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634587": [
        {
            "ioc_value": "swiftfluss.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:54:20",
            "last_seen_utc": "2025-11-06 16:00:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634586": [
        {
            "ioc_value": "pixelorbit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:47:40",
            "last_seen_utc": "2025-11-06 15:56:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634585": [
        {
            "ioc_value": "meteorsegel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634584": [
        {
            "ioc_value": "l2f7.starmarkt.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:40:19",
            "last_seen_utc": "2025-11-06 15:56:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634583": [
        {
            "ioc_value": "alphacinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:37:21",
            "last_seen_utc": "2025-11-06 15:43:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634579": [
        {
            "ioc_value": "flowascatch.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-06 15:33:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1634582": [
        {
            "ioc_value": "alpha-cinder.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634577": [
        {
            "ioc_value": "p9c.starmarkt.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634576": [
        {
            "ioc_value": "ix.n0vaharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:17:50",
            "last_seen_utc": "2025-11-06 15:19:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634575": [
        {
            "ioc_value": "5d.n0vaharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:06:23",
            "last_seen_utc": "2025-11-06 15:10:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634573": [
        {
            "ioc_value": "a6v1.brassufer.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:03:06",
            "last_seen_utc": "2025-11-06 15:10:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634572": [
        {
            "ioc_value": "5kch.n0vaharbor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 15:01:34",
            "last_seen_utc": "2025-11-06 15:03:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634571": [
        {
            "ioc_value": "pr.ember-grove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 14:57:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634570": [
        {
            "ioc_value": "51cv.ember-grove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 14:46:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634569": [
        {
            "ioc_value": "d7x.ember-grove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 14:37:48",
            "last_seen_utc": "2025-11-06 14:45:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634568": [
        {
            "ioc_value": "flintwiese.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 14:30:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634562": [
        {
            "ioc_value": "dolmain.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-06 14:29:50",
            "last_seen_utc": "2025-11-06 14:10:20",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115503150913683982",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1634567": [
        {
            "ioc_value": "quartzraven.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 14:27:28",
            "last_seen_utc": "2025-11-06 14:30:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634566": [
        {
            "ioc_value": "h8s2.brassufer.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 14:24:49",
            "last_seen_utc": "2025-11-06 14:30:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634565": [
        {
            "ioc_value": "pixe1tu1ip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 14:18:53",
            "last_seen_utc": "2025-11-06 14:24:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634564": [
        {
            "ioc_value": "thunderforst.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 14:16:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634560": [
        {
            "ioc_value": "z5m.brassufer.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 14:07:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634559": [
        {
            "ioc_value": "5a.frost-indigo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 13:57:34",
            "last_seen_utc": "2025-11-06 14:16:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634558": [
        {
            "ioc_value": "t1q4.brassufer.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 13:53:36",
            "last_seen_utc": "2025-11-06 13:58:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634557": [
        {
            "ioc_value": "frostindigo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 13:43:11",
            "last_seen_utc": "2025-11-06 13:53:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634556": [
        {
            "ioc_value": "e3k9.brassufer.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 13:02:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634555": [
        {
            "ioc_value": "5mx.ve1vet0rchid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 12:57:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634554": [
        {
            "ioc_value": "et.ve1vet0rchid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 12:48:45",
            "last_seen_utc": "2025-11-06 12:53:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634553": [
        {
            "ioc_value": "w7d.brassufer.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 12:47:52",
            "last_seen_utc": "2025-11-06 12:53:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634552": [
        {
            "ioc_value": "copperwerft.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 12:47:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634551": [
        {
            "ioc_value": "bw9.ve1vet0rchid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 12:40:26",
            "last_seen_utc": "2025-11-06 13:02:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634550": [
        {
            "ioc_value": "c1t7.ironbucht.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 12:33:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634549": [
        {
            "ioc_value": "g74n.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 12:18:18",
            "last_seen_utc": "2025-11-06 12:23:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634545": [
        {
            "ioc_value": "edentista.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-06 12:17:02",
            "last_seen_utc": "2025-11-06 12:09:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115502674751273414",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1634548": [
        {
            "ioc_value": "x9l2.ironbucht.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 12:12:25",
            "last_seen_utc": "2025-11-06 12:23:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634543": [
        {
            "ioc_value": "kmg.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 12:07:34",
            "last_seen_utc": "2025-11-06 12:33:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634536": [
        {
            "ioc_value": "sislaps.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-06 12:00:55",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251106-mnehdavpgj",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634535": [
        {
            "ioc_value": "fortelio.karina2bento-com.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-06 12:00:54",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251106-netflswlhm",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634534": [
        {
            "ioc_value": "1hx8.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:58:12",
            "last_seen_utc": "2025-11-06 12:00:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634533": [
        {
            "ioc_value": "f5q.ironbucht.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:49:23",
            "last_seen_utc": "2025-11-06 12:00:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634532": [
        {
            "ioc_value": "sz.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:47:52",
            "last_seen_utc": "2025-11-06 11:49:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634531": [
        {
            "ioc_value": "sanguen.courses",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-06 11:43:55",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634528": [
        {
            "ioc_value": "tamku.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-06 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634529": [
        {
            "ioc_value": "tamku.shoplerter.opnetorologies.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-06 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634530": [
        {
            "ioc_value": "significant-adopted-bearing-own.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-06 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634527": [
        {
            "ioc_value": "forrbes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-06 11:43:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "landupdate808",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634525": [
        {
            "ioc_value": "dv3.bbanddd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-06 11:42:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634523": [
        {
            "ioc_value": "bot.osintitalia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-06 11:41:44",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634524": [
        {
            "ioc_value": "teamc2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-06 11:41:44",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634511": [
        {
            "ioc_value": "xt83.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:38:34",
            "last_seen_utc": "2025-11-06 11:40:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634508": [
        {
            "ioc_value": "d7w2.zephyrsteg.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:28:57",
            "last_seen_utc": "2025-11-06 11:40:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634507": [
        {
            "ioc_value": "q88.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:28:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634506": [
        {
            "ioc_value": "j4va.frosthain.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:28:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634505": [
        {
            "ioc_value": "s0r.zephyrsteg.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:23:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634504": [
        {
            "ioc_value": "5m.maplexenon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:17:35",
            "last_seen_utc": "2025-11-06 11:28:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634503": [
        {
            "ioc_value": "8w.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:07:15",
            "last_seen_utc": "2025-11-06 11:09:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634502": [
        {
            "ioc_value": "m3t9.zephyrsteg.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:05:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634501": [
        {
            "ioc_value": "xse3.frosthain.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 11:05:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634489": [
        {
            "ioc_value": "m1r3.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:58:29",
            "last_seen_utc": "2025-11-06 11:05:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634488": [
        {
            "ioc_value": "2d63.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:47:10",
            "last_seen_utc": "2025-11-06 10:57:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634487": [
        {
            "ioc_value": "kp6.zephyrsteg.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:46:47",
            "last_seen_utc": "2025-11-06 10:57:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634485": [
        {
            "ioc_value": "ka.fundsreclaimllc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-06 10:40:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1634483": [
        {
            "ioc_value": "oa.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:37:52",
            "last_seen_utc": "2025-11-06 10:46:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634482": [
        {
            "ioc_value": "v4n1.zephyrsteg.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:30:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634481": [
        {
            "ioc_value": "m7rd.frosthain.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:29:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634480": [
        {
            "ioc_value": "f8s.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:28:04",
            "last_seen_utc": "2025-11-06 10:30:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634479": [
        {
            "ioc_value": "y8c.zephyrsteg.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:24:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634478": [
        {
            "ioc_value": "a9x.frosthain.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634477": [
        {
            "ioc_value": "u3k.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:16:46",
            "last_seen_utc": "2025-11-06 10:24:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634476": [
        {
            "ioc_value": "h0f8.solarfracht.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:11:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634475": [
        {
            "ioc_value": "zm4.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 10:06:55",
            "last_seen_utc": "2025-11-06 10:11:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634474": [
        {
            "ioc_value": "r2l.solarfracht.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634473": [
        {
            "ioc_value": "yzc.amberr0cket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:57:38",
            "last_seen_utc": "2025-11-06 09:59:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634472": [
        {
            "ioc_value": "swm5.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:47:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634471": [
        {
            "ioc_value": "b1x3.solarfracht.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:38:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634470": [
        {
            "ioc_value": "2n.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:37:40",
            "last_seen_utc": "2025-11-06 09:38:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634469": [
        {
            "ioc_value": "qk7.solarfracht.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:28:22",
            "last_seen_utc": "2025-11-06 09:33:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634468": [
        {
            "ioc_value": "u3zc.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:28:10",
            "last_seen_utc": "2025-11-06 09:33:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634467": [
        {
            "ioc_value": "y6kb.l3rc-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634466": [
        {
            "ioc_value": "we.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:17:52",
            "last_seen_utc": "2025-11-06 09:28:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634465": [
        {
            "ioc_value": "t9m2.solarfracht.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:10:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634464": [
        {
            "ioc_value": "hbo8.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 09:08:04",
            "last_seen_utc": "2025-11-06 09:10:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634462": [
        {
            "ioc_value": "wmw2.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634460": [
        {
            "ioc_value": "g4v.solarfracht.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:50:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634454": [
        {
            "ioc_value": "vo5.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:47:59",
            "last_seen_utc": "2025-11-06 08:50:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634441": [
        {
            "ioc_value": "p3wz1.l3rc-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:43:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634431": [
        {
            "ioc_value": "7.kzg-w-4-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:39:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634430": [
        {
            "ioc_value": "sj.dr1ftpanda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:37:42",
            "last_seen_utc": "2025-11-06 08:43:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634429": [
        {
            "ioc_value": "a9hm.l3rc-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:28:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634428": [
        {
            "ioc_value": "g5.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:27:24",
            "last_seen_utc": "2025-11-06 08:29:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634427": [
        {
            "ioc_value": "c2.kzg-w-4-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:22:51",
            "last_seen_utc": "2025-11-06 08:29:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634426": [
        {
            "ioc_value": "v4q7p.l3rc-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634425": [
        {
            "ioc_value": "e5.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:18:37",
            "last_seen_utc": "2025-11-06 08:22:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634422": [
        {
            "ioc_value": "bb.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-06 08:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1634423": [
        {
            "ioc_value": "bb.fabiankorte.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-06 08:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1634424": [
        {
            "ioc_value": "bb.ethicaltechinstitute.org.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-06 08:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1634418": [
        {
            "ioc_value": "1m.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 08:07:22",
            "last_seen_utc": "2025-11-06 08:09:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634098": [
        {
            "ioc_value": "imf1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-06 07:58:21",
            "last_seen_utc": "2025-11-05 20:07:10",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115498420887835277",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1634278": [
        {
            "ioc_value": "ft.imugandas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-06 07:58:18",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 80,
            "reference": null,
            "tags": "mirai",
            "anonymous": "0",
            "reporter": "seckle"
        }
    ],
    "1634223": [
        {
            "ioc_value": "secure.kasindramaharaj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-06 07:58:14",
            "last_seen_utc": "2025-11-12 06:49:56",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115499381109827499",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1634228": [
        {
            "ioc_value": "smilesmash.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-06 07:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1634400": [
        {
            "ioc_value": "c8.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:57:02",
            "last_seen_utc": "2025-11-06 08:01:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634399": [
        {
            "ioc_value": "wwe.kzg-w-4-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:48:19",
            "last_seen_utc": "2025-11-06 07:54:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634398": [
        {
            "ioc_value": "sm.tundrasable.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:48:15",
            "last_seen_utc": "2025-11-06 07:54:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634397": [
        {
            "ioc_value": "c1k.coralglanz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:44:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634396": [
        {
            "ioc_value": "y7.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:37:55",
            "last_seen_utc": "2025-11-06 07:48:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634395": [
        {
            "ioc_value": "t6k9.kzg-w-4-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:29:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634394": [
        {
            "ioc_value": "y9p.coralglanz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:27:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634393": [
        {
            "ioc_value": "x4m.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:27:38",
            "last_seen_utc": "2025-11-06 07:29:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634387": [
        {
            "ioc_value": "bz.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:18:45",
            "last_seen_utc": "2025-11-06 07:24:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634386": [
        {
            "ioc_value": "4p1m.kzg-w-4-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:16:36",
            "last_seen_utc": "2025-11-06 08:09:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634385": [
        {
            "ioc_value": "q1.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 07:08:28",
            "last_seen_utc": "2025-11-06 07:16:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634384": [
        {
            "ioc_value": "ge.quasarorchid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634383": [
        {
            "ioc_value": "s8rk2.085-x-89-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:50:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634382": [
        {
            "ioc_value": "h5.coralglanz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:48:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634381": [
        {
            "ioc_value": "p0x.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:47:22",
            "last_seen_utc": "2025-11-06 06:50:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634380": [
        {
            "ioc_value": "oz.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:37:34",
            "last_seen_utc": "2025-11-06 06:41:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634379": [
        {
            "ioc_value": "x0la.085-x-89-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:34:21",
            "last_seen_utc": "2025-11-06 06:41:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634378": [
        {
            "ioc_value": "v3.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:28:07",
            "last_seen_utc": "2025-11-06 06:34:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634377": [
        {
            "ioc_value": "h1p.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634376": [
        {
            "ioc_value": "t2w.coralglanz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:08:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634375": [
        {
            "ioc_value": "q2w5e.085-x-89-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:07:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634374": [
        {
            "ioc_value": "so.opaldrift.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 06:06:43",
            "last_seen_utc": "2025-11-06 06:08:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634373": [
        {
            "ioc_value": "servidoresethernet.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-06 06:02:20",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/251106-aac16sdw3a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634372": [
        {
            "ioc_value": "supercoolweb.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-06 06:00:43",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/251106-ebr9pswrcw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634371": [
        {
            "ioc_value": "sa3.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:57:58",
            "last_seen_utc": "2025-11-06 06:07:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634370": [
        {
            "ioc_value": "a7.prismquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:53:35",
            "last_seen_utc": "2025-11-06 05:59:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634368": [
        {
            "ioc_value": "b3h7.085-x-89-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634367": [
        {
            "ioc_value": "cm.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:47:38",
            "last_seen_utc": "2025-11-06 05:53:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634366": [
        {
            "ioc_value": "z9tqn.085-x-89-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:39:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634365": [
        {
            "ioc_value": "n7.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:37:21",
            "last_seen_utc": "2025-11-06 05:39:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634364": [
        {
            "ioc_value": "m0x.prismquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:28:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634363": [
        {
            "ioc_value": "t1n.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:22:28",
            "last_seen_utc": "2025-11-06 05:28:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634362": [
        {
            "ioc_value": "r5.cedarnova.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:17:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634361": [
        {
            "ioc_value": "bqk.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:07:20",
            "last_seen_utc": "2025-11-06 05:11:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634360": [
        {
            "ioc_value": "d6y1.085-x-89-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 05:03:06",
            "last_seen_utc": "2025-11-06 05:11:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634359": [
        {
            "ioc_value": "z8q.prismquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:58:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634358": [
        {
            "ioc_value": "x2.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:57:59",
            "last_seen_utc": "2025-11-06 05:03:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634357": [
        {
            "ioc_value": "pc4.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:47:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634356": [
        {
            "ioc_value": "d7q.a-8-xp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:38:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634355": [
        {
            "ioc_value": "m8q.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:37:46",
            "last_seen_utc": "2025-11-06 04:38:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634354": [
        {
            "ioc_value": "aj.aspenatlas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:27:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634353": [
        {
            "ioc_value": "hpn4.a-8-xp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634352": [
        {
            "ioc_value": "xk.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:16:26",
            "last_seen_utc": "2025-11-06 04:19:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634350": [
        {
            "ioc_value": "p2.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:08:40",
            "last_seen_utc": "2025-11-06 04:13:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634349": [
        {
            "ioc_value": "k3.prismquelle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 04:04:03",
            "last_seen_utc": "2025-11-06 04:13:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634337": [
        {
            "ioc_value": "ty3.a-8-xp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634336": [
        {
            "ioc_value": "c3r.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:57:34",
            "last_seen_utc": "2025-11-06 04:04:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634335": [
        {
            "ioc_value": "z01.a-8-xp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:48:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634334": [
        {
            "ioc_value": "w9.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:47:31",
            "last_seen_utc": "2025-11-06 03:48:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634333": [
        {
            "ioc_value": "w2t.ravenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:38:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634332": [
        {
            "ioc_value": "be.vortexgipfel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:37:14",
            "last_seen_utc": "2025-11-06 03:38:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634331": [
        {
            "ioc_value": "tqf.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:27:56",
            "last_seen_utc": "2025-11-06 03:29:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634330": [
        {
            "ioc_value": "a3.ravenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:22:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634329": [
        {
            "ioc_value": "z1.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:18:10",
            "last_seen_utc": "2025-11-06 03:22:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634328": [
        {
            "ioc_value": "v9r.a-8-xp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:11:33",
            "last_seen_utc": "2025-11-06 03:29:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634327": [
        {
            "ioc_value": "bd2.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:09:55",
            "last_seen_utc": "2025-11-06 03:11:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634326": [
        {
            "ioc_value": "n7x.ravenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 03:02:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634325": [
        {
            "ioc_value": "q7m.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:57:34",
            "last_seen_utc": "2025-11-06 03:05:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634324": [
        {
            "ioc_value": "k2.a-8-xp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:53:08",
            "last_seen_utc": "2025-11-06 03:05:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634323": [
        {
            "ioc_value": "gs.summitmond.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:47:47",
            "last_seen_utc": "2025-11-06 02:53:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634322": [
        {
            "ioc_value": "m0k.8-f-e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:38:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634321": [
        {
            "ioc_value": "x4.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:30:44",
            "last_seen_utc": "2025-11-06 02:38:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634320": [
        {
            "ioc_value": "q4.ravenpfad.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:23:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634319": [
        {
            "ioc_value": "c1v.8-f-e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634318": [
        {
            "ioc_value": "a2n.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:17:21",
            "last_seen_utc": "2025-11-06 02:23:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634317": [
        {
            "ioc_value": "pr6q.8-f-e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:08:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634316": [
        {
            "ioc_value": "zt3.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 02:08:04",
            "last_seen_utc": "2025-11-06 02:08:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634315": [
        {
            "ioc_value": "n8.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:57:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634314": [
        {
            "ioc_value": "9am.8-f-e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:52:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634313": [
        {
            "ioc_value": "kp.ripplerover.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:47:59",
            "last_seen_utc": "2025-11-06 01:52:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634312": [
        {
            "ioc_value": "yxm.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:37:49",
            "last_seen_utc": "2025-11-06 01:45:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634311": [
        {
            "ioc_value": "d5.willowberg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:33:51",
            "last_seen_utc": "2025-11-06 01:49:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634310": [
        {
            "ioc_value": "x4d.8-f-e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:30:48",
            "last_seen_utc": "2025-11-06 01:45:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634309": [
        {
            "ioc_value": "c4n.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:27:53",
            "last_seen_utc": "2025-11-06 01:33:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634308": [
        {
            "ioc_value": "v2.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634307": [
        {
            "ioc_value": "b7k2.willowberg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:09:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634306": [
        {
            "ioc_value": "t3k.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:07:40",
            "last_seen_utc": "2025-11-06 01:17:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634305": [
        {
            "ioc_value": "t8.8-f-e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 01:00:37",
            "last_seen_utc": "2025-11-06 01:17:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634304": [
        {
            "ioc_value": "rz.forgehafen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:57:21",
            "last_seen_utc": "2025-11-06 01:00:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634303": [
        {
            "ioc_value": "h9m.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:48:04",
            "last_seen_utc": "2025-11-06 00:50:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634302": [
        {
            "ioc_value": "b7m2.7nf214.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:38:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634301": [
        {
            "ioc_value": "x1.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:37:09",
            "last_seen_utc": "2025-11-06 00:38:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634300": [
        {
            "ioc_value": "x0p.willowberg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:34:15",
            "last_seen_utc": "2025-11-06 00:37:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634299": [
        {
            "ioc_value": "q2k.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:26:50",
            "last_seen_utc": "2025-11-06 00:34:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634298": [
        {
            "ioc_value": "3qd.7nf214.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:23:20",
            "last_seen_utc": "2025-11-06 00:34:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634297": [
        {
            "ioc_value": "m7x.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:17:59",
            "last_seen_utc": "2025-11-06 00:23:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634295": [
        {
            "ioc_value": "t1w.cometwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:08:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634294": [
        {
            "ioc_value": "ab.lunarlicht.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:02:35",
            "last_seen_utc": "2025-11-06 00:11:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634291": [
        {
            "ioc_value": "n1k.7nf214.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-06 00:01:54",
            "last_seen_utc": "2025-11-06 00:11:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634286": [
        {
            "ioc_value": "x.onyxmorgen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 23:57:52",
            "last_seen_utc": "2025-11-06 00:01:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634285": [
        {
            "ioc_value": "m.cometwald.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 23:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634284": [
        {
            "ioc_value": "bz.onyxmorgen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 23:48:35",
            "last_seen_utc": "2025-11-05 23:52:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634283": [
        {
            "ioc_value": "q1.onyxmorgen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 23:42:20",
            "last_seen_utc": "2025-11-05 23:46:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634282": [
        {
            "ioc_value": "wz0.7nf214.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 23:40:48",
            "last_seen_utc": "2025-11-05 23:52:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634281": [
        {
            "ioc_value": "g5.onyxmorgen.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 23:33:34",
            "last_seen_utc": "2025-11-05 23:40:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634280": [
        {
            "ioc_value": "e5.paradeabend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 23:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634279": [
        {
            "ioc_value": "1m.paradeabend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 23:17:34",
            "last_seen_utc": "2025-11-05 23:19:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634276": [
        {
            "ioc_value": "c8.paradeabend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 23:06:06",
            "last_seen_utc": "2025-11-05 23:07:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634235": [
        {
            "ioc_value": "p0.paradeabend.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:57:50",
            "last_seen_utc": "2025-11-05 23:03:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634234": [
        {
            "ioc_value": "r2p.7nf214.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:57:26",
            "last_seen_utc": "2025-11-05 23:07:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634233": [
        {
            "ioc_value": "0z.sproutkraft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:48:03",
            "last_seen_utc": "2025-11-05 22:57:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634232": [
        {
            "ioc_value": "r7k2.sk-f0s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:44:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634231": [
        {
            "ioc_value": "v3.sproutkraft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:37:45",
            "last_seen_utc": "2025-11-05 22:44:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634227": [
        {
            "ioc_value": "v1.sk-f0s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:33:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634226": [
        {
            "ioc_value": "h1.sproutkraft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:27:58",
            "last_seen_utc": "2025-11-05 22:33:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634225": [
        {
            "ioc_value": "gh.7nf214.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:22:28",
            "last_seen_utc": "2025-11-05 22:43:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634224": [
        {
            "ioc_value": "s.sproutkraft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:17:38",
            "last_seen_utc": "2025-11-05 22:22:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634222": [
        {
            "ioc_value": "h9p3.566318z8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:07:31",
            "last_seen_utc": "2025-11-05 22:20:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634221": [
        {
            "ioc_value": "n7.cobaltwolke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 22:07:19",
            "last_seen_utc": "2025-11-05 22:16:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634220": [
        {
            "ioc_value": "t1.cobaltwolke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 21:58:32",
            "last_seen_utc": "2025-11-05 21:59:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634219": [
        {
            "ioc_value": "z.566318z8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 21:53:11",
            "last_seen_utc": "2025-11-05 21:59:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634218": [
        {
            "ioc_value": "r9.cobaltwolke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 21:48:15",
            "last_seen_utc": "2025-11-05 21:53:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634217": [
        {
            "ioc_value": "bq.cobaltwolke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 21:36:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634216": [
        {
            "ioc_value": "m2x.566318z8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 21:34:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634215": [
        {
            "ioc_value": "x2.velvetnebel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 21:28:11",
            "last_seen_utc": "2025-11-05 21:34:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634214": [
        {
            "ioc_value": "q7.566318z8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 21:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634213": [
        {
            "ioc_value": "pc.velvetnebel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 21:16:52",
            "last_seen_utc": "2025-11-05 21:19:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634212": [
        {
            "ioc_value": "m8.velvetnebel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 21:07:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634210": [
        {
            "ioc_value": "mal289re1.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-05 20:58:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634209": [
        {
            "ioc_value": "a.velvetnebel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634208": [
        {
            "ioc_value": "xoilaczzzoz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-05 20:57:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1634154": [
        {
            "ioc_value": "cm.pixelstern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:48:24",
            "last_seen_utc": "2025-11-05 20:55:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634153": [
        {
            "ioc_value": "b7k2.q3v8p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:47:12",
            "last_seen_utc": "2025-11-05 20:55:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634152": [
        {
            "ioc_value": "x0p.q3v8p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:38:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634151": [
        {
            "ioc_value": "y7.pixelstern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:37:42",
            "last_seen_utc": "2025-11-05 20:47:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634150": [
        {
            "ioc_value": "k0.pixelstern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634149": [
        {
            "ioc_value": "29q.n-61-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:21:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634148": [
        {
            "ioc_value": "tq.pixelstern.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:17:13",
            "last_seen_utc": "2025-11-05 20:21:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634147": [
        {
            "ioc_value": "z1.falconhimmel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:12:43",
            "last_seen_utc": "2025-11-05 20:16:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634146": [
        {
            "ioc_value": "h1p.n-61-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:10:56",
            "last_seen_utc": "2025-11-05 20:16:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634145": [
        {
            "ioc_value": "v1.q3v8p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:08:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634144": [
        {
            "ioc_value": "bd.falconhimmel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:07:06",
            "last_seen_utc": "2025-11-05 20:10:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634143": [
        {
            "ioc_value": "wz0.n-61-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 20:01:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634138": [
        {
            "ioc_value": "q4.falconhimmel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:58:09",
            "last_seen_utc": "2025-11-05 20:01:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634137": [
        {
            "ioc_value": "op.2218pb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:47:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634136": [
        {
            "ioc_value": "g.falconhimmel.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:46:19",
            "last_seen_utc": "2025-11-05 19:50:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634131": [
        {
            "ioc_value": "mv.ethicaltechinstitute.org.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-05 19:41:18",
            "last_seen_utc": "2025-11-05 19:42:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1634132": [
        {
            "ioc_value": "mv.fabiankorte.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-05 19:41:18",
            "last_seen_utc": "2025-11-05 19:42:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1634130": [
        {
            "ioc_value": "k4r2.n-61-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:41:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634126": [
        {
            "ioc_value": "kz.harborfreund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:37:52",
            "last_seen_utc": "2025-11-05 19:41:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634125": [
        {
            "ioc_value": "1m.harborfreund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:27:34",
            "last_seen_utc": "2025-11-05 19:32:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634124": [
        {
            "ioc_value": "vj3.n-61-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:27:20",
            "last_seen_utc": "2025-11-05 19:32:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634123": [
        {
            "ioc_value": "c8.harborfreund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:23:53",
            "last_seen_utc": "2025-11-05 19:27:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634122": [
        {
            "ioc_value": "g8.n-61-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634121": [
        {
            "ioc_value": "p.harborfreund.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:17:29",
            "last_seen_utc": "2025-11-05 19:20:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634120": [
        {
            "ioc_value": "t2k8.d-k-6j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:11:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634119": [
        {
            "ioc_value": "0z.cloverschnee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 19:07:38",
            "last_seen_utc": "2025-11-05 19:11:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634118": [
        {
            "ioc_value": "v3.cloverschnee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:57:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634115": [
        {
            "ioc_value": "cmv.d-k-6j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:49:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634111": [
        {
            "ioc_value": "h2.cloverschnee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:46:33",
            "last_seen_utc": "2025-11-05 18:49:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634110": [
        {
            "ioc_value": "zk8.384v2271.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:43:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634109": [
        {
            "ioc_value": "s.cloverschnee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:42:23",
            "last_seen_utc": "2025-11-05 18:43:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634108": [
        {
            "ioc_value": "r01.d-k-6j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:39:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634107": [
        {
            "ioc_value": "u1x.384v2271.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:38:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634106": [
        {
            "ioc_value": "x1.embergarten.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:38:12",
            "last_seen_utc": "2025-11-05 18:39:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634105": [
        {
            "ioc_value": "b7n.d-k-6j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:32:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634104": [
        {
            "ioc_value": "q2.embergarten.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:27:54",
            "last_seen_utc": "2025-11-05 18:32:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634103": [
        {
            "ioc_value": "xq9.d-k-6j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634102": [
        {
            "ioc_value": "m7.embergarten.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:17:52",
            "last_seen_utc": "2025-11-05 18:21:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634094": [
        {
            "ioc_value": "quontran.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-05 18:03:02",
            "last_seen_utc": "2025-11-07 12:55:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251105-qgrqxaej7x",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1634093": [
        {
            "ioc_value": "a.embergarten.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:03:01",
            "last_seen_utc": "2025-11-05 18:12:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634092": [
        {
            "ioc_value": "a4.d-k-6j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 18:02:53",
            "last_seen_utc": "2025-11-05 18:12:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634088": [
        {
            "ioc_value": "bpu.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 17:59:49",
            "last_seen_utc": "2025-11-05 18:02:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634087": [
        {
            "ioc_value": "dv6.kgto6b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 17:48:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634086": [
        {
            "ioc_value": "mlo.j-7m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 17:47:53",
            "last_seen_utc": "2025-11-05 17:48:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634085": [
        {
            "ioc_value": "9yi.j935.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 17:37:29",
            "last_seen_utc": "2025-11-05 17:38:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634083": [
        {
            "ioc_value": "p0x.kgto6b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 17:30:35",
            "last_seen_utc": "2025-11-05 17:38:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634082": [
        {
            "ioc_value": "xa2.027-7i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 17:30:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634081": [
        {
            "ioc_value": "e7f.oqtx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 17:27:11",
            "last_seen_utc": "2025-11-05 17:30:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634080": [
        {
            "ioc_value": "0i4.4qo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 17:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634079": [
        {
            "ioc_value": "5wf.yw9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 17:01:30",
            "last_seen_utc": "2025-11-05 17:03:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634078": [
        {
            "ioc_value": "t9h3.kgto6b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:59:12",
            "last_seen_utc": "2025-11-05 17:03:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634077": [
        {
            "ioc_value": "hp.5g-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:53:11",
            "last_seen_utc": "2025-11-05 16:59:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634075": [
        {
            "ioc_value": "r6.027-7i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:48:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634074": [
        {
            "ioc_value": "uq.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:45:56",
            "last_seen_utc": "2025-11-05 16:51:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634073": [
        {
            "ioc_value": "za1.kgto6b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:43:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634072": [
        {
            "ioc_value": "uh.67tf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:37:40",
            "last_seen_utc": "2025-11-05 16:43:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634071": [
        {
            "ioc_value": "y7m4.lweaq9b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:34:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634070": [
        {
            "ioc_value": "m2v.kgto6b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:28:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634069": [
        {
            "ioc_value": "x74.j-7m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:27:53",
            "last_seen_utc": "2025-11-05 16:34:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634068": [
        {
            "ioc_value": "my.znx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:19:29",
            "last_seen_utc": "2025-11-05 16:21:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634055": [
        {
            "ioc_value": "q7.kgto6b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:14:31",
            "last_seen_utc": "2025-11-05 16:21:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634054": [
        {
            "ioc_value": "vhi.j935.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:12:45",
            "last_seen_utc": "2025-11-05 16:14:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634053": [
        {
            "ioc_value": "n9i.oqtx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 16:07:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634046": [
        {
            "ioc_value": "n8z.lweaq9b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 15:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634045": [
        {
            "ioc_value": "2cr.4qo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 15:56:13",
            "last_seen_utc": "2025-11-05 15:59:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634044": [
        {
            "ioc_value": "hf.yw9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 15:48:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634043": [
        {
            "ioc_value": "1sp.5g-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 15:30:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634042": [
        {
            "ioc_value": "u3c.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 15:28:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634041": [
        {
            "ioc_value": "t8cz.y2u-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 15:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634040": [
        {
            "ioc_value": "7yf.67tf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 15:17:47",
            "last_seen_utc": "2025-11-05 17:57:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634039": [
        {
            "ioc_value": "os.j-7m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 15:08:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634037": [
        {
            "ioc_value": "lr.znx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 14:57:43",
            "last_seen_utc": "2025-11-05 14:59:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634036": [
        {
            "ioc_value": "g7ya.y2u-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 14:52:53",
            "last_seen_utc": "2025-11-05 14:59:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634035": [
        {
            "ioc_value": "d1o.j935.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 14:44:21",
            "last_seen_utc": "2025-11-05 14:52:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634034": [
        {
            "ioc_value": "s2lmx.y2u-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 14:43:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634033": [
        {
            "ioc_value": "io8.oqtx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 14:37:37",
            "last_seen_utc": "2025-11-05 14:43:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634032": [
        {
            "ioc_value": "o4.4qo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 14:27:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634030": [
        {
            "ioc_value": "ndy.yw9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 14:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634029": [
        {
            "ioc_value": "lga.5g-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 14:05:13",
            "last_seen_utc": "2025-11-05 14:13:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634028": [
        {
            "ioc_value": "k7.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:57:58",
            "last_seen_utc": "2025-11-05 14:02:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634025": [
        {
            "ioc_value": "w7x.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:47:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634024": [
        {
            "ioc_value": "pul.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:38:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634023": [
        {
            "ioc_value": "g7c5.kzg-w-4y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:29:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634022": [
        {
            "ioc_value": "zon.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:27:34",
            "last_seen_utc": "2025-11-05 13:29:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634021": [
        {
            "ioc_value": "e9rn.y2u-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634020": [
        {
            "ioc_value": "9xz.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:17:16",
            "last_seen_utc": "2025-11-05 13:23:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634018": [
        {
            "ioc_value": "m2q9a.kzg-w-4y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:11:37",
            "last_seen_utc": "2025-11-05 13:23:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634017": [
        {
            "ioc_value": "qak.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:07:10",
            "last_seen_utc": "2025-11-05 13:11:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634016": [
        {
            "ioc_value": "u5q8.y2u-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 13:03:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634015": [
        {
            "ioc_value": "ljh.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:57:23",
            "last_seen_utc": "2025-11-05 13:03:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634014": [
        {
            "ioc_value": "y0bn4.kzg-w-4y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:56:45",
            "last_seen_utc": "2025-11-05 13:00:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634012": [
        {
            "ioc_value": "frt.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:47:05",
            "last_seen_utc": "2025-11-05 12:56:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634011": [
        {
            "ioc_value": "n6q.i1msth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:44:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634010": [
        {
            "ioc_value": "2pq.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:38:31",
            "last_seen_utc": "2025-11-05 12:44:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634008": [
        {
            "ioc_value": "00x.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:27:54",
            "last_seen_utc": "2025-11-05 12:29:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634006": [
        {
            "ioc_value": "p8t3k.kzg-w-4y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:22:37",
            "last_seen_utc": "2025-11-05 12:29:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1634005": [
        {
            "ioc_value": "x9.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:18:05",
            "last_seen_utc": "2025-11-05 12:22:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634004": [
        {
            "ioc_value": "5x.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:07:49",
            "last_seen_utc": "2025-11-05 12:14:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1634003": [
        {
            "ioc_value": "u1r6.kzg-w-4y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 12:06:58",
            "last_seen_utc": "2025-11-05 12:14:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633996": [
        {
            "ioc_value": "drpolok.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-05 12:01:09",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251105-na737sbj5y",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633993": [
        {
            "ioc_value": "kastefer8jagr1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-05 12:01:02",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251105-lrasxshl61",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633991": [
        {
            "ioc_value": "u5bd1.i1msth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 11:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633990": [
        {
            "ioc_value": "04.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 11:57:30",
            "last_seen_utc": "2025-11-05 12:06:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633989": [
        {
            "ioc_value": "lx.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 11:49:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633844": [
        {
            "ioc_value": "42.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 11:38:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633843": [
        {
            "ioc_value": "3l.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 11:28:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633842": [
        {
            "ioc_value": "were-eye.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-05 11:21:13",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633839": [
        {
            "ioc_value": "surit2948estoat02.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-05 11:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633838": [
        {
            "ioc_value": "hxipzknrsojnitzv.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-05 11:20:22",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633836": [
        {
            "ioc_value": "gamindcr.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-05 11:20:00",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633837": [
        {
            "ioc_value": "logs.skillface.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-05 11:20:00",
            "last_seen_utc": "2025-12-12 18:38:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633834": [
        {
            "ioc_value": "4k.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 11:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633816": [
        {
            "ioc_value": "d9.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 11:08:17",
            "last_seen_utc": "2025-11-05 11:11:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633815": [
        {
            "ioc_value": "amyt11besco01.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-11-05 11:05:59",
            "last_seen_utc": "2025-12-12 18:40:01",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pr0xylife"
        }
    ],
    "1633814": [
        {
            "ioc_value": "k0sj.i1msth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 11:04:22",
            "last_seen_utc": "2025-11-05 11:08:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633813": [
        {
            "ioc_value": "n3w7a.gfk-8120.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 11:01:19",
            "last_seen_utc": "2025-11-05 11:11:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633778": [
        {
            "ioc_value": "m7.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:57:51",
            "last_seen_utc": "2025-11-05 11:04:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633777": [
        {
            "ioc_value": "ik.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:52:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633776": [
        {
            "ioc_value": "nzs.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:47:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633775": [
        {
            "ioc_value": "r5z0t.gfk-8120.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:44:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633774": [
        {
            "ioc_value": "20q.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:37:38",
            "last_seen_utc": "2025-11-05 10:44:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633773": [
        {
            "ioc_value": "r8y.i1msth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:33:39",
            "last_seen_utc": "2025-11-05 10:44:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633772": [
        {
            "ioc_value": "h93.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:27:22",
            "last_seen_utc": "2025-11-05 10:33:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633771": [
        {
            "ioc_value": "c2x8.gfk-8120.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:21:57",
            "last_seen_utc": "2025-11-05 10:32:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633770": [
        {
            "ioc_value": "ke0.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:19:37",
            "last_seen_utc": "2025-11-05 10:21:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633769": [
        {
            "ioc_value": "p3nkd.i1msth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633768": [
        {
            "ioc_value": "a7m1v.gfk-8120.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:09:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633767": [
        {
            "ioc_value": "z6l.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 10:07:16",
            "last_seen_utc": "2025-11-05 10:19:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633765": [
        {
            "ioc_value": "h4p9q.gfk-8120.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:58:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633764": [
        {
            "ioc_value": "els.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:57:30",
            "last_seen_utc": "2025-11-05 09:58:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633763": [
        {
            "ioc_value": "t9w4.i1msth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:48:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633762": [
        {
            "ioc_value": "wdr.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:48:03",
            "last_seen_utc": "2025-11-05 09:48:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633761": [
        {
            "ioc_value": "n5i.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:37:14",
            "last_seen_utc": "2025-11-05 09:48:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633760": [
        {
            "ioc_value": "0x0.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:27:57",
            "last_seen_utc": "2025-11-05 09:28:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633759": [
        {
            "ioc_value": "u0x9a.3-f72v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:23:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633758": [
        {
            "ioc_value": "2e.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:17:42",
            "last_seen_utc": "2025-11-05 09:23:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633757": [
        {
            "ioc_value": "c8r5q.3-f72v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:12:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633756": [
        {
            "ioc_value": "jhfhfdkhdfdk32.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-05 09:08:10",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/48ffb8ff3ec6df6a15261f1cdc8da698a3b99f7370d231dec133687946c79ea6/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1633754": [
        {
            "ioc_value": "aj.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:07:53",
            "last_seen_utc": "2025-11-05 09:12:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633753": [
        {
            "ioc_value": "y1t4.3-f72v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 09:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633751": [
        {
            "ioc_value": "h2v.i1msth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:58:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633750": [
        {
            "ioc_value": "pv.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:57:34",
            "last_seen_utc": "2025-11-05 09:00:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633749": [
        {
            "ioc_value": "k3d8n.3-f72v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:52:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633748": [
        {
            "ioc_value": "bh.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:47:16",
            "last_seen_utc": "2025-11-05 08:52:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633739": [
        {
            "ioc_value": "a9p7m.3-f72v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:43:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633738": [
        {
            "ioc_value": "tz.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:37:29",
            "last_seen_utc": "2025-11-05 08:43:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633737": [
        {
            "ioc_value": "l6q2.3-f72v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:28:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633736": [
        {
            "ioc_value": "t0.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:27:35",
            "last_seen_utc": "2025-11-05 08:28:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633735": [
        {
            "ioc_value": "c5jqq.s64lr5ok.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:24:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633734": [
        {
            "ioc_value": "14.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:18:17",
            "last_seen_utc": "2025-11-05 08:24:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633733": [
        {
            "ioc_value": "yx0n.s64lr5ok.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:12:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633731": [
        {
            "ioc_value": "tc.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:08:00",
            "last_seen_utc": "2025-11-05 08:13:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633730": [
        {
            "ioc_value": "j4z8m.x625v7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 08:07:15",
            "last_seen_utc": "2025-11-05 08:13:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633708": [
        {
            "ioc_value": "7r.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:56:39",
            "last_seen_utc": "2025-11-05 08:07:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633703": [
        {
            "ioc_value": "zf42.s64lr5ok.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:49:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633701": [
        {
            "ioc_value": "go.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-05 07:48:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1633702": [
        {
            "ioc_value": "go.bestjacksonvillehotels.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-05 07:48:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1633700": [
        {
            "ioc_value": "mx.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:47:55",
            "last_seen_utc": "2025-11-05 07:49:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633697": [
        {
            "ioc_value": "s0h5.x625v7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:41:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633696": [
        {
            "ioc_value": "2iz.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:37:26",
            "last_seen_utc": "2025-11-05 07:41:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633409": [
        {
            "ioc_value": "excellencebpo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-05 07:37:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633423": [
        {
            "ioc_value": "emaragogi.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-05 07:37:09",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633426": [
        {
            "ioc_value": "s3.mirgaza.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-05 07:37:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633452": [
        {
            "ioc_value": "connect.zave.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-11-05 07:37:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/51fae03f58dc7f16a437c3f951ba7523b908fb7250d137a571458196c7fb7f2a/",
            "tags": "c2,RAT",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1633430": [
        {
            "ioc_value": "vakarpishkov.magnaart.ru.fbweb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-05 07:37:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633458": [
        {
            "ioc_value": "controllerjs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-05 07:37:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633463": [
        {
            "ioc_value": "cpajoliette.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-05 07:37:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633465": [
        {
            "ioc_value": "kislonij.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-05 07:37:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633520": [
        {
            "ioc_value": "acrobatupdatesystem.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-05 07:37:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Adobe Update,LogMeIn Resolve",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633521": [
        {
            "ioc_value": "pdfacrobatupdate.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-05 07:37:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Adobe Update,LogMeIn Resolve",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633528": [
        {
            "ioc_value": "securefiledepot.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-05 07:37:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "LogMeIn Resolve",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633694": [
        {
            "ioc_value": "efu.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:27:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633693": [
        {
            "ioc_value": "a7r.s64lr5ok.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:14:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633692": [
        {
            "ioc_value": "vyc.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:13:45",
            "last_seen_utc": "2025-11-05 07:14:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633691": [
        {
            "ioc_value": "lnq.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:07:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633690": [
        {
            "ioc_value": "e7v1n.x625v7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 07:03:57",
            "last_seen_utc": "2025-11-05 07:14:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633689": [
        {
            "ioc_value": "5ha.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:59:04",
            "last_seen_utc": "2025-11-05 07:03:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633688": [
        {
            "ioc_value": "m3t8p.s64lr5ok.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:53:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633687": [
        {
            "ioc_value": "p6m4q.x625v7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:49:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633686": [
        {
            "ioc_value": "chu.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:48:15",
            "last_seen_utc": "2025-11-05 06:53:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633685": [
        {
            "ioc_value": "t2k8.x625v7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:38:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633684": [
        {
            "ioc_value": "xqs.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:37:57",
            "last_seen_utc": "2025-11-05 06:38:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633683": [
        {
            "ioc_value": "yxb.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:27:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633682": [
        {
            "ioc_value": "w9c3a.x625v7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:22:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633681": [
        {
            "ioc_value": "2zs.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:17:52",
            "last_seen_utc": "2025-11-05 06:22:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633680": [
        {
            "ioc_value": "q1zd.s64lr5ok.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:14:12",
            "last_seen_utc": "2025-11-05 06:19:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633678": [
        {
            "ioc_value": "2z.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 06:07:34",
            "last_seen_utc": "2025-11-05 06:14:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633677": [
        {
            "ioc_value": "greatguru1985bk.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-05 06:00:49",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251105-cnwfsafr9v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633676": [
        {
            "ioc_value": "56.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 05:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633675": [
        {
            "ioc_value": "v9k.s64lr5ok.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 05:47:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633674": [
        {
            "ioc_value": "4q.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 05:47:21",
            "last_seen_utc": "2025-11-05 05:47:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633673": [
        {
            "ioc_value": "fx.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 05:37:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633671": [
        {
            "ioc_value": "88.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 05:28:16",
            "last_seen_utc": "2025-11-05 05:29:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633670": [
        {
            "ioc_value": "z3.aaty4qdy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 05:23:11",
            "last_seen_utc": "2025-11-05 05:29:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633669": [
        {
            "ioc_value": "40.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 05:16:58",
            "last_seen_utc": "2025-11-05 05:23:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633668": [
        {
            "ioc_value": "qm8.aaty4qdy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 05:08:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633667": [
        {
            "ioc_value": "3d.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 05:08:11",
            "last_seen_utc": "2025-11-05 05:08:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633666": [
        {
            "ioc_value": "5j.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 04:56:34",
            "last_seen_utc": "2025-11-05 05:02:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633665": [
        {
            "ioc_value": "u1x.aaty4qdy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 04:52:35",
            "last_seen_utc": "2025-11-05 05:02:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633664": [
        {
            "ioc_value": "dp.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 04:47:47",
            "last_seen_utc": "2025-11-05 04:52:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633663": [
        {
            "ioc_value": "dc.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 04:37:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633662": [
        {
            "ioc_value": "h4.aaty4qdy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 04:32:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633661": [
        {
            "ioc_value": "oos.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 04:26:41",
            "last_seen_utc": "2025-11-05 04:32:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633660": [
        {
            "ioc_value": "rg7.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 04:17:12",
            "last_seen_utc": "2025-11-05 04:17:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633659": [
        {
            "ioc_value": "aa9.o4-lq-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 04:13:24",
            "last_seen_utc": "2025-11-05 04:17:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633658": [
        {
            "ioc_value": "415.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 04:07:32",
            "last_seen_utc": "2025-11-05 04:13:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633651": [
        {
            "ioc_value": "wq0.o4-lq-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633650": [
        {
            "ioc_value": "5fw.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:57:00",
            "last_seen_utc": "2025-11-05 03:58:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633649": [
        {
            "ioc_value": "3dw.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:47:12",
            "last_seen_utc": "2025-11-05 03:50:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633646": [
        {
            "ioc_value": "h2p1.k5gc56.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:40:20",
            "last_seen_utc": "2025-11-05 03:50:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633645": [
        {
            "ioc_value": "npl.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:37:47",
            "last_seen_utc": "2025-11-05 03:40:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633644": [
        {
            "ioc_value": "c7z.o4-lq-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:29:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633643": [
        {
            "ioc_value": "3xk.k5gc56.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:28:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633642": [
        {
            "ioc_value": "c8n.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:28:00",
            "last_seen_utc": "2025-11-05 03:29:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633641": [
        {
            "ioc_value": "v1i.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:17:53",
            "last_seen_utc": "2025-11-05 03:25:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633638": [
        {
            "ioc_value": "qa9.k5gc56.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:11:37",
            "last_seen_utc": "2025-11-05 03:25:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633637": [
        {
            "ioc_value": "b9w.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:07:34",
            "last_seen_utc": "2025-11-05 03:14:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633636": [
        {
            "ioc_value": "n2.o4-lq-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 03:03:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633635": [
        {
            "ioc_value": "z7.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:57:10",
            "last_seen_utc": "2025-11-05 03:04:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633634": [
        {
            "ioc_value": "zv04.k5gc56.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:56:56",
            "last_seen_utc": "2025-11-05 03:04:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633633": [
        {
            "ioc_value": "mail.aliyun-mail.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-05 02:48:00",
            "last_seen_utc": "2025-12-09 19:52:58",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1633632": [
        {
            "ioc_value": "w9.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:47:23",
            "last_seen_utc": "2025-11-05 02:56:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633631": [
        {
            "ioc_value": "8q.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:36:57",
            "last_seen_utc": "2025-11-05 02:40:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633630": [
        {
            "ioc_value": "t1m.k5gc56.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:31:37",
            "last_seen_utc": "2025-11-05 02:40:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633629": [
        {
            "ioc_value": "t1w.p-72h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:29:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633628": [
        {
            "ioc_value": "2j.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:28:11",
            "last_seen_utc": "2025-11-05 02:31:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633627": [
        {
            "ioc_value": "g8.k5gc56.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:14:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633626": [
        {
            "ioc_value": "hc.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:12:47",
            "last_seen_utc": "2025-11-05 02:14:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633625": [
        {
            "ioc_value": "m.p-72h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:09:39",
            "last_seen_utc": "2025-11-05 02:14:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633624": [
        {
            "ioc_value": "fo.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 02:08:04",
            "last_seen_utc": "2025-11-05 02:09:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633623": [
        {
            "ioc_value": "zq9.p-72h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:59:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633622": [
        {
            "ioc_value": "7b.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:57:46",
            "last_seen_utc": "2025-11-05 02:03:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633621": [
        {
            "ioc_value": "w6.dae017f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:48:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633620": [
        {
            "ioc_value": "k3.p-72h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:47:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633619": [
        {
            "ioc_value": "s9.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:47:26",
            "last_seen_utc": "2025-11-05 01:48:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633618": [
        {
            "ioc_value": "p3.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:37:50",
            "last_seen_utc": "2025-11-05 01:40:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633617": [
        {
            "ioc_value": "r0t2.dae017f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:32:30",
            "last_seen_utc": "2025-11-05 01:40:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633616": [
        {
            "ioc_value": "i8.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:22:16",
            "last_seen_utc": "2025-11-05 01:32:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633615": [
        {
            "ioc_value": "sgd.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633614": [
        {
            "ioc_value": "d5.a-4n66k4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:07:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633613": [
        {
            "ioc_value": "dnb.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:03:42",
            "last_seen_utc": "2025-11-05 01:07:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633612": [
        {
            "ioc_value": "b7k2.a-4n66k4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 01:03:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633611": [
        {
            "ioc_value": "2xe.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:56:58",
            "last_seen_utc": "2025-11-05 01:03:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633610": [
        {
            "ioc_value": "7nb.dae017f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:56:35",
            "last_seen_utc": "2025-11-05 01:05:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633609": [
        {
            "ioc_value": "oka.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:47:00",
            "last_seen_utc": "2025-11-05 00:56:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633608": [
        {
            "ioc_value": "x0p.a-4n66k4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:43:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633607": [
        {
            "ioc_value": "pj1.dae017f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:38:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633606": [
        {
            "ioc_value": "el4.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:37:11",
            "last_seen_utc": "2025-11-05 00:43:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633605": [
        {
            "ioc_value": "xq9.dae017f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:29:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633604": [
        {
            "ioc_value": "iaz.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:26:43",
            "last_seen_utc": "2025-11-05 00:29:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633603": [
        {
            "ioc_value": "m.2u-gd2ml.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633602": [
        {
            "ioc_value": "uqy.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:16:25",
            "last_seen_utc": "2025-11-05 00:21:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633601": [
        {
            "ioc_value": "c4.dae017f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:11:51",
            "last_seen_utc": "2025-11-05 00:21:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633600": [
        {
            "ioc_value": "ua7.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-05 00:07:09",
            "last_seen_utc": "2025-11-05 00:11:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633597": [
        {
            "ioc_value": "p9y1.j6e-0g-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:59:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633596": [
        {
            "ioc_value": "ty.2bj82sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:54:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633595": [
        {
            "ioc_value": "3vo.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:53:16",
            "last_seen_utc": "2025-11-04 23:59:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633594": [
        {
            "ioc_value": "mn.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633592": [
        {
            "ioc_value": "0m.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:43:22",
            "last_seen_utc": "2025-11-04 23:44:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633591": [
        {
            "ioc_value": "a0p2.2bj82sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:39:18",
            "last_seen_utc": "2025-11-04 23:44:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633590": [
        {
            "ioc_value": "t5.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:38:02",
            "last_seen_utc": "2025-11-04 23:39:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633589": [
        {
            "ioc_value": "2y.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:30:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633588": [
        {
            "ioc_value": "mzr.2bj82sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633587": [
        {
            "ioc_value": "b3.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:23:29",
            "last_seen_utc": "2025-11-04 23:29:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633586": [
        {
            "ioc_value": "m.q8-v-4of.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633585": [
        {
            "ioc_value": "hk.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:17:46",
            "last_seen_utc": "2025-11-04 23:18:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633584": [
        {
            "ioc_value": "v93.2bj82sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:08:48",
            "last_seen_utc": "2025-11-04 23:18:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633583": [
        {
            "ioc_value": "oc.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 23:07:53",
            "last_seen_utc": "2025-11-04 23:08:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633558": [
        {
            "ioc_value": "okta.relatec.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 23:01:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/51.81.210.203+okta.relatec.it.com",
            "tags": "AS16276,C2,censys,Mythic,OVH",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1633556": [
        {
            "ioc_value": "sl.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:57:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633555": [
        {
            "ioc_value": "7x.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:47:32",
            "last_seen_utc": "2025-11-04 22:50:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633554": [
        {
            "ioc_value": "z9q.q8-v-4of.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:42:26",
            "last_seen_utc": "2025-11-04 22:48:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633553": [
        {
            "ioc_value": "h1k.2bj82sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:40:54",
            "last_seen_utc": "2025-11-04 22:50:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633552": [
        {
            "ioc_value": "9q.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:37:14",
            "last_seen_utc": "2025-11-04 22:42:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633551": [
        {
            "ioc_value": "k2.q8-v-4of.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:27:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633550": [
        {
            "ioc_value": "4jb.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:25:55",
            "last_seen_utc": "2025-11-04 22:32:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633549": [
        {
            "ioc_value": "k0fj3.k9-2g8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:23:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633548": [
        {
            "ioc_value": "q7.2bj82sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:23:40",
            "last_seen_utc": "2025-11-04 22:32:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633547": [
        {
            "ioc_value": "it4.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:13:04",
            "last_seen_utc": "2025-11-04 22:23:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633546": [
        {
            "ioc_value": "r6tva.k9-2g8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:09:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633545": [
        {
            "ioc_value": "cmk.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:06:51",
            "last_seen_utc": "2025-11-04 22:11:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633544": [
        {
            "ioc_value": "f3n7k.798u-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 22:06:38",
            "last_seen_utc": "2025-11-04 22:11:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633543": [
        {
            "ioc_value": "rea.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:57:59",
            "last_seen_utc": "2025-11-04 22:06:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633542": [
        {
            "ioc_value": "2dx.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:47:11",
            "last_seen_utc": "2025-11-04 21:53:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633541": [
        {
            "ioc_value": "w1hb.k9-2g8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:41:16",
            "last_seen_utc": "2025-11-04 21:53:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633540": [
        {
            "ioc_value": "b5y2q.798u-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:40:33",
            "last_seen_utc": "2025-11-04 21:53:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633539": [
        {
            "ioc_value": "umv.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:37:45",
            "last_seen_utc": "2025-11-04 21:41:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633538": [
        {
            "ioc_value": "6vy.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:27:59",
            "last_seen_utc": "2025-11-04 21:35:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633537": [
        {
            "ioc_value": "d3zq9.k9-2g8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633536": [
        {
            "ioc_value": "z0t8n.798u-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:27:31",
            "last_seen_utc": "2025-11-04 21:35:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633535": [
        {
            "ioc_value": "ti1.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:17:27",
            "last_seen_utc": "2025-11-04 21:27:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633534": [
        {
            "ioc_value": "y7m2.k9-2g8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:13:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633533": [
        {
            "ioc_value": "q7l3a.798u-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:10:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633532": [
        {
            "ioc_value": "9xy.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 21:07:39",
            "last_seen_utc": "2025-11-04 21:13:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633527": [
        {
            "ioc_value": "x1r9.798u-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633526": [
        {
            "ioc_value": "jo.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:56:21",
            "last_seen_utc": "2025-11-04 20:56:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633525": [
        {
            "ioc_value": "hj.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:48:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633524": [
        {
            "ioc_value": "xt.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:37:59",
            "last_seen_utc": "2025-11-04 20:42:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633523": [
        {
            "ioc_value": "v2p6m.798u-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:30:33",
            "last_seen_utc": "2025-11-04 20:42:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633522": [
        {
            "ioc_value": "0y.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:28:22",
            "last_seen_utc": "2025-11-04 20:30:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633519": [
        {
            "ioc_value": "wm.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:17:54",
            "last_seen_utc": "2025-11-04 20:22:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633518": [
        {
            "ioc_value": "d8k3a.j0-e-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:11:18",
            "last_seen_utc": "2025-11-04 20:22:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633517": [
        {
            "ioc_value": "c8r1n.9-s-7g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:10:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633516": [
        {
            "ioc_value": "9e.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 20:08:08",
            "last_seen_utc": "2025-11-04 20:11:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633498": [
        {
            "ioc_value": "z5tq.9-s-7g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:58:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633497": [
        {
            "ioc_value": "y9.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:57:48",
            "last_seen_utc": "2025-11-04 20:01:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633496": [
        {
            "ioc_value": "m4qwe.j0-e-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:51:43",
            "last_seen_utc": "2025-11-04 20:01:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633495": [
        {
            "ioc_value": "7h.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:47:31",
            "last_seen_utc": "2025-11-04 19:51:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633494": [
        {
            "ioc_value": "x2w7.9-s-7g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:38:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633493": [
        {
            "ioc_value": "74.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:38:16",
            "last_seen_utc": "2025-11-04 19:47:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633492": [
        {
            "ioc_value": "g5z9.j0-e-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:30:36",
            "last_seen_utc": "2025-11-04 19:47:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633491": [
        {
            "ioc_value": "fp.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:27:27",
            "last_seen_utc": "2025-11-04 19:30:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633489": [
        {
            "ioc_value": "p9akm.9-s-7g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633488": [
        {
            "ioc_value": "648.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:17:09",
            "last_seen_utc": "2025-11-04 19:23:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633487": [
        {
            "ioc_value": "7ne.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633486": [
        {
            "ioc_value": "r6t1x.j0-e-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 19:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633485": [
        {
            "ioc_value": "tr8.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:58:02",
            "last_seen_utc": "2025-11-04 19:00:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633484": [
        {
            "ioc_value": "h3v2.9-s-7g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633476": [
        {
            "ioc_value": "3wa.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:47:44",
            "last_seen_utc": "2025-11-04 18:57:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633471": [
        {
            "ioc_value": "y0b7n.j0-e-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:44:36",
            "last_seen_utc": "2025-11-04 18:49:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633468": [
        {
            "ioc_value": "5qi.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:36:56",
            "last_seen_utc": "2025-11-04 18:44:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633461": [
        {
            "ioc_value": "c2m8q.j0-e-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:29:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633459": [
        {
            "ioc_value": "w3q0.7mdmu7og.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:28:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633457": [
        {
            "ioc_value": "7xk.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:27:39",
            "last_seen_utc": "2025-11-04 18:29:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633455": [
        {
            "ioc_value": "4es.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:12:46",
            "last_seen_utc": "2025-11-04 18:14:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633453": [
        {
            "ioc_value": "n7w3a.t-7-1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:08:39",
            "last_seen_utc": "2025-11-04 18:14:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633451": [
        {
            "ioc_value": "a9.7mdmu7og.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:05:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633449": [
        {
            "ioc_value": "onecoder.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-11-04 18:04:32",
            "last_seen_utc": "2025-11-07 12:55:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251104-q8fsqatmbr",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633445": [
        {
            "ioc_value": "fcq.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 18:01:11",
            "last_seen_utc": "2025-11-04 18:08:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633443": [
        {
            "ioc_value": "egodinmaegobundunwoke7523bjfeyfdvkcgddjg.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 18:00:57",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251104-plbptasnhn",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633442": [
        {
            "ioc_value": "privacy2088.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 18:00:56",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251104-qswh8stnas",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633441": [
        {
            "ioc_value": "television-walks.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-04 18:00:43",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251104-r5e8fsdk7z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633440": [
        {
            "ioc_value": "academic-suits.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-04 18:00:42",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251104-tacvysvmdl",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633439": [
        {
            "ioc_value": "aer.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633438": [
        {
            "ioc_value": "n4.7mdmu7og.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:49:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633437": [
        {
            "ioc_value": "zl.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:47:11",
            "last_seen_utc": "2025-11-04 17:49:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633436": [
        {
            "ioc_value": "u4r8c.t-7-1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:40:53",
            "last_seen_utc": "2025-11-04 17:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633435": [
        {
            "ioc_value": "d5.1-b03-1q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:39:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633434": [
        {
            "ioc_value": "ng.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:37:53",
            "last_seen_utc": "2025-11-04 17:40:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633433": [
        {
            "ioc_value": "fz.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:32:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633432": [
        {
            "ioc_value": "y0a3.1-b03-1q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:23:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633431": [
        {
            "ioc_value": "k9z2.t-7-1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633429": [
        {
            "ioc_value": "p5x0d.t-7-1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:09:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633428": [
        {
            "ioc_value": "q7m.1-b03-1q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:08:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633427": [
        {
            "ioc_value": "gy.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 17:06:52",
            "last_seen_utc": "2025-11-04 17:09:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633425": [
        {
            "ioc_value": "a1t7m.t-7-1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:59:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633424": [
        {
            "ioc_value": "21.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:57:35",
            "last_seen_utc": "2025-11-04 16:59:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633422": [
        {
            "ioc_value": "h3v9q.t-7-1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:49:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633421": [
        {
            "ioc_value": "v1.1-b03-1q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:49:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633420": [
        {
            "ioc_value": "bl.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:49:06",
            "last_seen_utc": "2025-11-04 16:49:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633419": [
        {
            "ioc_value": "m6.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:46:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633418": [
        {
            "ioc_value": "kf.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:37:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633417": [
        {
            "ioc_value": "a4m2.r0en3ap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:33:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633416": [
        {
            "ioc_value": "1t.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:30:25",
            "last_seen_utc": "2025-11-04 16:33:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633415": [
        {
            "ioc_value": "r2t3.0-xv-3i5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:23:04",
            "last_seen_utc": "2025-11-04 16:30:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633411": [
        {
            "ioc_value": "tt7.r0en3ap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:11:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633410": [
        {
            "ioc_value": "qfl.d3-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:10:00",
            "last_seen_utc": "2025-11-04 16:23:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633408": [
        {
            "ioc_value": "v5q.r0en3ap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 16:05:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633395": [
        {
            "ioc_value": "jss.5b-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 15:57:59",
            "last_seen_utc": "2025-11-04 16:05:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633386": [
        {
            "ioc_value": "javsenpai.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:39:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633389": [
        {
            "ioc_value": "javsenpaiii.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:39:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633388": [
        {
            "ioc_value": "settings-4av.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:39:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633391": [
        {
            "ioc_value": "settingss.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:39:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633393": [
        {
            "ioc_value": "p6.0-xv-3i5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 15:36:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633392": [
        {
            "ioc_value": "iru.z-x0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 15:25:46",
            "last_seen_utc": "2025-11-04 15:36:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633381": [
        {
            "ioc_value": "n0z.r0en3ap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 15:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633380": [
        {
            "ioc_value": "m.366a4362.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 15:06:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633339": [
        {
            "ioc_value": "aprendaceo.com.br",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633340": [
        {
            "ioc_value": "wijkbuszuidwest.nl",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:40",
            "last_seen_utc": "2025-11-15 21:35:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633342": [
        {
            "ioc_value": "garudamaskosmetik.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:39",
            "last_seen_utc": "2025-12-09 13:35:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633341": [
        {
            "ioc_value": "amalgadget.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633343": [
        {
            "ioc_value": "88tdtc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633345": [
        {
            "ioc_value": "urs.org.vn",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:37",
            "last_seen_utc": "2025-12-08 19:00:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633349": [
        {
            "ioc_value": "vediclibrary.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633356": [
        {
            "ioc_value": "fxplay.in",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633369": [
        {
            "ioc_value": "piworfolo.com.theplatinumguesthouse.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:35",
            "last_seen_utc": "2025-12-07 20:34:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633377": [
        {
            "ioc_value": "chou.osteopathie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 15:04:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633379": [
        {
            "ioc_value": "vyt.24s6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 15:04:13",
            "last_seen_utc": "2025-11-04 15:07:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633378": [
        {
            "ioc_value": "zq8.366a4362.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 14:46:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633376": [
        {
            "ioc_value": "gsj.n2vr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 14:40:32",
            "last_seen_utc": "2025-11-04 14:46:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633375": [
        {
            "ioc_value": "k3.366a4362.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 14:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633374": [
        {
            "ioc_value": "ojt.dc-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 14:33:16",
            "last_seen_utc": "2025-11-04 14:35:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633373": [
        {
            "ioc_value": "j1c5p.7d0re6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 14:31:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633372": [
        {
            "ioc_value": "vickitmorrison.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-11-04 14:30:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Rhadamanthys",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633368": [
        {
            "ioc_value": "3rj.r0en3ap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 14:22:04",
            "last_seen_utc": "2025-11-04 14:42:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633357": [
        {
            "ioc_value": "h3u.8i-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 14:19:56",
            "last_seen_utc": "2025-11-04 14:31:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633353": [
        {
            "ioc_value": "t4x1.7d0re6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 14:12:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633350": [
        {
            "ioc_value": "ed.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-04 14:04:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1633351": [
        {
            "ioc_value": "ed.bestjacksonvillehotels.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-04 14:04:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1633335": [
        {
            "ioc_value": "m3p.z2q2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 13:30:54",
            "last_seen_utc": "2025-11-04 14:20:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633295": [
        {
            "ioc_value": "touchsol.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 13:28:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633320": [
        {
            "ioc_value": "ranchernandez.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 13:28:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633327": [
        {
            "ioc_value": "k8.r0en3ap.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 13:09:03",
            "last_seen_utc": "2025-11-04 13:37:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633326": [
        {
            "ioc_value": "cy6.7-h9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 13:07:50",
            "last_seen_utc": "2025-11-04 13:09:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633325": [
        {
            "ioc_value": "a7k.7d0re6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 12:28:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633324": [
        {
            "ioc_value": "0v.wo-h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 12:27:27",
            "last_seen_utc": "2025-11-04 12:30:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633323": [
        {
            "ioc_value": "g6.85cu3895.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 12:24:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633322": [
        {
            "ioc_value": "1c.03e3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 12:20:24",
            "last_seen_utc": "2025-11-04 12:24:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633319": [
        {
            "ioc_value": "z3w4.1051lt6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 12:10:29",
            "last_seen_utc": "2025-11-04 12:30:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633318": [
        {
            "ioc_value": "aw.614lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 12:07:24",
            "last_seen_utc": "2025-11-04 12:10:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633309": [
        {
            "ioc_value": "i4b2.gay",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-04 12:01:11",
            "last_seen_utc": "2025-12-12 18:38:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/251104-m64j8a1pdr",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633307": [
        {
            "ioc_value": "benjaz.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 12:01:00",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251104-k3g6pszqgl",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633306": [
        {
            "ioc_value": "simpleoil.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 12:00:59",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251104-mbyqgscj8w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1633304": [
        {
            "ioc_value": "t.ba2q7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 11:56:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633303": [
        {
            "ioc_value": "6g.w8i0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 11:54:45",
            "last_seen_utc": "2025-11-04 17:23:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633302": [
        {
            "ioc_value": "yb.oc57y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 11:49:57",
            "last_seen_utc": "2025-11-04 11:55:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633301": [
        {
            "ioc_value": "7bn.1051lt6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 11:44:04",
            "last_seen_utc": "2025-11-04 12:04:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633300": [
        {
            "ioc_value": "ch.hb0-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 11:40:10",
            "last_seen_utc": "2025-11-04 11:44:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633296": [
        {
            "ioc_value": "sessionstorexint.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-04 11:35:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633297": [
        {
            "ioc_value": "cronapiworkersvc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-04 11:35:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633293": [
        {
            "ioc_value": "buildtoolsrvcore.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-04 11:31:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633292": [
        {
            "ioc_value": "taskrunnersrvmod.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-04 11:30:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633290": [
        {
            "ioc_value": "m0t.1051lt6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 11:24:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633289": [
        {
            "ioc_value": "gw.888-c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 11:20:00",
            "last_seen_utc": "2025-11-04 11:24:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633288": [
        {
            "ioc_value": "v91.1051lt6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 11:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633287": [
        {
            "ioc_value": "z9m2.ba2q7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 11:05:57",
            "last_seen_utc": "2025-11-04 11:20:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633245": [
        {
            "ioc_value": "5d.8b-1d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 10:59:19",
            "last_seen_utc": "2025-11-04 11:16:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633244": [
        {
            "ioc_value": "j0.95tbm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 10:50:33",
            "last_seen_utc": "2025-11-04 10:53:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633243": [
        {
            "ioc_value": "w1.ba2q7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 10:49:06",
            "last_seen_utc": "2025-11-04 10:53:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633242": [
        {
            "ioc_value": "h2x.1051lt6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 10:40:03",
            "last_seen_utc": "2025-11-04 10:51:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633241": [
        {
            "ioc_value": "2d.55-0p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 10:34:33",
            "last_seen_utc": "2025-11-04 10:49:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633240": [
        {
            "ioc_value": "q5.1051lt6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 10:16:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633239": [
        {
            "ioc_value": "hw.3u-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 10:05:47",
            "last_seen_utc": "2025-11-04 10:16:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633238": [
        {
            "ioc_value": "663.67tf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:57:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633237": [
        {
            "ioc_value": "r2q3.94e-w8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:49:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633236": [
        {
            "ioc_value": "d2m1.q9-j341.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:47:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633235": [
        {
            "ioc_value": "vo7.v4-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:42:39",
            "last_seen_utc": "2025-11-04 09:49:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633234": [
        {
            "ioc_value": "7h.5g-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:34:24",
            "last_seen_utc": "2025-11-04 09:35:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633233": [
        {
            "ioc_value": "y7m.94e-w8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:30:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633232": [
        {
            "ioc_value": "elk.yw9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:28:38",
            "last_seen_utc": "2025-11-04 09:31:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633231": [
        {
            "ioc_value": "vqx.q9-j341.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:27:23",
            "last_seen_utc": "2025-11-04 09:35:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633230": [
        {
            "ioc_value": "h28.4qo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:19:22",
            "last_seen_utc": "2025-11-04 09:27:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633228": [
        {
            "ioc_value": "b0t.94e-w8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:05:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633227": [
        {
            "ioc_value": "hl.oqtx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:04:16",
            "last_seen_utc": "2025-11-04 09:08:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633226": [
        {
            "ioc_value": "a7n.q9-j341.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 09:02:30",
            "last_seen_utc": "2025-11-04 09:08:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633223": [
        {
            "ioc_value": "x.94e-w8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:54:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633222": [
        {
            "ioc_value": "fh0.j935.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:53:17",
            "last_seen_utc": "2025-11-04 09:02:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633217": [
        {
            "ioc_value": "elbrone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-04 08:49:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/suyog41/status/1985611651136307312",
            "tags": "MacSync",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1633214": [
        {
            "ioc_value": "qfe.znx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:48:05",
            "last_seen_utc": "2025-11-04 08:53:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633211": [
        {
            "ioc_value": "t19.q9-j341.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:42:58",
            "last_seen_utc": "2025-11-04 08:53:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633210": [
        {
            "ioc_value": "82.j-7m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:37:46",
            "last_seen_utc": "2025-11-04 08:42:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633209": [
        {
            "ioc_value": "6zy.l-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:27:52",
            "last_seen_utc": "2025-11-04 08:29:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633208": [
        {
            "ioc_value": "mz4.q9-j341.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:26:00",
            "last_seen_utc": "2025-11-04 08:29:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633206": [
        {
            "ioc_value": "willy.fawkingblodibastard.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-04 08:25:59",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1633207": [
        {
            "ioc_value": "p9z1.94e-w8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:23:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633204": [
        {
            "ioc_value": "ug0.k7t0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:17:34",
            "last_seen_utc": "2025-11-04 08:26:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633203": [
        {
            "ioc_value": "k3.q9-j341.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:12:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633202": [
        {
            "ioc_value": "00.0fv1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 08:09:23",
            "last_seen_utc": "2025-11-04 08:12:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633201": [
        {
            "ioc_value": "res34tgr.b0ats.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-04 08:03:50",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/20f1d0f8dbe7f5a155ae50e9b2b4909ee70b1bcd3c1eaddab374b4e47b2a1f4f/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1633188": [
        {
            "ioc_value": "www.onlinetools99.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-04 08:00:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1a698a6c4f1c78ea5caeb43b37a8f830f102e90aa66b71c2a8f7b46ad67b2017/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1633186": [
        {
            "ioc_value": "purrinvestasia.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-04 07:33:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/a4b7caa0eeb0d0a18db535cd66da23d8e9caa14a63fa31dc821eb74de69a249d/",
            "tags": "MaskGramStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1632676": [
        {
            "ioc_value": "momscare.ae.risallanursing.ae",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632678": [
        {
            "ioc_value": "myminicabin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632681": [
        {
            "ioc_value": "theadventuresbook.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632687": [
        {
            "ioc_value": "womensfitnessplans.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632688": [
        {
            "ioc_value": "babyboomerlive.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632689": [
        {
            "ioc_value": "stalbanspostboxes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632690": [
        {
            "ioc_value": "winstarplumbing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632691": [
        {
            "ioc_value": "aurorabuildings.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632692": [
        {
            "ioc_value": "idanreclub15.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632693": [
        {
            "ioc_value": "masazkielce.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632694": [
        {
            "ioc_value": "starkeyranchnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632696": [
        {
            "ioc_value": "healthcareblues.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632697": [
        {
            "ioc_value": "zenodirect.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632698": [
        {
            "ioc_value": "theignitercopywriter.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632699": [
        {
            "ioc_value": "uwielbienie.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632701": [
        {
            "ioc_value": "absorbersafety.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632700": [
        {
            "ioc_value": "helpbuildthedream.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632702": [
        {
            "ioc_value": "lgbtqwebdesign.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632703": [
        {
            "ioc_value": "lanadelreyoftour2025.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632706": [
        {
            "ioc_value": "thebitcoinbeachclub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632709": [
        {
            "ioc_value": "tomsurtsey.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632712": [
        {
            "ioc_value": "beatcandidanaturally.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:14",
            "last_seen_utc": "2025-11-03 18:48:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632713": [
        {
            "ioc_value": "trailkits.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632714": [
        {
            "ioc_value": "justiceforaldene.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632715": [
        {
            "ioc_value": "homesecuritysystemsideas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632716": [
        {
            "ioc_value": "niebezpieczna.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632717": [
        {
            "ioc_value": "tenkif.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632718": [
        {
            "ioc_value": "vaultofsalt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632728": [
        {
            "ioc_value": "cashmoneysudan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632719": [
        {
            "ioc_value": "lagunalodgeecoresort.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632723": [
        {
            "ioc_value": "ideacatcher.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632731": [
        {
            "ioc_value": "hankwilliamsjrtour2025.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632733": [
        {
            "ioc_value": "bokoskystudios.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632739": [
        {
            "ioc_value": "skpneft.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:05",
            "last_seen_utc": "2025-12-08 19:00:45",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632740": [
        {
            "ioc_value": "www.dev.ccm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632741": [
        {
            "ioc_value": "mail.thetavernonfourth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:04",
            "last_seen_utc": "2025-12-13 15:29:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632742": [
        {
            "ioc_value": "hdt.wom.mybluehost.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632743": [
        {
            "ioc_value": "fateluxurygoods.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632744": [
        {
            "ioc_value": "abanquet.bmssolutionz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:02",
            "last_seen_utc": "2025-12-11 19:29:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632745": [
        {
            "ioc_value": "lu-marquardt.picassomedia.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632746": [
        {
            "ioc_value": "kaestner-partner.picassomedia.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632748": [
        {
            "ioc_value": "tracking.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:29:00",
            "last_seen_utc": "2025-12-08 19:00:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632749": [
        {
            "ioc_value": "bustaff.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:59",
            "last_seen_utc": "2025-12-08 19:00:14",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632750": [
        {
            "ioc_value": "demo.printincbelize.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632752": [
        {
            "ioc_value": "mantis.bubars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:59",
            "last_seen_utc": "2025-12-12 18:00:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632753": [
        {
            "ioc_value": "i-like-ele-phants-verification.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632757": [
        {
            "ioc_value": "tx88club.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632756": [
        {
            "ioc_value": "poronin.naszemiejsce.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632758": [
        {
            "ioc_value": "myenerkind.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632759": [
        {
            "ioc_value": "themillennialdiyer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:55",
            "last_seen_utc": "2025-12-13 15:29:17",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632760": [
        {
            "ioc_value": "piccololawoffices.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632761": [
        {
            "ioc_value": "turgetuganda.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632762": [
        {
            "ioc_value": "vpsdevteam.us",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:54",
            "last_seen_utc": "2025-11-22 19:34:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632763": [
        {
            "ioc_value": "eventocontaduriafce.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:53",
            "last_seen_utc": "2025-12-13 15:28:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632764": [
        {
            "ioc_value": "tkagencia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:53",
            "last_seen_utc": "2025-12-13 15:29:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632765": [
        {
            "ioc_value": "hxingsoft.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:52",
            "last_seen_utc": "2025-12-08 19:00:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632767": [
        {
            "ioc_value": "thuysanhoangtrungps.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1632998": [
        {
            "ioc_value": "a09ee3dc53f6a9f461a45bac946c5a09ee3dca09ee3dc53f6a9.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:28:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633058": [
        {
            "ioc_value": "ceptj8d40dcb4cb2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.vo1d",
            "malware_alias": null,
            "malware_printable": "vo1d",
            "first_seen_utc": "2025-11-04 07:27:53",
            "last_seen_utc": "2025-11-06 04:09:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "redirector,Vo1d",
            "anonymous": "0",
            "reporter": "Bitsight"
        }
    ],
    "1632680": [
        {
            "ioc_value": "thesmartboater.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 07:27:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,Shopify",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1633121": [
        {
            "ioc_value": "intelupates.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 06:51:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA398",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633122": [
        {
            "ioc_value": "windowsdns.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 06:51:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA398",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633123": [
        {
            "ioc_value": "amsisupport.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 06:51:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA398",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633124": [
        {
            "ioc_value": "biossysinternal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 06:51:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA398",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633125": [
        {
            "ioc_value": "widgetservicecenter.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 06:51:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA398",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633120": [
        {
            "ioc_value": "bedenefuneralhome.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-04 06:50:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633114": [
        {
            "ioc_value": "rownip.schneidstore.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633115": [
        {
            "ioc_value": "rownipbackup.ga",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633116": [
        {
            "ioc_value": "rownipbackup.tk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633117": [
        {
            "ioc_value": "u864246.nvpn.so",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633109": [
        {
            "ioc_value": "lupend.ga",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633110": [
        {
            "ioc_value": "lupendbackup.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633111": [
        {
            "ioc_value": "lupendbackup.ga",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:02",
            "last_seen_utc": "2025-11-07 12:55:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633112": [
        {
            "ioc_value": "rownip.lupends.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633113": [
        {
            "ioc_value": "rownip.mailredirect.ooo",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633108": [
        {
            "ioc_value": "lupend.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-04 06:50:01",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633107": [
        {
            "ioc_value": "programming-variation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-04 06:49:43",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1633060": [
        {
            "ioc_value": "www.cioudfiore.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-04 02:48:21",
            "last_seen_utc": "2025-12-08 21:55:37",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1633059": [
        {
            "ioc_value": "cs.miu24.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-11-04 02:48:06",
            "last_seen_utc": "2025-12-04 19:48:35",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1633057": [
        {
            "ioc_value": "b.tyj-4b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 00:10:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633056": [
        {
            "ioc_value": "s9.l-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-04 00:07:22",
            "last_seen_utc": "2025-11-04 00:10:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633045": [
        {
            "ioc_value": "x19.k0xx-i4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:58:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633044": [
        {
            "ioc_value": "mg.k7t0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:56:56",
            "last_seen_utc": "2025-11-03 23:58:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633043": [
        {
            "ioc_value": "ewo.0fv1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:49:45",
            "last_seen_utc": "2025-11-03 23:54:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633042": [
        {
            "ioc_value": "n8r.k0xx-i4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:41:12",
            "last_seen_utc": "2025-11-03 23:54:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633041": [
        {
            "ioc_value": "mz7.tyj-4b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:40:28",
            "last_seen_utc": "2025-11-03 23:51:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633040": [
        {
            "ioc_value": "h6.3u-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:39:25",
            "last_seen_utc": "2025-11-03 23:41:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633039": [
        {
            "ioc_value": "3rd.67tf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:23:33",
            "last_seen_utc": "2025-11-03 23:28:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633038": [
        {
            "ioc_value": "q1.tyj-4b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:13:18",
            "last_seen_utc": "2025-11-03 23:28:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633037": [
        {
            "ioc_value": "q5.k0xx-i4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:13:16",
            "last_seen_utc": "2025-11-03 23:27:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633036": [
        {
            "ioc_value": "9hb.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:07:08",
            "last_seen_utc": "2025-11-03 23:13:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633029": [
        {
            "ioc_value": "cdn.relatec.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-03 23:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/51.81.210.203+cdn.relatec.it.com",
            "tags": "AS16276,C2,censys,Mythic,OVH",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1633022": [
        {
            "ioc_value": "rk8.pdv4m6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 23:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633018": [
        {
            "ioc_value": "v0x.do-04d2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 22:53:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633017": [
        {
            "ioc_value": "1d.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 22:52:48",
            "last_seen_utc": "2025-11-03 23:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633016": [
        {
            "ioc_value": "jo.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 22:49:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633015": [
        {
            "ioc_value": "h2v.pdv4m6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 22:43:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633014": [
        {
            "ioc_value": "a3h.do-04d2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 22:38:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633013": [
        {
            "ioc_value": "8r.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 22:38:02",
            "last_seen_utc": "2025-11-03 22:43:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633010": [
        {
            "ioc_value": "re.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-03 22:35:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1633011": [
        {
            "ioc_value": "re.bestjacksonvillehotels.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-03 22:35:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1633007": [
        {
            "ioc_value": "gf.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 22:22:38",
            "last_seen_utc": "2025-11-03 22:23:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633006": [
        {
            "ioc_value": "t92.do-04d2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 22:14:27",
            "last_seen_utc": "2025-11-03 22:23:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633005": [
        {
            "ioc_value": "1fu.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 22:09:48",
            "last_seen_utc": "2025-11-03 22:14:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633003": [
        {
            "ioc_value": "ghu.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:57:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1633002": [
        {
            "ioc_value": "y0q9.pdv4m6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:52:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1633001": [
        {
            "ioc_value": "izw.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:49:46",
            "last_seen_utc": "2025-11-03 21:52:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632996": [
        {
            "ioc_value": "gt.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:33:17",
            "last_seen_utc": "2025-11-03 21:40:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632995": [
        {
            "ioc_value": "g7m.pdv4m6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:32:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632994": [
        {
            "ioc_value": "z1n.do-04d2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:30:26",
            "last_seen_utc": "2025-11-03 21:40:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632993": [
        {
            "ioc_value": "x7f.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:24:32",
            "last_seen_utc": "2025-11-03 21:32:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632992": [
        {
            "ioc_value": "ikx.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:16:37",
            "last_seen_utc": "2025-11-03 21:17:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632989": [
        {
            "ioc_value": "n4.pdv4m6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:11:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632787": [
        {
            "ioc_value": "m4q.do-04d2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:07:09",
            "last_seen_utc": "2025-11-03 21:17:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632786": [
        {
            "ioc_value": "j8e.8786.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 21:06:22",
            "last_seen_utc": "2025-11-03 21:11:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632785": [
        {
            "ioc_value": "sc.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 20:54:04",
            "last_seen_utc": "2025-11-03 20:54:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632784": [
        {
            "ioc_value": "iw.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 20:48:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632783": [
        {
            "ioc_value": "k7.do-04d2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 20:46:08",
            "last_seen_utc": "2025-11-03 20:54:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632781": [
        {
            "ioc_value": "8mr.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 20:30:19",
            "last_seen_utc": "2025-11-03 20:46:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632780": [
        {
            "ioc_value": "v7p2.9m94k8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 20:23:17",
            "last_seen_utc": "2025-11-03 20:31:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632779": [
        {
            "ioc_value": "7hb.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 20:21:34",
            "last_seen_utc": "2025-11-03 20:23:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632778": [
        {
            "ioc_value": "yn.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 20:07:34",
            "last_seen_utc": "2025-11-03 20:11:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632777": [
        {
            "ioc_value": "privileged.iranbelaaghnea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-03 20:01:39",
            "last_seen_utc": "2025-11-03 23:00:32",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/195.123.240.47+privileged.iranbelaaghnea.com",
            "tags": "AS204957,C2,censys,GREENFLOID-AS,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1632775": [
        {
            "ioc_value": "w5t.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:58:06",
            "last_seen_utc": "2025-11-03 20:01:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632774": [
        {
            "ioc_value": "0m3.8j4-5-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:56:52",
            "last_seen_utc": "2025-11-03 20:01:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632773": [
        {
            "ioc_value": "5c5.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:49:21",
            "last_seen_utc": "2025-11-03 19:56:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632772": [
        {
            "ioc_value": "gn8.8j4-5-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:43:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632771": [
        {
            "ioc_value": "5j.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:41:57",
            "last_seen_utc": "2025-11-03 19:47:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632769": [
        {
            "ioc_value": "m0x.9m94k8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:27:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632768": [
        {
            "ioc_value": "y7.8j4-5-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:24:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632766": [
        {
            "ioc_value": "sp5.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:23:55",
            "last_seen_utc": "2025-11-03 19:27:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632755": [
        {
            "ioc_value": "2wq.8j4-5-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:14:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632747": [
        {
            "ioc_value": "8fz.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 19:08:54",
            "last_seen_utc": "2025-11-03 19:14:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632738": [
        {
            "ioc_value": "rz1.8j4-5-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632737": [
        {
            "ioc_value": "le.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:57:37",
            "last_seen_utc": "2025-11-03 18:59:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632732": [
        {
            "ioc_value": "z8q.9m94k8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632730": [
        {
            "ioc_value": "5h.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:48:45",
            "last_seen_utc": "2025-11-03 18:49:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632695": [
        {
            "ioc_value": "k4.8j4-5-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:40:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632686": [
        {
            "ioc_value": "sdg.8786.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:37:11",
            "last_seen_utc": "2025-11-03 18:40:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632685": [
        {
            "ioc_value": "k3.9m94k8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:34:38",
            "last_seen_utc": "2025-11-03 20:11:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632684": [
        {
            "ioc_value": "df.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:28:25",
            "last_seen_utc": "2025-11-03 18:34:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632683": [
        {
            "ioc_value": "4d3.f-o-9bt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:25:21",
            "last_seen_utc": "2025-11-03 18:28:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632682": [
        {
            "ioc_value": "ip1.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:23:46",
            "last_seen_utc": "2025-11-03 18:25:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632677": [
        {
            "ioc_value": "go.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:08:09",
            "last_seen_utc": "2025-11-03 18:19:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632675": [
        {
            "ioc_value": "ideas-anniversary.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-03 18:03:05",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251103-t7dthsyqgt",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1632674": [
        {
            "ioc_value": "ithelpdesk.theworkpc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-03 18:00:46",
            "last_seen_utc": "2025-11-07 12:55:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/251103-n6fntsfz4c",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1632673": [
        {
            "ioc_value": "opaoakkawkbao-52690.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-03 18:00:36",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251103-slsvwasngn",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1632671": [
        {
            "ioc_value": "line-bears.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-03 18:00:34",
            "last_seen_utc": "2025-12-12 18:39:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251103-vlrnxstkgq",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1632670": [
        {
            "ioc_value": "hxn.f-o-9bt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 18:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632669": [
        {
            "ioc_value": "n4kw.5g-t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632668": [
        {
            "ioc_value": "36.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:57:48",
            "last_seen_utc": "2025-11-03 18:00:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632667": [
        {
            "ioc_value": "ta5.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:49:58",
            "last_seen_utc": "2025-11-03 17:50:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632666": [
        {
            "ioc_value": "p01.f-o-9bt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:47:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632665": [
        {
            "ioc_value": "x9td2.5g-t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:45:04",
            "last_seen_utc": "2025-11-03 17:50:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632664": [
        {
            "ioc_value": "4j5.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:42:29",
            "last_seen_utc": "2025-11-03 17:47:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632663": [
        {
            "ioc_value": "3i7.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:37:48",
            "last_seen_utc": "2025-11-03 17:39:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632659": [
        {
            "ioc_value": "7qk.f-o-9bt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:31:03",
            "last_seen_utc": "2025-11-03 17:39:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632657": [
        {
            "ioc_value": "rt.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:27:42",
            "last_seen_utc": "2025-11-03 17:31:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632656": [
        {
            "ioc_value": "id.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:22:33",
            "last_seen_utc": "2025-11-03 17:24:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632654": [
        {
            "ioc_value": "bfb.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:16:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632653": [
        {
            "ioc_value": "cv8.f-o-9bt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:08:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632652": [
        {
            "ioc_value": "i6y.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:07:04",
            "last_seen_utc": "2025-11-03 17:08:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632651": [
        {
            "ioc_value": "m2.f-o-9bt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:02:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632650": [
        {
            "ioc_value": "2rf.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 17:01:21",
            "last_seen_utc": "2025-11-03 17:02:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632649": [
        {
            "ioc_value": "tci.8786.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 16:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632648": [
        {
            "ioc_value": "0o3.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 16:48:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632647": [
        {
            "ioc_value": "wz3.g6xt-5n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 16:47:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632646": [
        {
            "ioc_value": "m9y.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 16:39:58",
            "last_seen_utc": "2025-11-03 16:47:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632645": [
        {
            "ioc_value": "f1.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 16:22:43",
            "last_seen_utc": "2025-11-03 16:28:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632644": [
        {
            "ioc_value": "q3ha.5g-t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 16:13:50",
            "last_seen_utc": "2025-11-03 16:28:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632643": [
        {
            "ioc_value": "b5k2.g6xt-5n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 16:12:49",
            "last_seen_utc": "2025-11-03 16:25:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632640": [
        {
            "ioc_value": "w6.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 16:07:51",
            "last_seen_utc": "2025-11-03 16:13:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632625": [
        {
            "ioc_value": "b7rp.5g-t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 15:56:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632624": [
        {
            "ioc_value": "9m.g6xt-5n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 15:53:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632623": [
        {
            "ioc_value": "zts.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 15:50:32",
            "last_seen_utc": "2025-11-03 15:56:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632622": [
        {
            "ioc_value": "vy6.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 15:38:01",
            "last_seen_utc": "2025-11-03 15:39:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632429": [
        {
            "ioc_value": "graffetti.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-03 15:37:36",
            "last_seen_utc": "2025-11-03 13:06:12",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115485911727880909",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1632448": [
        {
            "ioc_value": "dotauan.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-03 15:37:34",
            "last_seen_utc": "2025-11-03 14:10:06",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115486162824245027",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1632621": [
        {
            "ioc_value": "tq0.g6xt-5n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 15:32:03",
            "last_seen_utc": "2025-11-03 15:39:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632620": [
        {
            "ioc_value": "xjh.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 15:23:39",
            "last_seen_utc": "2025-11-03 15:32:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632618": [
        {
            "ioc_value": "whitegoldgivenbestthingsangelbabygirlinm.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-03 15:14:43",
            "last_seen_utc": "2025-11-07 12:55:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632617": [
        {
            "ioc_value": "api.mangawizard.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-03 15:14:27",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632616": [
        {
            "ioc_value": "www.yphervra.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632598": [
        {
            "ioc_value": "www.olgetriggerd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632599": [
        {
            "ioc_value": "www.ollkredits.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632600": [
        {
            "ioc_value": "www.ono-777-app-download.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632601": [
        {
            "ioc_value": "www.onuloanajency.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632602": [
        {
            "ioc_value": "www.oopbytehq.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632603": [
        {
            "ioc_value": "www.ortunecoins2.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632604": [
        {
            "ioc_value": "www.ourburger.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632605": [
        {
            "ioc_value": "www.po333-login1.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632606": [
        {
            "ioc_value": "www.rtprintdeluxestudio.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632607": [
        {
            "ioc_value": "www.sarush.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632608": [
        {
            "ioc_value": "www.semeetaltoapp.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632609": [
        {
            "ioc_value": "www.sshy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632610": [
        {
            "ioc_value": "www.tephschuurman.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632611": [
        {
            "ioc_value": "www.tudiopaznokcibytow.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632612": [
        {
            "ioc_value": "www.uiact.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632613": [
        {
            "ioc_value": "www.upermagicalvacations.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632614": [
        {
            "ioc_value": "www.uttercleaningpasadenamd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632615": [
        {
            "ioc_value": "www.wnerstrategyservices.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632581": [
        {
            "ioc_value": "www.heorangesky.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632582": [
        {
            "ioc_value": "www.hytr.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632583": [
        {
            "ioc_value": "www.iaomich.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632584": [
        {
            "ioc_value": "www.ichesitenames.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632585": [
        {
            "ioc_value": "www.iguanzhang.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632586": [
        {
            "ioc_value": "www.ilgikitchenmart.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632587": [
        {
            "ioc_value": "www.illmarkt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632588": [
        {
            "ioc_value": "www.innacle-ese.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632589": [
        {
            "ioc_value": "www.inoption.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632590": [
        {
            "ioc_value": "www.klasdcfi.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632591": [
        {
            "ioc_value": "www.kwsmweb3.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632592": [
        {
            "ioc_value": "www.mmmr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632593": [
        {
            "ioc_value": "www.nchdigitalmedia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632594": [
        {
            "ioc_value": "www.noitusd.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632595": [
        {
            "ioc_value": "www.nott.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632596": [
        {
            "ioc_value": "www.num.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632597": [
        {
            "ioc_value": "www.obbyfigstore.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632564": [
        {
            "ioc_value": "www.bgwekjage.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632565": [
        {
            "ioc_value": "www.btuni.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632566": [
        {
            "ioc_value": "www.dfcpa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632567": [
        {
            "ioc_value": "www.ealastr.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632568": [
        {
            "ioc_value": "www.ecger.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632569": [
        {
            "ioc_value": "www.ech4today.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632570": [
        {
            "ioc_value": "www.ecproject.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632571": [
        {
            "ioc_value": "www.efime.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632572": [
        {
            "ioc_value": "www.ellovidesh.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632573": [
        {
            "ioc_value": "www.enirelax.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632574": [
        {
            "ioc_value": "www.entwise.city",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632575": [
        {
            "ioc_value": "www.ext-tamers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632576": [
        {
            "ioc_value": "www.fiidea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632577": [
        {
            "ioc_value": "www.fkd-vertriebspartner.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632578": [
        {
            "ioc_value": "www.gacede.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632579": [
        {
            "ioc_value": "www.grkxrnvnc.tattoo",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632580": [
        {
            "ioc_value": "www.h0u7k.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632552": [
        {
            "ioc_value": "www.033betx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632553": [
        {
            "ioc_value": "www.0bvisuals.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632554": [
        {
            "ioc_value": "www.3qor75s.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632555": [
        {
            "ioc_value": "www.952k.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632556": [
        {
            "ioc_value": "www.aburgeoise.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632557": [
        {
            "ioc_value": "www.akora.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632558": [
        {
            "ioc_value": "www.alahyamout.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632559": [
        {
            "ioc_value": "www.amakobet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632560": [
        {
            "ioc_value": "www.amilytideshealth.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632561": [
        {
            "ioc_value": "www.ariatrictoilet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632562": [
        {
            "ioc_value": "www.atiotechhub.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632563": [
        {
            "ioc_value": "www.axcivanbank.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-11-03 15:14:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1632484": [
        {
            "ioc_value": "1hi.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 15:10:03",
            "last_seen_utc": "2025-11-03 15:21:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632467": [
        {
            "ioc_value": "gxc.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 15:04:47",
            "last_seen_utc": "2025-11-03 15:12:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632466": [
        {
            "ioc_value": "xr7.g6xt-5n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 15:03:50",
            "last_seen_utc": "2025-11-03 15:21:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632465": [
        {
            "ioc_value": "k9k.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:59:36",
            "last_seen_utc": "2025-11-03 15:03:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632464": [
        {
            "ioc_value": "y6f0.5g-t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:57:25",
            "last_seen_utc": "2025-11-03 15:07:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632463": [
        {
            "ioc_value": "a1.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:48:31",
            "last_seen_utc": "2025-11-03 14:57:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632462": [
        {
            "ioc_value": "a1.g6xt-5n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:44:14",
            "last_seen_utc": "2025-11-03 14:57:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632461": [
        {
            "ioc_value": "m5.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:38:44",
            "last_seen_utc": "2025-11-03 14:44:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632460": [
        {
            "ioc_value": "sog.8786.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:28:22",
            "last_seen_utc": "2025-11-03 14:38:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632459": [
        {
            "ioc_value": "c4w.k8cr-9b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:25:23",
            "last_seen_utc": "2025-11-03 14:38:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632458": [
        {
            "ioc_value": "x2.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:22:23",
            "last_seen_utc": "2025-11-03 14:25:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632455": [
        {
            "ioc_value": "t9rq3.l-ly.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:13:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632454": [
        {
            "ioc_value": "gy9.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:13:07",
            "last_seen_utc": "2025-11-03 14:15:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632451": [
        {
            "ioc_value": "46.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:10:42",
            "last_seen_utc": "2025-11-03 14:13:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632446": [
        {
            "ioc_value": "hp.k8cr-9b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 14:02:25",
            "last_seen_utc": "2025-11-03 14:15:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632445": [
        {
            "ioc_value": "00x.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:57:37",
            "last_seen_utc": "2025-11-03 14:02:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632444": [
        {
            "ioc_value": "8n.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:48:52",
            "last_seen_utc": "2025-11-03 13:54:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632443": [
        {
            "ioc_value": "p2vk.l-ly.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:45:02",
            "last_seen_utc": "2025-11-03 13:54:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632442": [
        {
            "ioc_value": "6c.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:37:57",
            "last_seen_utc": "2025-11-03 13:45:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632441": [
        {
            "ioc_value": "z9t1.k8cr-9b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:36:34",
            "last_seen_utc": "2025-11-03 13:42:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632438": [
        {
            "ioc_value": "2u8.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:28:41",
            "last_seen_utc": "2025-11-03 13:36:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632437": [
        {
            "ioc_value": "h8ny.l-ly.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:26:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632436": [
        {
            "ioc_value": "15.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:20:32",
            "last_seen_utc": "2025-11-03 13:28:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632434": [
        {
            "ioc_value": "v2a.k8cr-9b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:10:39",
            "last_seen_utc": "2025-11-03 13:28:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632433": [
        {
            "ioc_value": "48.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:09:32",
            "last_seen_utc": "2025-11-03 13:10:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632427": [
        {
            "ioc_value": "d4xf.3u-6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 13:03:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632426": [
        {
            "ioc_value": "mk3.k8cr-9b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632425": [
        {
            "ioc_value": "hb.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:59:16",
            "last_seen_utc": "2025-11-03 13:03:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632424": [
        {
            "ioc_value": "gci.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:52:32",
            "last_seen_utc": "2025-11-03 12:59:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632423": [
        {
            "ioc_value": "54.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:45:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632422": [
        {
            "ioc_value": "my.8786.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:35:59",
            "last_seen_utc": "2025-11-03 12:41:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632421": [
        {
            "ioc_value": "r7pj2.3u-6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:32:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632420": [
        {
            "ioc_value": "9j5.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:31:19",
            "last_seen_utc": "2025-11-03 12:32:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632419": [
        {
            "ioc_value": "q7.k8cr-9b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:30:27",
            "last_seen_utc": "2025-11-03 12:41:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1632418": [
        {
            "ioc_value": "cnp.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:22:04",
            "last_seen_utc": "2025-11-03 12:30:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1632245": [
        {
            "ioc_value": "parserapiprocess.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-03 12:09:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631671": [
        {
            "ioc_value": "n4s.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:06:03",
            "last_seen_utc": "2025-11-03 12:13:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631665": [
        {
            "ioc_value": "b3yln.4qo8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 12:01:26",
            "last_seen_utc": "2025-11-03 12:13:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631663": [
        {
            "ioc_value": "agriifeed.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-03 12:00:42",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251103-m7864aer7v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631662": [
        {
            "ioc_value": "a1mz.3u-6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:57:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631661": [
        {
            "ioc_value": "7g.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:51:39",
            "last_seen_utc": "2025-11-03 12:01:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631660": [
        {
            "ioc_value": "s9k2.4qo8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:44:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631659": [
        {
            "ioc_value": "6yi.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:41:44",
            "last_seen_utc": "2025-11-03 11:44:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631658": [
        {
            "ioc_value": "v9q3.3u-6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:36:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631657": [
        {
            "ioc_value": "qki.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:34:45",
            "last_seen_utc": "2025-11-03 11:36:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631656": [
        {
            "ioc_value": "l9.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:28:23",
            "last_seen_utc": "2025-11-03 11:30:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631655": [
        {
            "ioc_value": "w6r0a.4qo8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:22:25",
            "last_seen_utc": "2025-11-03 11:35:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631654": [
        {
            "ioc_value": "n0.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:20:08",
            "last_seen_utc": "2025-11-03 11:22:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631653": [
        {
            "ioc_value": "j2vb.u4-r-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:09:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631652": [
        {
            "ioc_value": "yw0.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:08:19",
            "last_seen_utc": "2025-11-03 11:12:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631646": [
        {
            "ioc_value": "e1tvd.4qo8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 11:00:32",
            "last_seen_utc": "2025-11-03 11:12:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631644": [
        {
            "ioc_value": "ccd.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:58:02",
            "last_seen_utc": "2025-11-03 11:00:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631643": [
        {
            "ioc_value": "n0df5.u4-r-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:54:18",
            "last_seen_utc": "2025-11-03 10:58:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631642": [
        {
            "ioc_value": "vdn.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:53:50",
            "last_seen_utc": "2025-11-03 10:54:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631641": [
        {
            "ioc_value": "p7x3.4qo8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:47:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631640": [
        {
            "ioc_value": "e0s.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:43:58",
            "last_seen_utc": "2025-11-03 10:47:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631639": [
        {
            "ioc_value": "h2m9q.4qo8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:38:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631638": [
        {
            "ioc_value": "c4hx.u4-r-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:38:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631637": [
        {
            "ioc_value": "5nu.8786.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:37:45",
            "last_seen_utc": "2025-11-03 10:38:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631636": [
        {
            "ioc_value": "d4wce.67tf.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:29:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631635": [
        {
            "ioc_value": "17m.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:27:57",
            "last_seen_utc": "2025-11-03 10:29:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631634": [
        {
            "ioc_value": "g8z1.67tf.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631633": [
        {
            "ioc_value": "h9u.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:16:22",
            "last_seen_utc": "2025-11-03 10:18:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631632": [
        {
            "ioc_value": "r6wt2.u4-r-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631631": [
        {
            "ioc_value": "cr.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 10:07:38",
            "last_seen_utc": "2025-11-03 10:09:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631625": [
        {
            "ioc_value": "beastdositadvtofm.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.polaredge",
            "malware_alias": null,
            "malware_printable": "PolarEdge",
            "first_seen_utc": "2025-11-03 10:02:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/smoking-gun-uncovered-rpx-relay-at-polaredges-core-exposed/",
            "tags": "PolarEdge",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1631626": [
        {
            "ioc_value": "missionim.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.polaredge",
            "malware_alias": null,
            "malware_printable": "PolarEdge",
            "first_seen_utc": "2025-11-03 10:02:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/smoking-gun-uncovered-rpx-relay-at-polaredges-core-exposed/",
            "tags": "PolarEdge",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1631624": [
        {
            "ioc_value": "k3.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:57:19",
            "last_seen_utc": "2025-11-03 10:00:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631623": [
        {
            "ioc_value": "a9mj.u4-r-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:53:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631622": [
        {
            "ioc_value": "6rv.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:47:01",
            "last_seen_utc": "2025-11-03 09:53:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631621": [
        {
            "ioc_value": "n5t3a.67tf.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:46:12",
            "last_seen_utc": "2025-11-03 10:00:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631620": [
        {
            "ioc_value": "22k.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:38:12",
            "last_seen_utc": "2025-11-03 09:46:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631619": [
        {
            "ioc_value": "v5qp3.u4-r-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:28:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631618": [
        {
            "ioc_value": "83.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:27:54",
            "last_seen_utc": "2025-11-03 09:31:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631617": [
        {
            "ioc_value": "y0bq9.67tf.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:27:09",
            "last_seen_utc": "2025-11-03 09:31:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631616": [
        {
            "ioc_value": "lj.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:14:03",
            "last_seen_utc": "2025-11-03 09:27:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631615": [
        {
            "ioc_value": "ou.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:07:45",
            "last_seen_utc": "2025-11-03 09:09:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631372": [
        {
            "ioc_value": "bbjj.nageshks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-11-03 09:03:01",
            "last_seen_utc": "2025-11-03 00:01:10",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.130.229.139+bbjj.nageshks.com",
            "tags": "AS-HOSTINGER,AS47583,C2,censys,Hookbot",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1631373": [
        {
            "ioc_value": "www.bakersfieldrealtyinvestment.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-03 09:03:00",
            "last_seen_utc": "2025-11-17 00:04:56",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/86.54.42.94+www.bakersfieldrealtyinvestment.com",
            "tags": "AS42624,C2,censys,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1631374": [
        {
            "ioc_value": "www.mosenego.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-03 09:03:00",
            "last_seen_utc": "2025-11-03 00:01:13",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/193.108.113.14+www.mosenego.ru",
            "tags": "AS48347,C2,censys,MTW-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1631416": [
        {
            "ioc_value": "fofatot.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-03 09:02:59",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1631614": [
        {
            "ioc_value": "r1p6.67tf.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 09:01:28",
            "last_seen_utc": "2025-11-03 09:09:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631610": [
        {
            "ioc_value": "vdx.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:57:57",
            "last_seen_utc": "2025-11-03 09:02:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631609": [
        {
            "ioc_value": "y8kz.u4-r-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:50:46",
            "last_seen_utc": "2025-11-03 09:02:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631598": [
        {
            "ioc_value": "hehua.cookielive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ghost_rat",
            "malware_alias": "Farfli,Gh0st RAT,PCRat",
            "malware_printable": "Ghost RAT",
            "first_seen_utc": "2025-11-03 08:43:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,gh0st",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631597": [
        {
            "ioc_value": "cya.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:40:25",
            "last_seen_utc": "2025-11-03 08:50:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631596": [
        {
            "ioc_value": "v2k7m.67tf.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:38:01",
            "last_seen_utc": "2025-11-03 08:43:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631595": [
        {
            "ioc_value": "v7c.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:35:16",
            "last_seen_utc": "2025-11-03 08:38:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631594": [
        {
            "ioc_value": "c7x0.j-7m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:29:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631593": [
        {
            "ioc_value": "7u.8786.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:27:32",
            "last_seen_utc": "2025-11-03 08:29:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631592": [
        {
            "ioc_value": "qy.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631591": [
        {
            "ioc_value": "b1nr.432b47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:12:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631590": [
        {
            "ioc_value": "m9r2a.j-7m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:12:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631573": [
        {
            "ioc_value": "8p.p8ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 08:07:18",
            "last_seen_utc": "2025-11-03 08:12:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631571": [
        {
            "ioc_value": "de.atlantaoralandfacialsurgery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-11-03 08:05:10",
            "last_seen_utc": "2025-11-03 14:20:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1631549": [
        {
            "ioc_value": "fwi.71o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:54:00",
            "last_seen_utc": "2025-11-03 07:58:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631548": [
        {
            "ioc_value": "nqi.yldv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:47:41",
            "last_seen_utc": "2025-11-03 07:52:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631547": [
        {
            "ioc_value": "t1v8.j-7m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:45:08",
            "last_seen_utc": "2025-11-03 07:58:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631541": [
        {
            "ioc_value": "approved-liability.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-03 07:43:25",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631542": [
        {
            "ioc_value": "idkegobruh-44949.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-03 07:43:25",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631543": [
        {
            "ioc_value": "positive-significantly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-03 07:43:25",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631544": [
        {
            "ioc_value": "song-shepherd.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-03 07:43:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631545": [
        {
            "ioc_value": "Cure2x-54076.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-03 07:43:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631536": [
        {
            "ioc_value": "p3q6y.432b47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:40:38",
            "last_seen_utc": "2025-11-03 07:58:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631534": [
        {
            "ioc_value": "galaxyprojectontop.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-03 07:40:10",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631533": [
        {
            "ioc_value": "nigganazi61-42359.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-11-03 07:39:58",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631532": [
        {
            "ioc_value": "sophos1997.camdvr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-03 07:39:45",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631530": [
        {
            "ioc_value": "v3.darktide.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-03 07:39:30",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631531": [
        {
            "ioc_value": "v3.xoilaczzzhz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-03 07:39:30",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631523": [
        {
            "ioc_value": "medellin12345.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-03 07:39:29",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631524": [
        {
            "ioc_value": "v2.8services2point0.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-03 07:39:29",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631525": [
        {
            "ioc_value": "v2.antiracistusa.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-03 07:39:29",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631526": [
        {
            "ioc_value": "v2.darktide.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-03 07:39:29",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631527": [
        {
            "ioc_value": "v2.xoilaczzzhz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-03 07:39:29",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631528": [
        {
            "ioc_value": "v3.8services2point0.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-03 07:39:29",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631529": [
        {
            "ioc_value": "v3.antiracistusa.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-03 07:39:29",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631521": [
        {
            "ioc_value": "caiunofake.ddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-11-03 07:38:51",
            "last_seen_utc": "2025-11-07 12:55:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631513": [
        {
            "ioc_value": "8services2point0.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-03 07:37:57",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631514": [
        {
            "ioc_value": "caiunotrojan.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-03 07:37:57",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631515": [
        {
            "ioc_value": "darktide.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-03 07:37:57",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631516": [
        {
            "ioc_value": "gatex.antiracistusa.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-03 07:37:57",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631517": [
        {
            "ioc_value": "gatex.xoilaczzzhz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-03 07:37:57",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631518": [
        {
            "ioc_value": "nopirate1990.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-03 07:37:57",
            "last_seen_utc": "2025-11-09 12:07:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1631512": [
        {
            "ioc_value": "fr.ha0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:37:37",
            "last_seen_utc": "2025-11-03 07:45:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631504": [
        {
            "ioc_value": "mcz.g7ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:34:28",
            "last_seen_utc": "2025-11-03 07:36:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631500": [
        {
            "ioc_value": "k4.si9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:27:46",
            "last_seen_utc": "2025-11-03 07:30:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631499": [
        {
            "ioc_value": "k4p9q.j-7m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:24:19",
            "last_seen_utc": "2025-11-03 07:36:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631498": [
        {
            "ioc_value": "lm.to1j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:19:55",
            "last_seen_utc": "2025-11-03 07:26:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631497": [
        {
            "ioc_value": "t9jw4.432b47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:16:25",
            "last_seen_utc": "2025-11-03 07:26:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631495": [
        {
            "ioc_value": "axm.mjg1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:07:18",
            "last_seen_utc": "2025-11-03 07:16:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631475": [
        {
            "ioc_value": "1zs.yu5k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 07:01:29",
            "last_seen_utc": "2025-11-03 07:02:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631470": [
        {
            "ioc_value": "r0yg.0fv1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:58:52",
            "last_seen_utc": "2025-11-03 07:02:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631469": [
        {
            "ioc_value": "0kd.no4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:55:18",
            "last_seen_utc": "2025-11-03 06:58:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631468": [
        {
            "ioc_value": "f0v2.432b47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:52:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631467": [
        {
            "ioc_value": "2d4.1r55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:47:02",
            "last_seen_utc": "2025-11-03 06:52:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631466": [
        {
            "ioc_value": "tbd9.0fv1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:42:20",
            "last_seen_utc": "2025-11-03 06:48:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631465": [
        {
            "ioc_value": "wp.8786.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:37:17",
            "last_seen_utc": "2025-11-03 06:42:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631464": [
        {
            "ioc_value": "m5x8r.432b47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:33:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631463": [
        {
            "ioc_value": "z83n.0fv1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:29:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631462": [
        {
            "ioc_value": "0k.5x7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:27:51",
            "last_seen_utc": "2025-11-03 06:33:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631461": [
        {
            "ioc_value": "rl.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:08:54",
            "last_seen_utc": "2025-11-03 06:15:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631460": [
        {
            "ioc_value": "v1kpa.0fv1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:06:48",
            "last_seen_utc": "2025-11-03 06:15:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631459": [
        {
            "ioc_value": "q7dz.432b47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:06:47",
            "last_seen_utc": "2025-11-03 06:15:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631458": [
        {
            "ioc_value": "sd.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 06:04:43",
            "last_seen_utc": "2025-11-03 06:06:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631457": [
        {
            "ioc_value": "anyone-recover.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-03 06:01:14",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 100,
            "reference": "https://tria.ge/251103-d3el9avncz",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631455": [
        {
            "ioc_value": "until-slope.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-03 06:00:46",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251103-asb7layndp",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631453": [
        {
            "ioc_value": "minecraftmemesmp-55927.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-03 06:00:44",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251103-a3bc2sdn71",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631452": [
        {
            "ioc_value": "h2pk3.432b47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 05:40:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631451": [
        {
            "ioc_value": "q7m2x.0fv1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 05:33:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631450": [
        {
            "ioc_value": "ob1.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 05:19:30",
            "last_seen_utc": "2025-11-03 05:40:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631448": [
        {
            "ioc_value": "e2kj.ru7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 04:11:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631447": [
        {
            "ioc_value": "t7.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 04:09:35",
            "last_seen_utc": "2025-11-03 04:11:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631433": [
        {
            "ioc_value": "byv.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 04:01:11",
            "last_seen_utc": "2025-11-03 04:03:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631430": [
        {
            "ioc_value": "p8ny.ru7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 03:59:07",
            "last_seen_utc": "2025-11-03 04:03:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631429": [
        {
            "ioc_value": "0ma.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 03:43:18",
            "last_seen_utc": "2025-11-03 03:59:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631428": [
        {
            "ioc_value": "ab.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 03:25:43",
            "last_seen_utc": "2025-11-03 03:32:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631427": [
        {
            "ioc_value": "3g.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 03:21:07",
            "last_seen_utc": "2025-11-03 03:23:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631426": [
        {
            "ioc_value": "h4v7.ru7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 03:20:14",
            "last_seen_utc": "2025-11-03 03:32:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631425": [
        {
            "ioc_value": "atd.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 03:14:54",
            "last_seen_utc": "2025-11-03 03:20:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631423": [
        {
            "ioc_value": "n00.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 03:07:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631422": [
        {
            "ioc_value": "q6k.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 02:57:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631421": [
        {
            "ioc_value": "5u2.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 02:49:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631420": [
        {
            "ioc_value": "byf.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 02:43:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631419": [
        {
            "ioc_value": "m1ct.ru7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 02:39:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631418": [
        {
            "ioc_value": "bg.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 02:37:09",
            "last_seen_utc": "2025-11-03 02:39:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631417": [
        {
            "ioc_value": "q4p.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 02:22:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631414": [
        {
            "ioc_value": "xi.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 02:09:48",
            "last_seen_utc": "2025-11-03 02:09:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631413": [
        {
            "ioc_value": "j8wz.xa9t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 02:05:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631412": [
        {
            "ioc_value": "ii.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:58:58",
            "last_seen_utc": "2025-11-03 02:05:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631411": [
        {
            "ioc_value": "l2hq.xa9t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:49:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631410": [
        {
            "ioc_value": "sbx.op76.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:49:02",
            "last_seen_utc": "2025-11-03 01:49:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631409": [
        {
            "ioc_value": "hr.crju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:43:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631408": [
        {
            "ioc_value": "xe.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:37:37",
            "last_seen_utc": "2025-11-03 01:37:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631407": [
        {
            "ioc_value": "vp.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:27:43",
            "last_seen_utc": "2025-11-03 01:29:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631406": [
        {
            "ioc_value": "s4ym.xa9t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:23:18",
            "last_seen_utc": "2025-11-03 01:37:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631405": [
        {
            "ioc_value": "t5h.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:19:18",
            "last_seen_utc": "2025-11-03 01:23:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631404": [
        {
            "ioc_value": "vef.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:09:30",
            "last_seen_utc": "2025-11-03 01:10:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631403": [
        {
            "ioc_value": "o11.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:07:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631402": [
        {
            "ioc_value": "q7xpa.si9a.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 01:03:43",
            "last_seen_utc": "2025-11-03 01:10:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631401": [
        {
            "ioc_value": "qa.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:57:00",
            "last_seen_utc": "2025-11-03 01:03:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631400": [
        {
            "ioc_value": "m4t9.si9a.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:48:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631399": [
        {
            "ioc_value": "kfy.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:46:08",
            "last_seen_utc": "2025-11-03 00:48:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631398": [
        {
            "ioc_value": "b0zq.si9a.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:39:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631397": [
        {
            "ioc_value": "uvd.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:38:09",
            "last_seen_utc": "2025-11-03 00:44:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631396": [
        {
            "ioc_value": "x5wk.ve1p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:30:23",
            "last_seen_utc": "2025-11-03 00:44:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631395": [
        {
            "ioc_value": "fx.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:24:49",
            "last_seen_utc": "2025-11-03 00:30:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631394": [
        {
            "ioc_value": "w1c8.si9a.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:14:33",
            "last_seen_utc": "2025-11-03 00:26:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631393": [
        {
            "ioc_value": "gw3.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:07:54",
            "last_seen_utc": "2025-11-03 00:14:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631392": [
        {
            "ioc_value": "n6ta.ve1p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-03 00:02:59",
            "last_seen_utc": "2025-11-03 00:08:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631385": [
        {
            "ioc_value": "e3h7n.si9a.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:55:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631384": [
        {
            "ioc_value": "jk.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:51:27",
            "last_seen_utc": "2025-11-03 00:02:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631383": [
        {
            "ioc_value": "b3x8.ve1p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:43:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631382": [
        {
            "ioc_value": "jqp.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:31:30",
            "last_seen_utc": "2025-11-02 23:43:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631381": [
        {
            "ioc_value": "94f.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:27:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631380": [
        {
            "ioc_value": "f9r2.ve1p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:23:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631379": [
        {
            "ioc_value": "k9pwa.ha0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:22:50",
            "last_seen_utc": "2025-11-02 23:32:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631378": [
        {
            "ioc_value": "iso.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:20:18",
            "last_seen_utc": "2025-11-02 23:23:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631377": [
        {
            "ioc_value": "t6y3.ha0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:08:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631376": [
        {
            "ioc_value": "wzu.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 23:07:09",
            "last_seen_utc": "2025-11-02 23:08:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631366": [
        {
            "ioc_value": "xb.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:57:54",
            "last_seen_utc": "2025-11-02 23:04:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631365": [
        {
            "ioc_value": "z0tb.ha0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:54:36",
            "last_seen_utc": "2025-11-02 23:04:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631364": [
        {
            "ioc_value": "jq.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:50:00",
            "last_seen_utc": "2025-11-02 22:54:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631363": [
        {
            "ioc_value": "q7je.ve1p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:49:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631360": [
        {
            "ioc_value": "ent.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:34:27",
            "last_seen_utc": "2025-11-02 22:50:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631359": [
        {
            "ioc_value": "r1m8q.ha0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:28:29",
            "last_seen_utc": "2025-11-02 22:36:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631358": [
        {
            "ioc_value": "9ht.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:20:35",
            "last_seen_utc": "2025-11-02 22:28:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631357": [
        {
            "ioc_value": "c5n3.m2la.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:15:38",
            "last_seen_utc": "2025-11-02 22:21:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631356": [
        {
            "ioc_value": "v2k7.ha0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:06:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631355": [
        {
            "ioc_value": "lj.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 22:04:42",
            "last_seen_utc": "2025-11-02 22:15:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631354": [
        {
            "ioc_value": "o9.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 21:57:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631353": [
        {
            "ioc_value": "uvu.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 21:46:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631352": [
        {
            "ioc_value": "p6dv.m2la.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 21:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631351": [
        {
            "ioc_value": "x7m.op76.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 21:38:11",
            "last_seen_utc": "2025-11-02 21:46:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631350": [
        {
            "ioc_value": "ew3.crju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 21:23:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631349": [
        {
            "ioc_value": "53.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 21:19:54",
            "last_seen_utc": "2025-11-02 21:22:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631348": [
        {
            "ioc_value": "z1wb.m2la.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 21:18:11",
            "last_seen_utc": "2025-11-02 21:22:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631347": [
        {
            "ioc_value": "vc.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 21:07:47",
            "last_seen_utc": "2025-11-02 21:18:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631346": [
        {
            "ioc_value": "t3xq.m2la.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 21:00:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631345": [
        {
            "ioc_value": "ivs.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:57:30",
            "last_seen_utc": "2025-11-02 21:00:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631344": [
        {
            "ioc_value": "rd7.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:49:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631343": [
        {
            "ioc_value": "a8vd.no4s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:39:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631342": [
        {
            "ioc_value": "ph.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:39:18",
            "last_seen_utc": "2025-11-02 20:40:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631341": [
        {
            "ioc_value": "e9rm2.9-88.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:36:33",
            "last_seen_utc": "2025-11-02 20:40:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631340": [
        {
            "ioc_value": "de7.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:35:06",
            "last_seen_utc": "2025-11-02 20:36:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631339": [
        {
            "ioc_value": "kzg.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:27:14",
            "last_seen_utc": "2025-11-02 20:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631338": [
        {
            "ioc_value": "n3qla.no4s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:21:43",
            "last_seen_utc": "2025-11-02 20:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631337": [
        {
            "ioc_value": "a3.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:19:54",
            "last_seen_utc": "2025-11-02 20:21:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631335": [
        {
            "ioc_value": "91u.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:07:03",
            "last_seen_utc": "2025-11-02 20:09:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631334": [
        {
            "ioc_value": "g5t9.no4s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 20:00:54",
            "last_seen_utc": "2025-11-02 20:09:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631330": [
        {
            "ioc_value": "rl1.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:57:40",
            "last_seen_utc": "2025-11-02 20:00:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631329": [
        {
            "ioc_value": "u4j9.9-88.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:55:16",
            "last_seen_utc": "2025-11-02 20:09:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631328": [
        {
            "ioc_value": "10f.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:49:42",
            "last_seen_utc": "2025-11-02 19:55:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631327": [
        {
            "ioc_value": "y0s3n.no4s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:48:50",
            "last_seen_utc": "2025-11-02 19:54:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631326": [
        {
            "ioc_value": "a7ny.9-88.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:41:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631325": [
        {
            "ioc_value": "obi.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:40:45",
            "last_seen_utc": "2025-11-02 19:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631324": [
        {
            "ioc_value": "k2hf.9-88.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631321": [
        {
            "ioc_value": "oz.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:28:39",
            "last_seen_utc": "2025-11-02 19:32:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631320": [
        {
            "ioc_value": "h2w8.no4s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631319": [
        {
            "ioc_value": "80n.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:19:23",
            "last_seen_utc": "2025-11-02 19:25:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631318": [
        {
            "ioc_value": "p3kqa.q3lo.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:15:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631317": [
        {
            "ioc_value": "gd.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:08:04",
            "last_seen_utc": "2025-11-02 19:15:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631316": [
        {
            "ioc_value": "u4r9.q3lo.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 19:01:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631315": [
        {
            "ioc_value": "a9.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:57:08",
            "last_seen_utc": "2025-11-02 19:01:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631314": [
        {
            "ioc_value": "mcb.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:53:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631312": [
        {
            "ioc_value": "d7m0.q3lo.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:46:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631311": [
        {
            "ioc_value": "1n.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:44:10",
            "last_seen_utc": "2025-11-02 18:46:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631309": [
        {
            "ioc_value": "2ro.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:37:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631307": [
        {
            "ioc_value": "dd.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:28:11",
            "last_seen_utc": "2025-11-02 18:32:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631306": [
        {
            "ioc_value": "x1zpn.q3lo.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:25:27",
            "last_seen_utc": "2025-11-02 18:32:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631305": [
        {
            "ioc_value": "g5zx.9-88.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:19:59",
            "last_seen_utc": "2025-11-02 18:28:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631304": [
        {
            "ioc_value": "u7.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:19:46",
            "last_seen_utc": "2025-11-02 18:25:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631303": [
        {
            "ioc_value": "arkanix.pw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-11-02 18:13:45",
            "last_seen_utc": "2025-11-19 08:33:30",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/113ec872de39f8bd15e8565b8313d4b907f7e4c5529887a884110dbc3524eb83",
            "tags": "ArkanixStealer,c2,domain,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631302": [
        {
            "ioc_value": "nf.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 18:07:53",
            "last_seen_utc": "2025-11-02 18:09:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631301": [
        {
            "ioc_value": "below-artificial.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-11-02 18:02:34",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-vyw46sct3h",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631298": [
        {
            "ioc_value": "99898nffa.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-02 18:00:45",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-pvcnga1lcy",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631297": [
        {
            "ioc_value": "hair-gale.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-02 18:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-rkrezs1nbv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631295": [
        {
            "ioc_value": "pop-experimental.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-02 18:00:35",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-s67jrsar8t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631293": [
        {
            "ioc_value": "virtual-conjunction.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-02 18:00:34",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-t1dj6sb12b",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631294": [
        {
            "ioc_value": "cash-mae.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-02 18:00:34",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-tw2ffabj7x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631292": [
        {
            "ioc_value": "cash-clearly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-02 18:00:33",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-t2mjgabk2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631290": [
        {
            "ioc_value": "y3kx.j935.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:57:36",
            "last_seen_utc": "2025-11-02 18:09:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631289": [
        {
            "ioc_value": "8b.op76.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:57:22",
            "last_seen_utc": "2025-11-02 18:06:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631288": [
        {
            "ioc_value": "c8v2.q3lo.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:52:07",
            "last_seen_utc": "2025-11-02 18:08:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631287": [
        {
            "ioc_value": "a0.crju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:49:34",
            "last_seen_utc": "2025-11-02 17:52:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631286": [
        {
            "ioc_value": "anunnbj.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 17:41:40",
            "last_seen_utc": "2025-11-16 15:16:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631284": [
        {
            "ioc_value": "pressot.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 17:41:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631285": [
        {
            "ioc_value": "affairu.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 17:41:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631283": [
        {
            "ioc_value": "comtedo.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 17:41:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631282": [
        {
            "ioc_value": "w1v9.j935.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:37:29",
            "last_seen_utc": "2025-11-02 17:51:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631281": [
        {
            "ioc_value": "xo.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:37:25",
            "last_seen_utc": "2025-11-02 17:39:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631280": [
        {
            "ioc_value": "r5yd.b6je.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:28:27",
            "last_seen_utc": "2025-11-02 17:39:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631279": [
        {
            "ioc_value": "bz.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:23:58",
            "last_seen_utc": "2025-11-02 17:28:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631277": [
        {
            "ioc_value": "d4.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:19:14",
            "last_seen_utc": "2025-11-02 17:24:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631276": [
        {
            "ioc_value": "m9qla.b6je.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:06:10",
            "last_seen_utc": "2025-11-02 17:24:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631275": [
        {
            "ioc_value": "j68.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 17:04:52",
            "last_seen_utc": "2025-11-02 17:11:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631274": [
        {
            "ioc_value": "b4tr.j935.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:59:04",
            "last_seen_utc": "2025-11-02 17:03:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631273": [
        {
            "ioc_value": "iq.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:56:47",
            "last_seen_utc": "2025-11-02 17:06:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631268": [
        {
            "ioc_value": "ki.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:47:59",
            "last_seen_utc": "2025-11-02 16:49:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631267": [
        {
            "ioc_value": "t0k3.b6je.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:41:16",
            "last_seen_utc": "2025-11-02 16:49:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631266": [
        {
            "ioc_value": "cjq.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:37:38",
            "last_seen_utc": "2025-11-02 16:41:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631265": [
        {
            "ioc_value": "z6n4.b6je.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:29:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631264": [
        {
            "ioc_value": "gg6.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:26:28",
            "last_seen_utc": "2025-11-02 16:29:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631263": [
        {
            "ioc_value": "d6qa.j935.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:25:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631262": [
        {
            "ioc_value": "dqb.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:18:41",
            "last_seen_utc": "2025-11-02 16:25:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631261": [
        {
            "ioc_value": "j1p7q.b6je.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:09:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631258": [
        {
            "ioc_value": "rw.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 16:07:24",
            "last_seen_utc": "2025-11-02 16:09:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631254": [
        {
            "ioc_value": "www.srv1061577.hstgr.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-11-02 16:00:57",
            "last_seen_utc": "2025-11-02 23:00:23",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/168.231.116.237+www.srv1061577.hstgr.cloud",
            "tags": "AS-HOSTINGER,AS47583,C2,censys,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631252": [
        {
            "ioc_value": "b3x9.h-3t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:57:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631251": [
        {
            "ioc_value": "fs.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:53:23",
            "last_seen_utc": "2025-11-02 15:57:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631250": [
        {
            "ioc_value": "m9p.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:36:38",
            "last_seen_utc": "2025-11-02 15:39:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631249": [
        {
            "ioc_value": "e9tva.h-3t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:34:53",
            "last_seen_utc": "2025-11-02 15:39:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631248": [
        {
            "ioc_value": "6a.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:27:33",
            "last_seen_utc": "2025-11-02 15:34:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631247": [
        {
            "ioc_value": "j5aw9.9r3s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:20:49",
            "last_seen_utc": "2025-11-02 15:38:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631246": [
        {
            "ioc_value": "ng.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:19:46",
            "last_seen_utc": "2025-11-02 15:20:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631245": [
        {
            "ioc_value": "w7r0.h-3t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:13:09",
            "last_seen_utc": "2025-11-02 15:20:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631244": [
        {
            "ioc_value": "h3l8.9r3s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:09:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631243": [
        {
            "ioc_value": "2on.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 15:07:44",
            "last_seen_utc": "2025-11-02 15:13:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631242": [
        {
            "ioc_value": "y1.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:58:13",
            "last_seen_utc": "2025-11-02 15:03:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631241": [
        {
            "ioc_value": "tc.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:50:29",
            "last_seen_utc": "2025-11-02 14:50:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630998": [
        {
            "ioc_value": "login.relatec.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-02 14:47:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/51.81.210.203+login.relatec.it.com",
            "tags": "AS16276,C2,censys,Mythic,OVH",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1631001": [
        {
            "ioc_value": "ccpwnews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-11-02 14:47:23",
            "last_seen_utc": "2025-11-02 00:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/108.181.115.242+ccpwnews.com",
            "tags": "AS40676,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1631054": [
        {
            "ioc_value": "check-here.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.moobot",
            "malware_alias": null,
            "malware_printable": "MooBot",
            "first_seen_utc": "2025-11-02 14:47:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "Moobot",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1631239": [
        {
            "ioc_value": "n0fp.9r3s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:44:56",
            "last_seen_utc": "2025-11-02 14:50:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631238": [
        {
            "ioc_value": "s2q1n.h-3t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:40:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631237": [
        {
            "ioc_value": "py.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:33:34",
            "last_seen_utc": "2025-11-02 14:44:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631236": [
        {
            "ioc_value": "k4m8.h-3t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:26:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631234": [
        {
            "ioc_value": "r4yq.9r3s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:25:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631231": [
        {
            "ioc_value": "qb.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:20:22",
            "last_seen_utc": "2025-11-02 14:26:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631229": [
        {
            "ioc_value": "n6tr.139z.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:10:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631224": [
        {
            "ioc_value": "2iw.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 14:08:22",
            "last_seen_utc": "2025-11-02 14:10:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631212": [
        {
            "ioc_value": "pozsonz.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:54",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631213": [
        {
            "ioc_value": "loadupm.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:54",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631204": [
        {
            "ioc_value": "scapev.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:53",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631205": [
        {
            "ioc_value": "genusal.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:53",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631206": [
        {
            "ioc_value": "grownuc.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:53",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631207": [
        {
            "ioc_value": "secondp.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:53",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631208": [
        {
            "ioc_value": "backchv.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:53",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631209": [
        {
            "ioc_value": "manualc.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:53",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631210": [
        {
            "ioc_value": "feathej.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:53",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631211": [
        {
            "ioc_value": "genuslu.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:53",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631198": [
        {
            "ioc_value": "cadujb.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:52",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631199": [
        {
            "ioc_value": "extermz.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:52",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631200": [
        {
            "ioc_value": "newmadp.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:52",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631201": [
        {
            "ioc_value": "mexicaq.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:52",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631202": [
        {
            "ioc_value": "lethali.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:52",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631203": [
        {
            "ioc_value": "penstjn.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-11-02 14:01:52",
            "last_seen_utc": "2025-11-16 15:16:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631196": [
        {
            "ioc_value": "g0sqa.139z.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 13:58:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631195": [
        {
            "ioc_value": "17.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 13:56:45",
            "last_seen_utc": "2025-11-02 13:58:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631194": [
        {
            "ioc_value": "mm.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 13:44:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631193": [
        {
            "ioc_value": "u0.op76.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 13:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631192": [
        {
            "ioc_value": "0n.crju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 13:21:08",
            "last_seen_utc": "2025-11-02 13:21:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631191": [
        {
            "ioc_value": "q1me4.yw9a.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 13:15:29",
            "last_seen_utc": "2025-11-02 13:21:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631190": [
        {
            "ioc_value": "nn.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 13:04:12",
            "last_seen_utc": "2025-11-02 13:15:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631189": [
        {
            "ioc_value": "v3d7.yw9a.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 13:01:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631188": [
        {
            "ioc_value": "amo.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 12:57:00",
            "last_seen_utc": "2025-11-02 13:01:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631187": [
        {
            "ioc_value": "ygz.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 12:49:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631186": [
        {
            "ioc_value": "p9kr.yw9a.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 12:39:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631185": [
        {
            "ioc_value": "s1l.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 12:38:10",
            "last_seen_utc": "2025-11-02 12:39:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631184": [
        {
            "ioc_value": "eo.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 12:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631183": [
        {
            "ioc_value": "f2x8m.yw9a.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 12:24:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631182": [
        {
            "ioc_value": "lz.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 12:18:58",
            "last_seen_utc": "2025-11-02 12:24:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631181": [
        {
            "ioc_value": "42.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 12:07:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631180": [
        {
            "ioc_value": "p3q.6x-3z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 12:03:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631176": [
        {
            "ioc_value": "administration-montreal.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-02 12:00:25",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-m2jn9ahq7t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631174": [
        {
            "ioc_value": "20.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:58:06",
            "last_seen_utc": "2025-11-02 12:03:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631173": [
        {
            "ioc_value": "c0.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:48:20",
            "last_seen_utc": "2025-11-02 11:52:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631172": [
        {
            "ioc_value": "k7v1.6x-3z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:47:54",
            "last_seen_utc": "2025-11-02 11:52:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631171": [
        {
            "ioc_value": "2x7.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:37:03",
            "last_seen_utc": "2025-11-02 11:47:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631170": [
        {
            "ioc_value": "u0b9.6x-3z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:30:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631169": [
        {
            "ioc_value": "pf4.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:28:11",
            "last_seen_utc": "2025-11-02 11:30:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631168": [
        {
            "ioc_value": "g4m.6x-3z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631167": [
        {
            "ioc_value": "4p2.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:17:51",
            "last_seen_utc": "2025-11-02 11:18:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631166": [
        {
            "ioc_value": "y9bm.139z.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:08:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631165": [
        {
            "ioc_value": "9yg.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 11:07:35",
            "last_seen_utc": "2025-11-02 11:08:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631158": [
        {
            "ioc_value": "a3vnt.139z.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631157": [
        {
            "ioc_value": "u1.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:57:45",
            "last_seen_utc": "2025-11-02 10:59:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631156": [
        {
            "ioc_value": "pzk6.139z.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:49:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631155": [
        {
            "ioc_value": "xc.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:47:20",
            "last_seen_utc": "2025-11-02 10:49:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631154": [
        {
            "ioc_value": "n.k-8ip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:40:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631153": [
        {
            "ioc_value": "7t.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:39:37",
            "last_seen_utc": "2025-11-02 10:40:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631152": [
        {
            "ioc_value": "c0z7.k-8ip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631151": [
        {
            "ioc_value": "8v.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:27:22",
            "last_seen_utc": "2025-11-02 10:29:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631150": [
        {
            "ioc_value": "wy.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:18:35",
            "last_seen_utc": "2025-11-02 10:20:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631149": [
        {
            "ioc_value": "h4qpn.v4-z.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:11:45",
            "last_seen_utc": "2025-11-02 10:20:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631147": [
        {
            "ioc_value": "sw.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 10:07:08",
            "last_seen_utc": "2025-11-02 10:11:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631146": [
        {
            "ioc_value": "s1.k-8ip.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:57:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631145": [
        {
            "ioc_value": "gle.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:56:45",
            "last_seen_utc": "2025-11-02 09:57:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631144": [
        {
            "ioc_value": "7c7.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:48:00",
            "last_seen_utc": "2025-11-02 09:52:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631143": [
        {
            "ioc_value": "c9la.v4-z.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:44:07",
            "last_seen_utc": "2025-11-02 09:57:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631142": [
        {
            "ioc_value": "8s.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:37:44",
            "last_seen_utc": "2025-11-02 09:44:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631141": [
        {
            "ioc_value": "m5we2.v4-z.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631140": [
        {
            "ioc_value": "tp.op76.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:27:27",
            "last_seen_utc": "2025-11-02 09:29:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631139": [
        {
            "ioc_value": "q.tgmop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631138": [
        {
            "ioc_value": "60.crju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:17:38",
            "last_seen_utc": "2025-11-02 09:21:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631137": [
        {
            "ioc_value": "h0w4.98g-bj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:17:24",
            "last_seen_utc": "2025-11-02 09:21:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631136": [
        {
            "ioc_value": "dl.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 09:07:22",
            "last_seen_utc": "2025-11-02 09:17:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631135": [
        {
            "ioc_value": "2fr.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:57:06",
            "last_seen_utc": "2025-11-02 08:57:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631134": [
        {
            "ioc_value": "k2w0.tgmop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:52:43",
            "last_seen_utc": "2025-11-02 08:57:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631133": [
        {
            "ioc_value": "g2x7m.98g-bj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:52:13",
            "last_seen_utc": "2025-11-02 08:57:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631132": [
        {
            "ioc_value": "bo.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:47:20",
            "last_seen_utc": "2025-11-02 08:52:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631130": [
        {
            "ioc_value": "a3z.tgmop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631129": [
        {
            "ioc_value": "mde.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:38:04",
            "last_seen_utc": "2025-11-02 08:44:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631128": [
        {
            "ioc_value": "n5rqa.98g-bj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:30:30",
            "last_seen_utc": "2025-11-02 08:40:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631127": [
        {
            "ioc_value": "sh.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:27:43",
            "last_seen_utc": "2025-11-02 08:30:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631126": [
        {
            "ioc_value": "88.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631125": [
        {
            "ioc_value": "v0g.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 08:07:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631121": [
        {
            "ioc_value": "6n.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:57:49",
            "last_seen_utc": "2025-11-02 08:03:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631120": [
        {
            "ioc_value": "y9t3.98g-bj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:51:12",
            "last_seen_utc": "2025-11-02 08:03:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631119": [
        {
            "ioc_value": "b0.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:47:33",
            "last_seen_utc": "2025-11-02 07:51:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631118": [
        {
            "ioc_value": "b3m.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:37:13",
            "last_seen_utc": "2025-11-02 07:38:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631117": [
        {
            "ioc_value": "jjl.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:27:24",
            "last_seen_utc": "2025-11-02 07:27:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631116": [
        {
            "ioc_value": "m4n.89atr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:23:38",
            "last_seen_utc": "2025-11-02 07:27:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631115": [
        {
            "ioc_value": "c1pze.98g-bj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:21:12",
            "last_seen_utc": "2025-11-02 07:38:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631114": [
        {
            "ioc_value": "m5n.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:18:11",
            "last_seen_utc": "2025-11-02 07:23:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631113": [
        {
            "ioc_value": "zq1.89atr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:11:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631112": [
        {
            "ioc_value": "m4ny.p0k61h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:09:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631111": [
        {
            "ioc_value": "t0.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 07:08:56",
            "last_seen_utc": "2025-11-02 07:11:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631110": [
        {
            "ioc_value": "hi.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:58:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631109": [
        {
            "ioc_value": "t5bx0.p0k61h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:51:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631107": [
        {
            "ioc_value": "p6.89atr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:47:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631108": [
        {
            "ioc_value": "v0s.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:47:51",
            "last_seen_utc": "2025-11-02 06:51:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631106": [
        {
            "ioc_value": "z8r1d.p0k61h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:39:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631105": [
        {
            "ioc_value": "v7.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:37:35",
            "last_seen_utc": "2025-11-02 06:47:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631104": [
        {
            "ioc_value": "h2k.4-4gy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:32:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631103": [
        {
            "ioc_value": "3ch.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:28:26",
            "last_seen_utc": "2025-11-02 06:32:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631102": [
        {
            "ioc_value": "v2k9.p0k61h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:18:49",
            "last_seen_utc": "2025-11-02 06:29:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631101": [
        {
            "ioc_value": "dn.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:17:34",
            "last_seen_utc": "2025-11-02 06:18:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631100": [
        {
            "ioc_value": "1kl.xa9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:07:17",
            "last_seen_utc": "2025-11-02 06:11:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631099": [
        {
            "ioc_value": "q7m3a.p0k61h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 06:03:30",
            "last_seen_utc": "2025-11-02 06:11:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631098": [
        {
            "ioc_value": "based-ratios.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-02 06:00:31",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-apv6asgz3b",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631095": [
        {
            "ioc_value": "hosting-concepts.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-02 06:00:29",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-djtbaszjev",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631096": [
        {
            "ioc_value": "park-cayman.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-02 06:00:29",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251102-ctm2layrht",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1631094": [
        {
            "ioc_value": "uq.zo6r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 05:59:34",
            "last_seen_utc": "2025-11-02 06:03:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631093": [
        {
            "ioc_value": "8ls.1z57.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 05:48:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631092": [
        {
            "ioc_value": "ak.1yjp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 05:38:10",
            "last_seen_utc": "2025-11-02 05:45:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631091": [
        {
            "ioc_value": "t0y6.op-76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 05:32:05",
            "last_seen_utc": "2025-11-02 05:45:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631090": [
        {
            "ioc_value": "ttz.op76.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 05:27:43",
            "last_seen_utc": "2025-11-02 05:32:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631089": [
        {
            "ioc_value": "qh.crju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 05:18:58",
            "last_seen_utc": "2025-11-02 05:25:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631088": [
        {
            "ioc_value": "e9n4k.op-76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 05:18:21",
            "last_seen_utc": "2025-11-02 05:25:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631087": [
        {
            "ioc_value": "v2q.y8-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 05:14:46",
            "last_seen_utc": "2025-11-02 05:18:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631086": [
        {
            "ioc_value": "m2q8.op-76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 04:48:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631085": [
        {
            "ioc_value": "q2.5-rt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 04:33:19",
            "last_seen_utc": "2025-11-02 04:48:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631084": [
        {
            "ioc_value": "0w.da5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 04:08:18",
            "last_seen_utc": "2025-11-02 04:08:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631078": [
        {
            "ioc_value": "a5w9t.op-76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 04:00:54",
            "last_seen_utc": "2025-11-02 04:08:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631073": [
        {
            "ioc_value": "u5.ve1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 03:57:57",
            "last_seen_utc": "2025-11-02 04:00:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631072": [
        {
            "ioc_value": "0k.18yk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 03:41:57",
            "last_seen_utc": "2025-11-02 03:44:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631071": [
        {
            "ioc_value": "z3h1.op-76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 03:30:57",
            "last_seen_utc": "2025-11-02 03:44:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631070": [
        {
            "ioc_value": "k7yb.1yjp.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 03:28:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631069": [
        {
            "ioc_value": "ih.fe9v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 03:23:45",
            "last_seen_utc": "2025-11-02 03:30:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631068": [
        {
            "ioc_value": "v2l.be3q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 03:07:21",
            "last_seen_utc": "2025-11-02 03:12:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631067": [
        {
            "ioc_value": "x0t5n.8786.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 03:05:15",
            "last_seen_utc": "2025-11-02 03:12:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631066": [
        {
            "ioc_value": "s11.3-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:58:14",
            "last_seen_utc": "2025-11-02 03:05:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631064": [
        {
            "ioc_value": "0h.ru7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:48:18",
            "last_seen_utc": "2025-11-02 02:53:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631063": [
        {
            "ioc_value": "v1q0.1yjp.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:45:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631062": [
        {
            "ioc_value": "q8x.q3lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:38:00",
            "last_seen_utc": "2025-11-02 02:45:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631061": [
        {
            "ioc_value": "w8j3.8786.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:36:07",
            "last_seen_utc": "2025-11-02 02:53:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631060": [
        {
            "ioc_value": "3r7.77-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:33:51",
            "last_seen_utc": "2025-11-02 02:36:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631059": [
        {
            "ioc_value": "zny.wi7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:28:10",
            "last_seen_utc": "2025-11-02 02:29:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631058": [
        {
            "ioc_value": "k1s7.8786.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:21:35",
            "last_seen_utc": "2025-11-02 02:29:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631057": [
        {
            "ioc_value": "g6u.m2la.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:19:45",
            "last_seen_utc": "2025-11-02 02:21:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631056": [
        {
            "ioc_value": "6c.e-dx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:07:47",
            "last_seen_utc": "2025-11-02 02:09:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631055": [
        {
            "ioc_value": "t2kc.1yjp.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 02:06:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631052": [
        {
            "ioc_value": "d4m9q.8786.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:58:53",
            "last_seen_utc": "2025-11-02 02:09:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631051": [
        {
            "ioc_value": "cqi.ki8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:57:31",
            "last_seen_utc": "2025-11-02 02:06:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631050": [
        {
            "ioc_value": "se3.t4mo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:51:48",
            "last_seen_utc": "2025-11-02 01:52:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631049": [
        {
            "ioc_value": "8a.u-v9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:48:33",
            "last_seen_utc": "2025-11-02 01:49:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631048": [
        {
            "ioc_value": "b2y6.8786.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:40:32",
            "last_seen_utc": "2025-11-02 01:52:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631047": [
        {
            "ioc_value": "rr.33b2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:37:19",
            "last_seen_utc": "2025-11-02 01:40:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631046": [
        {
            "ioc_value": "h5c7.mjg1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:28:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631045": [
        {
            "ioc_value": "x.wlh84.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:27:05",
            "last_seen_utc": "2025-11-02 01:28:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631044": [
        {
            "ioc_value": "n0aq.y8-8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:24:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631043": [
        {
            "ioc_value": "q2.wlh84.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:19:53",
            "last_seen_utc": "2025-11-02 01:28:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631042": [
        {
            "ioc_value": "d.wlh84.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:08:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631041": [
        {
            "ioc_value": "q8m2.y8-8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 01:02:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631040": [
        {
            "ioc_value": "u0v4t.mjg1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:59:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631039": [
        {
            "ioc_value": "1m.595-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:58:09",
            "last_seen_utc": "2025-11-02 01:02:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631038": [
        {
            "ioc_value": "c8.595-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:48:52",
            "last_seen_utc": "2025-11-02 00:51:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631037": [
        {
            "ioc_value": "j8q2.mjg1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:46:05",
            "last_seen_utc": "2025-11-02 00:51:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631036": [
        {
            "ioc_value": "p.595-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:37:35",
            "last_seen_utc": "2025-11-02 00:46:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631035": [
        {
            "ioc_value": "v3.zms-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:27:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631034": [
        {
            "ioc_value": "h1.zms-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:24:57",
            "last_seen_utc": "2025-11-02 00:27:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631033": [
        {
            "ioc_value": "p3zy.y8-8.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:24:02",
            "last_seen_utc": "2025-11-02 00:27:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631032": [
        {
            "ioc_value": "s.zms-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:16:00",
            "last_seen_utc": "2025-11-02 00:24:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631031": [
        {
            "ioc_value": "r1n8k.mjg1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:09:43",
            "last_seen_utc": "2025-11-02 00:17:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631030": [
        {
            "ioc_value": "w1.7n28r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-02 00:07:18",
            "last_seen_utc": "2025-11-02 00:09:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631021": [
        {
            "ioc_value": "p6z3.mjg1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631020": [
        {
            "ioc_value": "k9.7n28r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:57:00",
            "last_seen_utc": "2025-11-01 23:59:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631019": [
        {
            "ioc_value": "s4k1.5x7u.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:52:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631018": [
        {
            "ioc_value": "l5tj.e-dx.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:50:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631017": [
        {
            "ioc_value": "a.7n28r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:49:13",
            "last_seen_utc": "2025-11-01 23:52:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631016": [
        {
            "ioc_value": "x9he.e-dx.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:43:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631015": [
        {
            "ioc_value": "g2t9w.5x7u.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:42:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631014": [
        {
            "ioc_value": "x.b8c90.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:41:59",
            "last_seen_utc": "2025-11-01 23:43:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631013": [
        {
            "ioc_value": "m3.b8c90.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:38:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631012": [
        {
            "ioc_value": "u0pw.e-dx.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:34:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631011": [
        {
            "ioc_value": "n5r3.5x7u.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:33:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631010": [
        {
            "ioc_value": "e.b8c90.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:27:52",
            "last_seen_utc": "2025-11-01 23:34:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631009": [
        {
            "ioc_value": "y0p6.5x7u.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631008": [
        {
            "ioc_value": "z9.4kl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:15:57",
            "last_seen_utc": "2025-11-01 23:21:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631007": [
        {
            "ioc_value": "t1.4kl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:09:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1631006": [
        {
            "ioc_value": "b6ru.e-dx.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:05:42",
            "last_seen_utc": "2025-11-01 23:21:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1631005": [
        {
            "ioc_value": "c1m8q.5x7u.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 23:03:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630995": [
        {
            "ioc_value": "b.4kl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:59:46",
            "last_seen_utc": "2025-11-01 23:05:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630994": [
        {
            "ioc_value": "e1xb.e-dx.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:51:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630993": [
        {
            "ioc_value": "x8.13-yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:47:27",
            "last_seen_utc": "2025-11-01 22:57:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630992": [
        {
            "ioc_value": "n4.13-yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:42:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630991": [
        {
            "ioc_value": "g.13-yz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:37:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630990": [
        {
            "ioc_value": "q7p0d.u-v9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:30:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630989": [
        {
            "ioc_value": "y7.259ox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:27:04",
            "last_seen_utc": "2025-11-01 22:30:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630988": [
        {
            "ioc_value": "q1.259ox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630987": [
        {
            "ioc_value": "p.259ox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:07:57",
            "last_seen_utc": "2025-11-01 22:11:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630986": [
        {
            "ioc_value": "j4da.18yk.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:06:44",
            "last_seen_utc": "2025-11-01 22:10:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630985": [
        {
            "ioc_value": "a8t1.u-v9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 22:05:01",
            "last_seen_utc": "2025-11-01 22:08:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630984": [
        {
            "ioc_value": "v3.kuq5g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 21:57:40",
            "last_seen_utc": "2025-11-01 22:06:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630983": [
        {
            "ioc_value": "h2.kuq5g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 21:48:47",
            "last_seen_utc": "2025-11-01 21:50:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630982": [
        {
            "ioc_value": "h2qm.18yk.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 21:48:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630981": [
        {
            "ioc_value": "m9r2q.u-v9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 21:40:53",
            "last_seen_utc": "2025-11-01 21:50:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630980": [
        {
            "ioc_value": "s.kuq5g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 21:37:45",
            "last_seen_utc": "2025-11-01 21:48:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630979": [
        {
            "ioc_value": "x.u-na5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 21:34:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630978": [
        {
            "ioc_value": "z6c4p.1r55.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 21:26:31",
            "last_seen_utc": "2025-11-01 21:34:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630977": [
        {
            "ioc_value": "w8nz.18yk.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 21:15:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630976": [
        {
            "ioc_value": "m9.u-na5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 21:13:28",
            "last_seen_utc": "2025-11-01 21:26:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630975": [
        {
            "ioc_value": "a.u-na5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:58:02",
            "last_seen_utc": "2025-11-01 20:59:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630974": [
        {
            "ioc_value": "c0p3.18yk.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:50:16",
            "last_seen_utc": "2025-11-01 20:59:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630973": [
        {
            "ioc_value": "sp.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:49:17",
            "last_seen_utc": "2025-11-01 20:52:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630972": [
        {
            "ioc_value": "l0t8.1r55.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:41:59",
            "last_seen_utc": "2025-11-01 20:52:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630971": [
        {
            "ioc_value": "a9x7.crju.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:38:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630970": [
        {
            "ioc_value": "s9n.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:37:59",
            "last_seen_utc": "2025-11-01 20:41:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630969": [
        {
            "ioc_value": "f5e.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:27:38",
            "last_seen_utc": "2025-11-01 20:30:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630968": [
        {
            "ioc_value": "x3b5n.1r55.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:18:49",
            "last_seen_utc": "2025-11-01 20:30:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630967": [
        {
            "ioc_value": "2i.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:17:48",
            "last_seen_utc": "2025-11-01 20:20:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630966": [
        {
            "ioc_value": "k5h2.crju.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:16:29",
            "last_seen_utc": "2025-11-01 20:20:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630965": [
        {
            "ioc_value": "vkf.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 20:04:40",
            "last_seen_utc": "2025-11-01 20:16:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630963": [
        {
            "ioc_value": "e7v1.1r55.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 19:54:27",
            "last_seen_utc": "2025-11-01 20:06:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630962": [
        {
            "ioc_value": "3z6.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 19:54:23",
            "last_seen_utc": "2025-11-01 19:58:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630961": [
        {
            "ioc_value": "d3yl.crju.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 19:49:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630960": [
        {
            "ioc_value": "mnp.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 19:49:11",
            "last_seen_utc": "2025-11-01 19:54:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630959": [
        {
            "ioc_value": "xue.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 19:34:50",
            "last_seen_utc": "2025-11-01 19:40:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630958": [
        {
            "ioc_value": "h2q9m.1r55.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 19:24:09",
            "last_seen_utc": "2025-11-01 19:35:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630957": [
        {
            "ioc_value": "v8jd.crju.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 19:21:36",
            "last_seen_utc": "2025-11-01 19:40:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630956": [
        {
            "ioc_value": "qa.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 19:20:26",
            "last_seen_utc": "2025-11-01 19:24:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630955": [
        {
            "ioc_value": "gh.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 19:02:43",
            "last_seen_utc": "2025-11-01 19:03:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630954": [
        {
            "ioc_value": "w7p2g.yldv.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:56:10",
            "last_seen_utc": "2025-11-01 19:03:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630953": [
        {
            "ioc_value": "jyn.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:51:22",
            "last_seen_utc": "2025-11-01 18:56:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630950": [
        {
            "ioc_value": "hd.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:45:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630949": [
        {
            "ioc_value": "4l.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:38:00",
            "last_seen_utc": "2025-11-01 18:38:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630948": [
        {
            "ioc_value": "n9k3.3-5y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:37:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630947": [
        {
            "ioc_value": "f0k4.yldv.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:28:14",
            "last_seen_utc": "2025-11-01 18:38:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630946": [
        {
            "ioc_value": "qqc.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:27:35",
            "last_seen_utc": "2025-11-01 18:37:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630945": [
        {
            "ioc_value": "ei.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:19:30",
            "last_seen_utc": "2025-11-01 18:28:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630944": [
        {
            "ioc_value": "y4tn.3-5y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630943": [
        {
            "ioc_value": "d3tzn.yldv.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:09:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630942": [
        {
            "ioc_value": "7jp.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 18:07:33",
            "last_seen_utc": "2025-11-01 18:18:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630941": [
        {
            "ioc_value": "core-allowing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-01 18:00:28",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251101-sp7s7stkaj",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630940": [
        {
            "ioc_value": "hope-atlas.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-01 18:00:27",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251101-ss9rzaev2a",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630939": [
        {
            "ioc_value": "designed-outsourcing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-01 18:00:26",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251101-ss9rzaev2a",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630938": [
        {
            "ioc_value": "lou.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:55:04",
            "last_seen_utc": "2025-11-01 17:56:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630937": [
        {
            "ioc_value": "q1v8.3-5y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:54:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630936": [
        {
            "ioc_value": "7v7.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:48:51",
            "last_seen_utc": "2025-11-01 17:54:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630935": [
        {
            "ioc_value": "s8j1.yldv.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:44:25",
            "last_seen_utc": "2025-11-01 17:56:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630934": [
        {
            "ioc_value": "8n.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:43:07",
            "last_seen_utc": "2025-11-01 17:44:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630933": [
        {
            "ioc_value": "hnz.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:37:32",
            "last_seen_utc": "2025-11-01 17:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630932": [
        {
            "ioc_value": "l2c7.5-rt.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:36:13",
            "last_seen_utc": "2025-11-01 17:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630931": [
        {
            "ioc_value": "6d.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:28:52",
            "last_seen_utc": "2025-11-01 17:36:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630930": [
        {
            "ioc_value": "x5pw.5-rt.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:27:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630929": [
        {
            "ioc_value": "r6mqa.yldv.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:21:34",
            "last_seen_utc": "2025-11-01 17:40:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630928": [
        {
            "ioc_value": "fr.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:20:33",
            "last_seen_utc": "2025-11-01 17:27:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630927": [
        {
            "ioc_value": "mbc.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:16:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630926": [
        {
            "ioc_value": "p1.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 17:08:18",
            "last_seen_utc": "2025-11-01 17:10:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630925": [
        {
            "ioc_value": "fjd.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:58:23",
            "last_seen_utc": "2025-11-01 16:59:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630924": [
        {
            "ioc_value": "p1wy.71o9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:49:08",
            "last_seen_utc": "2025-11-01 16:59:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630923": [
        {
            "ioc_value": "tz.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:47:05",
            "last_seen_utc": "2025-11-01 16:49:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630922": [
        {
            "ioc_value": "s2t4.33b2.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:43:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630921": [
        {
            "ioc_value": "y8h.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:35:12",
            "last_seen_utc": "2025-11-01 16:43:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630920": [
        {
            "ioc_value": "b9h2x.71o9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:29:28",
            "last_seen_utc": "2025-11-01 16:38:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630919": [
        {
            "ioc_value": "a1.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:26:34",
            "last_seen_utc": "2025-11-01 16:29:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630918": [
        {
            "ioc_value": "b5mx.33b2.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:23:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630917": [
        {
            "ioc_value": "1p2.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:22:10",
            "last_seen_utc": "2025-11-01 16:23:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630916": [
        {
            "ioc_value": "ayx.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:15:59",
            "last_seen_utc": "2025-11-01 16:18:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630915": [
        {
            "ioc_value": "g4zt.71o9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:09:26",
            "last_seen_utc": "2025-11-01 16:18:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630914": [
        {
            "ioc_value": "4q.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 16:08:07",
            "last_seen_utc": "2025-11-01 16:09:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630906": [
        {
            "ioc_value": "hzr.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:59:23",
            "last_seen_utc": "2025-11-01 16:02:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630905": [
        {
            "ioc_value": "w3d.33b2.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:59:21",
            "last_seen_utc": "2025-11-01 16:02:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630904": [
        {
            "ioc_value": "n2v5m.71o9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:57:55",
            "last_seen_utc": "2025-11-01 16:01:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630903": [
        {
            "ioc_value": "bs.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:49:46",
            "last_seen_utc": "2025-11-01 15:59:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630902": [
        {
            "ioc_value": "dr5.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:38:12",
            "last_seen_utc": "2025-11-01 15:42:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630901": [
        {
            "ioc_value": "k7q3.71o9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:23:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630900": [
        {
            "ioc_value": "sxw.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:21:26",
            "last_seen_utc": "2025-11-01 15:28:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630899": [
        {
            "ioc_value": "h6p4t.1z57.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:20:35",
            "last_seen_utc": "2025-11-01 15:28:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630898": [
        {
            "ioc_value": "u9ped.op76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:09:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630897": [
        {
            "ioc_value": "gz.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 15:06:12",
            "last_seen_utc": "2025-11-01 15:20:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630896": [
        {
            "ioc_value": "y7g.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:55:46",
            "last_seen_utc": "2025-11-01 14:58:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630669": [
        {
            "ioc_value": "thankyou.insources.edu.au",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-01 14:53:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/170.64.173.240+thankyou.insources.edu.au",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1630873": [
        {
            "ioc_value": "eyesurgeryguide.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-01 14:53:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "kam193"
        }
    ],
    "1630895": [
        {
            "ioc_value": "6r8.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:48:45",
            "last_seen_utc": "2025-11-01 14:51:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630894": [
        {
            "ioc_value": "j0xk.op76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:46:34",
            "last_seen_utc": "2025-11-01 14:58:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630893": [
        {
            "ioc_value": "zq3.1z57.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:46:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630892": [
        {
            "ioc_value": "lc.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:39:05",
            "last_seen_utc": "2025-11-01 14:46:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630891": [
        {
            "ioc_value": "976.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:30:13",
            "last_seen_utc": "2025-11-01 14:34:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630890": [
        {
            "ioc_value": "x64.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:22:39",
            "last_seen_utc": "2025-11-01 14:29:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630889": [
        {
            "ioc_value": "c8m2t.op76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:20:01",
            "last_seen_utc": "2025-11-01 14:34:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630888": [
        {
            "ioc_value": "f0x8.1z57.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:17:23",
            "last_seen_utc": "2025-11-01 14:26:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630887": [
        {
            "ioc_value": "ck3.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:16:33",
            "last_seen_utc": "2025-11-01 14:20:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630886": [
        {
            "ioc_value": "wz.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 14:05:21",
            "last_seen_utc": "2025-11-01 14:07:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630885": [
        {
            "ioc_value": "0bl.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 13:51:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630884": [
        {
            "ioc_value": "fc.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 13:43:00",
            "last_seen_utc": "2025-11-01 13:48:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630881": [
        {
            "ioc_value": "y5rb.op76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 13:41:45",
            "last_seen_utc": "2025-11-01 14:07:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630880": [
        {
            "ioc_value": "voluntarydasd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-11-01 13:39:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,netsupport",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630879": [
        {
            "ioc_value": "954.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 13:38:28",
            "last_seen_utc": "2025-11-01 13:41:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630876": [
        {
            "ioc_value": "lr.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 13:27:13",
            "last_seen_utc": "2025-11-01 13:31:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630875": [
        {
            "ioc_value": "c7b2.1z57.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 13:20:20",
            "last_seen_utc": "2025-11-01 13:43:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630874": [
        {
            "ioc_value": "ch.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 13:20:02",
            "last_seen_utc": "2025-11-01 13:28:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630872": [
        {
            "ioc_value": "18.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-01 13:08:11",
            "last_seen_utc": "2025-11-29 09:53:24",
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630870": [
        {
            "ioc_value": "18.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 13:02:34",
            "last_seen_utc": "2025-11-01 13:08:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630869": [
        {
            "ioc_value": "q2hzn.op76.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 13:02:03",
            "last_seen_utc": "2025-11-01 13:31:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630868": [
        {
            "ioc_value": "vvx.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 12:54:07",
            "last_seen_utc": "2025-11-01 13:02:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630867": [
        {
            "ioc_value": "2c.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 12:45:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630857": [
        {
            "ioc_value": "brille.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-01 12:44:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630858": [
        {
            "ioc_value": "camerun738.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-01 12:44:38",
            "last_seen_utc": "2025-11-07 12:55:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630859": [
        {
            "ioc_value": "inglostad.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-01 12:44:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630860": [
        {
            "ioc_value": "olympiacos345.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-01 12:44:38",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630861": [
        {
            "ioc_value": "sufficientblessings132.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-01 12:44:38",
            "last_seen_utc": "2025-11-07 12:55:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630862": [
        {
            "ioc_value": "winner999.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-01 12:44:38",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630863": [
        {
            "ioc_value": "winner999.gleeze.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-11-01 12:44:38",
            "last_seen_utc": "2025-12-12 18:39:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630855": [
        {
            "ioc_value": "lolzzmortex.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-01 12:44:20",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630856": [
        {
            "ioc_value": "viba.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-11-01 12:44:20",
            "last_seen_utc": "2025-11-08 07:24:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630853": [
        {
            "ioc_value": "janarch.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-11-01 12:43:50",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630843": [
        {
            "ioc_value": "ia.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 12:38:57",
            "last_seen_utc": "2025-11-01 12:47:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630702": [
        {
            "ioc_value": "evo.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 12:25:04",
            "last_seen_utc": "2025-11-01 12:25:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630701": [
        {
            "ioc_value": "k0wz.u-v-9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 12:22:04",
            "last_seen_utc": "2025-11-01 12:25:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630700": [
        {
            "ioc_value": "4i.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 12:18:12",
            "last_seen_utc": "2025-11-01 12:22:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630699": [
        {
            "ioc_value": "so.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 12:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630698": [
        {
            "ioc_value": "y1r5.u-v-9.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 12:08:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630697": [
        {
            "ioc_value": "xxxxyuanko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-11-01 12:02:18",
            "last_seen_utc": "2025-11-07 12:55:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251101-ncvwnaskcr",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630692": [
        {
            "ioc_value": "121637121.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-11-01 12:00:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251101-kfp8sscy8h",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630690": [
        {
            "ioc_value": "field-accessing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-01 12:00:18",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251101-h9xtmacl7z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630689": [
        {
            "ioc_value": "5vt.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:58:21",
            "last_seen_utc": "2025-11-01 12:08:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630688": [
        {
            "ioc_value": "bcq.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:47:44",
            "last_seen_utc": "2025-11-01 11:53:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630687": [
        {
            "ioc_value": "t7pqm.77-6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:47:15",
            "last_seen_utc": "2025-11-01 11:53:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630686": [
        {
            "ioc_value": "qz8hd.mjg-1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:40:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630685": [
        {
            "ioc_value": "5d.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:38:21",
            "last_seen_utc": "2025-11-01 11:47:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630684": [
        {
            "ioc_value": "a3k9.77-6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:33:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630683": [
        {
            "ioc_value": "p9a.mjg-1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:26:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630682": [
        {
            "ioc_value": "nq.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:20:39",
            "last_seen_utc": "2025-11-01 11:33:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630681": [
        {
            "ioc_value": "d2xm.mjg-1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:14:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630679": [
        {
            "ioc_value": "y9bm.5-sy77.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630678": [
        {
            "ioc_value": "67.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:08:02",
            "last_seen_utc": "2025-11-01 11:14:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630677": [
        {
            "ioc_value": "v7k3q.mjg-1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 11:04:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630666": [
        {
            "ioc_value": "j0e.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:53:14",
            "last_seen_utc": "2025-11-01 11:08:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630665": [
        {
            "ioc_value": "i2.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:48:25",
            "last_seen_utc": "2025-11-01 10:54:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630664": [
        {
            "ioc_value": "a3vnt.5-sy77.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:43:08",
            "last_seen_utc": "2025-11-01 10:54:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630663": [
        {
            "ioc_value": "rk8.64198.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:40:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630662": [
        {
            "ioc_value": "0y.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:39:33",
            "last_seen_utc": "2025-11-01 10:43:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630661": [
        {
            "ioc_value": "h2v.64198.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:27:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630660": [
        {
            "ioc_value": "5e.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:21:03",
            "last_seen_utc": "2025-11-01 10:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630659": [
        {
            "ioc_value": "x.64198.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:15:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630658": [
        {
            "ioc_value": "pzk6.5-sy77.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:15:31",
            "last_seen_utc": "2025-11-01 10:21:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630657": [
        {
            "ioc_value": "o3n.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:14:45",
            "last_seen_utc": "2025-11-01 10:15:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630656": [
        {
            "ioc_value": "hbr.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:08:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630655": [
        {
            "ioc_value": "y0q9.64198.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 10:06:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630652": [
        {
            "ioc_value": "aa.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:57:33",
            "last_seen_utc": "2025-11-01 10:06:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630651": [
        {
            "ioc_value": "u1rg3.5-sy77.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:53:19",
            "last_seen_utc": "2025-11-01 10:03:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630650": [
        {
            "ioc_value": "ay.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:49:40",
            "last_seen_utc": "2025-11-01 09:53:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630649": [
        {
            "ioc_value": "9x.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:39:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630648": [
        {
            "ioc_value": "d2x7.5-sy77.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:34:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630647": [
        {
            "ioc_value": "r9q.f42u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:24:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630646": [
        {
            "ioc_value": "veu.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:22:13",
            "last_seen_utc": "2025-11-01 09:34:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630645": [
        {
            "ioc_value": "h4qpn.5-sy77.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:16:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630644": [
        {
            "ioc_value": "cx.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:14:21",
            "last_seen_utc": "2025-11-01 09:16:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630643": [
        {
            "ioc_value": "ioy.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 09:08:58",
            "last_seen_utc": "2025-11-01 09:10:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630642": [
        {
            "ioc_value": "fl.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:57:21",
            "last_seen_utc": "2025-11-01 09:01:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630641": [
        {
            "ioc_value": "c9la.w-8z35.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:56:24",
            "last_seen_utc": "2025-11-01 09:10:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630640": [
        {
            "ioc_value": "4jf.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:48:24",
            "last_seen_utc": "2025-11-01 08:56:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630636": [
        {
            "ioc_value": "k3.f42u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:39:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630635": [
        {
            "ioc_value": "tq.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:37:55",
            "last_seen_utc": "2025-11-01 08:40:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630634": [
        {
            "ioc_value": "m5we2.w-8z35.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:34:45",
            "last_seen_utc": "2025-11-01 08:40:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630633": [
        {
            "ioc_value": "9u.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:28:07",
            "last_seen_utc": "2025-11-01 08:34:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630632": [
        {
            "ioc_value": "r0yg.w-8z35.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:22:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630631": [
        {
            "ioc_value": "l2v.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:18:45",
            "last_seen_utc": "2025-11-01 08:22:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630630": [
        {
            "ioc_value": "v7p2.i-m22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630629": [
        {
            "ioc_value": "lh.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:08:26",
            "last_seen_utc": "2025-11-01 08:09:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630628": [
        {
            "ioc_value": "tbd9.w-8z35.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 08:07:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630611": [
        {
            "ioc_value": "3f.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 07:57:34",
            "last_seen_utc": "2025-11-01 08:07:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630610": [
        {
            "ioc_value": "m0x.i-m22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 07:54:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630609": [
        {
            "ioc_value": "f5.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 07:47:02",
            "last_seen_utc": "2025-11-01 07:54:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630608": [
        {
            "ioc_value": "z83n.w-8z35.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 07:41:47",
            "last_seen_utc": "2025-11-01 07:48:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630607": [
        {
            "ioc_value": "t6c.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 07:38:13",
            "last_seen_utc": "2025-11-01 07:41:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630486": [
        {
            "ioc_value": "register.toastmasters86.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-11-01 07:28:31",
            "last_seen_utc": "2025-11-13 06:27:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115470830827855704",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1630606": [
        {
            "ioc_value": "m6.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 07:27:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630605": [
        {
            "ioc_value": "v1kpa.w-8z35.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 07:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630604": [
        {
            "ioc_value": "zf.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 07:17:57",
            "last_seen_utc": "2025-11-01 07:21:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630603": [
        {
            "ioc_value": "t1.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 07:07:55",
            "last_seen_utc": "2025-11-01 07:08:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630431": [
        {
            "ioc_value": "accomplish-suppose-val-ensure.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-01 07:00:18",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1630432": [
        {
            "ioc_value": "stress-substance-mall-corrections.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-01 07:00:18",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1630433": [
        {
            "ioc_value": "rider-february-thorough-decades.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-01 07:00:17",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1630434": [
        {
            "ioc_value": "termination-str-north-cool.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-01 07:00:17",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1630435": [
        {
            "ioc_value": "castle-fifth-print-metallic.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-01 07:00:17",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1630436": [
        {
            "ioc_value": "librarian-alabama-iowa-vegetables.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-11-01 07:00:16",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1630450": [
        {
            "ioc_value": "techwebi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-11-01 07:00:10",
            "last_seen_utc": "2025-11-03 14:12:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,REMPROXY",
            "anonymous": "0",
            "reporter": "BlackLotusLabs"
        }
    ],
    "1630602": [
        {
            "ioc_value": "jwr.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:57:34",
            "last_seen_utc": "2025-11-01 06:59:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630601": [
        {
            "ioc_value": "h1vf4.lu2p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:52:17",
            "last_seen_utc": "2025-11-01 06:59:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630600": [
        {
            "ioc_value": "q7m2x.w-8z35.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:52:15",
            "last_seen_utc": "2025-11-01 07:08:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630599": [
        {
            "ioc_value": "bj.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:42:34",
            "last_seen_utc": "2025-11-01 06:52:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630598": [
        {
            "ioc_value": "h9l.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:35:17",
            "last_seen_utc": "2025-11-01 06:40:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630597": [
        {
            "ioc_value": "1i7.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:29:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630596": [
        {
            "ioc_value": "c6pz.lu2p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:28:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630595": [
        {
            "ioc_value": "oql.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:17:11",
            "last_seen_utc": "2025-11-01 06:28:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630594": [
        {
            "ioc_value": "v2.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:07:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630592": [
        {
            "ioc_value": "e9tk3.lu2p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 06:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630590": [
        {
            "ioc_value": "abmtwphx4.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-11-01 06:00:21",
            "last_seen_utc": "2025-11-01 06:00:22",
            "confidence_level": 100,
            "reference": "https://tria.ge/251101-cj9gvabq3t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630589": [
        {
            "ioc_value": "5m.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 05:57:11",
            "last_seen_utc": "2025-11-01 06:00:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630588": [
        {
            "ioc_value": "nw.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 05:47:48",
            "last_seen_utc": "2025-11-01 05:52:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630587": [
        {
            "ioc_value": "f7q2.q7jt-0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 05:47:35",
            "last_seen_utc": "2025-11-01 05:58:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630586": [
        {
            "ioc_value": "wa.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 05:39:57",
            "last_seen_utc": "2025-11-01 05:47:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630585": [
        {
            "ioc_value": "y8m2.lu2p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 05:25:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630583": [
        {
            "ioc_value": "p0r.q7jt-0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 04:55:41",
            "last_seen_utc": "2025-11-01 05:00:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630582": [
        {
            "ioc_value": "l8q.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 04:48:26",
            "last_seen_utc": "2025-11-01 04:55:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630581": [
        {
            "ioc_value": "9az.q7jt-0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 04:39:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630580": [
        {
            "ioc_value": "a5rl.lu2p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 04:38:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630579": [
        {
            "ioc_value": "sr7.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 04:38:25",
            "last_seen_utc": "2025-11-01 04:39:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630574": [
        {
            "ioc_value": "wq1.q7jt-0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:53:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630573": [
        {
            "ioc_value": "w9hd3.mi9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:49:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630572": [
        {
            "ioc_value": "n6k.q7jt-0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:39:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630571": [
        {
            "ioc_value": "ahh.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:37:13",
            "last_seen_utc": "2025-11-01 03:39:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630570": [
        {
            "ioc_value": "lj.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:28:21",
            "last_seen_utc": "2025-11-01 03:33:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630569": [
        {
            "ioc_value": "g2.q7jt-0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:27:42",
            "last_seen_utc": "2025-11-01 03:33:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630568": [
        {
            "ioc_value": "f7zn0.mi9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:25:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630567": [
        {
            "ioc_value": "4hp.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:18:02",
            "last_seen_utc": "2025-11-01 03:27:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630566": [
        {
            "ioc_value": "e15.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:08:16",
            "last_seen_utc": "2025-11-01 03:11:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630565": [
        {
            "ioc_value": "x4d2.w7tx-3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 03:02:48",
            "last_seen_utc": "2025-11-01 03:11:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630564": [
        {
            "ioc_value": "mt.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:57:58",
            "last_seen_utc": "2025-11-01 03:02:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630563": [
        {
            "ioc_value": "t4j2.mi9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630562": [
        {
            "ioc_value": "2b7.w7tx-3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:48:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630561": [
        {
            "ioc_value": "9y.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:48:09",
            "last_seen_utc": "2025-11-01 02:49:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630560": [
        {
            "ioc_value": "s8lp.mi9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:39:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630559": [
        {
            "ioc_value": "80.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:37:43",
            "last_seen_utc": "2025-11-01 02:39:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630558": [
        {
            "ioc_value": "tkm.w7tx-3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:29:07",
            "last_seen_utc": "2025-11-01 02:39:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630557": [
        {
            "ioc_value": "vsm.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:27:26",
            "last_seen_utc": "2025-11-01 02:29:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630556": [
        {
            "ioc_value": "ug8.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:17:39",
            "last_seen_utc": "2025-11-01 02:23:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630555": [
        {
            "ioc_value": "x3wr.mi9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:13:02",
            "last_seen_utc": "2025-11-01 02:29:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630554": [
        {
            "ioc_value": "r09.w7tx-3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:04:01",
            "last_seen_utc": "2025-11-01 02:19:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630553": [
        {
            "ioc_value": "un.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 02:01:15",
            "last_seen_utc": "2025-11-01 02:13:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630552": [
        {
            "ioc_value": "l1t.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:57:00",
            "last_seen_utc": "2025-11-01 02:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630551": [
        {
            "ioc_value": "ftb.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:48:14",
            "last_seen_utc": "2025-11-01 01:52:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630550": [
        {
            "ioc_value": "h5x.w7tx-3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:43:32",
            "last_seen_utc": "2025-11-01 02:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630549": [
        {
            "ioc_value": "410.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:38:04",
            "last_seen_utc": "2025-11-01 01:43:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630548": [
        {
            "ioc_value": "ud.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:27:36",
            "last_seen_utc": "2025-11-01 01:37:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630547": [
        {
            "ioc_value": "p2hk.fi0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:23:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630546": [
        {
            "ioc_value": "qv.w7tx-3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:22:23",
            "last_seen_utc": "2025-11-01 01:37:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630545": [
        {
            "ioc_value": "2n4.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:18:50",
            "last_seen_utc": "2025-11-01 01:23:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630544": [
        {
            "ioc_value": "c4u.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:07:33",
            "last_seen_utc": "2025-11-01 01:07:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630543": [
        {
            "ioc_value": "n4t5.fi0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:04:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630542": [
        {
            "ioc_value": "d4m1.i3-42s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 01:01:15",
            "last_seen_utc": "2025-11-01 01:07:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630541": [
        {
            "ioc_value": "ocx.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:57:45",
            "last_seen_utc": "2025-11-01 01:04:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630540": [
        {
            "ioc_value": "a92.i3-42s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:49:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630539": [
        {
            "ioc_value": "p4p.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:47:25",
            "last_seen_utc": "2025-11-01 00:49:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630538": [
        {
            "ioc_value": "qt.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:38:30",
            "last_seen_utc": "2025-11-01 00:39:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630537": [
        {
            "ioc_value": "a2.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:28:13",
            "last_seen_utc": "2025-11-01 00:32:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630536": [
        {
            "ioc_value": "z1n.i3-42s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:27:24",
            "last_seen_utc": "2025-11-01 00:32:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630535": [
        {
            "ioc_value": "j9m3z.fi0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:25:36",
            "last_seen_utc": "2025-11-01 00:39:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630534": [
        {
            "ioc_value": "xj.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:19:21",
            "last_seen_utc": "2025-11-01 00:27:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630533": [
        {
            "ioc_value": "b7qx.fi0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:08:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630532": [
        {
            "ioc_value": "tq8.i3-42s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:08:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630531": [
        {
            "ioc_value": "29.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-11-01 00:07:49",
            "last_seen_utc": "2025-11-01 00:08:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630526": [
        {
            "ioc_value": "kn5.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:58:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630525": [
        {
            "ioc_value": "wx.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:47:45",
            "last_seen_utc": "2025-10-31 23:50:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630523": [
        {
            "ioc_value": "v6r2.fi0m.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:43:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630524": [
        {
            "ioc_value": "mv3.i3-42s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:43:50",
            "last_seen_utc": "2025-10-31 23:50:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630522": [
        {
            "ioc_value": "pl.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:37:25",
            "last_seen_utc": "2025-10-31 23:43:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630521": [
        {
            "ioc_value": "d1ys4.zo4n.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:28:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630520": [
        {
            "ioc_value": "z4.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:27:34",
            "last_seen_utc": "2025-10-31 23:28:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630519": [
        {
            "ioc_value": "5pi.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:18:13",
            "last_seen_utc": "2025-10-31 23:23:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630518": [
        {
            "ioc_value": "k7.i3-42s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:11:16",
            "last_seen_utc": "2025-10-31 23:23:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630517": [
        {
            "ioc_value": "q3v2.zo4n.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630516": [
        {
            "ioc_value": "ma4.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 23:07:25",
            "last_seen_utc": "2025-10-31 23:11:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630505": [
        {
            "ioc_value": "auth.m365.1drive.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-31 23:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/144.172.109.53+auth.m365.1drive.zip",
            "tags": "AS14956,C2,censys,Mythic,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1630504": [
        {
            "ioc_value": "vzh.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:57:10",
            "last_seen_utc": "2025-10-31 23:00:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630503": [
        {
            "ioc_value": "r3j5.bo8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:49:31",
            "last_seen_utc": "2025-10-31 23:00:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630502": [
        {
            "ioc_value": "nj.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:47:48",
            "last_seen_utc": "2025-10-31 22:50:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630501": [
        {
            "ioc_value": "c9fw.zo4n.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:46:29",
            "last_seen_utc": "2025-10-31 22:50:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630500": [
        {
            "ioc_value": "ab.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:32:27",
            "last_seen_utc": "2025-10-31 22:46:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630499": [
        {
            "ioc_value": "g3.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:27:47",
            "last_seen_utc": "2025-10-31 22:30:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630498": [
        {
            "ioc_value": "u1kz8.bo8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:21:05",
            "last_seen_utc": "2025-10-31 22:36:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630497": [
        {
            "ioc_value": "qvc.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:17:58",
            "last_seen_utc": "2025-10-31 22:21:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630496": [
        {
            "ioc_value": "n2v4.bo8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:05:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630495": [
        {
            "ioc_value": "1a1.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:04:58",
            "last_seen_utc": "2025-10-31 22:05:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630494": [
        {
            "ioc_value": "r9b5m.da6v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 22:02:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630493": [
        {
            "ioc_value": "yw.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 21:58:39",
            "last_seen_utc": "2025-10-31 22:02:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630492": [
        {
            "ioc_value": "d9y7w.bo8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 21:46:01",
            "last_seen_utc": "2025-10-31 22:00:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630491": [
        {
            "ioc_value": "382.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 21:45:50",
            "last_seen_utc": "2025-10-31 21:49:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630490": [
        {
            "ioc_value": "l2x7.da6v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 21:39:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630489": [
        {
            "ioc_value": "qg8.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 21:36:57",
            "last_seen_utc": "2025-10-31 21:46:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630488": [
        {
            "ioc_value": "cs.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 21:23:05",
            "last_seen_utc": "2025-10-31 21:25:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630487": [
        {
            "ioc_value": "2x9.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 21:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630485": [
        {
            "ioc_value": "p6b3q.bo8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 21:10:16",
            "last_seen_utc": "2025-10-31 21:25:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630484": [
        {
            "ioc_value": "70.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 21:08:09",
            "last_seen_utc": "2025-10-31 21:10:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630482": [
        {
            "ioc_value": "nd.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 20:57:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630481": [
        {
            "ioc_value": "a3j9h.da6v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 20:54:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630480": [
        {
            "ioc_value": "ylu.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 20:42:46",
            "last_seen_utc": "2025-10-31 20:54:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630478": [
        {
            "ioc_value": "c2.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 20:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630477": [
        {
            "ioc_value": "9f.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 20:29:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630475": [
        {
            "ioc_value": "s1k4p.ve5l.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 20:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630474": [
        {
            "ioc_value": "kk.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 20:17:13",
            "last_seen_utc": "2025-10-31 20:18:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630473": [
        {
            "ioc_value": "46.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 20:07:22",
            "last_seen_utc": "2025-10-31 20:08:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630465": [
        {
            "ioc_value": "vu.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:58:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630464": [
        {
            "ioc_value": "m3y8n.ve5l.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:50:42",
            "last_seen_utc": "2025-10-31 20:08:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630462": [
        {
            "ioc_value": "o9.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:42:44",
            "last_seen_utc": "2025-10-31 19:50:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630460": [
        {
            "ioc_value": "ds.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:37:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630459": [
        {
            "ioc_value": "t0r9.yq2r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:33:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630458": [
        {
            "ioc_value": "y5n4.da6v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:30:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630457": [
        {
            "ioc_value": "ri.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:24:32",
            "last_seen_utc": "2025-10-31 19:33:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630456": [
        {
            "ioc_value": "w1z3k.x3le.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630455": [
        {
            "ioc_value": "wl.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:17:51",
            "last_seen_utc": "2025-10-31 19:23:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630454": [
        {
            "ioc_value": "a4g2t.yq2r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:16:19",
            "last_seen_utc": "2025-10-31 19:23:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630453": [
        {
            "ioc_value": "ah.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 19:07:35",
            "last_seen_utc": "2025-10-31 19:16:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630452": [
        {
            "ioc_value": "4xc.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 18:59:15",
            "last_seen_utc": "2025-10-31 18:59:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630451": [
        {
            "ioc_value": "b4tqm.x3le.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 18:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630438": [
        {
            "ioc_value": "x9nh3.yq2r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 18:31:10",
            "last_seen_utc": "2025-10-31 18:38:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630437": [
        {
            "ioc_value": "iid.t1va.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 18:21:54",
            "last_seen_utc": "2025-10-31 18:31:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630430": [
        {
            "ioc_value": "z6c8q.yq2r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 18:12:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630426": [
        {
            "ioc_value": "t9f.zo8k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 18:08:01",
            "last_seen_utc": "2025-10-31 18:12:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630424": [
        {
            "ioc_value": "dydnspriv.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-31 18:03:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251031-r9nqdszncw",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630423": [
        {
            "ioc_value": "systeam.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-31 18:02:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251031-pe9y2agn4z",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630421": [
        {
            "ioc_value": "dosscloud.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-31 18:00:36",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 100,
            "reference": "https://tria.ge/251031-rcvsfahj8z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630420": [
        {
            "ioc_value": "loganwolverin2028.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-31 18:00:17",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 100,
            "reference": "https://tria.ge/251031-rlhjgahk5s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630419": [
        {
            "ioc_value": "e8f5p.x3le.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 17:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630418": [
        {
            "ioc_value": "7y.qo1s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 17:52:30",
            "last_seen_utc": "2025-10-31 17:59:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630417": [
        {
            "ioc_value": "k1p4v.yq2r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 17:44:43",
            "last_seen_utc": "2025-10-31 17:57:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630416": [
        {
            "ioc_value": "mmw.da6v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 17:38:29",
            "last_seen_utc": "2025-10-31 17:44:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630415": [
        {
            "ioc_value": "s2j7.x3le.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 17:30:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630414": [
        {
            "ioc_value": "r8jkc.qo1s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 17:29:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630413": [
        {
            "ioc_value": "238.yq2r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 17:22:36",
            "last_seen_utc": "2025-10-31 17:30:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630411": [
        {
            "ioc_value": "kitty.onthewifi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-31 17:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/2cd8e233c3e01fde1f702c0a0066d6869c0fc3ce9a823470cb9529ba622b711e/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1630409": [
        {
            "ioc_value": "t2.bo8y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 17:06:20",
            "last_seen_utc": "2025-10-31 17:14:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630408": [
        {
            "ioc_value": "d2m4.qo1s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 17:01:56",
            "last_seen_utc": "2025-10-31 17:14:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630407": [
        {
            "ioc_value": "5ai.mi9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 16:56:57",
            "last_seen_utc": "2025-10-31 17:01:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630406": [
        {
            "ioc_value": "6i4.re7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 16:41:57",
            "last_seen_utc": "2025-10-31 16:47:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630405": [
        {
            "ioc_value": "mahmoud9pos.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-31 16:40:46",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/a10dc99d9b284ea223ec3bd88b6a8a5b08ed623c8cbd4ea92cce11abef707167/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1630404": [
        {
            "ioc_value": "fk6.wi7o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 16:37:46",
            "last_seen_utc": "2025-11-01 05:25:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630403": [
        {
            "ioc_value": "h9kq.x3le.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 16:36:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630402": [
        {
            "ioc_value": "q7fzp.qo1s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 16:36:13",
            "last_seen_utc": "2025-10-31 16:47:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630400": [
        {
            "ioc_value": "bb7.gi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 16:20:50",
            "last_seen_utc": "2025-10-31 16:36:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630399": [
        {
            "ioc_value": "e3ytn.qo1s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 16:12:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630397": [
        {
            "ioc_value": "tr.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-31 16:08:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1630398": [
        {
            "ioc_value": "tr.aidexcel.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-31 16:08:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1630394": [
        {
            "ioc_value": "qzz.va4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 16:07:25",
            "last_seen_utc": "2025-10-31 16:12:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630390": [
        {
            "ioc_value": "l4k9w.qo1s.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 16:01:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630382": [
        {
            "ioc_value": "1h.zo4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:57:08",
            "last_seen_utc": "2025-11-01 03:53:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630380": [
        {
            "ioc_value": "pf.ve5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630379": [
        {
            "ioc_value": "c3ytx.ha5r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:38:32",
            "last_seen_utc": "2025-10-31 15:57:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630378": [
        {
            "ioc_value": "v6t3x.pe8d.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:37:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630377": [
        {
            "ioc_value": "vq.lo2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:37:19",
            "last_seen_utc": "2025-10-31 15:38:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630376": [
        {
            "ioc_value": "vf.je9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:32:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630375": [
        {
            "ioc_value": "u9.fi0m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:25:17",
            "last_seen_utc": "2025-10-31 15:27:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630374": [
        {
            "ioc_value": "j9r2.pe8d.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:22:53",
            "last_seen_utc": "2025-10-31 15:27:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630373": [
        {
            "ioc_value": "62.pe8d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:21:05",
            "last_seen_utc": "2025-10-31 15:22:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630372": [
        {
            "ioc_value": "v0m4.ha5r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:16:01",
            "last_seen_utc": "2025-10-31 15:25:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630366": [
        {
            "ioc_value": "holonimjs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-31 15:10:30",
            "last_seen_utc": "2025-10-31 15:10:35",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115469413433444577",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1630364": [
        {
            "ioc_value": "df.sa3x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:09:13",
            "last_seen_utc": "2025-10-31 15:16:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630363": [
        {
            "ioc_value": "vv.ha5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 15:04:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630361": [
        {
            "ioc_value": "8ql.n6ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 14:57:57",
            "last_seen_utc": "2025-10-31 15:02:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630360": [
        {
            "ioc_value": "a0gqv.pe8d.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 14:57:43",
            "last_seen_utc": "2025-10-31 15:12:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630359": [
        {
            "ioc_value": "eg.x3le.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 14:47:10",
            "last_seen_utc": "2025-10-31 14:57:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630358": [
        {
            "ioc_value": "9s.m2jo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 14:37:27",
            "last_seen_utc": "2025-10-31 18:58:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630357": [
        {
            "ioc_value": "s3nzk.pe8d.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 14:30:47",
            "last_seen_utc": "2025-10-31 14:42:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630356": [
        {
            "ioc_value": "c8.71290.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 14:28:08",
            "last_seen_utc": "2025-10-31 14:30:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630354": [
        {
            "ioc_value": "p0.71290.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 14:24:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630353": [
        {
            "ioc_value": "are-fifteen.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-31 14:21:05",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630352": [
        {
            "ioc_value": "h1.8oryn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 14:07:57",
            "last_seen_utc": "2025-10-31 14:20:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630351": [
        {
            "ioc_value": "b5yhr.pe8d.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:59:58",
            "last_seen_utc": "2025-10-31 14:10:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630350": [
        {
            "ioc_value": "t5v3.t1va.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:56:38",
            "last_seen_utc": "2025-10-31 14:20:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630349": [
        {
            "ioc_value": "s.8oryn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:56:05",
            "last_seen_utc": "2025-10-31 13:59:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630348": [
        {
            "ioc_value": "x8.9-ck6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:49:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630347": [
        {
            "ioc_value": "a.9-ck6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:37:45",
            "last_seen_utc": "2025-10-31 13:45:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630346": [
        {
            "ioc_value": "wz.25qx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:28:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630345": [
        {
            "ioc_value": "b.25qx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:17:44",
            "last_seen_utc": "2025-10-31 13:24:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630340": [
        {
            "ioc_value": "n5.9715w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:08:16",
            "last_seen_utc": "2025-10-31 13:11:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630339": [
        {
            "ioc_value": "z9f4.wi7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:07:15",
            "last_seen_utc": "2025-10-31 13:42:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630336": [
        {
            "ioc_value": "guiasexo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-31 13:06:53",
            "last_seen_utc": "2025-10-31 16:10:20",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115468927655293820",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1630331": [
        {
            "ioc_value": "r4mzt.t1va.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 13:05:48",
            "last_seen_utc": "2025-10-31 13:45:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630330": [
        {
            "ioc_value": "g.9715w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:57:02",
            "last_seen_utc": "2025-10-31 13:10:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630328": [
        {
            "ioc_value": "m.017fk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:49:14",
            "last_seen_utc": "2025-10-31 12:53:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630327": [
        {
            "ioc_value": "do92r.t1va.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:43:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630326": [
        {
            "ioc_value": "n2t8k.wi7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:42:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630325": [
        {
            "ioc_value": "y7.017fk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:38:09",
            "last_seen_utc": "2025-10-31 12:43:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630324": [
        {
            "ioc_value": "q7fx.t1va.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:28:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630323": [
        {
            "ioc_value": "q1.dl3zd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:27:52",
            "last_seen_utc": "2025-10-31 12:33:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630322": [
        {
            "ioc_value": "p7lrd.wi7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:27:21",
            "last_seen_utc": "2025-10-31 12:33:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630321": [
        {
            "ioc_value": "p.dl3zd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:20:09",
            "last_seen_utc": "2025-10-31 12:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630320": [
        {
            "ioc_value": "c4x3m.wi7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:12:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630319": [
        {
            "ioc_value": "h.t-nin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 12:07:52",
            "last_seen_utc": "2025-10-31 12:12:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630318": [
        {
            "ioc_value": "note-road.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-10-31 12:04:44",
            "last_seen_utc": "2025-11-07 12:55:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251031-k4j2pawnaq",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630312": [
        {
            "ioc_value": "disnotavalidmeantocommunicatemkidlydothe.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-31 12:00:36",
            "last_seen_utc": "2025-11-07 12:55:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/251031-m5373awqaj",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630311": [
        {
            "ioc_value": "basic-fan.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-31 12:00:28",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251031-lks1xsykby",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630310": [
        {
            "ioc_value": "lower-mem.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-31 12:00:27",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251031-nflr6agl5s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630309": [
        {
            "ioc_value": "v3.t-nin.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:57:31",
            "last_seen_utc": "2025-10-31 12:07:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630308": [
        {
            "ioc_value": "m3yhu.t1va.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:49:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630307": [
        {
            "ioc_value": "g0bn9.wi7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:47:53",
            "last_seen_utc": "2025-10-31 12:07:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630306": [
        {
            "ioc_value": "x2.91-7l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:47:45",
            "last_seen_utc": "2025-10-31 11:53:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630305": [
        {
            "ioc_value": "s.91-7l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:37:26",
            "last_seen_utc": "2025-10-31 11:47:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630304": [
        {
            "ioc_value": "k9.6vwj8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:27:35",
            "last_seen_utc": "2025-10-31 11:30:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630303": [
        {
            "ioc_value": "j1de9.re7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:20:02",
            "last_seen_utc": "2025-10-31 11:29:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630302": [
        {
            "ioc_value": "a.6vwj8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:18:18",
            "last_seen_utc": "2025-10-31 11:20:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630301": [
        {
            "ioc_value": "w6j2.sa3x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:13:10",
            "last_seen_utc": "2025-10-31 11:30:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630300": [
        {
            "ioc_value": "2v.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:08:32",
            "last_seen_utc": "2025-10-31 11:13:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630299": [
        {
            "ioc_value": "r1m3k.sa3x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 11:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630277": [
        {
            "ioc_value": "live.m365.1drive.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-31 11:00:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/144.172.109.53+live.m365.1drive.zip",
            "tags": "AS14956,C2,censys,Mythic,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1630275": [
        {
            "ioc_value": "office365.m365.1drive.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-31 11:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/144.172.109.53+office365.m365.1drive.zip",
            "tags": "AS14956,C2,censys,Mythic,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1630276": [
        {
            "ioc_value": "aad.m365.1drive.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-31 11:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/144.172.109.53+aad.m365.1drive.zip",
            "tags": "AS14956,C2,censys,Mythic,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1630274": [
        {
            "ioc_value": "res.cdn.m365.1drive.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-31 11:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/144.172.109.53+res.cdn.m365.1drive.zip",
            "tags": "AS14956,C2,censys,Mythic,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1630269": [
        {
            "ioc_value": "p5wz0.re7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:58:00",
            "last_seen_utc": "2025-10-31 11:11:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630268": [
        {
            "ioc_value": "46.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:57:45",
            "last_seen_utc": "2025-10-31 11:07:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630267": [
        {
            "ioc_value": "f5bqh.sa3x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:50:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630265": [
        {
            "ioc_value": "jk.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:48:00",
            "last_seen_utc": "2025-10-31 10:50:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630264": [
        {
            "ioc_value": "u7z9n.sa3x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:40:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630263": [
        {
            "ioc_value": "fg.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:37:43",
            "last_seen_utc": "2025-10-31 10:40:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630262": [
        {
            "ioc_value": "x2cvg.sa3x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:29:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630261": [
        {
            "ioc_value": "70.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:27:26",
            "last_seen_utc": "2025-10-31 10:29:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630259": [
        {
            "ioc_value": "ui.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-31 10:24:54",
            "last_seen_utc": "2025-11-03 14:20:05",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1630260": [
        {
            "ioc_value": "ui.aidexcel.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-31 10:24:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1630256": [
        {
            "ioc_value": "ddc.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:17:36",
            "last_seen_utc": "2025-10-31 10:20:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630255": [
        {
            "ioc_value": "v7.der14i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:09:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630253": [
        {
            "ioc_value": "rp9a.je9t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:07:33",
            "last_seen_utc": "2025-10-31 10:20:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630252": [
        {
            "ioc_value": "h2.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 10:07:20",
            "last_seen_utc": "2025-10-31 10:12:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630251": [
        {
            "ioc_value": "hpd.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 09:57:03",
            "last_seen_utc": "2025-10-31 10:07:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630250": [
        {
            "ioc_value": "m7dqw.je9t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 09:51:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630249": [
        {
            "ioc_value": "kp.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 09:47:17",
            "last_seen_utc": "2025-10-31 09:51:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630236": [
        {
            "ioc_value": "uq1.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 09:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630235": [
        {
            "ioc_value": "t2gh5.je9t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 09:33:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630229": [
        {
            "ioc_value": "intelligencedns.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-10-31 09:30:34",
            "last_seen_utc": "2025-11-07 12:55:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,spynote",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630222": [
        {
            "ioc_value": "www.kolklokjkj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-31 09:29:46",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630223": [
        {
            "ioc_value": "www.ozkeplancarpet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-31 09:29:46",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630224": [
        {
            "ioc_value": "www.siegania.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-31 09:29:46",
            "last_seen_utc": "2025-11-07 12:55:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630225": [
        {
            "ioc_value": "www.tjxh-internetional.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-31 09:29:46",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630220": [
        {
            "ioc_value": "arusicucloud.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-31 09:29:45",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630221": [
        {
            "ioc_value": "westy.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-31 09:29:45",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630219": [
        {
            "ioc_value": "dot9-30205.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-31 09:29:22",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630216": [
        {
            "ioc_value": "v2.kallisti.uk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-31 09:28:49",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630217": [
        {
            "ioc_value": "v3.kallisti.uk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-31 09:28:49",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630214": [
        {
            "ioc_value": "gatex.kallisti.uk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-31 09:28:10",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1630211": [
        {
            "ioc_value": "lvo.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 09:27:12",
            "last_seen_utc": "2025-10-31 09:33:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630205": [
        {
            "ioc_value": "sm.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 09:17:58",
            "last_seen_utc": "2025-10-31 09:19:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630204": [
        {
            "ioc_value": "6h.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 09:07:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630203": [
        {
            "ioc_value": "k8zm4.je9t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 09:01:22",
            "last_seen_utc": "2025-10-31 09:19:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630196": [
        {
            "ioc_value": "3r.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:57:50",
            "last_seen_utc": "2025-10-31 09:01:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630189": [
        {
            "ioc_value": "factsec.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-31 08:49:21",
            "last_seen_utc": "2025-12-14 11:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1630186": [
        {
            "ioc_value": "t9x4.der14i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:48:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630184": [
        {
            "ioc_value": "0lj.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:47:33",
            "last_seen_utc": "2025-10-31 08:49:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630180": [
        {
            "ioc_value": "y3rfx.je9t.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:39:15",
            "last_seen_utc": "2025-10-31 08:49:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630179": [
        {
            "ioc_value": "c45.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:37:12",
            "last_seen_utc": "2025-10-31 08:39:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630178": [
        {
            "ioc_value": "7a.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:27:26",
            "last_seen_utc": "2025-10-31 08:30:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630177": [
        {
            "ioc_value": "mz1.der14i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:18:29",
            "last_seen_utc": "2025-10-31 08:28:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630176": [
        {
            "ioc_value": "py.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:18:02",
            "last_seen_utc": "2025-10-31 08:18:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630175": [
        {
            "ioc_value": "hpa.i4-27k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:11:01",
            "last_seen_utc": "2025-10-31 08:30:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630174": [
        {
            "ioc_value": "k5h.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:07:57",
            "last_seen_utc": "2025-10-31 08:11:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630163": [
        {
            "ioc_value": "q3.der14i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 08:00:11",
            "last_seen_utc": "2025-10-31 09:19:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630162": [
        {
            "ioc_value": "25.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:58:06",
            "last_seen_utc": "2025-10-31 08:00:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630161": [
        {
            "ioc_value": "z7x5.i4-27k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:50:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630155": [
        {
            "ioc_value": "z6u.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:47:48",
            "last_seen_utc": "2025-10-31 07:51:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630154": [
        {
            "ioc_value": "k9r2.lej75a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:47:29",
            "last_seen_utc": "2025-10-31 07:51:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630152": [
        {
            "ioc_value": "97.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:37:53",
            "last_seen_utc": "2025-10-31 07:47:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630151": [
        {
            "ioc_value": "m11.i4-27k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:30:58",
            "last_seen_utc": "2025-10-31 07:45:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630150": [
        {
            "ioc_value": "a9.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:29:38",
            "last_seen_utc": "2025-10-31 07:30:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630149": [
        {
            "ioc_value": "ux.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630148": [
        {
            "ioc_value": "3qv.i4-27k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:09:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630147": [
        {
            "ioc_value": "fh6.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 07:07:21",
            "last_seen_utc": "2025-10-31 07:09:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629701": [
        {
            "ioc_value": "prototype.tapmycard.work",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-31 07:04:56",
            "last_seen_utc": "2025-11-13 06:27:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115464930976707272",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1630146": [
        {
            "ioc_value": "ug0.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:57:17",
            "last_seen_utc": "2025-10-31 07:02:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630145": [
        {
            "ioc_value": "gk9.i4-27k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:52:09",
            "last_seen_utc": "2025-10-31 07:02:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630144": [
        {
            "ioc_value": "4o.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:47:57",
            "last_seen_utc": "2025-10-31 06:52:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630143": [
        {
            "ioc_value": "u0b.lej75a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:43:01",
            "last_seen_utc": "2025-10-31 06:48:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630142": [
        {
            "ioc_value": "birmatrabiloktrabvel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-31 06:39:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.242.64",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630141": [
        {
            "ioc_value": "gs.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:39:06",
            "last_seen_utc": "2025-10-31 06:43:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630140": [
        {
            "ioc_value": "snappis.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-31 06:38:25",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630139": [
        {
            "ioc_value": "d2.i4-27k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:37:01",
            "last_seen_utc": "2025-10-31 06:43:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630138": [
        {
            "ioc_value": "m7.lej75a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:30:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630137": [
        {
            "ioc_value": "8i.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:28:01",
            "last_seen_utc": "2025-10-31 06:37:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630136": [
        {
            "ioc_value": "p9y1.lej75a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630135": [
        {
            "ioc_value": "jw.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:18:03",
            "last_seen_utc": "2025-10-31 06:22:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630134": [
        {
            "ioc_value": "cmv2.y3-68c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:17:00",
            "last_seen_utc": "2025-10-31 06:22:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630133": [
        {
            "ioc_value": "l8.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:07:46",
            "last_seen_utc": "2025-10-31 06:17:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630130": [
        {
            "ioc_value": "t08.y3-68c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 06:01:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630129": [
        {
            "ioc_value": "tuesdaymandatesss.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-31 06:00:19",
            "last_seen_utc": "2025-11-07 12:55:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/251031-fnk7lafv7e",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1630128": [
        {
            "ioc_value": "hvg.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 05:57:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630127": [
        {
            "ioc_value": "xr.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 05:47:28",
            "last_seen_utc": "2025-10-31 06:01:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630126": [
        {
            "ioc_value": "1l.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 05:36:34",
            "last_seen_utc": "2025-10-31 05:39:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630125": [
        {
            "ioc_value": "9az.y3-68c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 05:30:59",
            "last_seen_utc": "2025-10-31 05:39:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630124": [
        {
            "ioc_value": "t6y.hab77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 05:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630123": [
        {
            "ioc_value": "js.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 05:28:20",
            "last_seen_utc": "2025-10-31 05:30:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630122": [
        {
            "ioc_value": "z3.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 05:18:02",
            "last_seen_utc": "2025-10-31 05:19:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630121": [
        {
            "ioc_value": "wq7.y3-68c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 05:09:52",
            "last_seen_utc": "2025-10-31 05:19:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630120": [
        {
            "ioc_value": "g70.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 05:08:14",
            "last_seen_utc": "2025-10-31 05:09:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630119": [
        {
            "ioc_value": "cm.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 04:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630118": [
        {
            "ioc_value": "xla.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 04:46:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630117": [
        {
            "ioc_value": "nj.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 04:37:55",
            "last_seen_utc": "2025-10-31 04:38:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630116": [
        {
            "ioc_value": "r3k.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 04:27:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630115": [
        {
            "ioc_value": "r1m.y3-68c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 04:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630114": [
        {
            "ioc_value": "lk.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 04:17:14",
            "last_seen_utc": "2025-10-31 04:20:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630113": [
        {
            "ioc_value": "i21.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 04:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630112": [
        {
            "ioc_value": "b9k2.hab77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 04:02:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630111": [
        {
            "ioc_value": "k4.y3-68c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 04:01:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630097": [
        {
            "ioc_value": "m1.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:57:10",
            "last_seen_utc": "2025-10-31 04:02:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630096": [
        {
            "ioc_value": "75.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:47:55",
            "last_seen_utc": "2025-10-31 03:51:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630095": [
        {
            "ioc_value": "x0p.hab77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:45:15",
            "last_seen_utc": "2025-10-31 03:58:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630094": [
        {
            "ioc_value": "x0p.ey-m5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:40:33",
            "last_seen_utc": "2025-10-31 03:51:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630093": [
        {
            "ioc_value": "dv.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:38:09",
            "last_seen_utc": "2025-10-31 03:45:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630092": [
        {
            "ioc_value": "lp.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:27:52",
            "last_seen_utc": "2025-10-31 03:32:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630091": [
        {
            "ioc_value": "2zq4.ey-m5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:27:11",
            "last_seen_utc": "2025-10-31 03:32:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630090": [
        {
            "ioc_value": "lq.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:18:38",
            "last_seen_utc": "2025-10-31 03:27:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630089": [
        {
            "ioc_value": "q7m.hab77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:11:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630088": [
        {
            "ioc_value": "pq.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:07:49",
            "last_seen_utc": "2025-10-31 03:11:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630087": [
        {
            "ioc_value": "bvt.ey-m5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 03:03:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630083": [
        {
            "ioc_value": "bnd.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:57:33",
            "last_seen_utc": "2025-10-31 03:03:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630082": [
        {
            "ioc_value": "h91.ey-m5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630080": [
        {
            "ioc_value": "fx.doubao.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-31 02:48:28",
            "last_seen_utc": "2025-12-14 11:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1630079": [
        {
            "ioc_value": "aws.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:47:13",
            "last_seen_utc": "2025-10-31 02:49:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630078": [
        {
            "ioc_value": "op.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630077": [
        {
            "ioc_value": "v1.hab77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:37:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630076": [
        {
            "ioc_value": "n3d.ey-m5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:30:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630075": [
        {
            "ioc_value": "q1.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:28:14",
            "last_seen_utc": "2025-10-31 02:37:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630074": [
        {
            "ioc_value": "wnf.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:16:53",
            "last_seen_utc": "2025-10-31 02:20:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1630073": [
        {
            "ioc_value": "q6.ey-m5t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:08:37",
            "last_seen_utc": "2025-10-31 02:20:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1630049": [
        {
            "ioc_value": "t2w9.kat31o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:03:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629996": [
        {
            "ioc_value": "4o2.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 02:02:00",
            "last_seen_utc": "2025-10-31 02:08:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629937": [
        {
            "ioc_value": "e4.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629936": [
        {
            "ioc_value": "wth.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:48:02",
            "last_seen_utc": "2025-10-31 01:54:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629935": [
        {
            "ioc_value": "v8x.ey-l2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:42:17",
            "last_seen_utc": "2025-10-31 01:54:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629934": [
        {
            "ioc_value": "ihx.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:38:05",
            "last_seen_utc": "2025-10-31 01:42:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629933": [
        {
            "ioc_value": "0q.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:27:24",
            "last_seen_utc": "2025-10-31 01:33:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629932": [
        {
            "ioc_value": "r4n.kat31o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:25:20",
            "last_seen_utc": "2025-10-31 01:39:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629931": [
        {
            "ioc_value": "a2h4.ey-l2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:22:31",
            "last_seen_utc": "2025-10-31 01:33:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629930": [
        {
            "ioc_value": "95f.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:18:38",
            "last_seen_utc": "2025-10-31 01:25:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629929": [
        {
            "ioc_value": "zf0.ey-l2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:09:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629928": [
        {
            "ioc_value": "xeq.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 01:04:17",
            "last_seen_utc": "2025-10-31 01:09:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629927": [
        {
            "ioc_value": "oct.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 00:57:04",
            "last_seen_utc": "2025-10-31 00:59:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629926": [
        {
            "ioc_value": "pi1.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 00:48:19",
            "last_seen_utc": "2025-10-31 00:48:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629925": [
        {
            "ioc_value": "m0k4.kat31o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 00:44:22",
            "last_seen_utc": "2025-10-31 00:58:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629924": [
        {
            "ioc_value": "tq1.ey-l2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 00:44:02",
            "last_seen_utc": "2025-10-31 00:59:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629923": [
        {
            "ioc_value": "w8.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 00:37:53",
            "last_seen_utc": "2025-10-31 00:44:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629922": [
        {
            "ioc_value": "9hm.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 00:27:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629921": [
        {
            "ioc_value": "m9k.ey-l2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 00:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629920": [
        {
            "ioc_value": "pe5.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 00:18:45",
            "last_seen_utc": "2025-10-31 00:19:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629919": [
        {
            "ioc_value": "nn.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-31 00:07:57",
            "last_seen_utc": "2025-10-31 00:10:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629918": [
        {
            "ioc_value": "z8q.kat31o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629917": [
        {
            "ioc_value": "w0.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:57:31",
            "last_seen_utc": "2025-10-31 00:01:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629757": [
        {
            "ioc_value": "p7.ey-l2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:51:54",
            "last_seen_utc": "2025-10-31 00:10:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629754": [
        {
            "ioc_value": "k3.kat31o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:47:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629753": [
        {
            "ioc_value": "ga9.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:47:15",
            "last_seen_utc": "2025-10-30 23:51:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629752": [
        {
            "ioc_value": "ij.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:35:20",
            "last_seen_utc": "2025-10-30 23:36:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629751": [
        {
            "ioc_value": "po.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:28:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629750": [
        {
            "ioc_value": "r3k.068xaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:27:15",
            "last_seen_utc": "2025-10-30 23:36:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629749": [
        {
            "ioc_value": "zyz.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:18:05",
            "last_seen_utc": "2025-10-30 23:27:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629748": [
        {
            "ioc_value": "t7z.lo9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:14:18",
            "last_seen_utc": "2025-10-30 23:21:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629747": [
        {
            "ioc_value": "3mb.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 23:07:47",
            "last_seen_utc": "2025-10-30 23:14:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629740": [
        {
            "ioc_value": "w9.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:54:20",
            "last_seen_utc": "2025-10-30 22:54:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629739": [
        {
            "ioc_value": "k1w.lo9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:49:04",
            "last_seen_utc": "2025-10-30 22:54:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629738": [
        {
            "ioc_value": "g4j.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:48:07",
            "last_seen_utc": "2025-10-30 22:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629737": [
        {
            "ioc_value": "h2v.068xaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:47:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629736": [
        {
            "ioc_value": "7r.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:37:37",
            "last_seen_utc": "2025-10-30 22:47:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629735": [
        {
            "ioc_value": "h8r.lo9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:29:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629734": [
        {
            "ioc_value": "kuc.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:27:44",
            "last_seen_utc": "2025-10-30 22:29:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629731": [
        {
            "ioc_value": "jc7.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629730": [
        {
            "ioc_value": "x.068xaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:11:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629729": [
        {
            "ioc_value": "rorectal.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-30 22:09:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629728": [
        {
            "ioc_value": "arorectal.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-30 22:08:33",
            "last_seen_utc": "2025-10-30 22:09:47",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1805263/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629726": [
        {
            "ioc_value": "698.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 22:06:08",
            "last_seen_utc": "2025-10-30 22:11:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629721": [
        {
            "ioc_value": "chuza.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:24",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629722": [
        {
            "ioc_value": "cantrqj.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:24",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629723": [
        {
            "ioc_value": "axibbyg.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:24",
            "last_seen_utc": "2025-11-19 15:36:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629724": [
        {
            "ioc_value": "alaxak.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:24",
            "last_seen_utc": "2025-11-09 21:52:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629713": [
        {
            "ioc_value": "captaix.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:23",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629714": [
        {
            "ioc_value": "litteru.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:23",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629715": [
        {
            "ioc_value": "throjvy.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:23",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629716": [
        {
            "ioc_value": "livusa.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:23",
            "last_seen_utc": "2025-11-19 15:36:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629717": [
        {
            "ioc_value": "jinga.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:23",
            "last_seen_utc": "2025-11-16 22:14:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629718": [
        {
            "ioc_value": "genusg.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:23",
            "last_seen_utc": "2025-11-16 22:14:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629719": [
        {
            "ioc_value": "dourq.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:23",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629720": [
        {
            "ioc_value": "cutccg.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-30 22:00:23",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629712": [
        {
            "ioc_value": "3tc.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 21:46:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629711": [
        {
            "ioc_value": "4n.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 21:12:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629710": [
        {
            "ioc_value": "z8.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 21:05:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629708": [
        {
            "ioc_value": "x0.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 20:50:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629707": [
        {
            "ioc_value": "g7m.068xaw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 20:45:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629706": [
        {
            "ioc_value": "itz.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 20:40:24",
            "last_seen_utc": "2025-10-30 20:45:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629704": [
        {
            "ioc_value": "so.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 20:30:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629703": [
        {
            "ioc_value": "1h.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 20:26:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629702": [
        {
            "ioc_value": "ms.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 20:22:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629700": [
        {
            "ioc_value": "bxl.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 20:09:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629694": [
        {
            "ioc_value": "ut.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 19:40:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629693": [
        {
            "ioc_value": "l3y.lo9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 19:33:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629692": [
        {
            "ioc_value": "g0.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 19:28:20",
            "last_seen_utc": "2025-10-30 19:33:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629691": [
        {
            "ioc_value": "k2w.122suj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 19:26:06",
            "last_seen_utc": "2025-10-30 19:30:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629690": [
        {
            "ioc_value": "d5n.lo9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 19:22:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629689": [
        {
            "ioc_value": "2b3.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 19:20:29",
            "last_seen_utc": "2025-10-30 19:26:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629687": [
        {
            "ioc_value": "xpx.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-30 19:14:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1629685": [
        {
            "ioc_value": "u6b.lo9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 19:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629684": [
        {
            "ioc_value": "s16.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 19:05:30",
            "last_seen_utc": "2025-10-30 19:07:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629683": [
        {
            "ioc_value": "p2t.lo9q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:54:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629681": [
        {
            "ioc_value": "h5.122suj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:51:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629677": [
        {
            "ioc_value": "vvp.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:47:58",
            "last_seen_utc": "2025-10-30 18:54:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629671": [
        {
            "ioc_value": "s9e.mi7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:40:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629669": [
        {
            "ioc_value": "9d4.w1um.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:38:01",
            "last_seen_utc": "2025-10-30 21:21:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629668": [
        {
            "ioc_value": "xpx.aidexcel.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-30 18:36:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1629666": [
        {
            "ioc_value": "6tm.ty9a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:27:41",
            "last_seen_utc": "2025-10-30 18:28:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629665": [
        {
            "ioc_value": "g4m.mi7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:22:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629664": [
        {
            "ioc_value": "5ct.fa3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:19:23",
            "last_seen_utc": "2025-10-30 18:22:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629662": [
        {
            "ioc_value": "n0x.mi7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:13:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629661": [
        {
            "ioc_value": "c1z.122suj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:08:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629660": [
        {
            "ioc_value": "65.ha7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:08:04",
            "last_seen_utc": "2025-10-30 18:13:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629655": [
        {
            "ioc_value": "vq8.mi7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 18:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629654": [
        {
            "ioc_value": "3z.te8x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:57:52",
            "last_seen_utc": "2025-10-30 18:00:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629653": [
        {
            "ioc_value": "edh.q4zi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:51:18",
            "last_seen_utc": "2025-10-30 17:55:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629652": [
        {
            "ioc_value": "c1d.mi7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:49:54",
            "last_seen_utc": "2025-10-30 17:55:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629651": [
        {
            "ioc_value": "yk5.mi7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:41:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629650": [
        {
            "ioc_value": "3f.p7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:38:18",
            "last_seen_utc": "2025-10-30 17:49:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629649": [
        {
            "ioc_value": "vhu.ru6q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:32:28",
            "last_seen_utc": "2025-10-30 17:41:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629648": [
        {
            "ioc_value": "ufb.b9sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:27:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629647": [
        {
            "ioc_value": "55i.j3ve.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:22:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629646": [
        {
            "ioc_value": "r7a.mi7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:21:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629645": [
        {
            "ioc_value": "3a.xo3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:09:47",
            "last_seen_utc": "2025-10-30 17:21:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629644": [
        {
            "ioc_value": "y4w1.565fit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:05:32",
            "last_seen_utc": "2025-10-30 17:14:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629643": [
        {
            "ioc_value": "c1.di5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 17:01:27",
            "last_seen_utc": "2025-10-30 17:05:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629642": [
        {
            "ioc_value": "93.se5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:57:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629641": [
        {
            "ioc_value": "hum.ke9t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:48:28",
            "last_seen_utc": "2025-10-30 16:52:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629640": [
        {
            "ioc_value": "j2p.mi7x.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:47:50",
            "last_seen_utc": "2025-10-30 16:52:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629639": [
        {
            "ioc_value": "d0k.565fit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:46:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629638": [
        {
            "ioc_value": "c8.yf-l3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:38:44",
            "last_seen_utc": "2025-10-30 16:47:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629637": [
        {
            "ioc_value": "p0.yf-l3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:28:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629636": [
        {
            "ioc_value": "v9p3.565fit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629635": [
        {
            "ioc_value": "w4.xa4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:23:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629634": [
        {
            "ioc_value": "x2.ew-w3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:19:28",
            "last_seen_utc": "2025-10-30 16:27:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629633": [
        {
            "ioc_value": "m8.ew-w3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 16:09:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629629": [
        {
            "ioc_value": "mbasic.celticcommunications.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-30 16:01:42",
            "last_seen_utc": "2025-10-30 23:00:48",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/46.62.143.99+mbasic.celticcommunications.co",
            "tags": "AS24940,censys,EvilGinx,HETZNER-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629630": [
        {
            "ioc_value": "l.celticcommunications.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-30 16:01:42",
            "last_seen_utc": "2025-10-30 23:00:49",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/46.62.143.99+l.celticcommunications.co",
            "tags": "AS24940,censys,EvilGinx,HETZNER-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629619": [
        {
            "ioc_value": "tn.xa4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 15:43:25",
            "last_seen_utc": "2025-10-30 15:53:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629616": [
        {
            "ioc_value": "q1.if-p4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 15:38:16",
            "last_seen_utc": "2025-10-30 15:53:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629614": [
        {
            "ioc_value": "b1.uz-k9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 15:21:06",
            "last_seen_utc": "2025-10-30 15:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629613": [
        {
            "ioc_value": "m2x.565fit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 15:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629612": [
        {
            "ioc_value": "hk.xa4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 15:15:39",
            "last_seen_utc": "2025-10-30 15:30:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629611": [
        {
            "ioc_value": "r7.uz-k9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 15:08:56",
            "last_seen_utc": "2025-10-30 15:20:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629610": [
        {
            "ioc_value": "b2.xa4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 14:54:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629609": [
        {
            "ioc_value": "t.yo11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 14:52:19",
            "last_seen_utc": "2025-10-30 14:54:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629608": [
        {
            "ioc_value": "q7.565fit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 14:43:21",
            "last_seen_utc": "2025-10-30 15:43:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629607": [
        {
            "ioc_value": "n3.yo11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 14:37:12",
            "last_seen_utc": "2025-10-30 14:43:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629606": [
        {
            "ioc_value": "z9.xa4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 14:35:26",
            "last_seen_utc": "2025-10-30 14:39:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629605": [
        {
            "ioc_value": "b.yy88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 14:25:04",
            "last_seen_utc": "2025-10-30 14:35:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629604": [
        {
            "ioc_value": "p5g1.78nsy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 14:21:00",
            "last_seen_utc": "2025-10-30 14:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629603": [
        {
            "ioc_value": "m3.xa4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 14:15:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629602": [
        {
            "ioc_value": "k9.yy88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 14:08:15",
            "last_seen_utc": "2025-10-30 14:21:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629601": [
        {
            "ioc_value": "s.ie45.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629600": [
        {
            "ioc_value": "qx.xa4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:46:24",
            "last_seen_utc": "2025-10-30 13:55:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629599": [
        {
            "ioc_value": "w1.ie45.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:45:26",
            "last_seen_utc": "2025-10-30 13:55:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629598": [
        {
            "ioc_value": "m.78nsy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:40:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629597": [
        {
            "ioc_value": "h3.0f78.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:38:58",
            "last_seen_utc": "2025-10-30 13:46:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629596": [
        {
            "ioc_value": "q9vz.78nsy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:24:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629595": [
        {
            "ioc_value": "q.0f78.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:22:44",
            "last_seen_utc": "2025-10-30 13:25:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629577": [
        {
            "ioc_value": "fixprjajaa.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-30 13:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/3278fd5fc57c782e9c3a04933c83571c379504eee91c4aee5fff11b46e1234a5/",
            "tags": "FixStealer,infostealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1629586": [
        {
            "ioc_value": "fellsminjs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-30 13:19:49",
            "last_seen_utc": "2025-10-30 13:11:03",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115463281237820209",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1629591": [
        {
            "ioc_value": "southerngun.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-30 13:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115463281237820209",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1629594": [
        {
            "ioc_value": "a7.xa4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:19:44",
            "last_seen_utc": "2025-10-30 13:25:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629583": [
        {
            "ioc_value": "x7.5v05.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:09:13",
            "last_seen_utc": "2025-10-30 13:20:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629582": [
        {
            "ioc_value": "t0k.78nsy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 13:04:09",
            "last_seen_utc": "2025-10-30 13:20:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629581": [
        {
            "ioc_value": "m.5v05.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 12:59:03",
            "last_seen_utc": "2025-10-30 13:04:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629579": [
        {
            "ioc_value": "k0y.ju8r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 12:45:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629578": [
        {
            "ioc_value": "z1.8g89.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 12:40:35",
            "last_seen_utc": "2025-10-30 12:45:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629576": [
        {
            "ioc_value": "s9t.ju8r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 12:28:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629575": [
        {
            "ioc_value": "a.8g89.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 12:26:24",
            "last_seen_utc": "2025-10-30 12:28:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629573": [
        {
            "ioc_value": "y4c.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 12:07:41",
            "last_seen_utc": "2025-10-30 12:11:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629572": [
        {
            "ioc_value": "sheep.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-10-30 12:03:49",
            "last_seen_utc": "2025-11-07 12:55:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251030-jynbgsxmcs",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629569": [
        {
            "ioc_value": "E0925-38257.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-30 12:01:42",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251030-ml33ysgs5f",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629567": [
        {
            "ioc_value": "teo875-33757.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-30 12:01:41",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251030-nsgzqsxpgl",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629564": [
        {
            "ioc_value": "envio.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-30 12:00:53",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251030-jwn51axmbz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629563": [
        {
            "ioc_value": "ever-lamp.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-30 12:00:52",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251030-m16sdsyrhx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629562": [
        {
            "ioc_value": "added-aurora.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-30 12:00:51",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251030-nn6gjahk4x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629559": [
        {
            "ioc_value": "j2m.ju8r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 11:58:37",
            "last_seen_utc": "2025-10-30 12:11:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629558": [
        {
            "ioc_value": "b2.78nsy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 11:52:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629557": [
        {
            "ioc_value": "77w.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 11:51:35",
            "last_seen_utc": "2025-10-30 11:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629464": [
        {
            "ioc_value": "iloveboats9.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-30 11:44:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "solostalking"
        }
    ],
    "1629555": [
        {
            "ioc_value": "ipu.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 11:39:09",
            "last_seen_utc": "2025-10-30 11:45:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629554": [
        {
            "ioc_value": "t5m.60nma5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 11:37:19",
            "last_seen_utc": "2025-10-30 11:45:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629553": [
        {
            "ioc_value": "n6d.ju8r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 11:35:03",
            "last_seen_utc": "2025-10-30 11:39:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629552": [
        {
            "ioc_value": "aw9.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 11:28:16",
            "last_seen_utc": "2025-10-30 11:37:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629549": [
        {
            "ioc_value": "nv5.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-30 11:13:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1629550": [
        {
            "ioc_value": "nv5.united-gs.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-30 11:13:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1629546": [
        {
            "ioc_value": "n9v.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 11:11:08",
            "last_seen_utc": "2025-10-30 11:14:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629545": [
        {
            "ioc_value": "r5q.ju8r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 11:09:43",
            "last_seen_utc": "2025-10-30 11:14:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629520": [
        {
            "ioc_value": "b.60nma5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:59:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629519": [
        {
            "ioc_value": "xla.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:56:26",
            "last_seen_utc": "2025-10-30 11:09:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629518": [
        {
            "ioc_value": "w1z.ju8r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:54:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629517": [
        {
            "ioc_value": "qbd.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:50:51",
            "last_seen_utc": "2025-10-30 10:54:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629516": [
        {
            "ioc_value": "6hu.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:38:48",
            "last_seen_utc": "2025-10-30 10:40:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629515": [
        {
            "ioc_value": "c8u.ju8r.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:34:55",
            "last_seen_utc": "2025-10-30 10:40:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629514": [
        {
            "ioc_value": "r0n9.60nma5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:32:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629513": [
        {
            "ioc_value": "q9a.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:23:18",
            "last_seen_utc": "2025-10-30 10:34:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629512": [
        {
            "ioc_value": "t7p.v3ix.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:22:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629511": [
        {
            "ioc_value": "879.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 10:07:27",
            "last_seen_utc": "2025-10-30 10:22:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629510": [
        {
            "ioc_value": "a12.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:57:46",
            "last_seen_utc": "2025-10-30 10:00:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629509": [
        {
            "ioc_value": "ze.v3ix.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:56:59",
            "last_seen_utc": "2025-10-30 10:00:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629508": [
        {
            "ioc_value": "c1z.60nma5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:53:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629507": [
        {
            "ioc_value": "9x2.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:47:57",
            "last_seen_utc": "2025-10-30 09:56:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629506": [
        {
            "ioc_value": "rsm.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:38:02",
            "last_seen_utc": "2025-10-30 09:42:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629505": [
        {
            "ioc_value": "q4m.v3ix.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:31:16",
            "last_seen_utc": "2025-10-30 09:42:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629504": [
        {
            "ioc_value": "qgb.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:24:40",
            "last_seen_utc": "2025-10-30 09:31:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629503": [
        {
            "ioc_value": "p4r.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:12:19",
            "last_seen_utc": "2025-10-30 09:14:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629502": [
        {
            "ioc_value": "8tk.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:04:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629501": [
        {
            "ioc_value": "y2.02lxy3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:04:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629500": [
        {
            "ioc_value": "s0up.s7li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 09:02:23",
            "last_seen_utc": "2025-10-30 09:14:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629498": [
        {
            "ioc_value": "bud.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 08:57:26",
            "last_seen_utc": "2025-10-30 09:04:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629496": [
        {
            "ioc_value": "d6k1.02lxy3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 08:49:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629481": [
        {
            "ioc_value": "b1rd.s7li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 08:43:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629465": [
        {
            "ioc_value": "911.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 08:40:15",
            "last_seen_utc": "2025-10-30 08:49:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629463": [
        {
            "ioc_value": "hlp.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 08:29:50",
            "last_seen_utc": "2025-10-30 08:34:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629462": [
        {
            "ioc_value": "8xd.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 08:25:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629461": [
        {
            "ioc_value": "m00n.s7li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 08:24:22",
            "last_seen_utc": "2025-10-30 08:34:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629459": [
        {
            "ioc_value": "glu.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 08:19:05",
            "last_seen_utc": "2025-10-30 08:24:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629458": [
        {
            "ioc_value": "vth.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 08:08:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629438": [
        {
            "ioc_value": "t3s.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:57:39",
            "last_seen_utc": "2025-10-30 08:07:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629437": [
        {
            "ioc_value": "g00d.s7li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:57:04",
            "last_seen_utc": "2025-10-30 08:08:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629436": [
        {
            "ioc_value": "v7pz.02lxy3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:54:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629435": [
        {
            "ioc_value": "za9.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:47:38",
            "last_seen_utc": "2025-10-30 07:57:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629434": [
        {
            "ioc_value": "fv5.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:37:20",
            "last_seen_utc": "2025-10-30 07:38:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629433": [
        {
            "ioc_value": "plum.s7li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:30:11",
            "last_seen_utc": "2025-10-30 07:38:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629432": [
        {
            "ioc_value": "9ij.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:27:21",
            "last_seen_utc": "2025-10-30 07:30:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629431": [
        {
            "ioc_value": "m5o.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:24:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629430": [
        {
            "ioc_value": "ajs.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629072": [
        {
            "ioc_value": "perropa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-30 07:14:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1629073": [
        {
            "ioc_value": "menuderg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-30 07:14:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1629111": [
        {
            "ioc_value": "cdn.m365.1drive.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-30 07:14:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/144.172.109.53+cdn.m365.1drive.zip",
            "tags": "AS14956,C2,censys,Mythic,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1629112": [
        {
            "ioc_value": "beautybalcony.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-30 07:14:32",
            "last_seen_utc": "2025-10-30 00:02:57",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/195.123.240.47+beautybalcony.com",
            "tags": "AS204957,C2,censys,GREENFLOID-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1629359": [
        {
            "ioc_value": "75nahgyu2.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-30 07:14:24",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/file/a13c4568567428c81cdf7fd12b6f3ad002dd96f9977b595368ee4d731944f2eb/relations",
            "tags": "c2",
            "anonymous": "0",
            "reporter": "vovaan"
        }
    ],
    "1629360": [
        {
            "ioc_value": "he.75nahgyu2.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-30 07:14:22",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/file/a13c4568567428c81cdf7fd12b6f3ad002dd96f9977b595368ee4d731944f2eb/relations",
            "tags": "c2",
            "anonymous": "0",
            "reporter": "vovaan"
        }
    ],
    "1629361": [
        {
            "ioc_value": "smo.75nahgyu2.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-30 07:14:21",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/file/a13c4568567428c81cdf7fd12b6f3ad002dd96f9977b595368ee4d731944f2eb/relations",
            "tags": "c2",
            "anonymous": "0",
            "reporter": "vovaan"
        }
    ],
    "1629429": [
        {
            "ioc_value": "dune.s7li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:09:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629428": [
        {
            "ioc_value": "mrj.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 07:07:00",
            "last_seen_utc": "2025-10-30 07:09:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629427": [
        {
            "ioc_value": "b23.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:58:10",
            "last_seen_utc": "2025-10-30 07:03:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629426": [
        {
            "ioc_value": "mow.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:47:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629425": [
        {
            "ioc_value": "r0se.ze9y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:41:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629424": [
        {
            "ioc_value": "f78.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:37:33",
            "last_seen_utc": "2025-10-30 06:41:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629423": [
        {
            "ioc_value": "eaa.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:27:45",
            "last_seen_utc": "2025-10-30 06:31:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629422": [
        {
            "ioc_value": "rk8.7g37b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:23:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629421": [
        {
            "ioc_value": "l00k.ze9y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:22:22",
            "last_seen_utc": "2025-10-30 06:31:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629420": [
        {
            "ioc_value": "p19.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:18:29",
            "last_seen_utc": "2025-10-30 06:23:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629419": [
        {
            "ioc_value": "d29.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:07:11",
            "last_seen_utc": "2025-10-30 06:09:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629417": [
        {
            "ioc_value": "mint.ze9y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 06:00:24",
            "last_seen_utc": "2025-10-30 06:09:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629416": [
        {
            "ioc_value": "wlk.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 05:57:25",
            "last_seen_utc": "2025-10-30 06:00:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629413": [
        {
            "ioc_value": "gzt.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 05:48:08",
            "last_seen_utc": "2025-10-30 05:54:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629412": [
        {
            "ioc_value": "bark.ze9y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 05:45:32",
            "last_seen_utc": "2025-10-30 05:50:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629411": [
        {
            "ioc_value": "muj.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 05:38:21",
            "last_seen_utc": "2025-10-30 05:45:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629410": [
        {
            "ioc_value": "tir.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 05:28:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629409": [
        {
            "ioc_value": "3le.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 05:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629408": [
        {
            "ioc_value": "2b9k.ye-t5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 05:12:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629407": [
        {
            "ioc_value": "7bv.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 05:07:55",
            "last_seen_utc": "2025-10-30 05:12:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629406": [
        {
            "ioc_value": "yrg.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:58:02",
            "last_seen_utc": "2025-10-30 05:02:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629405": [
        {
            "ioc_value": "rmx.ye-t5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:50:12",
            "last_seen_utc": "2025-10-30 05:02:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629404": [
        {
            "ioc_value": "h2v.7g37b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:49:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629403": [
        {
            "ioc_value": "svc.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:47:16",
            "last_seen_utc": "2025-10-30 04:50:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629402": [
        {
            "ioc_value": "bwp.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:39:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629401": [
        {
            "ioc_value": "xpx.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:36:09",
            "last_seen_utc": "2025-10-30 04:38:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629400": [
        {
            "ioc_value": "h71.ye-t5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:32:42",
            "last_seen_utc": "2025-10-30 04:38:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629399": [
        {
            "ioc_value": "epw.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:30:28",
            "last_seen_utc": "2025-10-30 04:32:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629398": [
        {
            "ioc_value": "npo.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:07:27",
            "last_seen_utc": "2025-10-30 04:16:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629397": [
        {
            "ioc_value": "0wq.ye-t5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 04:05:54",
            "last_seen_utc": "2025-10-30 04:16:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629381": [
        {
            "ioc_value": "nyd.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:58:00",
            "last_seen_utc": "2025-10-30 04:05:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629380": [
        {
            "ioc_value": "tj3.ye-t5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:50:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629379": [
        {
            "ioc_value": "x.7g37b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:49:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629378": [
        {
            "ioc_value": "a19.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:48:44",
            "last_seen_utc": "2025-10-30 03:50:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629377": [
        {
            "ioc_value": "gsd.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:37:46",
            "last_seen_utc": "2025-10-30 03:39:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629376": [
        {
            "ioc_value": "z0d.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:27:27",
            "last_seen_utc": "2025-10-30 03:34:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629375": [
        {
            "ioc_value": "g8.ye-t5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:27:02",
            "last_seen_utc": "2025-10-30 03:39:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629374": [
        {
            "ioc_value": "cct.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:17:39",
            "last_seen_utc": "2025-10-30 03:27:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629373": [
        {
            "ioc_value": "d2a5.5no-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:11:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629372": [
        {
            "ioc_value": "j83.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:07:08",
            "last_seen_utc": "2025-10-30 03:11:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629371": [
        {
            "ioc_value": "1z.5no-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 03:02:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629370": [
        {
            "ioc_value": "n84.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:58:23",
            "last_seen_utc": "2025-10-30 03:02:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629369": [
        {
            "ioc_value": "qpr.5no-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:52:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629368": [
        {
            "ioc_value": "ewd.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:47:05",
            "last_seen_utc": "2025-10-30 02:52:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629367": [
        {
            "ioc_value": "m94.5no-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:45:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629365": [
        {
            "ioc_value": "y0q9.7g37b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:43:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629363": [
        {
            "ioc_value": "vkp.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:42:54",
            "last_seen_utc": "2025-10-30 02:45:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629362": [
        {
            "ioc_value": "405.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:38:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629358": [
        {
            "ioc_value": "c7t.5no-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:28:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629357": [
        {
            "ioc_value": "c99.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:27:55",
            "last_seen_utc": "2025-10-30 02:36:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629356": [
        {
            "ioc_value": "g7x.7g37b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629355": [
        {
            "ioc_value": "cbo.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:17:39",
            "last_seen_utc": "2025-10-30 02:28:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629353": [
        {
            "ioc_value": "uv4.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:07:51",
            "last_seen_utc": "2025-10-30 02:08:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629352": [
        {
            "ioc_value": "yx.5no-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 02:02:42",
            "last_seen_utc": "2025-10-30 02:08:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629351": [
        {
            "ioc_value": "jcr.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:58:37",
            "last_seen_utc": "2025-10-30 02:02:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629170": [
        {
            "ioc_value": "n4.7g37b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629169": [
        {
            "ioc_value": "b0r9.7si-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:45:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629168": [
        {
            "ioc_value": "h07.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:44:15",
            "last_seen_utc": "2025-10-30 01:47:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629167": [
        {
            "ioc_value": "n4y.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:37:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629166": [
        {
            "ioc_value": "fh9.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:27:10",
            "last_seen_utc": "2025-10-30 01:30:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629165": [
        {
            "ioc_value": "8s3.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:18:56",
            "last_seen_utc": "2025-10-30 01:22:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629164": [
        {
            "ioc_value": "xk2.7si-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:14:16",
            "last_seen_utc": "2025-10-30 01:30:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629163": [
        {
            "ioc_value": "r9q.2s84d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:14:10",
            "last_seen_utc": "2025-10-30 01:29:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629162": [
        {
            "ioc_value": "vyt.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 01:08:05",
            "last_seen_utc": "2025-10-30 01:14:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629161": [
        {
            "ioc_value": "h27.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:57:47",
            "last_seen_utc": "2025-10-30 01:03:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629160": [
        {
            "ioc_value": "4m.7si-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:56:03",
            "last_seen_utc": "2025-10-30 01:03:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629159": [
        {
            "ioc_value": "gp3.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:48:01",
            "last_seen_utc": "2025-10-30 00:56:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629158": [
        {
            "ioc_value": "pnq.7si-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:39:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629157": [
        {
            "ioc_value": "g42.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:37:42",
            "last_seen_utc": "2025-10-30 00:39:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629156": [
        {
            "ioc_value": "rh6.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:27:49",
            "last_seen_utc": "2025-10-30 00:35:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629155": [
        {
            "ioc_value": "v31.7si-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:20:25",
            "last_seen_utc": "2025-10-30 00:35:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629154": [
        {
            "ioc_value": "6i4.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:18:25",
            "last_seen_utc": "2025-10-30 00:20:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629153": [
        {
            "ioc_value": "d5.2s84d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:15:51",
            "last_seen_utc": "2025-10-30 00:29:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629149": [
        {
            "ioc_value": "a7.7si-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:02:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629148": [
        {
            "ioc_value": "y27.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-30 00:00:25",
            "last_seen_utc": "2025-10-30 00:15:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629144": [
        {
            "ioc_value": "feromonesbones.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-29 23:43:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1803706/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629143": [
        {
            "ioc_value": "ljutyojkfgjkfnmf.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-29 23:42:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1803720/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629141": [
        {
            "ioc_value": "unfet.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:59",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629142": [
        {
            "ioc_value": "eleciso.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:59",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629123": [
        {
            "ioc_value": "imbibei.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629124": [
        {
            "ioc_value": "dimityk.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629125": [
        {
            "ioc_value": "databap.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629126": [
        {
            "ioc_value": "puntoc.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629127": [
        {
            "ioc_value": "aspedyd.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629128": [
        {
            "ioc_value": "czarpve.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629129": [
        {
            "ioc_value": "chinij.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629130": [
        {
            "ioc_value": "lonaktm.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629131": [
        {
            "ioc_value": "caddov.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629132": [
        {
            "ioc_value": "overruq.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629133": [
        {
            "ioc_value": "corneot.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629134": [
        {
            "ioc_value": "biauob.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629135": [
        {
            "ioc_value": "maghaf.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629136": [
        {
            "ioc_value": "overfrz.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629137": [
        {
            "ioc_value": "middii.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629138": [
        {
            "ioc_value": "pleasuc.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629139": [
        {
            "ioc_value": "sugare.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-19 15:36:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629140": [
        {
            "ioc_value": "satet.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-29 23:34:58",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629107": [
        {
            "ioc_value": "b0t2.2s84d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 22:22:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629106": [
        {
            "ioc_value": "lvu.xa4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 22:18:02",
            "last_seen_utc": "2025-10-29 22:22:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629105": [
        {
            "ioc_value": "9hd.1ne-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 22:12:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629104": [
        {
            "ioc_value": "p0t.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 22:07:22",
            "last_seen_utc": "2025-10-29 22:12:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629101": [
        {
            "ioc_value": "wvw.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-29 22:05:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1629102": [
        {
            "ioc_value": "wvw.united-gs.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-29 22:05:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1629098": [
        {
            "ioc_value": "tq.1ne-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:56:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629097": [
        {
            "ioc_value": "x8m.2s84d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:53:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629096": [
        {
            "ioc_value": "sbh.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:51:29",
            "last_seen_utc": "2025-10-29 21:56:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629095": [
        {
            "ioc_value": "9mv.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:32:29",
            "last_seen_utc": "2025-10-29 21:35:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629094": [
        {
            "ioc_value": "movies-buzz.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-29 21:31:26",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1629091": [
        {
            "ioc_value": "zv1.1ne-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:30:54",
            "last_seen_utc": "2025-10-29 21:35:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629086": [
        {
            "ioc_value": "blessingshope100.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-29 21:30:42",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1629087": [
        {
            "ioc_value": "mangomondayyy.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-29 21:30:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1629088": [
        {
            "ioc_value": "www.abiaclassprojectpage.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-29 21:30:42",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1629089": [
        {
            "ioc_value": "www.charlesschrf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-29 21:30:42",
            "last_seen_utc": "2025-12-12 18:39:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1629090": [
        {
            "ioc_value": "zihnyunrui.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-29 21:30:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1629085": [
        {
            "ioc_value": "lux0w0w0w.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-29 21:30:25",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1629083": [
        {
            "ioc_value": "sb0vht3nf.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-29 21:29:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1629079": [
        {
            "ioc_value": "v4.2s84d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:28:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629077": [
        {
            "ioc_value": "bgq.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:27:48",
            "last_seen_utc": "2025-10-29 21:30:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629075": [
        {
            "ioc_value": "fxh.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629071": [
        {
            "ioc_value": "m2a9.1ne-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:12:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629069": [
        {
            "ioc_value": "h.3c38h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:08:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629068": [
        {
            "ioc_value": "a4t.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 21:07:36",
            "last_seen_utc": "2025-10-29 21:12:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629067": [
        {
            "ioc_value": "xyq.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:58:14",
            "last_seen_utc": "2025-10-29 21:00:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629065": [
        {
            "ioc_value": "rp8.1ne-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:54:11",
            "last_seen_utc": "2025-10-29 21:00:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629064": [
        {
            "ioc_value": "3jc.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:47:16",
            "last_seen_utc": "2025-10-29 20:54:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629063": [
        {
            "ioc_value": "k4.1ne-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:33:30",
            "last_seen_utc": "2025-10-29 20:41:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629062": [
        {
            "ioc_value": "j5a.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:33:24",
            "last_seen_utc": "2025-10-29 20:41:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629061": [
        {
            "ioc_value": "689.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:29:13",
            "last_seen_utc": "2025-10-29 20:33:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629060": [
        {
            "ioc_value": "a9.3c38h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:24:37",
            "last_seen_utc": "2025-10-29 20:35:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629059": [
        {
            "ioc_value": "qcv.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:17:51",
            "last_seen_utc": "2025-10-29 20:24:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629058": [
        {
            "ioc_value": "m0k.3c38h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:08:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629057": [
        {
            "ioc_value": "cs0.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:06:33",
            "last_seen_utc": "2025-10-29 20:08:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629055": [
        {
            "ioc_value": "g00d.da-5-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 20:02:27",
            "last_seen_utc": "2025-10-29 20:19:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629044": [
        {
            "ioc_value": "64d.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:57:46",
            "last_seen_utc": "2025-10-29 20:02:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629043": [
        {
            "ioc_value": "zq7.3c38h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:49:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629042": [
        {
            "ioc_value": "l1me.da-5-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:47:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629041": [
        {
            "ioc_value": "uny.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:47:28",
            "last_seen_utc": "2025-10-29 19:49:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629037": [
        {
            "ioc_value": "7it.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:37:42",
            "last_seen_utc": "2025-10-29 19:47:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629036": [
        {
            "ioc_value": "6wo.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:27:24",
            "last_seen_utc": "2025-10-29 19:28:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629035": [
        {
            "ioc_value": "k2.3c38h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:24:12",
            "last_seen_utc": "2025-10-29 19:28:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629034": [
        {
            "ioc_value": "foam.da-5-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:20:10",
            "last_seen_utc": "2025-10-29 19:28:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629033": [
        {
            "ioc_value": "uxg.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:18:07",
            "last_seen_utc": "2025-10-29 19:24:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629031": [
        {
            "ioc_value": "ke0.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:06:18",
            "last_seen_utc": "2025-10-29 19:14:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629030": [
        {
            "ioc_value": "flip.da-5-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 19:05:52",
            "last_seen_utc": "2025-10-29 19:14:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629029": [
        {
            "ioc_value": "lyy.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:58:03",
            "last_seen_utc": "2025-10-29 19:05:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629026": [
        {
            "ioc_value": "sak.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:47:49",
            "last_seen_utc": "2025-10-29 18:48:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629023": [
        {
            "ioc_value": "flat.da-5-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:43:49",
            "last_seen_utc": "2025-10-29 18:48:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629022": [
        {
            "ioc_value": "l1st.r-1-v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:43:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629021": [
        {
            "ioc_value": "vfp.hy6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:36:57",
            "last_seen_utc": "2025-10-29 18:43:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629020": [
        {
            "ioc_value": "0m0.n5ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:27:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629019": [
        {
            "ioc_value": "oaks.r-1-v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629018": [
        {
            "ioc_value": "qon.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:17:22",
            "last_seen_utc": "2025-10-29 18:18:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629017": [
        {
            "ioc_value": "b00k.je-9-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:15:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629016": [
        {
            "ioc_value": "c0de.r-1-v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:08:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629015": [
        {
            "ioc_value": "in9.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 18:08:04",
            "last_seen_utc": "2025-10-29 18:15:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629011": [
        {
            "ioc_value": "assistancewindows20025.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-29 18:00:55",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251029-swq42a1lev",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629009": [
        {
            "ioc_value": "armadengineering.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-29 18:00:41",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251029-syylwsal81",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1629008": [
        {
            "ioc_value": "c00l.je-9-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:58:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629007": [
        {
            "ioc_value": "dwr.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:57:15",
            "last_seen_utc": "2025-10-29 17:58:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629006": [
        {
            "ioc_value": "h1u.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:47:23",
            "last_seen_utc": "2025-10-29 17:52:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629005": [
        {
            "ioc_value": "girl.je-9-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:43:13",
            "last_seen_utc": "2025-10-29 17:52:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629004": [
        {
            "ioc_value": "puma.r-1-v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:38:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629003": [
        {
            "ioc_value": "nn3.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:34:46",
            "last_seen_utc": "2025-10-29 17:43:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629002": [
        {
            "ioc_value": "7rj.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:30:02",
            "last_seen_utc": "2025-10-29 17:33:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1629001": [
        {
            "ioc_value": "gear.je-9-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:27:42",
            "last_seen_utc": "2025-10-29 17:33:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1629000": [
        {
            "ioc_value": "57y.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:16:08",
            "last_seen_utc": "2025-10-29 17:27:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628999": [
        {
            "ioc_value": "fawn.je-9-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:09:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628998": [
        {
            "ioc_value": "11f.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 17:07:22",
            "last_seen_utc": "2025-10-29 17:09:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628997": [
        {
            "ioc_value": "m00n.x-2-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:59:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628996": [
        {
            "ioc_value": "hb3.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:56:05",
            "last_seen_utc": "2025-10-29 16:59:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628995": [
        {
            "ioc_value": "s1te.fa-0-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:49:00",
            "last_seen_utc": "2025-10-29 16:57:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628994": [
        {
            "ioc_value": "v1i.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:47:14",
            "last_seen_utc": "2025-10-29 16:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628993": [
        {
            "ioc_value": "pa5s.x-2-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:39:21",
            "last_seen_utc": "2025-10-29 16:48:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628990": [
        {
            "ioc_value": "uqb.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:35:39",
            "last_seen_utc": "2025-10-29 16:39:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628991": [
        {
            "ioc_value": "i11s.fa-0-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:35:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628989": [
        {
            "ioc_value": "bop.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:20:23",
            "last_seen_utc": "2025-10-29 16:22:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628988": [
        {
            "ioc_value": "yarn.x-2-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:12:45",
            "last_seen_utc": "2025-10-29 16:22:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628987": [
        {
            "ioc_value": "xes.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:09:10",
            "last_seen_utc": "2025-10-29 16:12:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628969": [
        {
            "ioc_value": "seb.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:00:19",
            "last_seen_utc": "2025-10-29 16:05:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628968": [
        {
            "ioc_value": "gale.x-2-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 16:00:16",
            "last_seen_utc": "2025-10-29 16:05:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628967": [
        {
            "ioc_value": "xx6.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:57:39",
            "last_seen_utc": "2025-10-29 16:00:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628960": [
        {
            "ioc_value": "polimakels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-29 15:56:53",
            "last_seen_utc": "2025-10-29 15:51:47",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115458250920283515",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1628965": [
        {
            "ioc_value": "galaxyfoundation.org.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-29 15:56:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115458250920283515",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1628958": [
        {
            "ioc_value": "1oi.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:49:54",
            "last_seen_utc": "2025-10-29 15:50:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628957": [
        {
            "ioc_value": "c0rn.fa-0-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:39:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628956": [
        {
            "ioc_value": "brim.x-2-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:39:05",
            "last_seen_utc": "2025-10-29 15:50:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628955": [
        {
            "ioc_value": "1fj.lo9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:37:35",
            "last_seen_utc": "2025-10-29 15:39:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628954": [
        {
            "ioc_value": "acp.mi7x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:27:34",
            "last_seen_utc": "2025-10-29 15:29:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628953": [
        {
            "ioc_value": "f0i1.ju-5-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:24:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628951": [
        {
            "ioc_value": "s0da.r-9-xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:17:31",
            "last_seen_utc": "2025-10-29 15:29:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628950": [
        {
            "ioc_value": "5u2.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:16:45",
            "last_seen_utc": "2025-10-29 15:24:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628949": [
        {
            "ioc_value": "7d0.ka2s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 15:07:58",
            "last_seen_utc": "2025-10-29 15:08:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628946": [
        {
            "ioc_value": "dev.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-29 15:01:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1628947": [
        {
            "ioc_value": "dev.united-gs.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-29 15:01:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1628943": [
        {
            "ioc_value": "d2l.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:57:09",
            "last_seen_utc": "2025-10-29 14:58:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628941": [
        {
            "ioc_value": "bots.kiro.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-29 14:54:52",
            "last_seen_utc": "2025-10-29 14:54:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/33e1e49c79bf62ed7b32f55fb9eb69502ffc72a53f314a0a1cc8b730c689e397/",
            "tags": "Hailbot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628939": [
        {
            "ioc_value": "l0se.ju-5-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:50:21",
            "last_seen_utc": "2025-10-29 14:58:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628938": [
        {
            "ioc_value": "gu5.v3ix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:47:52",
            "last_seen_utc": "2025-10-29 14:54:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628937": [
        {
            "ioc_value": "l1st.r-9-xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:41:11",
            "last_seen_utc": "2025-10-29 14:58:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628936": [
        {
            "ioc_value": "zy8.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:38:02",
            "last_seen_utc": "2025-10-29 14:41:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628920": [
        {
            "ioc_value": "asturiasactiva.es",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-29 14:37:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "ozeliurs"
        }
    ],
    "1628933": [
        {
            "ioc_value": "varorg.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-29 14:36:59",
            "last_seen_utc": "2025-10-29 14:32:19",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115457938732425807",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1628935": [
        {
            "ioc_value": "s0ar.ju-5-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:36:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628931": [
        {
            "ioc_value": "cove.r-9-xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628930": [
        {
            "ioc_value": "zwf.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:20:36",
            "last_seen_utc": "2025-10-29 14:36:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628929": [
        {
            "ioc_value": "knit.ju-5-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:10:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628928": [
        {
            "ioc_value": "glow.r-9-xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:09:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628927": [
        {
            "ioc_value": "wdh.bo3l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 14:07:41",
            "last_seen_utc": "2025-10-29 14:10:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628925": [
        {
            "ioc_value": "qty.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:58:25",
            "last_seen_utc": "2025-10-29 14:01:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628924": [
        {
            "ioc_value": "plum.r-9-xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:57:09",
            "last_seen_utc": "2025-10-29 14:01:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628923": [
        {
            "ioc_value": "tide.ju-5-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:53:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628921": [
        {
            "ioc_value": "xk9.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:49:09",
            "last_seen_utc": "2025-10-29 13:57:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628917": [
        {
            "ioc_value": "9jw.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:38:21",
            "last_seen_utc": "2025-10-29 13:44:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628916": [
        {
            "ioc_value": "l00k.vo-3-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:30:17",
            "last_seen_utc": "2025-10-29 13:44:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628915": [
        {
            "ioc_value": "f0b.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:28:03",
            "last_seen_utc": "2025-10-29 13:30:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628914": [
        {
            "ioc_value": "rook.ju-5-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:17:23",
            "last_seen_utc": "2025-10-29 13:28:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628913": [
        {
            "ioc_value": "dm1.r4tu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:13:42",
            "last_seen_utc": "2025-10-29 13:17:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628912": [
        {
            "ioc_value": "7cw.wi0x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:08:01",
            "last_seen_utc": "2025-10-29 13:11:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628911": [
        {
            "ioc_value": "r0se.vo-3-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 13:05:18",
            "last_seen_utc": "2025-10-29 13:17:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628910": [
        {
            "ioc_value": "ogj.po5m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:57:38",
            "last_seen_utc": "2025-10-29 13:05:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628908": [
        {
            "ioc_value": "dune.vo-3-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:50:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628907": [
        {
            "ioc_value": "cki.fe7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:48:41",
            "last_seen_utc": "2025-10-29 12:50:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628906": [
        {
            "ioc_value": "qje.ra6n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:36:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628905": [
        {
            "ioc_value": "wq7.1z22k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:33:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628904": [
        {
            "ioc_value": "tvx.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:30:39",
            "last_seen_utc": "2025-10-29 12:33:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628903": [
        {
            "ioc_value": "mint.vo-3-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:22:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628902": [
        {
            "ioc_value": "q2v.ju8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:18:27",
            "last_seen_utc": "2025-10-29 12:22:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628900": [
        {
            "ioc_value": "nfs8u9aw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-29 12:15:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/L0Psec/status/1982917091956236737",
            "tags": "macho,macos",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628901": [
        {
            "ioc_value": "ad4rchr39w8f.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-29 12:15:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/L0Psec/status/1982917091956236737",
            "tags": "macho,macos",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628898": [
        {
            "ioc_value": "zppd.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-29 12:09:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628899": [
        {
            "ioc_value": "urclive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-29 12:09:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628896": [
        {
            "ioc_value": "rwmb.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-29 12:09:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628897": [
        {
            "ioc_value": "www.hasist.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-29 12:09:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628895": [
        {
            "ioc_value": "hmd.gl8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:05:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628894": [
        {
            "ioc_value": "d5m9.1z22k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 12:04:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628890": [
        {
            "ioc_value": "windefenderconection.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-29 12:01:20",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 100,
            "reference": "https://tria.ge/251029-lga1yavpbq",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628886": [
        {
            "ioc_value": "takes-thinkpad.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-29 12:00:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251029-ncjtdsfw5f",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628884": [
        {
            "ioc_value": "yu2.ze9y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:58:03",
            "last_seen_utc": "2025-10-29 12:04:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628883": [
        {
            "ioc_value": "bark.vo-3-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:55:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628882": [
        {
            "ioc_value": "xc6.s7li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:47:57",
            "last_seen_utc": "2025-10-29 11:55:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628845": [
        {
            "ioc_value": "www.aadcdnn.m365.1drive.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-29 11:44:56",
            "last_seen_utc": "2025-10-29 11:00:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/144.172.109.53+www.aadcdnn.m365.1drive.zip",
            "tags": "AS14956,C2,censys,Mythic,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1628836": [
        {
            "ioc_value": "secureapimiddleware.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:44:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "ge0lev"
        }
    ],
    "1628881": [
        {
            "ioc_value": "k0.1z22k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:38:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628879": [
        {
            "ioc_value": "fun.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:37:57",
            "last_seen_utc": "2025-10-29 11:39:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628878": [
        {
            "ioc_value": "goat.tu-7-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:29:49",
            "last_seen_utc": "2025-10-29 11:39:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628877": [
        {
            "ioc_value": "hay.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:27:40",
            "last_seen_utc": "2025-10-29 11:29:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628876": [
        {
            "ioc_value": "f1g.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628875": [
        {
            "ioc_value": "fab.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:08:33",
            "last_seen_utc": "2025-10-29 11:13:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628874": [
        {
            "ioc_value": "golf.tu-7-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 11:03:05",
            "last_seen_utc": "2025-10-29 11:13:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628840": [
        {
            "ioc_value": "u1x.1z22k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:59:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628839": [
        {
            "ioc_value": "boa.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:58:15",
            "last_seen_utc": "2025-10-29 11:03:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628832": [
        {
            "ioc_value": "joy.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:48:27",
            "last_seen_utc": "2025-10-29 10:50:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628830": [
        {
            "ioc_value": "s3.1z22k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:45:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628829": [
        {
            "ioc_value": "dune.tu-7-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:40:25",
            "last_seen_utc": "2025-10-29 10:50:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628828": [
        {
            "ioc_value": "fix.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:38:28",
            "last_seen_utc": "2025-10-29 10:45:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628827": [
        {
            "ioc_value": "bee.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:28:10",
            "last_seen_utc": "2025-10-29 10:32:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628826": [
        {
            "ioc_value": "jar.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:18:50",
            "last_seen_utc": "2025-10-29 10:21:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628825": [
        {
            "ioc_value": "b1rd.tu-7-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:16:32",
            "last_seen_utc": "2025-10-29 10:32:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628824": [
        {
            "ioc_value": "m0x.6wou3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:09:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628823": [
        {
            "ioc_value": "dug.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 10:07:31",
            "last_seen_utc": "2025-10-29 10:16:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628822": [
        {
            "ioc_value": "s00n.tu-7-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:59:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628821": [
        {
            "ioc_value": "hub.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:57:44",
            "last_seen_utc": "2025-10-29 09:59:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628819": [
        {
            "ioc_value": "c0p.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:48:59",
            "last_seen_utc": "2025-10-29 09:53:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628818": [
        {
            "ioc_value": "lag.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:37:26",
            "last_seen_utc": "2025-10-29 09:41:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628817": [
        {
            "ioc_value": "m1lk.pi-6-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:31:00",
            "last_seen_utc": "2025-10-29 09:53:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628816": [
        {
            "ioc_value": "age.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:28:09",
            "last_seen_utc": "2025-10-29 09:31:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628811": [
        {
            "ioc_value": "q.6wou3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628810": [
        {
            "ioc_value": "nay.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:12:14",
            "last_seen_utc": "2025-10-29 09:19:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628809": [
        {
            "ioc_value": "rig.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:09:32",
            "last_seen_utc": "2025-10-29 09:09:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628808": [
        {
            "ioc_value": "p00l.pi-6-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 09:00:51",
            "last_seen_utc": "2025-10-29 09:14:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628807": [
        {
            "ioc_value": "5ap.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:53:57",
            "last_seen_utc": "2025-10-29 09:00:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628804": [
        {
            "ioc_value": "red.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:47:44",
            "last_seen_utc": "2025-10-29 08:53:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628800": [
        {
            "ioc_value": "lab.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:38:59",
            "last_seen_utc": "2025-10-29 08:44:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628799": [
        {
            "ioc_value": "f6.6wou3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:35:17",
            "last_seen_utc": "2025-10-29 08:44:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628798": [
        {
            "ioc_value": "hark.pi-6-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:33:51",
            "last_seen_utc": "2025-10-29 08:53:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628797": [
        {
            "ioc_value": "see.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:29:12",
            "last_seen_utc": "2025-10-29 08:35:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628796": [
        {
            "ioc_value": "1id.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:17:17",
            "last_seen_utc": "2025-10-29 08:22:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628795": [
        {
            "ioc_value": "t1.3pea2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:13:25",
            "last_seen_utc": "2025-10-29 08:22:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628794": [
        {
            "ioc_value": "lie.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:08:17",
            "last_seen_utc": "2025-10-29 08:13:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628793": [
        {
            "ioc_value": "east.pi-6-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 08:07:00",
            "last_seen_utc": "2025-10-29 08:19:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628787": [
        {
            "ioc_value": "cloudstoragebox.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-29 08:01:22",
            "last_seen_utc": "2025-10-29 11:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/108.181.115.243+cloudstoragebox.com",
            "tags": "AS40676,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628778": [
        {
            "ioc_value": "0ff.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 07:54:19",
            "last_seen_utc": "2025-10-29 08:06:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628777": [
        {
            "ioc_value": "app.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 07:48:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628775": [
        {
            "ioc_value": "pdo.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-29 07:45:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1628776": [
        {
            "ioc_value": "pdo.united-gs.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-29 07:45:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1628772": [
        {
            "ioc_value": "but.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 07:37:50",
            "last_seen_utc": "2025-10-29 07:44:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628771": [
        {
            "ioc_value": "b2m.3pea2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 07:28:05",
            "last_seen_utc": "2025-10-29 07:44:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628770": [
        {
            "ioc_value": "shy.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 07:28:03",
            "last_seen_utc": "2025-10-29 07:28:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628768": [
        {
            "ioc_value": "gestcular.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-10-29 07:22:28",
            "last_seen_utc": "2025-10-30 22:09:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,hijackloader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628767": [
        {
            "ioc_value": "dock.pi-6-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 07:20:55",
            "last_seen_utc": "2025-10-29 07:43:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628766": [
        {
            "ioc_value": "ion.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 07:17:45",
            "last_seen_utc": "2025-10-29 07:20:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628765": [
        {
            "ioc_value": "eel.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 07:07:58",
            "last_seen_utc": "2025-10-29 07:09:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628764": [
        {
            "ioc_value": "y7k.3pea2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628763": [
        {
            "ioc_value": "s0up.k-8-li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:59:05",
            "last_seen_utc": "2025-10-29 07:09:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628762": [
        {
            "ioc_value": "one.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:56:32",
            "last_seen_utc": "2025-10-29 06:59:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628761": [
        {
            "ioc_value": "materials-mali.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-29 06:54:21",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628760": [
        {
            "ioc_value": "ate.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:47:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628759": [
        {
            "ioc_value": "r0n9.3pea2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:40:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628758": [
        {
            "ioc_value": "0ur.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:39:58",
            "last_seen_utc": "2025-10-29 06:40:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628757": [
        {
            "ioc_value": "fit.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:28:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628755": [
        {
            "ioc_value": "far.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:18:15",
            "last_seen_utc": "2025-10-29 06:23:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628752": [
        {
            "ioc_value": "gab.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:07:57",
            "last_seen_utc": "2025-10-29 06:09:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628750": [
        {
            "ioc_value": "villataxi.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-29 06:04:04",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251029-bvk3ysslel",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628749": [
        {
            "ioc_value": "navy.k-8-li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 06:01:07",
            "last_seen_utc": "2025-10-29 06:23:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628748": [
        {
            "ioc_value": "screen-suggesting.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-29 06:00:40",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251029-c9xwqsdr4z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628747": [
        {
            "ioc_value": "get.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:58:09",
            "last_seen_utc": "2025-10-29 06:01:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628746": [
        {
            "ioc_value": "ore.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:48:43",
            "last_seen_utc": "2025-10-29 05:51:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628385": [
        {
            "ioc_value": "azure.m365.1drive.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-29 05:46:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/144.172.109.53+azure.m365.1drive.zip",
            "tags": "AS14956,C2,censys,Mythic,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1628386": [
        {
            "ioc_value": "www.accounts.m365.1drive.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-29 05:46:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/144.172.109.53+www.accounts.m365.1drive.zip",
            "tags": "AS14956,C2,censys,Mythic,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1628745": [
        {
            "ioc_value": "w4.3pea2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:40:22",
            "last_seen_utc": "2025-10-29 06:00:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628744": [
        {
            "ioc_value": "ban.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:37:25",
            "last_seen_utc": "2025-10-29 05:43:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628743": [
        {
            "ioc_value": "kiln.k-8-li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:36:52",
            "last_seen_utc": "2025-10-29 05:51:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628742": [
        {
            "ioc_value": "out.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:29:34",
            "last_seen_utc": "2025-10-29 05:36:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628741": [
        {
            "ioc_value": "law.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:22:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628740": [
        {
            "ioc_value": "d6.4qua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628739": [
        {
            "ioc_value": "hand.k-8-li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:10:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628738": [
        {
            "ioc_value": "lap.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 05:10:26",
            "last_seen_utc": "2025-10-29 05:21:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628737": [
        {
            "ioc_value": "v7p2.4qua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 04:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628736": [
        {
            "ioc_value": "rid.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 04:58:06",
            "last_seen_utc": "2025-10-29 04:58:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628735": [
        {
            "ioc_value": "jog.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 04:48:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628734": [
        {
            "ioc_value": "any.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 04:30:45",
            "last_seen_utc": "2025-10-29 04:38:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628733": [
        {
            "ioc_value": "a03.4qua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 04:29:55",
            "last_seen_utc": "2025-10-29 04:38:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628732": [
        {
            "ioc_value": "hew.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 04:07:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628730": [
        {
            "ioc_value": "amfspro.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-29 04:01:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.9.155+amfspro.click",
            "tags": "Amatera,AS13335,C2,censys,CLOUDFLARENET,Panel,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628704": [
        {
            "ioc_value": "gig.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:57:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628703": [
        {
            "ioc_value": "m.4qua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:49:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628702": [
        {
            "ioc_value": "hat.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:49:01",
            "last_seen_utc": "2025-10-29 03:54:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628701": [
        {
            "ioc_value": "b1d.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:38:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628700": [
        {
            "ioc_value": "n2ch.9ha-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:30:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628699": [
        {
            "ioc_value": "led.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:28:26",
            "last_seen_utc": "2025-10-29 03:30:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628698": [
        {
            "ioc_value": "bet.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:18:50",
            "last_seen_utc": "2025-10-29 03:19:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628697": [
        {
            "ioc_value": "x9z.4qua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:14:41",
            "last_seen_utc": "2025-10-29 03:19:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628696": [
        {
            "ioc_value": "ken.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:07:50",
            "last_seen_utc": "2025-10-29 03:14:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628695": [
        {
            "ioc_value": "g8wy.9ha-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 03:07:11",
            "last_seen_utc": "2025-10-29 03:19:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628693": [
        {
            "ioc_value": "dry.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:58:02",
            "last_seen_utc": "2025-10-29 03:07:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628692": [
        {
            "ioc_value": "p5ld.9ha-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:51:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628689": [
        {
            "ioc_value": "hid.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:49:17",
            "last_seen_utc": "2025-10-29 02:51:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628688": [
        {
            "ioc_value": "bra.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:37:28",
            "last_seen_utc": "2025-10-29 02:39:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628686": [
        {
            "ioc_value": "x9sr.9ha-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:29:45",
            "last_seen_utc": "2025-10-29 02:39:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628685": [
        {
            "ioc_value": "cap.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:27:41",
            "last_seen_utc": "2025-10-29 02:29:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628683": [
        {
            "ioc_value": "had.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:18:26",
            "last_seen_utc": "2025-10-29 02:19:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628682": [
        {
            "ioc_value": "may.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:08:07",
            "last_seen_utc": "2025-10-29 02:09:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628681": [
        {
            "ioc_value": "q1.4qua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:02:34",
            "last_seen_utc": "2025-10-29 02:09:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628680": [
        {
            "ioc_value": "t0qm.9ha-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 02:01:25",
            "last_seen_utc": "2025-10-29 02:09:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628679": [
        {
            "ioc_value": "has.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:57:21",
            "last_seen_utc": "2025-10-29 02:02:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628678": [
        {
            "ioc_value": "c0re.do-k-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:53:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628677": [
        {
            "ioc_value": "bus.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:48:03",
            "last_seen_utc": "2025-10-29 01:53:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628676": [
        {
            "ioc_value": "b3vf.9ha-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:46:30",
            "last_seen_utc": "2025-10-29 01:52:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628675": [
        {
            "ioc_value": "10ta.do-k-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:42:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628674": [
        {
            "ioc_value": "fro.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:38:18",
            "last_seen_utc": "2025-10-29 01:46:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628673": [
        {
            "ioc_value": "y6nb.7l-0b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:31:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628672": [
        {
            "ioc_value": "asp.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:27:45",
            "last_seen_utc": "2025-10-29 01:31:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628671": [
        {
            "ioc_value": "r2px.7l-0b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628670": [
        {
            "ioc_value": "dud.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:19:23",
            "last_seen_utc": "2025-10-29 01:19:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628669": [
        {
            "ioc_value": "k7w.7l-0b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:09:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628668": [
        {
            "ioc_value": "nag.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 01:07:51",
            "last_seen_utc": "2025-10-29 01:09:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628667": [
        {
            "ioc_value": "d1hs.7l-0b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:59:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628666": [
        {
            "ioc_value": "pop.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:58:35",
            "last_seen_utc": "2025-10-29 00:59:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628665": [
        {
            "ioc_value": "s1ne.do-k-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628664": [
        {
            "ioc_value": "ant.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:48:20",
            "last_seen_utc": "2025-10-29 00:58:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628662": [
        {
            "ioc_value": "pit.n4ym.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:38:02",
            "last_seen_utc": "2025-10-29 00:41:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628661": [
        {
            "ioc_value": "sage.do-k-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:37:40",
            "last_seen_utc": "2025-10-29 00:41:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628660": [
        {
            "ioc_value": "v9tc.7l-0b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:34:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628659": [
        {
            "ioc_value": "fin.je9r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:28:16",
            "last_seen_utc": "2025-10-29 00:37:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628658": [
        {
            "ioc_value": "m4qy.7l-0b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:14:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628657": [
        {
            "ioc_value": "rum.da5v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:12:55",
            "last_seen_utc": "2025-10-29 00:14:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628656": [
        {
            "ioc_value": "hot.x2lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:04:09",
            "last_seen_utc": "2025-10-29 00:12:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628655": [
        {
            "ioc_value": "onyx.do-k-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-29 00:04:03",
            "last_seen_utc": "2025-10-29 00:12:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628649": [
        {
            "ioc_value": "rub.pi6o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:58:55",
            "last_seen_utc": "2025-10-29 00:04:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628648": [
        {
            "ioc_value": "a8lx.1p-8s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:51:02",
            "last_seen_utc": "2025-10-29 00:04:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628647": [
        {
            "ioc_value": "opal.do-k-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628646": [
        {
            "ioc_value": "ham.r9xa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:42:32",
            "last_seen_utc": "2025-10-28 23:51:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628515": [
        {
            "ioc_value": "bug.tu7q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:37:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628508": [
        {
            "ioc_value": "u3kd.1p-8s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:37:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628424": [
        {
            "ioc_value": "rye.m4ze.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:27:32",
            "last_seen_utc": "2025-10-28 23:37:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628423": [
        {
            "ioc_value": "c7wp.1p-8s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628422": [
        {
            "ioc_value": "bow.k8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:18:07",
            "last_seen_utc": "2025-10-29 04:29:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628416": [
        {
            "ioc_value": "brirbxl.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:14:10",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628417": [
        {
            "ioc_value": "calbewo.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:14:10",
            "last_seen_utc": "2025-11-16 22:14:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628418": [
        {
            "ioc_value": "meeqgem.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:14:10",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628419": [
        {
            "ioc_value": "venezdj.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:14:10",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628420": [
        {
            "ioc_value": "stamozp.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:14:10",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628421": [
        {
            "ioc_value": "faeadud.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:14:10",
            "last_seen_utc": "2025-11-16 22:14:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628407": [
        {
            "ioc_value": "foodopg.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:28",
            "last_seen_utc": "2025-11-16 22:14:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628408": [
        {
            "ioc_value": "irrufnv.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:28",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628409": [
        {
            "ioc_value": "scatbhn.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:28",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628410": [
        {
            "ioc_value": "ventagl.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:28",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628411": [
        {
            "ioc_value": "phthkob.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:28",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628412": [
        {
            "ioc_value": "splwplx.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:28",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628413": [
        {
            "ioc_value": "teered.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:28",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628414": [
        {
            "ioc_value": "anomal.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:28",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628401": [
        {
            "ioc_value": "strisef.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:27",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628402": [
        {
            "ioc_value": "kaloop.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:27",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628403": [
        {
            "ioc_value": "sentmpy.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:27",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628404": [
        {
            "ioc_value": "texaajc.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:27",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628405": [
        {
            "ioc_value": "genubxc.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:27",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628406": [
        {
            "ioc_value": "sounqp.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 23:13:27",
            "last_seen_utc": "2025-11-25 10:40:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628399": [
        {
            "ioc_value": "h9r.1p-8s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:03:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628398": [
        {
            "ioc_value": "day.vo3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 23:02:14",
            "last_seen_utc": "2025-10-28 23:03:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628384": [
        {
            "ioc_value": "mend.s-2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 22:55:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628383": [
        {
            "ioc_value": "up.je5w.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 22:54:29",
            "last_seen_utc": "2025-10-28 22:55:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628382": [
        {
            "ioc_value": "etch.s-2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 22:35:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628381": [
        {
            "ioc_value": "z1mv.1p-8s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 22:30:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628380": [
        {
            "ioc_value": "bu5.je5w.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 22:30:21",
            "last_seen_utc": "2025-10-28 22:35:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628379": [
        {
            "ioc_value": "reed.s-2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 22:22:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628378": [
        {
            "ioc_value": "bay.r7va.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 22:11:56",
            "last_seen_utc": "2025-10-28 22:22:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628374": [
        {
            "ioc_value": "q5tn.1p-8s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:57:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628373": [
        {
            "ioc_value": "pan.je5w.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:55:57",
            "last_seen_utc": "2025-10-28 21:57:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628370": [
        {
            "ioc_value": "prd.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-28 21:53:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1628371": [
        {
            "ioc_value": "prd.united-gs.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-28 21:53:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1628367": [
        {
            "ioc_value": "s0il.s-2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:49:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628350": [
        {
            "ioc_value": "msnapp.help",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628351": [
        {
            "ioc_value": "accountroyal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628352": [
        {
            "ioc_value": "palaerospace.careers",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628353": [
        {
            "ioc_value": "msnapp.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628354": [
        {
            "ioc_value": "healthiestmama.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628355": [
        {
            "ioc_value": "alwayslivehealthy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628356": [
        {
            "ioc_value": "rhealthylivingsolutions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628357": [
        {
            "ioc_value": "rheinmetallcareer.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628358": [
        {
            "ioc_value": "chakracleansetherapy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628359": [
        {
            "ioc_value": "clearmindhealthandwellness.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628360": [
        {
            "ioc_value": "joinboeing.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628361": [
        {
            "ioc_value": "rheinmetallcareer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628362": [
        {
            "ioc_value": "zytonhealth.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628363": [
        {
            "ioc_value": "airbushiring.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628364": [
        {
            "ioc_value": "healthinfusiontherapy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628365": [
        {
            "ioc_value": "bodywellnessbycynthia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628366": [
        {
            "ioc_value": "careers-portal.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 21:49:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA455",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628349": [
        {
            "ioc_value": "perstby.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 21:48:46",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628348": [
        {
            "ioc_value": "d1m.r7va.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:48:13",
            "last_seen_utc": "2025-10-28 21:49:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628342": [
        {
            "ioc_value": "moremoneyyyyyyyyyyyyyyeeeeeeeee.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-28 21:47:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628343": [
        {
            "ioc_value": "www.soloteck.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-28 21:47:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628340": [
        {
            "ioc_value": "cnc.changeme.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-28 21:47:02",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628341": [
        {
            "ioc_value": "joker.proxywall.p-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-28 21:47:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628338": [
        {
            "ioc_value": "www.ytenode.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628339": [
        {
            "ioc_value": "www.z611.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628318": [
        {
            "ioc_value": "www.p6.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628319": [
        {
            "ioc_value": "www.partments-for-rent-94915.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628320": [
        {
            "ioc_value": "www.q1kxvb7a02-90x0.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628321": [
        {
            "ioc_value": "www.rindcity.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628322": [
        {
            "ioc_value": "www.rnamentalhub.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628323": [
        {
            "ioc_value": "www.rontointerventofabbro.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628324": [
        {
            "ioc_value": "www.rvxae.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628325": [
        {
            "ioc_value": "www.ryequatureteam.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628326": [
        {
            "ioc_value": "www.so0un.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628327": [
        {
            "ioc_value": "www.t222.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628328": [
        {
            "ioc_value": "www.tguosheng.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628329": [
        {
            "ioc_value": "www.trategy-21.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628330": [
        {
            "ioc_value": "www.ullcitytrackclub.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628331": [
        {
            "ioc_value": "www.umjb2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628332": [
        {
            "ioc_value": "www.upkie.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628333": [
        {
            "ioc_value": "www.urewellnesshub.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628334": [
        {
            "ioc_value": "www.vkugx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628335": [
        {
            "ioc_value": "www.vtnvb.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628336": [
        {
            "ioc_value": "www.vvvt.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628337": [
        {
            "ioc_value": "www.ww26510.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628297": [
        {
            "ioc_value": "www.enviro.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628298": [
        {
            "ioc_value": "www.eonesens.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628299": [
        {
            "ioc_value": "www.eshara.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628300": [
        {
            "ioc_value": "www.hatimage.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628301": [
        {
            "ioc_value": "www.iatyogrod63.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628302": [
        {
            "ioc_value": "www.igiconsulting.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628303": [
        {
            "ioc_value": "www.ile.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628304": [
        {
            "ioc_value": "www.indvyn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628305": [
        {
            "ioc_value": "www.inhbaokhang.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628306": [
        {
            "ioc_value": "www.islr.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628307": [
        {
            "ioc_value": "www.italideas.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628308": [
        {
            "ioc_value": "www.marov.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628309": [
        {
            "ioc_value": "www.nlyoneserver.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628310": [
        {
            "ioc_value": "www.offeecoffeecoffeecoffee.coffee",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628311": [
        {
            "ioc_value": "www.oftonsonline.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628312": [
        {
            "ioc_value": "www.onfirmacaoenviodigiital.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628313": [
        {
            "ioc_value": "www.oodsy.design",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628314": [
        {
            "ioc_value": "www.orbiddendreams.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628315": [
        {
            "ioc_value": "www.ord-connect.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628316": [
        {
            "ioc_value": "www.ordsserialli1.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628317": [
        {
            "ioc_value": "www.oweredby.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628280": [
        {
            "ioc_value": "www.agamentomonave.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628281": [
        {
            "ioc_value": "www.annahnoh.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628282": [
        {
            "ioc_value": "www.aofi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628283": [
        {
            "ioc_value": "www.ark-10.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628284": [
        {
            "ioc_value": "www.aystablecoin.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628285": [
        {
            "ioc_value": "www.brj.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628286": [
        {
            "ioc_value": "www.btwbo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628287": [
        {
            "ioc_value": "www.c1809.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628288": [
        {
            "ioc_value": "www.c2863.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628289": [
        {
            "ioc_value": "www.c4895.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628290": [
        {
            "ioc_value": "www.cciccloud.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628291": [
        {
            "ioc_value": "www.cxzsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628292": [
        {
            "ioc_value": "www.d5468338461.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628293": [
        {
            "ioc_value": "www.echat.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628294": [
        {
            "ioc_value": "www.edallionroofrepairs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628295": [
        {
            "ioc_value": "www.egt.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628296": [
        {
            "ioc_value": "www.enpercent.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628276": [
        {
            "ioc_value": "www.56837.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628277": [
        {
            "ioc_value": "www.6n.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628278": [
        {
            "ioc_value": "www.6w5rfre.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628279": [
        {
            "ioc_value": "www.7684455.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-28 21:46:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628209": [
        {
            "ioc_value": "envio22-10.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-28 21:45:41",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1628204": [
        {
            "ioc_value": "wow.je5w.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:38:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628203": [
        {
            "ioc_value": "dove.s-2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:36:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628202": [
        {
            "ioc_value": "ki.r7va.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:28:09",
            "last_seen_utc": "2025-10-28 21:36:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628201": [
        {
            "ioc_value": "twig.s-2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:27:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628200": [
        {
            "ioc_value": "cow.je5w.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:17:46",
            "last_seen_utc": "2025-10-28 21:27:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628199": [
        {
            "ioc_value": "veil.m-4-rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:02:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628198": [
        {
            "ioc_value": "piy.r7va.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 21:02:47",
            "last_seen_utc": "2025-10-28 21:04:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628196": [
        {
            "ioc_value": "hark.tu7q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 20:54:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628195": [
        {
            "ioc_value": "ns1.servicedata.services",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-28 20:48:37",
            "last_seen_utc": "2025-12-14 11:48:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628194": [
        {
            "ioc_value": "east.tu7q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 20:32:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628193": [
        {
            "ioc_value": "cow.r7va.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 20:30:16",
            "last_seen_utc": "2025-10-28 20:32:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628192": [
        {
            "ioc_value": "ace.je5w.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 20:28:38",
            "last_seen_utc": "2025-10-28 20:29:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628191": [
        {
            "ioc_value": "dune.tu7q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 20:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628190": [
        {
            "ioc_value": "m0s5.m-4-rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 20:14:10",
            "last_seen_utc": "2025-10-28 20:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628189": [
        {
            "ioc_value": "kit.r7va.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 20:09:40",
            "last_seen_utc": "2025-10-28 20:23:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628185": [
        {
            "ioc_value": "auth.factionwarfare.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-10-28 20:01:09",
            "last_seen_utc": "2025-10-28 23:00:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/5.180.151.9+auth.factionwarfare.net",
            "tags": "AS40021,C2,censys,CONTABO-40021,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628182": [
        {
            "ioc_value": "b1n.r7va.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:55:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628183": [
        {
            "ioc_value": "dock.tu7q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:55:43",
            "last_seen_utc": "2025-10-28 20:01:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628180": [
        {
            "ioc_value": "l10n.m-4-rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628181": [
        {
            "ioc_value": "f0r.je5w.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:55:29",
            "last_seen_utc": "2025-10-28 20:01:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628179": [
        {
            "ioc_value": "coal.m-4-rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:39:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628178": [
        {
            "ioc_value": "ra.je5w.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:39:06",
            "last_seen_utc": "2025-10-28 20:54:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628177": [
        {
            "ioc_value": "dewy.tu7q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:31:09",
            "last_seen_utc": "2025-10-28 19:39:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628176": [
        {
            "ioc_value": "bi.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:27:38",
            "last_seen_utc": "2025-10-28 19:31:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628175": [
        {
            "ioc_value": "ma.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:17:49",
            "last_seen_utc": "2025-10-28 19:23:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628174": [
        {
            "ioc_value": "glow.m-4-rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:13:44",
            "last_seen_utc": "2025-10-28 19:23:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628173": [
        {
            "ioc_value": "dawn.tu7q.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:10:45",
            "last_seen_utc": "2025-10-28 19:20:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628147": [
        {
            "ioc_value": "skillnorequired.cc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-28 19:03:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "infostealer,Rhadamanthys",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1628148": [
        {
            "ioc_value": "dropcheats.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-28 19:03:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "infostealer,Rhadamanthys",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1628172": [
        {
            "ioc_value": "oh.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 19:03:26",
            "last_seen_utc": "2025-10-28 19:13:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628171": [
        {
            "ioc_value": "5age.pi6o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 18:50:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628170": [
        {
            "ioc_value": "wave.m-4-rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 18:49:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628164": [
        {
            "ioc_value": "hi.n2-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 18:41:21",
            "last_seen_utc": "2025-10-28 18:43:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628163": [
        {
            "ioc_value": "1ris.pi6o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 18:36:53",
            "last_seen_utc": "2025-10-28 18:43:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628162": [
        {
            "ioc_value": "plum.n4ym.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 18:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628161": [
        {
            "ioc_value": "ho.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 18:17:59",
            "last_seen_utc": "2025-10-28 18:20:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628160": [
        {
            "ioc_value": "ma.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 18:08:10",
            "last_seen_utc": "2025-10-28 18:16:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628158": [
        {
            "ioc_value": "10.tcp.eu.ngrok.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-28 18:01:15",
            "last_seen_utc": "2025-10-28 18:01:15",
            "confidence_level": 100,
            "reference": "https://tria.ge/251028-t3sf4saj81",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628157": [
        {
            "ioc_value": "gale.n4ym.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 18:01:09",
            "last_seen_utc": "2025-10-28 18:16:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628156": [
        {
            "ioc_value": "ta.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 17:57:41",
            "last_seen_utc": "2025-10-28 18:01:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628155": [
        {
            "ioc_value": "h2c.8ds98.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 17:50:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628154": [
        {
            "ioc_value": "we.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 17:48:55",
            "last_seen_utc": "2025-10-28 17:50:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628146": [
        {
            "ioc_value": "cove.n4ym.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 17:34:00",
            "last_seen_utc": "2025-10-28 17:49:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628145": [
        {
            "ioc_value": "um.xe-1r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 17:33:32",
            "last_seen_utc": "2025-10-28 17:34:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628139": [
        {
            "ioc_value": "y0q9.8ds98.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 17:09:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628137": [
        {
            "ioc_value": "brim.n4ym.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 16:44:02",
            "last_seen_utc": "2025-10-28 16:50:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628136": [
        {
            "ioc_value": "key.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 16:38:44",
            "last_seen_utc": "2025-10-28 16:44:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628134": [
        {
            "ioc_value": "orb.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 16:27:26",
            "last_seen_utc": "2025-10-28 16:29:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628133": [
        {
            "ioc_value": "g7m.8ds98.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 16:23:19",
            "last_seen_utc": "2025-10-28 16:29:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628132": [
        {
            "ioc_value": "beg.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 16:17:39",
            "last_seen_utc": "2025-10-28 16:23:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628131": [
        {
            "ioc_value": "glow.k8li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 16:13:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628130": [
        {
            "ioc_value": "dew.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 16:08:52",
            "last_seen_utc": "2025-10-28 16:13:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628129": [
        {
            "ioc_value": "global.coachmyresume.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-28 16:08:45",
            "last_seen_utc": "2025-11-05 04:07:23",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115452656031692516",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1628125": [
        {
            "ioc_value": "apexxenon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-28 16:02:44",
            "last_seen_utc": "2025-10-28 23:00:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/198.252.109.34+apexxenon.com",
            "tags": "AS20068,C2,censys,Havoc,HAWKHOST",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628119": [
        {
            "ioc_value": "go.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 15:57:13",
            "last_seen_utc": "2025-10-28 16:00:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628118": [
        {
            "ioc_value": "golf.k8li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 15:52:22",
            "last_seen_utc": "2025-10-28 16:00:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628114": [
        {
            "ioc_value": "ha.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 15:47:27",
            "last_seen_utc": "2025-10-28 15:52:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628113": [
        {
            "ioc_value": "n4.8ds98.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 15:31:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628112": [
        {
            "ioc_value": "goat.k8li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 15:28:24",
            "last_seen_utc": "2025-10-28 15:40:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628111": [
        {
            "ioc_value": "bi.fy-7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 15:24:48",
            "last_seen_utc": "2025-10-28 15:31:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628110": [
        {
            "ioc_value": "ho.n2-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 15:16:57",
            "last_seen_utc": "2025-10-28 15:18:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628108": [
        {
            "ioc_value": "rodriggez.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-28 15:10:56",
            "last_seen_utc": "2025-10-28 15:10:58",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115452428609667974",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1628106": [
        {
            "ioc_value": "girl.k8li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 15:02:46",
            "last_seen_utc": "2025-10-28 15:18:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628105": [
        {
            "ioc_value": "1n.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:47:58",
            "last_seen_utc": "2025-10-28 14:49:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628104": [
        {
            "ioc_value": "gear.k8li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:45:19",
            "last_seen_utc": "2025-10-28 14:49:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628103": [
        {
            "ioc_value": "d5.6cm81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:42:00",
            "last_seen_utc": "2025-10-28 14:48:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628102": [
        {
            "ioc_value": "do.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:35:26",
            "last_seen_utc": "2025-10-28 14:45:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628101": [
        {
            "ioc_value": "fawn.k8li.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:25:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628100": [
        {
            "ioc_value": "jairecanoas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628099": [
        {
            "ioc_value": "zmzkdodudhdbdu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628098": [
        {
            "ioc_value": "dhdjisksnsbhssu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628097": [
        {
            "ioc_value": "w7k2.6cm81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:12:21",
            "last_seen_utc": "2025-10-28 14:26:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628095": [
        {
            "ioc_value": "themccoyhome.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-28 14:09:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115452184786538983",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1628090": [
        {
            "ioc_value": "prajsm.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-28 14:08:59",
            "last_seen_utc": "2025-10-28 14:09:04",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115452184786538983",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1628088": [
        {
            "ioc_value": "foam.da5v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:08:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628087": [
        {
            "ioc_value": "1f.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 14:06:09",
            "last_seen_utc": "2025-10-28 14:12:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628085": [
        {
            "ioc_value": "flip.da5v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 13:11:00",
            "last_seen_utc": "2025-10-28 13:20:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628084": [
        {
            "ioc_value": "ya.p2-om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 13:08:16",
            "last_seen_utc": "2025-10-28 13:11:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628083": [
        {
            "ioc_value": "b0t.6cm81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:59:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628082": [
        {
            "ioc_value": "act.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:58:26",
            "last_seen_utc": "2025-10-28 12:59:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628080": [
        {
            "ioc_value": "pie.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:48:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628079": [
        {
            "ioc_value": "xq8.6cm81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:39:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628078": [
        {
            "ioc_value": "kld.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:36:54",
            "last_seen_utc": "2025-10-28 12:39:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628077": [
        {
            "ioc_value": "far.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:28:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628073": [
        {
            "ioc_value": "flat.da5v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:25:36",
            "last_seen_utc": "2025-10-28 12:39:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628072": [
        {
            "ioc_value": "xl.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:17:49",
            "last_seen_utc": "2025-10-28 12:25:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628071": [
        {
            "ioc_value": "am.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:08:56",
            "last_seen_utc": "2025-10-28 12:13:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628070": [
        {
            "ioc_value": "appbnc-connexion.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-28 12:08:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628068": [
        {
            "ioc_value": "simplecopseholding.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-28 12:08:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628066": [
        {
            "ioc_value": "hlherb.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-28 12:06:33",
            "last_seen_utc": "2025-10-28 14:07:44",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115451703555965263",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1628063": [
        {
            "ioc_value": "f1rm.da5v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 12:02:10",
            "last_seen_utc": "2025-10-28 12:13:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628057": [
        {
            "ioc_value": "ubongoload.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-28 12:00:53",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251028-hw3sqasqbq",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628056": [
        {
            "ioc_value": "dirolchiks.tplinkdns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-28 12:00:42",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251028-ngl5bae13g",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628054": [
        {
            "ioc_value": "multiple-knitting.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-28 12:00:41",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251028-ngl5bae13g",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628053": [
        {
            "ioc_value": "need-disturbed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-28 12:00:40",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251028-ngl5bae13g",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1628052": [
        {
            "ioc_value": "ex.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:57:44",
            "last_seen_utc": "2025-10-28 12:02:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628051": [
        {
            "ioc_value": "ye.fy-7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:48:20",
            "last_seen_utc": "2025-10-28 18:50:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628050": [
        {
            "ioc_value": "f1le.da5v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:45:46",
            "last_seen_utc": "2025-10-28 11:50:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628049": [
        {
            "ioc_value": "v1.6cm81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:39:46",
            "last_seen_utc": "2025-10-28 11:49:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628048": [
        {
            "ioc_value": "nu.n2-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:36:21",
            "last_seen_utc": "2025-10-28 11:45:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628047": [
        {
            "ioc_value": "nu.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:20:21",
            "last_seen_utc": "2025-10-28 11:21:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628046": [
        {
            "ioc_value": "no.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628045": [
        {
            "ioc_value": "f15h.da5v.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:13:02",
            "last_seen_utc": "2025-10-28 11:21:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628044": [
        {
            "ioc_value": "no.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:06:46",
            "last_seen_utc": "2025-10-28 11:13:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628042": [
        {
            "ioc_value": "x3pn.1s-1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 11:03:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628038": [
        {
            "ioc_value": "login.jamesriver-ins.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-28 11:00:27",
            "last_seen_utc": "2025-10-28 12:01:18",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.216.130.82+login.jamesriver-ins.com",
            "tags": "AMAZON-AES,AS14618,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1628030": [
        {
            "ioc_value": "ha.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 10:53:44",
            "last_seen_utc": "2025-10-28 11:03:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628027": [
        {
            "ioc_value": "jump.0x1.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-28 10:49:05",
            "last_seen_utc": "2025-11-30 17:48:45",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628026": [
        {
            "ioc_value": "52sya04g88x3k.cfc-execute.su.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-28 10:48:56",
            "last_seen_utc": "2025-12-07 19:48:05",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1628025": [
        {
            "ioc_value": "d6aw.1s-1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 10:33:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628024": [
        {
            "ioc_value": "t04.4md69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 10:31:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628021": [
        {
            "ioc_value": "h2v.4md69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 10:07:17",
            "last_seen_utc": "2025-10-28 10:10:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628020": [
        {
            "ioc_value": "q9lt.1s-1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 10:07:11",
            "last_seen_utc": "2025-10-28 10:11:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628019": [
        {
            "ioc_value": "say.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628017": [
        {
            "ioc_value": "h2vx.1s-1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:44:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628016": [
        {
            "ioc_value": "rot.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:43:10",
            "last_seen_utc": "2025-10-28 09:44:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628015": [
        {
            "ioc_value": "why.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:40:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628014": [
        {
            "ioc_value": "ion.v3sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:31:09",
            "last_seen_utc": "2025-10-28 09:39:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628013": [
        {
            "ioc_value": "z9k1.4md69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:29:41",
            "last_seen_utc": "2025-10-28 09:33:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628012": [
        {
            "ioc_value": "yaw.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:28:54",
            "last_seen_utc": "2025-10-28 09:29:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628011": [
        {
            "ioc_value": "r4yd.1s-1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:26:07",
            "last_seen_utc": "2025-10-28 09:39:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628010": [
        {
            "ioc_value": "hit.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:17:36",
            "last_seen_utc": "2025-10-28 09:26:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1628009": [
        {
            "ioc_value": "m7qc.1s-1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:15:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628008": [
        {
            "ioc_value": "m7p.4md69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:11:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1628006": [
        {
            "ioc_value": "if.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 09:09:43",
            "last_seen_utc": "2025-10-28 09:15:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627997": [
        {
            "ioc_value": "iit.tweethost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-28 08:06:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1627998": [
        {
            "ioc_value": "iit.teba-forexport.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-28 08:06:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1627992": [
        {
            "ioc_value": "portal.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-28 08:01:28",
            "last_seen_utc": "2025-10-28 11:00:48",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+portal.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627985": [
        {
            "ioc_value": "z8wm.7-09f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 07:02:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627983": [
        {
            "ioc_value": "inspectlet.observer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627984": [
        {
            "ioc_value": "insightanalytics.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627967": [
        {
            "ioc_value": "cdnjscookies.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627968": [
        {
            "ioc_value": "gagichls.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627969": [
        {
            "ioc_value": "wordpress-login.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627970": [
        {
            "ioc_value": "wordpress-commerce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627971": [
        {
            "ioc_value": "ls1ks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627972": [
        {
            "ioc_value": "suckerity.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627973": [
        {
            "ioc_value": "woscket.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627974": [
        {
            "ioc_value": "wsocket.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627975": [
        {
            "ioc_value": "wooadminpro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627976": [
        {
            "ioc_value": "elementatorprof.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627977": [
        {
            "ioc_value": "gigacgetski.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627978": [
        {
            "ioc_value": "kezopersuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627979": [
        {
            "ioc_value": "webawast.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627980": [
        {
            "ioc_value": "asd123qwe2.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627981": [
        {
            "ioc_value": "keritysuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627982": [
        {
            "ioc_value": "websocket.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627966": [
        {
            "ioc_value": "babymarket.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-28 07:00:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,magecart",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627965": [
        {
            "ioc_value": "feabihc.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-28 06:59:48",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627964": [
        {
            "ioc_value": "decision-danny.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-28 06:59:23",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627963": [
        {
            "ioc_value": "whiteangelcameonearthwithgodsignformegod.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-28 06:59:05",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627962": [
        {
            "ioc_value": "faggotfaggotfaggotfaggotfaggotfaggotfaggotfaggotfaggotfaggot.die.skin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-28 06:58:50",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627957": [
        {
            "ioc_value": "contents-douglas.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-28 06:57:47",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627958": [
        {
            "ioc_value": "robotproject.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-28 06:57:47",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627959": [
        {
            "ioc_value": "safe-railway.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-28 06:57:47",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627955": [
        {
            "ioc_value": "doxxing.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-28 06:57:30",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627956": [
        {
            "ioc_value": "seznam.giize.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-28 06:57:30",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627950": [
        {
            "ioc_value": "us.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 06:56:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627948": [
        {
            "ioc_value": "g1rq.7-09f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 06:32:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627947": [
        {
            "ioc_value": "do.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 06:28:08",
            "last_seen_utc": "2025-10-28 06:32:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627942": [
        {
            "ioc_value": "wilsonkumar.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-28 06:00:35",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251028-gkbdnavkhx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627943": [
        {
            "ioc_value": "giftoo1.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-28 06:00:35",
            "last_seen_utc": "2025-11-07 12:55:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251028-cnf14atngt",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627940": [
        {
            "ioc_value": "q3.4md69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 05:48:58",
            "last_seen_utc": "2025-10-28 07:09:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627939": [
        {
            "ioc_value": "uh.yq-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 05:17:54",
            "last_seen_utc": "2025-10-28 05:21:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627938": [
        {
            "ioc_value": "t2xb.7-09f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 05:13:27",
            "last_seen_utc": "2025-10-28 05:31:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627937": [
        {
            "ioc_value": "go.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 05:08:07",
            "last_seen_utc": "2025-10-28 05:13:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627936": [
        {
            "ioc_value": "y9lg.9-32p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 04:57:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627935": [
        {
            "ioc_value": "bi.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 04:55:50",
            "last_seen_utc": "2025-10-28 04:57:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627934": [
        {
            "ioc_value": "k9r2.0bj3i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 04:13:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627931": [
        {
            "ioc_value": "my.com.au.debbiesimril.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-28 04:01:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.241.8+my.com.au.debbiesimril.com",
            "tags": "AS214943,C2,censys,Gafgyt,open-dir,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627924": [
        {
            "ioc_value": "ox.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 03:47:49",
            "last_seen_utc": "2025-10-28 03:48:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627923": [
        {
            "ioc_value": "u0b.0bj3i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 03:44:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627922": [
        {
            "ioc_value": "k0hs.9-32p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 03:42:34",
            "last_seen_utc": "2025-10-28 04:00:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627921": [
        {
            "ioc_value": "my.xe-1r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 03:37:54",
            "last_seen_utc": "2025-10-28 03:44:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627920": [
        {
            "ioc_value": "3dpf.9-32p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 03:25:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627919": [
        {
            "ioc_value": "my.p2-om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 03:22:04",
            "last_seen_utc": "2025-10-28 17:09:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627918": [
        {
            "ioc_value": "m7.0bj3i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 03:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627917": [
        {
            "ioc_value": "ego.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 03:09:07",
            "last_seen_utc": "2025-10-28 03:20:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627916": [
        {
            "ioc_value": "flx.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 02:58:37",
            "last_seen_utc": "2025-10-28 03:00:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627721": [
        {
            "ioc_value": "n6vt.9-32p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 02:50:55",
            "last_seen_utc": "2025-10-28 03:09:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627717": [
        {
            "ioc_value": "wulongdakon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-28 02:48:24",
            "last_seen_utc": "2025-12-13 13:49:22",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1627716": [
        {
            "ioc_value": "ram.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 02:48:21",
            "last_seen_utc": "2025-10-28 02:50:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627715": [
        {
            "ioc_value": "p9y1.0bj3i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 02:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627713": [
        {
            "ioc_value": "a7qy.9-32p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 02:02:20",
            "last_seen_utc": "2025-10-28 02:14:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627712": [
        {
            "ioc_value": "a3z.0bj3i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627711": [
        {
            "ioc_value": "oak.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:57:36",
            "last_seen_utc": "2025-10-28 02:02:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627710": [
        {
            "ioc_value": "ion.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:47:43",
            "last_seen_utc": "2025-10-28 01:49:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627709": [
        {
            "ioc_value": "w4jm.9-32p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:41:48",
            "last_seen_utc": "2025-10-28 01:49:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627708": [
        {
            "ioc_value": "ox.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:38:27",
            "last_seen_utc": "2025-10-28 01:41:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627707": [
        {
            "ioc_value": "f6.0bj3i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:35:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627706": [
        {
            "ioc_value": "we.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:28:31",
            "last_seen_utc": "2025-10-28 01:35:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627705": [
        {
            "ioc_value": "u4hm.6-19t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627704": [
        {
            "ioc_value": "n0.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:18:07",
            "last_seen_utc": "2025-10-28 15:40:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627703": [
        {
            "ioc_value": "xi.ko-8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:09:21",
            "last_seen_utc": "2025-10-28 01:14:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627702": [
        {
            "ioc_value": "n0j.6-19t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 01:04:12",
            "last_seen_utc": "2025-10-28 01:14:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627701": [
        {
            "ioc_value": "i5.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 00:38:19",
            "last_seen_utc": "2025-10-28 18:36:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627700": [
        {
            "ioc_value": "w2cx.6-19t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 00:33:24",
            "last_seen_utc": "2025-10-28 00:39:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627699": [
        {
            "ioc_value": "x0p.3jw5u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 00:30:03",
            "last_seen_utc": "2025-10-28 00:39:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627698": [
        {
            "ioc_value": "am.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 00:27:55",
            "last_seen_utc": "2025-10-28 00:33:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627697": [
        {
            "ioc_value": "we.bo-x2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 00:18:32",
            "last_seen_utc": "2025-10-28 00:24:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627696": [
        {
            "ioc_value": "d6pl.6-19t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 00:14:57",
            "last_seen_utc": "2025-10-28 00:24:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627695": [
        {
            "ioc_value": "q7m.3jw5u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 00:10:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627694": [
        {
            "ioc_value": "up.yq-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-28 00:08:45",
            "last_seen_utc": "2025-10-28 00:14:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627690": [
        {
            "ioc_value": "v4.3jw5u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 23:55:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627689": [
        {
            "ioc_value": "y3s.6-19t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 23:51:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627688": [
        {
            "ioc_value": "no.de-6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 23:50:48",
            "last_seen_utc": "2025-10-27 23:55:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627687": [
        {
            "ioc_value": "r8kd.6-19t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 23:30:58",
            "last_seen_utc": "2025-10-27 23:38:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627686": [
        {
            "ioc_value": "xl.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 23:28:08",
            "last_seen_utc": "2025-10-28 14:26:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627680": [
        {
            "ioc_value": "a7r.0vl3u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 22:53:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627678": [
        {
            "ioc_value": "g5t.8j8-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 22:45:33",
            "last_seen_utc": "2025-10-27 22:50:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627677": [
        {
            "ioc_value": "1t.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 22:33:43",
            "last_seen_utc": "2025-10-28 10:33:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627676": [
        {
            "ioc_value": "m.0vl3u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 22:33:18",
            "last_seen_utc": "2025-10-27 22:42:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627675": [
        {
            "ioc_value": "z0wa.8j8-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 22:24:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627674": [
        {
            "ioc_value": "c7nh.8j8-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 22:10:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627673": [
        {
            "ioc_value": "eh.p2-om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 22:08:02",
            "last_seen_utc": "2025-10-27 22:10:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627672": [
        {
            "ioc_value": "egg.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:58:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627671": [
        {
            "ioc_value": "rat.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:46:34",
            "last_seen_utc": "2025-10-27 21:47:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627670": [
        {
            "ioc_value": "v1rx.8j8-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:37:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627669": [
        {
            "ioc_value": "zq8.0vl3u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:35:59",
            "last_seen_utc": "2025-10-27 21:47:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627668": [
        {
            "ioc_value": "wig.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:34:45",
            "last_seen_utc": "2025-10-27 21:37:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627667": [
        {
            "ioc_value": "k1.0vl3u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:31:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627666": [
        {
            "ioc_value": "gas.v3sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:27:26",
            "last_seen_utc": "2025-10-27 21:31:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627665": [
        {
            "ioc_value": "one.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:17:31",
            "last_seen_utc": "2025-10-27 21:24:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627664": [
        {
            "ioc_value": "p9q.8j8-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:16:51",
            "last_seen_utc": "2025-10-27 21:28:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627663": [
        {
            "ioc_value": "lag.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 21:09:41",
            "last_seen_utc": "2025-10-27 21:16:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627662": [
        {
            "ioc_value": "m6zk.8j8-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627661": [
        {
            "ioc_value": "y41.9bp6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:58:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627660": [
        {
            "ioc_value": "lo.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:58:20",
            "last_seen_utc": "2025-10-27 20:59:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627657": [
        {
            "ioc_value": "us-gateway.google-status.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-27 20:48:56",
            "last_seen_utc": "2025-12-06 01:52:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1627656": [
        {
            "ioc_value": "antams.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-27 20:48:40",
            "last_seen_utc": "2025-12-14 11:48:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1627655": [
        {
            "ioc_value": "b2yl.3v9-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:43:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627654": [
        {
            "ioc_value": "pi.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:40:40",
            "last_seen_utc": "2025-10-27 20:43:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627652": [
        {
            "ioc_value": "mu.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:27:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627651": [
        {
            "ioc_value": "h4qc.3v9-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:16:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627650": [
        {
            "ioc_value": "oh.ko-8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:15:56",
            "last_seen_utc": "2025-10-27 20:16:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627649": [
        {
            "ioc_value": "hk2.9bp6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:04:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627648": [
        {
            "ioc_value": "am.fy-7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 20:02:02",
            "last_seen_utc": "2025-10-27 20:04:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627635": [
        {
            "ioc_value": "t1g.3v9-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 19:58:45",
            "last_seen_utc": "2025-10-27 20:04:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627634": [
        {
            "ioc_value": "ia.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 19:48:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627633": [
        {
            "ioc_value": "z.9bp6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 19:37:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627632": [
        {
            "ioc_value": "nanomiloklosikolaymas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-27 19:36:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.240.56",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627631": [
        {
            "ioc_value": "x9dr.3v9-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 19:35:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627630": [
        {
            "ioc_value": "cersaavtolabnovuklubykol.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-27 19:34:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.58",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627629": [
        {
            "ioc_value": "fiklokasilupafas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-27 19:33:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/158.94.209.52",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627626": [
        {
            "ioc_value": "api.newshimforjune.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-27 19:27:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1802522/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627623": [
        {
            "ioc_value": "api.lkofitjhecvr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-27 19:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1802522/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627624": [
        {
            "ioc_value": "api.gigachatglob.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-27 19:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1802522/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627625": [
        {
            "ioc_value": "api.newshimone.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-27 19:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1802522/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627612": [
        {
            "ioc_value": "sirrbef.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-27 19:06:41",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627613": [
        {
            "ioc_value": "orthnsa.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-27 19:06:41",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627614": [
        {
            "ioc_value": "pitchz.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-27 19:06:41",
            "last_seen_utc": "2025-11-08 12:45:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627615": [
        {
            "ioc_value": "portag.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-27 19:06:41",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627606": [
        {
            "ioc_value": "d0m7.9bp6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 18:24:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627605": [
        {
            "ioc_value": "q3vz.3v9-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 18:23:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627604": [
        {
            "ioc_value": "w3t.9bp6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 18:06:07",
            "last_seen_utc": "2025-10-27 18:15:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627603": [
        {
            "ioc_value": "220520122153.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-27 18:04:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251027-rbttrae17h",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627602": [
        {
            "ioc_value": "contents-hungarian.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-10-27 18:03:48",
            "last_seen_utc": "2025-11-07 12:55:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/251027-tbaf8aynav",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627601": [
        {
            "ioc_value": "555888.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-27 18:02:09",
            "last_seen_utc": "2025-11-07 12:55:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251027-tae1baynas",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627598": [
        {
            "ioc_value": "k7m.3v9-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 18:01:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627597": [
        {
            "ioc_value": "cover-phantom.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-27 18:00:33",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251027-sfcayafy4c",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627596": [
        {
            "ioc_value": "ex.de-6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 17:48:02",
            "last_seen_utc": "2025-10-27 17:49:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627595": [
        {
            "ioc_value": "unit.b-9-ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 17:43:47",
            "last_seen_utc": "2025-10-27 17:49:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627593": [
        {
            "ioc_value": "ad.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 17:24:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627567": [
        {
            "ioc_value": "q8.9bp6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 17:06:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627566": [
        {
            "ioc_value": "task.b-9-ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 16:54:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627565": [
        {
            "ioc_value": "ye.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 16:50:08",
            "last_seen_utc": "2025-10-27 16:54:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627563": [
        {
            "ioc_value": "rd5.8vl8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 16:42:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627562": [
        {
            "ioc_value": "sale.b-9-ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 16:34:17",
            "last_seen_utc": "2025-10-27 16:49:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627540": [
        {
            "ioc_value": "flickrodf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-27 16:28:30",
            "last_seen_utc": "2025-10-27 16:12:53",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115447009285059676",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1627545": [
        {
            "ioc_value": "technoxpertsgroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-27 16:28:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115447009285059676",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1627560": [
        {
            "ioc_value": "dstat.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-27 16:26:03",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/79bcf99e5c1a3c82d9de611adecaa580350711916e22f9f019d80ae90b3ef24f/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1627553": [
        {
            "ioc_value": "ten.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 16:16:56",
            "last_seen_utc": "2025-10-27 16:22:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627550": [
        {
            "ioc_value": "cvt.technicalprorj.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-27 16:15:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1627538": [
        {
            "ioc_value": "1it.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 16:08:25",
            "last_seen_utc": "2025-10-27 16:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627537": [
        {
            "ioc_value": "h2v.8vl8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 16:06:39",
            "last_seen_utc": "2025-10-27 16:21:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627536": [
        {
            "ioc_value": "mhzlh773-56010.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-27 16:01:50",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627528": [
        {
            "ioc_value": "road.b-9-ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627529": [
        {
            "ioc_value": "key.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:59:00",
            "last_seen_utc": "2025-10-27 16:06:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627527": [
        {
            "ioc_value": "yen.v3sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:47:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627526": [
        {
            "ioc_value": "x.8vl8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:46:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627525": [
        {
            "ioc_value": "z1nc.b-9-ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:44:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627524": [
        {
            "ioc_value": "cut.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:39:38",
            "last_seen_utc": "2025-10-27 15:46:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627523": [
        {
            "ioc_value": "ash.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:34:01",
            "last_seen_utc": "2025-10-27 15:35:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627522": [
        {
            "ioc_value": "y0q9.8vl8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:34:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627521": [
        {
            "ioc_value": "yard.b-9-ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:29:41",
            "last_seen_utc": "2025-10-27 15:35:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627520": [
        {
            "ioc_value": "la.tov-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:28:30",
            "last_seen_utc": "2025-10-27 15:29:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627519": [
        {
            "ioc_value": "wood.wi-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627518": [
        {
            "ioc_value": "g7m.8vl8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627517": [
        {
            "ioc_value": "it.q-len.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:18:06",
            "last_seen_utc": "2025-10-27 15:19:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627512": [
        {
            "ioc_value": "view.wi-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:12:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627511": [
        {
            "ioc_value": "ye.j5-ol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:08:20",
            "last_seen_utc": "2025-10-27 15:12:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627510": [
        {
            "ioc_value": "gate.wi-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 15:04:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627509": [
        {
            "ioc_value": "ma.ko-8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:57:51",
            "last_seen_utc": "2025-10-27 15:04:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627508": [
        {
            "ioc_value": "n4.8vl8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:53:52",
            "last_seen_utc": "2025-10-27 14:59:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627507": [
        {
            "ioc_value": "he.fy-7a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:48:04",
            "last_seen_utc": "2025-10-28 01:04:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627506": [
        {
            "ioc_value": "ad.n2-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:37:43",
            "last_seen_utc": "2025-10-28 07:09:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627505": [
        {
            "ioc_value": "fuel.wi-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:30:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627504": [
        {
            "ioc_value": "ta.ra-9x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:28:52",
            "last_seen_utc": "2025-10-27 14:30:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627503": [
        {
            "ioc_value": "t2.8ss4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:25:18",
            "last_seen_utc": "2025-10-27 14:30:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627502": [
        {
            "ioc_value": "um.z3-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:20:26",
            "last_seen_utc": "2025-10-27 19:37:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627501": [
        {
            "ioc_value": "game.wi-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:15:44",
            "last_seen_utc": "2025-10-27 14:20:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627499": [
        {
            "ioc_value": "ma.bo-x2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 14:08:24",
            "last_seen_utc": "2025-10-28 05:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627498": [
        {
            "ioc_value": "la.yq-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:58:12",
            "last_seen_utc": "2025-10-27 18:06:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627497": [
        {
            "ioc_value": "book.wi-7-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:52:43",
            "last_seen_utc": "2025-10-27 13:58:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627496": [
        {
            "ioc_value": "c1x3.8ss4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:48:53",
            "last_seen_utc": "2025-10-27 13:58:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627495": [
        {
            "ioc_value": "g0.de-6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:48:47",
            "last_seen_utc": "2025-10-27 13:52:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627494": [
        {
            "ioc_value": "cvt.teba-forexport.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-27 13:44:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1627492": [
        {
            "ioc_value": "or.r0-mx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:38:44",
            "last_seen_utc": "2025-10-27 23:38:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627491": [
        {
            "ioc_value": "b.8ss4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:32:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627490": [
        {
            "ioc_value": "hill.x-3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:32:25",
            "last_seen_utc": "2025-10-27 13:41:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627489": [
        {
            "ioc_value": "at.hu-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:30:24",
            "last_seen_utc": "2025-10-27 13:32:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627484": [
        {
            "ioc_value": "eh.s4-ti.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:20:54",
            "last_seen_utc": "2025-10-28 04:13:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627483": [
        {
            "ioc_value": "p0a.8ss4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627482": [
        {
            "ioc_value": "home.x-3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:17:19",
            "last_seen_utc": "2025-10-27 13:26:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627481": [
        {
            "ioc_value": "ya.g-vox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 13:07:36",
            "last_seen_utc": "2025-10-27 13:18:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627479": [
        {
            "ioc_value": "zq9.8ss4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627478": [
        {
            "ioc_value": "ta.xe-1r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:57:46",
            "last_seen_utc": "2025-10-28 13:34:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627477": [
        {
            "ioc_value": "gold.x-3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:49:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627476": [
        {
            "ioc_value": "to.p2-om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:45:39",
            "last_seen_utc": "2025-10-28 10:07:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627475": [
        {
            "ioc_value": "k5.8ss4e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:40:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627474": [
        {
            "ioc_value": "bus.p2om.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:38:42",
            "last_seen_utc": "2025-10-27 12:40:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627473": [
        {
            "ioc_value": "fire.x-3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:33:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627472": [
        {
            "ioc_value": "dry.la9q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:28:21",
            "last_seen_utc": "2025-10-27 12:33:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627471": [
        {
            "ioc_value": "v7.7kf1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:24:04",
            "last_seen_utc": "2025-10-27 12:33:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627467": [
        {
            "ioc_value": "sessomania.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-27 12:21:25",
            "last_seen_utc": "2025-10-27 12:11:48",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115446061715663915",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1627470": [
        {
            "ioc_value": "tip.z3lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:19:51",
            "last_seen_utc": "2025-10-27 12:24:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627465": [
        {
            "ioc_value": "cold.x-3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:09:16",
            "last_seen_utc": "2025-10-27 12:22:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627464": [
        {
            "ioc_value": "but.v3sa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 12:07:58",
            "last_seen_utc": "2025-10-28 02:18:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627463": [
        {
            "ioc_value": "sorbbolindo.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-27 12:05:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251027-jyq3da1mdp",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627456": [
        {
            "ioc_value": "ratings-architects.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-27 12:00:34",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251027-k65q6scp9z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627455": [
        {
            "ioc_value": "h2k.7kf1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 11:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627454": [
        {
            "ioc_value": "pap.tov4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 11:58:06",
            "last_seen_utc": "2025-10-27 11:58:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627453": [
        {
            "ioc_value": "bird.x-3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 11:56:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627452": [
        {
            "ioc_value": "dry.mi4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 11:54:53",
            "last_seen_utc": "2025-10-27 11:56:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627451": [
        {
            "ioc_value": "no.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 11:50:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627450": [
        {
            "ioc_value": "ad.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 11:41:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627442": [
        {
            "ioc_value": "c5r.3j5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 10:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627441": [
        {
            "ioc_value": "qi.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 10:08:43",
            "last_seen_utc": "2025-10-27 10:14:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627440": [
        {
            "ioc_value": "d4pz.3j5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 10:02:42",
            "last_seen_utc": "2025-10-27 10:14:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627439": [
        {
            "ioc_value": "eh.pl-8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 09:59:30",
            "last_seen_utc": "2025-10-27 10:02:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627437": [
        {
            "ioc_value": "y7mf.3j5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 09:37:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627435": [
        {
            "ioc_value": "u3qa.3j5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 09:16:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627434": [
        {
            "ioc_value": "oh.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 09:15:42",
            "last_seen_utc": "2025-10-27 09:16:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627430": [
        {
            "ioc_value": "k8xn.3j5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 08:43:07",
            "last_seen_utc": "2025-10-27 08:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627429": [
        {
            "ioc_value": "pe.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 08:39:07",
            "last_seen_utc": "2025-10-27 08:43:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627428": [
        {
            "ioc_value": "nu.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 08:27:29",
            "last_seen_utc": "2025-10-27 08:30:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627427": [
        {
            "ioc_value": "r0lg.3j5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 08:21:41",
            "last_seen_utc": "2025-10-27 08:29:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627426": [
        {
            "ioc_value": "ax.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 08:19:42",
            "last_seen_utc": "2025-10-27 08:26:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627416": [
        {
            "ioc_value": "os.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 07:38:12",
            "last_seen_utc": "2025-10-27 07:40:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627415": [
        {
            "ioc_value": "v3n.2h7-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 07:31:12",
            "last_seen_utc": "2025-10-27 07:44:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627414": [
        {
            "ioc_value": "ye.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 07:27:54",
            "last_seen_utc": "2025-10-27 07:31:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627407": [
        {
            "ioc_value": "gpu.orca-trade.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-27 07:22:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1627408": [
        {
            "ioc_value": "gz.technicalprorj.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-27 07:22:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1627409": [
        {
            "ioc_value": "wed.salahelden.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-27 07:22:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1627410": [
        {
            "ioc_value": "fri.technicalprorj.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-27 07:22:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1627397": [
        {
            "ioc_value": "manaura-43718.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-27 07:21:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627398": [
        {
            "ioc_value": "3thebfgnh.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-27 07:21:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627399": [
        {
            "ioc_value": "z9kahfjxc.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-27 07:21:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627395": [
        {
            "ioc_value": "new.executor.qzz.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-27 07:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627393": [
        {
            "ioc_value": "v2.xoilaczzzgz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-27 07:20:04",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627394": [
        {
            "ioc_value": "v3.xoilaczzzgz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-27 07:20:04",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627387": [
        {
            "ioc_value": "blog.atri.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-27 07:19:25",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627388": [
        {
            "ioc_value": "gatex.xoilaczzzgz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-27 07:19:25",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627389": [
        {
            "ioc_value": "kw.atri.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-27 07:19:25",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627390": [
        {
            "ioc_value": "pay.atri.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-27 07:19:25",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627385": [
        {
            "ioc_value": "ye.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 07:17:37",
            "last_seen_utc": "2025-10-27 07:19:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627382": [
        {
            "ioc_value": "ef.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 07:08:51",
            "last_seen_utc": "2025-10-27 07:09:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627381": [
        {
            "ioc_value": "n2bv.2h7-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 07:00:29",
            "last_seen_utc": "2025-10-27 07:19:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627380": [
        {
            "ioc_value": "ow.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 06:58:34",
            "last_seen_utc": "2025-10-27 07:00:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627378": [
        {
            "ioc_value": "6yd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-27 06:53:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/9b2217b4b0abe7b404353f52ccbddeb93c6790efb5ad0a568be00483655c3790/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1627377": [
        {
            "ioc_value": "ya.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 06:48:17",
            "last_seen_utc": "2025-10-27 06:49:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627376": [
        {
            "ioc_value": "h5yx.2h7-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 06:43:47",
            "last_seen_utc": "2025-10-27 06:49:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627375": [
        {
            "ioc_value": "ye.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 06:38:29",
            "last_seen_utc": "2025-10-27 06:43:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627374": [
        {
            "ioc_value": "xi.pl-8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 06:28:11",
            "last_seen_utc": "2025-10-27 06:32:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627373": [
        {
            "ioc_value": "c9tw.2h7-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 06:27:24",
            "last_seen_utc": "2025-10-27 06:32:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627371": [
        {
            "ioc_value": "ho.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 06:18:22",
            "last_seen_utc": "2025-10-27 06:27:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627369": [
        {
            "ioc_value": "getting-judicial.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-27 06:02:46",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251027-dk1f1ahv6b",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627368": [
        {
            "ioc_value": "za.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 06:00:56",
            "last_seen_utc": "2025-10-27 06:05:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627364": [
        {
            "ioc_value": "z1mk.2h7-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 06:00:15",
            "last_seen_utc": "2025-10-27 06:05:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627362": [
        {
            "ioc_value": "ow.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 05:47:34",
            "last_seen_utc": "2025-10-27 06:00:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627361": [
        {
            "ioc_value": "no.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 05:37:39",
            "last_seen_utc": "2025-10-27 05:45:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627360": [
        {
            "ioc_value": "q6pr.2h7-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 05:28:01",
            "last_seen_utc": "2025-10-27 05:41:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627359": [
        {
            "ioc_value": "ya.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 05:27:23",
            "last_seen_utc": "2025-10-27 05:28:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627358": [
        {
            "ioc_value": "yo.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 05:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627357": [
        {
            "ioc_value": "ai.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 05:08:06",
            "last_seen_utc": "2025-10-27 05:14:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627356": [
        {
            "ioc_value": "m3yc.3v-3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 05:05:01",
            "last_seen_utc": "2025-10-27 05:14:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627355": [
        {
            "ioc_value": "1t.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 04:58:19",
            "last_seen_utc": "2025-10-27 05:05:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627354": [
        {
            "ioc_value": "jo.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 04:45:50",
            "last_seen_utc": "2025-10-27 04:54:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627353": [
        {
            "ioc_value": "t6b.3v-3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 04:37:35",
            "last_seen_utc": "2025-10-27 04:47:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627352": [
        {
            "ioc_value": "jo.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 04:27:47",
            "last_seen_utc": "2025-10-27 04:37:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627351": [
        {
            "ioc_value": "lo.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 04:17:59",
            "last_seen_utc": "2025-10-27 04:23:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627350": [
        {
            "ioc_value": "ae.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 04:07:47",
            "last_seen_utc": "2025-10-27 04:13:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627339": [
        {
            "ioc_value": "g1zx.3v-3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627338": [
        {
            "ioc_value": "fa.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:57:23",
            "last_seen_utc": "2025-10-27 03:58:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627337": [
        {
            "ioc_value": "lo.pl-8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:47:36",
            "last_seen_utc": "2025-10-27 03:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627336": [
        {
            "ioc_value": "he.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:38:20",
            "last_seen_utc": "2025-10-27 03:40:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627335": [
        {
            "ioc_value": "r2tl.3v-3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:31:56",
            "last_seen_utc": "2025-10-27 03:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627334": [
        {
            "ioc_value": "me.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:28:03",
            "last_seen_utc": "2025-10-27 03:31:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627333": [
        {
            "ioc_value": "t9x4.7kf1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:18:59",
            "last_seen_utc": "2025-10-27 03:28:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627332": [
        {
            "ioc_value": "he.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:18:16",
            "last_seen_utc": "2025-10-27 03:22:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627331": [
        {
            "ioc_value": "so.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:07:58",
            "last_seen_utc": "2025-10-27 03:16:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627330": [
        {
            "ioc_value": "x7md.3v-3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 03:04:04",
            "last_seen_utc": "2025-10-27 03:22:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627329": [
        {
            "ioc_value": "ta.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 02:58:00",
            "last_seen_utc": "2025-10-27 03:04:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627326": [
        {
            "ioc_value": "mz1.7kf1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 02:49:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627323": [
        {
            "ioc_value": "bililbilil.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-27 02:48:26",
            "last_seen_utc": "2025-11-30 13:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1627322": [
        {
            "ioc_value": "ar.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 02:47:44",
            "last_seen_utc": "2025-10-27 10:55:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627321": [
        {
            "ioc_value": "f9q.3v-3y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 02:36:03",
            "last_seen_utc": "2025-10-27 02:50:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627320": [
        {
            "ioc_value": "ox.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 02:27:22",
            "last_seen_utc": "2025-10-27 07:59:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627319": [
        {
            "ioc_value": "q3.7kf1u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 02:18:36",
            "last_seen_utc": "2025-10-27 10:55:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627318": [
        {
            "ioc_value": "na.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 02:17:28",
            "last_seen_utc": "2025-10-27 02:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627317": [
        {
            "ioc_value": "he.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 02:08:12",
            "last_seen_utc": "2025-10-27 02:10:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627316": [
        {
            "ioc_value": "blue.ky-4-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 02:04:04",
            "last_seen_utc": "2025-10-27 02:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627315": [
        {
            "ioc_value": "ut.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 01:58:17",
            "last_seen_utc": "2025-10-27 08:50:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627314": [
        {
            "ioc_value": "pine.tr-8-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 01:55:41",
            "last_seen_utc": "2025-10-27 01:59:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627313": [
        {
            "ioc_value": "cook.ky-4-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 01:44:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627312": [
        {
            "ioc_value": "aw.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 01:40:13",
            "last_seen_utc": "2025-10-27 09:54:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627168": [
        {
            "ioc_value": "quit.ky-4-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:51:11",
            "last_seen_utc": "2025-10-27 01:04:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627167": [
        {
            "ioc_value": "rift.tr-8-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:49:37",
            "last_seen_utc": "2025-10-27 01:01:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627166": [
        {
            "ioc_value": "re.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:48:24",
            "last_seen_utc": "2025-10-27 00:51:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627165": [
        {
            "ioc_value": "clay.tr-8-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:39:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627164": [
        {
            "ioc_value": "da.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:38:30",
            "last_seen_utc": "2025-10-27 00:39:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627163": [
        {
            "ioc_value": "1t.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:28:09",
            "last_seen_utc": "2025-10-27 00:31:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627162": [
        {
            "ioc_value": "port.ky-4-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:26:47",
            "last_seen_utc": "2025-10-27 00:31:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627161": [
        {
            "ioc_value": "ye.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:17:53",
            "last_seen_utc": "2025-10-27 00:26:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627160": [
        {
            "ioc_value": "oe.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:08:07",
            "last_seen_utc": "2025-10-27 00:10:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627159": [
        {
            "ioc_value": "open.ky-4-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-27 00:04:21",
            "last_seen_utc": "2025-10-27 00:10:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627152": [
        {
            "ioc_value": "b0.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 23:57:39",
            "last_seen_utc": "2025-10-27 04:43:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627151": [
        {
            "ioc_value": "s0l0.tr-8-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 23:55:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627150": [
        {
            "ioc_value": "if.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 23:48:55",
            "last_seen_utc": "2025-10-26 23:55:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627149": [
        {
            "ioc_value": "go.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 23:30:29",
            "last_seen_utc": "2025-10-26 23:31:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627148": [
        {
            "ioc_value": "bark.tr-8-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 23:24:28",
            "last_seen_utc": "2025-10-26 23:31:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627147": [
        {
            "ioc_value": "node.ky-4-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 23:10:50",
            "last_seen_utc": "2025-10-26 23:25:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627146": [
        {
            "ioc_value": "gale.tr-8-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 23:08:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627145": [
        {
            "ioc_value": "el.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 23:02:18",
            "last_seen_utc": "2025-10-26 23:10:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627125": [
        {
            "ioc_value": "dune.n-4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 22:42:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627124": [
        {
            "ioc_value": "b00k.re-t-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 22:38:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627119": [
        {
            "ioc_value": "l0gs.re-t-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 22:10:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627118": [
        {
            "ioc_value": "s1lk.n-4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 22:07:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627117": [
        {
            "ioc_value": "mail.re-t-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:58:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627116": [
        {
            "ioc_value": "5o.do-k3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:56:30",
            "last_seen_utc": "2025-10-26 21:58:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627115": [
        {
            "ioc_value": "ye.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:46:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627114": [
        {
            "ioc_value": "eh.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:32:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627113": [
        {
            "ioc_value": "l0re.n-4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:23:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627110": [
        {
            "ioc_value": "icebergtbilisi.ge",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-26 21:20:38",
            "last_seen_utc": "2025-10-26 21:20:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627111": [
        {
            "ioc_value": "Ablelifepurelife.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-26 21:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627112": [
        {
            "ioc_value": "ablelifepurelifebk.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-26 21:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1627109": [
        {
            "ioc_value": "lake.re-t-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:12:21",
            "last_seen_utc": "2025-10-26 21:18:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627108": [
        {
            "ioc_value": "ah.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:08:33",
            "last_seen_utc": "2025-10-26 21:48:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627107": [
        {
            "ioc_value": "tab.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:07:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627106": [
        {
            "ioc_value": "end.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:05:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627105": [
        {
            "ioc_value": "mint.n-4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:00:40",
            "last_seen_utc": "2025-10-26 21:08:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627103": [
        {
            "ioc_value": "jump.re-t-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627104": [
        {
            "ioc_value": "go.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 21:00:21",
            "last_seen_utc": "2025-10-26 21:47:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627100": [
        {
            "ioc_value": "p1.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 20:45:06",
            "last_seen_utc": "2025-10-26 21:46:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627101": [
        {
            "ioc_value": "join.re-t-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 20:45:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627099": [
        {
            "ioc_value": "ol.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 20:26:20",
            "last_seen_utc": "2025-10-26 21:45:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627098": [
        {
            "ioc_value": "my.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 20:19:48",
            "last_seen_utc": "2025-10-26 21:45:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627097": [
        {
            "ioc_value": "t00l.pl-8-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 20:14:01",
            "last_seen_utc": "2025-10-26 20:26:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627095": [
        {
            "ioc_value": "fa.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 20:09:44",
            "last_seen_utc": "2025-10-26 21:44:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627096": [
        {
            "ioc_value": "c0ve.n-4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 20:09:44",
            "last_seen_utc": "2025-10-26 20:19:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627094": [
        {
            "ioc_value": "fern.n-4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 20:01:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627084": [
        {
            "ioc_value": "cog.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 19:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1627082": [
        {
            "ioc_value": "hi.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 19:53:32",
            "last_seen_utc": "2025-10-26 21:42:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627083": [
        {
            "ioc_value": "f1le.pl-8-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 19:53:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627055": [
        {
            "ioc_value": "kenges-rakishev-investigation.is",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 19:34:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,infostealer,lumma,stealer",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1627058": [
        {
            "ioc_value": "dorimeinserino.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-26 19:34:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/a0facf58db948588939ced368a25e78edad3780cc3489a69a27cf4a3a116befc",
            "tags": "c2,Rhadamanthys",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1627059": [
        {
            "ioc_value": "www.aieov.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.floxif",
            "malware_alias": null,
            "malware_printable": "Floxif",
            "first_seen_utc": "2025-10-26 19:34:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/9d64bed861d443eba3baec789c797051a68e7d11a348bd4a41db2c8b1c7b3459/relations",
            "tags": "floxfix",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1627079": [
        {
            "ioc_value": "auth.snickers.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-26 19:31:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/be6105ef2b86169055f3c1db4b2162626b649671b65281f3754ee9f115478a5f/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1627047": [
        {
            "ioc_value": "b7gs.4aeaco0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 18:39:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627038": [
        {
            "ioc_value": "idea.pl-8-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 18:23:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627037": [
        {
            "ioc_value": "uh.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 18:11:50",
            "last_seen_utc": "2025-10-26 21:34:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627036": [
        {
            "ioc_value": "host.pl-8-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 18:11:12",
            "last_seen_utc": "2025-10-26 18:16:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627034": [
        {
            "ioc_value": "ex.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 18:08:30",
            "last_seen_utc": "2025-10-26 21:34:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627035": [
        {
            "ioc_value": "m.4aeaco0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 18:08:30",
            "last_seen_utc": "2025-10-26 18:11:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627033": [
        {
            "ioc_value": "b00t.no-ip.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-26 18:06:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-st4mcaby9h",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627031": [
        {
            "ioc_value": "growth-turtle.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-26 18:01:52",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-q5tkeazrbq",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627030": [
        {
            "ioc_value": "ka.do-k3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 18:00:54",
            "last_seen_utc": "2025-10-26 21:33:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627029": [
        {
            "ioc_value": "dedumanno.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-26 18:00:42",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-t26mcact5d",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627028": [
        {
            "ioc_value": "articles-dividend.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-26 18:00:32",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-td4g3scp2x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627027": [
        {
            "ioc_value": "job-citizenship.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-26 18:00:31",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-tstw7acs8a",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627026": [
        {
            "ioc_value": "county-secret.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-26 18:00:30",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-vcwaracv4a",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1627025": [
        {
            "ioc_value": "gift.pl-8-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 17:52:00",
            "last_seen_utc": "2025-10-26 18:00:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627024": [
        {
            "ioc_value": "em.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 17:51:59",
            "last_seen_utc": "2025-10-26 21:32:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627022": [
        {
            "ioc_value": "we.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 17:44:45",
            "last_seen_utc": "2025-10-26 21:31:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627023": [
        {
            "ioc_value": "gear.pl-8-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 17:44:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627021": [
        {
            "ioc_value": "q8yr.4aeaco0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 17:24:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627019": [
        {
            "ioc_value": "ma.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 17:18:58",
            "last_seen_utc": "2025-10-26 21:30:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627020": [
        {
            "ioc_value": "pa55.me-2-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 17:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627018": [
        {
            "ioc_value": "am.x3-ri.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 17:15:01",
            "last_seen_utc": "2025-10-26 23:25:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627017": [
        {
            "ioc_value": "needleexperience.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-26 17:04:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1627012": [
        {
            "ioc_value": "my.to-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 16:59:33",
            "last_seen_utc": "2025-10-26 21:28:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1627010": [
        {
            "ioc_value": "write-event.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-26 16:57:15",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626998": [
        {
            "ioc_value": "ka.s2-ly.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 16:49:54",
            "last_seen_utc": "2025-10-26 21:49:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626999": [
        {
            "ioc_value": "s1te.me-2-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 16:49:54",
            "last_seen_utc": "2025-10-26 16:59:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626996": [
        {
            "ioc_value": "classic-dave.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-26 16:41:12",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/58954334-127a-4364-bc1a-0f047339860b",
            "tags": "njRAT",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1626997": [
        {
            "ioc_value": "rfvlive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-26 16:40:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1626993": [
        {
            "ioc_value": "utps.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-26 16:38:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1626994": [
        {
            "ioc_value": "systemsupport.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-26 16:38:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1626995": [
        {
            "ioc_value": "nwrstghbwrtjynrsfghberth.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-26 16:38:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1626992": [
        {
            "ioc_value": "ka.ze-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 16:38:36",
            "last_seen_utc": "2025-10-26 22:10:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626985": [
        {
            "ioc_value": "farm.me-2-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 16:20:46",
            "last_seen_utc": "2025-10-26 16:38:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626986": [
        {
            "ioc_value": "ka.ky-4x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 16:20:46",
            "last_seen_utc": "2025-10-26 21:25:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626983": [
        {
            "ioc_value": "j1.4aeaco0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 16:03:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626984": [
        {
            "ioc_value": "pe.vex-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 16:03:34",
            "last_seen_utc": "2025-10-26 21:24:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626966": [
        {
            "ioc_value": "bhware.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-26 16:02:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/2c64a1b9a4556e4ea7324dde53318f32f0a07d7ae31c370f737a72645833ec26/",
            "tags": "BHWareStealer,C2,infostealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1626967": [
        {
            "ioc_value": "root.bhware.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-26 16:02:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/2c64a1b9a4556e4ea7324dde53318f32f0a07d7ae31c370f737a72645833ec26/",
            "tags": "BHWareStealer,C2,infostealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1626978": [
        {
            "ioc_value": "edit.me-2-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 15:56:04",
            "last_seen_utc": "2025-10-26 16:04:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626976": [
        {
            "ioc_value": "re.wi-7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 15:48:12",
            "last_seen_utc": "2025-10-26 21:22:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626977": [
        {
            "ioc_value": "xh5.6aiiwi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 15:48:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626975": [
        {
            "ioc_value": "ut.tr-8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 15:28:27",
            "last_seen_utc": "2025-10-26 21:21:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626974": [
        {
            "ioc_value": "er.n4-ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 15:19:31",
            "last_seen_utc": "2025-10-27 01:04:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626973": [
        {
            "ioc_value": "r2n.6aiiwi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 15:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626972": [
        {
            "ioc_value": "data.me-2-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 15:12:57",
            "last_seen_utc": "2025-10-26 15:20:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626971": [
        {
            "ioc_value": "em.pl-8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 15:08:17",
            "last_seen_utc": "2025-10-26 22:42:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626970": [
        {
            "ioc_value": "calm.me-2-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 14:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626968": [
        {
            "ioc_value": "ho.do-k3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 14:53:36",
            "last_seen_utc": "2025-10-26 21:18:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626969": [
        {
            "ioc_value": "f.6aiiwi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 14:53:36",
            "last_seen_utc": "2025-10-26 15:08:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626964": [
        {
            "ioc_value": "h0me.xa-5-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 14:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626965": [
        {
            "ioc_value": "da.qen-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 14:20:58",
            "last_seen_utc": "2025-10-26 21:17:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626963": [
        {
            "ioc_value": "c0de.xa-5-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 14:03:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626962": [
        {
            "ioc_value": "l9q7.6aiiwi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 14:00:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626961": [
        {
            "ioc_value": "oy.r1v-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 14:00:44",
            "last_seen_utc": "2025-10-27 02:37:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626958": [
        {
            "ioc_value": "oh.re-t0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 13:48:40",
            "last_seen_utc": "2025-10-26 21:15:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626957": [
        {
            "ioc_value": "u0b.6aiiwi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 13:38:55",
            "last_seen_utc": "2025-10-26 13:53:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626955": [
        {
            "ioc_value": "jab.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 13:37:56",
            "last_seen_utc": "2025-10-26 21:14:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626956": [
        {
            "ioc_value": "boat.xa-5-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 13:37:56",
            "last_seen_utc": "2025-10-26 13:48:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626954": [
        {
            "ioc_value": "fry.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 13:30:21",
            "last_seen_utc": "2025-10-26 21:13:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626951": [
        {
            "ioc_value": "wed.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 13:18:35",
            "last_seen_utc": "2025-10-26 21:13:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626952": [
        {
            "ioc_value": "area.xa-5-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 13:18:35",
            "last_seen_utc": "2025-10-26 13:30:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626950": [
        {
            "ioc_value": "one.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 13:08:41",
            "last_seen_utc": "2025-10-26 21:12:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626949": [
        {
            "ioc_value": "c3.6aiiwi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 13:04:35",
            "last_seen_utc": "2025-10-26 13:08:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626947": [
        {
            "ioc_value": "acid.xa-5-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 12:57:19",
            "last_seen_utc": "2025-10-26 13:12:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626948": [
        {
            "ioc_value": "our.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 12:57:19",
            "last_seen_utc": "2025-10-26 21:10:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626946": [
        {
            "ioc_value": "k9r2.7ph88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 12:37:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626945": [
        {
            "ioc_value": "yam.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 12:34:14",
            "last_seen_utc": "2025-10-26 21:09:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626941": [
        {
            "ioc_value": "par.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 12:18:39",
            "last_seen_utc": "2025-10-26 21:07:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626942": [
        {
            "ioc_value": "u0b.7ph88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 12:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626943": [
        {
            "ioc_value": "able.xa-5-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 12:18:39",
            "last_seen_utc": "2025-10-26 12:34:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626938": [
        {
            "ioc_value": "thread-faq.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-26 12:02:17",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-ndqy4agq91",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626939": [
        {
            "ioc_value": "norot15.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-26 12:02:17",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-n2al1sg19e",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626928": [
        {
            "ioc_value": "bln.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 11:54:42",
            "last_seen_utc": "2025-10-26 21:05:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626927": [
        {
            "ioc_value": "k4sm.9h-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 11:54:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626925": [
        {
            "ioc_value": "hue.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 11:35:08",
            "last_seen_utc": "2025-10-26 21:04:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626926": [
        {
            "ioc_value": "v0jp.9h-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 11:35:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626923": [
        {
            "ioc_value": "h8rf.9h-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 11:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626924": [
        {
            "ioc_value": "boy.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 11:19:03",
            "last_seen_utc": "2025-10-26 21:04:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626922": [
        {
            "ioc_value": "c1wn.9h-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 11:08:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626921": [
        {
            "ioc_value": "wee.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 11:08:35",
            "last_seen_utc": "2025-10-26 21:04:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626920": [
        {
            "ioc_value": "p9y1.7ph88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 11:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626906": [
        {
            "ioc_value": "fad.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 10:51:16",
            "last_seen_utc": "2025-10-26 21:04:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626900": [
        {
            "ioc_value": "a3z.7ph88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 10:43:54",
            "last_seen_utc": "2025-10-26 10:58:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626898": [
        {
            "ioc_value": "few.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 10:40:19",
            "last_seen_utc": "2025-10-26 21:04:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626899": [
        {
            "ioc_value": "z6qa.9h-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 10:40:19",
            "last_seen_utc": "2025-10-26 10:51:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626895": [
        {
            "ioc_value": "ate.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 10:23:02",
            "last_seen_utc": "2025-10-26 21:02:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626894": [
        {
            "ioc_value": "t3yg.9h-5y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 10:23:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626892": [
        {
            "ioc_value": "l5vd.8r-4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 10:02:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626893": [
        {
            "ioc_value": "odd.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 10:02:04",
            "last_seen_utc": "2025-10-26 21:00:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626891": [
        {
            "ioc_value": "aid.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 09:49:47",
            "last_seen_utc": "2025-10-26 20:19:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626890": [
        {
            "ioc_value": "e7pk.8r-4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 09:44:25",
            "last_seen_utc": "2025-10-26 09:49:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626889": [
        {
            "ioc_value": "jug.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 09:39:01",
            "last_seen_utc": "2025-10-26 20:18:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626888": [
        {
            "ioc_value": "f6.7ph88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 09:39:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626886": [
        {
            "ioc_value": "u4qh.8r-4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 09:29:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626887": [
        {
            "ioc_value": "yap.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 09:29:44",
            "last_seen_utc": "2025-10-26 20:17:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626885": [
        {
            "ioc_value": "technical-adsl.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-26 09:17:27",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626883": [
        {
            "ioc_value": "miodzaki.bit",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.necurs",
            "malware_alias": "nucurs",
            "malware_printable": "Necurs",
            "first_seen_utc": "2025-10-26 09:15:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,necurs",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626879": [
        {
            "ioc_value": "comando555.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-26 09:15:24",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626880": [
        {
            "ioc_value": "dcdgloss.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-26 09:15:24",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626881": [
        {
            "ioc_value": "go-fairy.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-26 09:15:24",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626882": [
        {
            "ioc_value": "less-drives.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-26 09:15:24",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626877": [
        {
            "ioc_value": "cloudflare.cooltheburn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-26 09:15:06",
            "last_seen_utc": "2025-12-07 19:48:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626878": [
        {
            "ioc_value": "cloudflare.fentonph.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-26 09:15:06",
            "last_seen_utc": "2025-12-07 19:48:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626875": [
        {
            "ioc_value": "cloudflare.alegria-productions.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-26 09:15:05",
            "last_seen_utc": "2025-12-07 19:48:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626876": [
        {
            "ioc_value": "cloudflare.avicforging.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-26 09:15:05",
            "last_seen_utc": "2025-12-07 19:48:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626872": [
        {
            "ioc_value": "x.hinderalawfirm.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-26 09:12:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626873": [
        {
            "ioc_value": "yww68h3pz.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-26 09:12:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626869": [
        {
            "ioc_value": "you.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 09:10:17",
            "last_seen_utc": "2025-10-26 20:15:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626862": [
        {
            "ioc_value": "mz6.5bq18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 08:52:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626861": [
        {
            "ioc_value": "a2mx.8r-4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 08:13:17",
            "last_seen_utc": "2025-10-26 09:10:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626860": [
        {
            "ioc_value": "gad.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 08:13:16",
            "last_seen_utc": "2025-10-26 20:05:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626848": [
        {
            "ioc_value": "l1e.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 07:50:20",
            "last_seen_utc": "2025-10-26 20:03:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626849": [
        {
            "ioc_value": "g9tl.8r-4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 07:50:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626847": [
        {
            "ioc_value": "vat.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 07:40:05",
            "last_seen_utc": "2025-10-26 20:02:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626585": [
        {
            "ioc_value": "banjuyj.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:31",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626586": [
        {
            "ioc_value": "blasttw.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:31",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626587": [
        {
            "ioc_value": "brothdy.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:30",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626588": [
        {
            "ioc_value": "cutke.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:30",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626589": [
        {
            "ioc_value": "cracka.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:26",
            "last_seen_utc": "2025-10-25 15:43:19",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626590": [
        {
            "ioc_value": "illuyxka.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:26",
            "last_seen_utc": "2025-10-25 14:42:10",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626591": [
        {
            "ioc_value": "pseuyms.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:25",
            "last_seen_utc": "2025-10-25 14:42:10",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626592": [
        {
            "ioc_value": "senegmx.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:25",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626593": [
        {
            "ioc_value": "swepois.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:24",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626594": [
        {
            "ioc_value": "tangebg.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:24",
            "last_seen_utc": "2025-10-25 14:42:10",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626595": [
        {
            "ioc_value": "vacuuex.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:23",
            "last_seen_utc": "2025-10-25 14:42:10",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626596": [
        {
            "ioc_value": "walruhj.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:23",
            "last_seen_utc": "2025-10-25 14:42:10",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626597": [
        {
            "ioc_value": "chalkc.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:23",
            "last_seen_utc": "2025-10-25 14:42:10",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626599": [
        {
            "ioc_value": "ineffqa.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:22",
            "last_seen_utc": "2025-11-16 15:16:54",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626598": [
        {
            "ioc_value": "trannlh.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-26 07:39:20",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1626671": [
        {
            "ioc_value": "vps-2624.onecom-cloud.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-26 07:39:17",
            "last_seen_utc": null,
            "confidence_level": 80,
            "reference": null,
            "tags": "mirai",
            "anonymous": "0",
            "reporter": "seckle"
        }
    ],
    "1626740": [
        {
            "ioc_value": "cureprjajaa.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-26 07:39:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "FixStealer,infostealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1626845": [
        {
            "ioc_value": "h2k3.5bq18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 07:30:04",
            "last_seen_utc": "2025-10-26 07:40:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626843": [
        {
            "ioc_value": "jag.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 07:29:58",
            "last_seen_utc": "2025-10-26 20:01:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626844": [
        {
            "ioc_value": "s0we.8r-4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 07:29:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626841": [
        {
            "ioc_value": "f1ct.6-w0y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 07:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626842": [
        {
            "ioc_value": "bog.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 07:20:00",
            "last_seen_utc": "2025-10-26 20:00:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626840": [
        {
            "ioc_value": "thy.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 07:08:25",
            "last_seen_utc": "2025-10-26 19:58:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626834": [
        {
            "ioc_value": "b9.5bq18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 06:59:57",
            "last_seen_utc": "2025-10-26 07:09:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626833": [
        {
            "ioc_value": "q7hp.6-w0y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 06:54:40",
            "last_seen_utc": "2025-10-26 07:08:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626832": [
        {
            "ioc_value": "dry.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 06:54:39",
            "last_seen_utc": "2025-10-26 19:57:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626831": [
        {
            "ioc_value": "his.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 06:30:56",
            "last_seen_utc": "2025-10-26 19:54:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626830": [
        {
            "ioc_value": "d3yv.6-w0y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 06:22:21",
            "last_seen_utc": "2025-10-26 06:30:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626828": [
        {
            "ioc_value": "ken.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 06:18:26",
            "last_seen_utc": "2025-10-26 19:53:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626829": [
        {
            "ioc_value": "x0p4.5bq18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626827": [
        {
            "ioc_value": "rib.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 06:09:58",
            "last_seen_utc": "2025-10-26 19:52:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626822": [
        {
            "ioc_value": "server145454-55503.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-26 06:00:56",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-c755bscw2a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626823": [
        {
            "ioc_value": "center-para.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-26 06:00:56",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-c755bscw2a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626821": [
        {
            "ioc_value": "nako-33498.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-26 06:00:21",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251026-bcajhab13a",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626819": [
        {
            "ioc_value": "q7m.5bq18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626820": [
        {
            "ioc_value": "day.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:58:39",
            "last_seen_utc": "2025-10-26 19:51:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626817": [
        {
            "ioc_value": "x8lb.6-w0y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:55:56",
            "last_seen_utc": "2025-10-26 06:09:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626818": [
        {
            "ioc_value": "set.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:55:56",
            "last_seen_utc": "2025-10-26 19:50:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626815": [
        {
            "ioc_value": "aim.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:33:40",
            "last_seen_utc": "2025-10-26 19:49:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626816": [
        {
            "ioc_value": "j5qn.6-w0y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:33:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626814": [
        {
            "ioc_value": "v1.5bq18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:33:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626813": [
        {
            "ioc_value": "pry.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:30:23",
            "last_seen_utc": "2025-10-26 19:48:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626812": [
        {
            "ioc_value": "r2uk.6-w0y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:13:26",
            "last_seen_utc": "2025-10-26 05:30:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626811": [
        {
            "ioc_value": "oft.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:13:25",
            "last_seen_utc": "2025-10-26 19:46:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626809": [
        {
            "ioc_value": "orb.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:08:51",
            "last_seen_utc": "2025-10-26 19:46:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626810": [
        {
            "ioc_value": "t2w.1lt22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 05:08:51",
            "last_seen_utc": "2025-10-26 05:17:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626808": [
        {
            "ioc_value": "her.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 04:51:12",
            "last_seen_utc": "2025-10-26 19:44:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626806": [
        {
            "ioc_value": "rap.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 04:39:44",
            "last_seen_utc": "2025-10-26 19:43:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626807": [
        {
            "ioc_value": "b6dc.3-s0u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 04:39:44",
            "last_seen_utc": "2025-10-26 04:51:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626805": [
        {
            "ioc_value": "r4n9.1lt22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 04:32:59",
            "last_seen_utc": "2025-10-26 04:52:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626804": [
        {
            "ioc_value": "war.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 04:23:15",
            "last_seen_utc": "2025-10-26 19:41:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626803": [
        {
            "ioc_value": "far.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 04:18:19",
            "last_seen_utc": "2025-10-26 19:41:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626801": [
        {
            "ioc_value": "m0sa.3-s0u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 04:10:57",
            "last_seen_utc": "2025-10-26 04:23:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626802": [
        {
            "ioc_value": "bid.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 04:10:57",
            "last_seen_utc": "2025-10-26 19:40:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626800": [
        {
            "ioc_value": "a7.1lt22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 04:05:02",
            "last_seen_utc": "2025-10-26 04:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626790": [
        {
            "ioc_value": "jam.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:50:58",
            "last_seen_utc": "2025-10-26 19:38:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626789": [
        {
            "ioc_value": "m0k2.1lt22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:43:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626788": [
        {
            "ioc_value": "tea.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:39:36",
            "last_seen_utc": "2025-10-26 19:36:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626786": [
        {
            "ioc_value": "p7vx.3-s0u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:32:15",
            "last_seen_utc": "2025-10-26 03:50:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626787": [
        {
            "ioc_value": "cap.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:32:15",
            "last_seen_utc": "2025-10-26 19:36:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626785": [
        {
            "ioc_value": "z8q.1lt22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626784": [
        {
            "ioc_value": "pan.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:19:11",
            "last_seen_utc": "2025-10-26 19:35:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626783": [
        {
            "ioc_value": "w4ty.3-s0u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:13:30",
            "last_seen_utc": "2025-10-26 03:19:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626781": [
        {
            "ioc_value": "k3.1lt22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:09:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626782": [
        {
            "ioc_value": "bit.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 03:09:25",
            "last_seen_utc": "2025-10-26 19:34:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626780": [
        {
            "ioc_value": "p5w0.7aoasu3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:54:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626778": [
        {
            "ioc_value": "n1qh.3-s0u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:51:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626779": [
        {
            "ioc_value": "wet.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:51:49",
            "last_seen_utc": "2025-10-26 19:32:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626774": [
        {
            "ioc_value": "bud.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:37:56",
            "last_seen_utc": "2025-10-26 02:39:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626773": [
        {
            "ioc_value": "top.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:28:10",
            "last_seen_utc": "2025-10-26 02:31:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626772": [
        {
            "ioc_value": "k8zr.3-s0u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:24:30",
            "last_seen_utc": "2025-10-26 02:39:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626771": [
        {
            "ioc_value": "bar.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:18:11",
            "last_seen_utc": "2025-10-26 02:24:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626770": [
        {
            "ioc_value": "t4q.7aoasu3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:17:58",
            "last_seen_utc": "2025-10-26 02:28:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626769": [
        {
            "ioc_value": "spy.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:09:13",
            "last_seen_utc": "2025-10-26 02:17:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626768": [
        {
            "ioc_value": "sod.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:07:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626767": [
        {
            "ioc_value": "y5fw.4-l8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 02:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626766": [
        {
            "ioc_value": "cab.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 01:57:51",
            "last_seen_utc": "2025-10-26 02:00:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626765": [
        {
            "ioc_value": "dug.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 01:42:08",
            "last_seen_utc": "2025-10-26 01:50:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626764": [
        {
            "ioc_value": "ice.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 01:37:43",
            "last_seen_utc": "2025-10-26 01:41:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626763": [
        {
            "ioc_value": "c2jn.4-l8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 01:32:06",
            "last_seen_utc": "2025-10-26 01:50:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626761": [
        {
            "ioc_value": "pun.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 01:27:22",
            "last_seen_utc": "2025-10-26 01:32:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626760": [
        {
            "ioc_value": "gum.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 01:10:57",
            "last_seen_utc": "2025-10-26 01:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626759": [
        {
            "ioc_value": "v9rx.4-l8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 01:05:19",
            "last_seen_utc": "2025-10-26 01:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626758": [
        {
            "ioc_value": "rub.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 00:58:02",
            "last_seen_utc": "2025-10-26 01:07:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626757": [
        {
            "ioc_value": "mat.b9ku.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 00:45:02",
            "last_seen_utc": "2025-10-26 00:57:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626756": [
        {
            "ioc_value": "t1kd.4-l8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 00:41:00",
            "last_seen_utc": "2025-10-26 00:57:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626755": [
        {
            "ioc_value": "jar.fa0n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 00:38:13",
            "last_seen_utc": "2025-10-26 00:41:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626754": [
        {
            "ioc_value": "vow.pl8a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 00:27:45",
            "last_seen_utc": "2025-10-26 00:33:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626753": [
        {
            "ioc_value": "hq7b.4-l8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 00:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626752": [
        {
            "ioc_value": "hop.me2v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 00:17:22",
            "last_seen_utc": "2025-10-26 00:19:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626751": [
        {
            "ioc_value": "rut.n4ke.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-26 00:08:41",
            "last_seen_utc": "2025-10-26 00:11:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626747": [
        {
            "ioc_value": "m7y1.7aoasu3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:59:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626746": [
        {
            "ioc_value": "dip.qen9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:57:23",
            "last_seen_utc": "2025-10-26 00:01:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626745": [
        {
            "ioc_value": "z3mp.4-l8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:55:27",
            "last_seen_utc": "2025-10-26 00:11:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626744": [
        {
            "ioc_value": "mob.m4rj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:48:31",
            "last_seen_utc": "2025-10-25 23:55:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626743": [
        {
            "ioc_value": "p0sb.o-b-79.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:39:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626742": [
        {
            "ioc_value": "raw.ju5q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:38:16",
            "last_seen_utc": "2025-10-25 23:39:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626741": [
        {
            "ioc_value": "7rcl.o-b-79.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:29:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626739": [
        {
            "ioc_value": "did.vex0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:27:58",
            "last_seen_utc": "2025-10-25 23:29:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626738": [
        {
            "ioc_value": "x9pa.o-b-79.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:25:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626736": [
        {
            "ioc_value": "x2z.7aoasu3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:19:47",
            "last_seen_utc": "2025-10-26 01:32:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626735": [
        {
            "ioc_value": "ge1.xa5r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:17:56",
            "last_seen_utc": "2025-10-25 23:25:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626733": [
        {
            "ioc_value": "4wj.o-b-79.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:12:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626731": [
        {
            "ioc_value": "7d.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 23:06:07",
            "last_seen_utc": "2025-10-25 23:12:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626730": [
        {
            "ioc_value": "e1mk.o-b-79.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626728": [
        {
            "ioc_value": "q6yt.o-b-79.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:50:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626726": [
        {
            "ioc_value": "iv.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:47:31",
            "last_seen_utc": "2025-10-25 22:50:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626725": [
        {
            "ioc_value": "s0ga.i-c-81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:39:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626724": [
        {
            "ioc_value": "0q.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:38:15",
            "last_seen_utc": "2025-10-25 22:44:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626723": [
        {
            "ioc_value": "n5vx.i-c-81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:29:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626722": [
        {
            "ioc_value": "ma.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:28:29",
            "last_seen_utc": "2025-10-25 22:29:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626721": [
        {
            "ioc_value": "wj.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:18:25",
            "last_seen_utc": "2025-10-25 22:22:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626720": [
        {
            "ioc_value": "2lh.i-c-81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:18:16",
            "last_seen_utc": "2025-10-25 22:22:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626718": [
        {
            "ioc_value": "jg.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:07:58",
            "last_seen_utc": "2025-10-25 22:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626707": [
        {
            "ioc_value": "f8rn.i-c-81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 22:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626703": [
        {
            "ioc_value": "sq.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:58:11",
            "last_seen_utc": "2025-10-25 22:00:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626702": [
        {
            "ioc_value": "y3pq.i-c-81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:51:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626701": [
        {
            "ioc_value": "nn.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:47:53",
            "last_seen_utc": "2025-10-25 21:51:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626700": [
        {
            "ioc_value": "y5n.0ouuky0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:39:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626699": [
        {
            "ioc_value": "k1zw.i-c-81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:39:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626698": [
        {
            "ioc_value": "52.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:37:53",
            "last_seen_utc": "2025-10-25 21:39:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626697": [
        {
            "ioc_value": "ru.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:27:49",
            "last_seen_utc": "2025-10-25 21:31:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626696": [
        {
            "ioc_value": "s.0ouuky0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:27:37",
            "last_seen_utc": "2025-10-25 21:31:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626695": [
        {
            "ioc_value": "yb.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:17:33",
            "last_seen_utc": "2025-10-25 21:27:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626694": [
        {
            "ioc_value": "m9sn.i-d-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:12:44",
            "last_seen_utc": "2025-10-25 21:29:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626693": [
        {
            "ioc_value": "q0h3.0ouuky0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:09:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626692": [
        {
            "ioc_value": "l0.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 21:08:17",
            "last_seen_utc": "2025-10-25 21:12:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626690": [
        {
            "ioc_value": "t4ub.i-d-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 20:59:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626689": [
        {
            "ioc_value": "7w.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 20:50:22",
            "last_seen_utc": "2025-10-25 20:59:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626688": [
        {
            "ioc_value": "w4.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 20:48:14",
            "last_seen_utc": "2025-10-25 20:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626687": [
        {
            "ioc_value": "d3yk.i-d-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 20:43:25",
            "last_seen_utc": "2025-10-25 20:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626686": [
        {
            "ioc_value": "x7.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 20:36:54",
            "last_seen_utc": "2025-10-25 20:43:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626685": [
        {
            "ioc_value": "33.njur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 20:26:09",
            "last_seen_utc": "2025-10-25 20:28:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626684": [
        {
            "ioc_value": "w6jl.i-d-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 20:15:39",
            "last_seen_utc": "2025-10-25 20:28:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626683": [
        {
            "ioc_value": "cr.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 20:13:23",
            "last_seen_utc": "2025-10-25 20:15:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626682": [
        {
            "ioc_value": "ms.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 20:08:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626678": [
        {
            "ioc_value": "r3.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:57:42",
            "last_seen_utc": "2025-10-25 20:02:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626677": [
        {
            "ioc_value": "v1.0ouuky0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:53:16",
            "last_seen_utc": "2025-10-25 20:02:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626676": [
        {
            "ioc_value": "kf.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:47:25",
            "last_seen_utc": "2025-10-25 19:53:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626675": [
        {
            "ioc_value": "r0ce.i-d-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:41:02",
            "last_seen_utc": "2025-10-25 19:53:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626674": [
        {
            "ioc_value": "8d.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:37:19",
            "last_seen_utc": "2025-10-25 19:43:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626673": [
        {
            "ioc_value": "r1se.jg-7-ra.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:34:50",
            "last_seen_utc": "2025-10-25 19:43:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626669": [
        {
            "ioc_value": "6t.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:24:54",
            "last_seen_utc": "2025-10-25 19:34:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626668": [
        {
            "ioc_value": "bw.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:18:30",
            "last_seen_utc": "2025-10-25 19:24:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626666": [
        {
            "ioc_value": "a7px.i-d-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:17:07",
            "last_seen_utc": "2025-10-25 19:28:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626664": [
        {
            "ioc_value": "v0.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 19:08:25",
            "last_seen_utc": "2025-10-25 19:17:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626663": [
        {
            "ioc_value": "h1gd.y-p-19.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626662": [
        {
            "ioc_value": "bd.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:52:51",
            "last_seen_utc": "2025-10-25 18:59:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626658": [
        {
            "ioc_value": "wf.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:48:02",
            "last_seen_utc": "2025-10-25 18:51:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626654": [
        {
            "ioc_value": "u9tw.y-p-19.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:40:16",
            "last_seen_utc": "2025-10-25 18:51:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626653": [
        {
            "ioc_value": "q3.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:37:59",
            "last_seen_utc": "2025-10-25 18:40:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626652": [
        {
            "ioc_value": "l4.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:27:22",
            "last_seen_utc": "2025-10-25 18:34:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626651": [
        {
            "ioc_value": "dawn.jg-7-ra.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:25:09",
            "last_seen_utc": "2025-10-25 18:34:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626650": [
        {
            "ioc_value": "sp.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:17:35",
            "last_seen_utc": "2025-10-25 18:25:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626649": [
        {
            "ioc_value": "z5kr.y-p-19.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:11:20",
            "last_seen_utc": "2025-10-25 18:29:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626648": [
        {
            "ioc_value": "ui.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 18:08:27",
            "last_seen_utc": "2025-10-25 18:11:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626642": [
        {
            "ioc_value": "know-studied.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-25 18:01:41",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251025-r9p88axjam",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626637": [
        {
            "ioc_value": "212.ip.gl.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-25 18:00:23",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251025-vt8meagr3t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626636": [
        {
            "ioc_value": "s7.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:57:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626635": [
        {
            "ioc_value": "3ql.y-p-19.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:53:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626634": [
        {
            "ioc_value": "os.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:48:16",
            "last_seen_utc": "2025-10-25 17:53:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626633": [
        {
            "ioc_value": "c2hf.y-p-19.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:37:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626632": [
        {
            "ioc_value": "fd.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:35:53",
            "last_seen_utc": "2025-10-25 17:37:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626631": [
        {
            "ioc_value": "v7mx.y-p-19.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:29:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626630": [
        {
            "ioc_value": "5e.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:27:52",
            "last_seen_utc": "2025-10-25 17:29:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626629": [
        {
            "ioc_value": "21.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:17:48",
            "last_seen_utc": "2025-10-25 17:22:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626628": [
        {
            "ioc_value": "s0il.jg-7-ra.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:15:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626627": [
        {
            "ioc_value": "c0al.sne-4-p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:12:33",
            "last_seen_utc": "2025-10-25 17:22:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626626": [
        {
            "ioc_value": "co.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 17:08:59",
            "last_seen_utc": "2025-10-25 17:15:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626625": [
        {
            "ioc_value": "0y.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 16:52:36",
            "last_seen_utc": "2025-10-25 16:53:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626624": [
        {
            "ioc_value": "mist.jg-7-ra.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 16:44:22",
            "last_seen_utc": "2025-10-25 16:53:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626623": [
        {
            "ioc_value": "el.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 16:40:25",
            "last_seen_utc": "2025-10-25 16:44:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626622": [
        {
            "ioc_value": "tide.sne-4-p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 16:38:02",
            "last_seen_utc": "2025-10-25 16:42:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626621": [
        {
            "ioc_value": "1o.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 16:36:10",
            "last_seen_utc": "2025-10-25 16:38:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626620": [
        {
            "ioc_value": "e8.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 16:29:11",
            "last_seen_utc": "2025-10-25 16:31:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626619": [
        {
            "ioc_value": "8v.njur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 16:12:06",
            "last_seen_utc": "2025-10-25 16:18:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626618": [
        {
            "ioc_value": "bark.sne-4-p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 16:11:23",
            "last_seen_utc": "2025-10-25 16:31:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626617": [
        {
            "ioc_value": "tk.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 16:08:08",
            "last_seen_utc": "2025-10-25 16:11:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626609": [
        {
            "ioc_value": "nobles.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-25 15:43:19",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626610": [
        {
            "ioc_value": "unembel.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-25 15:43:19",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626607": [
        {
            "ioc_value": "m0ss.uht3o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 15:34:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626605": [
        {
            "ioc_value": "9z.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 14:58:23",
            "last_seen_utc": "2025-10-25 14:59:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626604": [
        {
            "ioc_value": "gl0w.sne-4-p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 14:55:21",
            "last_seen_utc": "2025-10-25 15:11:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626603": [
        {
            "ioc_value": "sk.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 14:48:11",
            "last_seen_utc": "2025-10-25 14:55:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626602": [
        {
            "ioc_value": "z1.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 14:39:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626600": [
        {
            "ioc_value": "j5.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 14:23:49",
            "last_seen_utc": "2025-10-25 14:34:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626583": [
        {
            "ioc_value": "5b.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 14:19:05",
            "last_seen_utc": "2025-10-25 14:23:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626582": [
        {
            "ioc_value": "mist.sne-4-p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 14:18:51",
            "last_seen_utc": "2025-10-25 14:23:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626581": [
        {
            "ioc_value": "x2.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 14:09:23",
            "last_seen_utc": "2025-10-25 14:11:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626580": [
        {
            "ioc_value": "fern.sne-4-p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:56:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626579": [
        {
            "ioc_value": "qh.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:55:57",
            "last_seen_utc": "2025-10-25 14:18:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626578": [
        {
            "ioc_value": "l00m.uht3o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:55:09",
            "last_seen_utc": "2025-10-25 14:11:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626482": [
        {
            "ioc_value": "cybertecha.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-25 13:53:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://foresiet.com/blog/aura-stealer-malware-analysis/",
            "tags": "AuraStealer",
            "anonymous": "0",
            "reporter": "AUZombie"
        }
    ],
    "1626483": [
        {
            "ioc_value": "browsertools.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-25 13:53:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://foresiet.com/blog/aura-stealer-malware-analysis/",
            "tags": "AuraStealer",
            "anonymous": "0",
            "reporter": "AUZombie"
        }
    ],
    "1626480": [
        {
            "ioc_value": "gamedb.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-25 13:53:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://foresiet.com/blog/aura-stealer-malware-analysis/",
            "tags": "AuraStealer",
            "anonymous": "0",
            "reporter": "AUZombie"
        }
    ],
    "1626481": [
        {
            "ioc_value": "cloudupdate.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-25 13:53:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://foresiet.com/blog/aura-stealer-malware-analysis/",
            "tags": "AuraStealer",
            "anonymous": "0",
            "reporter": "AUZombie"
        }
    ],
    "1626577": [
        {
            "ioc_value": "p1.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:48:31",
            "last_seen_utc": "2025-10-25 13:56:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626576": [
        {
            "ioc_value": "y5.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:37:12",
            "last_seen_utc": "2025-10-25 13:46:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626575": [
        {
            "ioc_value": "nexu5.lizqa.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:30:32",
            "last_seen_utc": "2025-10-25 13:46:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626574": [
        {
            "ioc_value": "ve1l.uht3o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:29:43",
            "last_seen_utc": "2025-10-25 13:37:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626573": [
        {
            "ioc_value": "yu.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:27:05",
            "last_seen_utc": "2025-10-25 13:30:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626572": [
        {
            "ioc_value": "tidal.lizqa.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626571": [
        {
            "ioc_value": "wm.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:18:13",
            "last_seen_utc": "2025-10-25 13:18:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626570": [
        {
            "ioc_value": "cd.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:07:49",
            "last_seen_utc": "2025-10-25 13:10:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626569": [
        {
            "ioc_value": "candy.lizqa.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 13:02:01",
            "last_seen_utc": "2025-10-25 13:10:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626568": [
        {
            "ioc_value": "zl.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:57:37",
            "last_seen_utc": "2025-10-25 13:02:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626566": [
        {
            "ioc_value": "au.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:47:51",
            "last_seen_utc": "2025-10-25 12:49:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626565": [
        {
            "ioc_value": "charm.lizqa.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:41:39",
            "last_seen_utc": "2025-10-25 12:49:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626564": [
        {
            "ioc_value": "d2.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:37:32",
            "last_seen_utc": "2025-10-25 12:41:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626563": [
        {
            "ioc_value": "plush.lizqa.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626562": [
        {
            "ioc_value": "81.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:28:17",
            "last_seen_utc": "2025-10-25 12:29:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626561": [
        {
            "ioc_value": "gale.uht3o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626560": [
        {
            "ioc_value": "xd.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:18:32",
            "last_seen_utc": "2025-10-25 12:19:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626559": [
        {
            "ioc_value": "0xide.lizqa.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:11:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626558": [
        {
            "ioc_value": "peak.uht3o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:09:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626556": [
        {
            "ioc_value": "0g.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:06:17",
            "last_seen_utc": "2025-10-25 12:11:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626554": [
        {
            "ioc_value": "Mahmoudzoroo.myftp.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-25 12:05:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251025-nzz4wsct6d",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626553": [
        {
            "ioc_value": "cybergate.myvnc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-25 12:05:18",
            "last_seen_utc": "2025-11-07 12:55:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251025-hst2eaav2c",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626552": [
        {
            "ioc_value": "clay.uht3o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 12:04:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626546": [
        {
            "ioc_value": "wanfeng168.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-25 12:00:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626544": [
        {
            "ioc_value": "single-finally.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-25 12:00:24",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251025-nqcx1asldy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626543": [
        {
            "ioc_value": "links-rwanda.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-25 12:00:23",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251025-nqcx1asldy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626540": [
        {
            "ioc_value": "w7.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:58:12",
            "last_seen_utc": "2025-10-25 12:04:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626539": [
        {
            "ioc_value": "tlgrm-redirect.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-25 11:57:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626538": [
        {
            "ioc_value": "kh.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:49:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626537": [
        {
            "ioc_value": "pearl.q0spi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:41:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626536": [
        {
            "ioc_value": "8q.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:38:03",
            "last_seen_utc": "2025-10-25 11:41:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626535": [
        {
            "ioc_value": "qu1rk.q0spi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:34:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626533": [
        {
            "ioc_value": "28.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:27:38",
            "last_seen_utc": "2025-10-25 11:34:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626491": [
        {
            "ioc_value": "9i.njur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:17:52",
            "last_seen_utc": "2025-10-25 11:17:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626490": [
        {
            "ioc_value": "grain.q0spi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:13:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626489": [
        {
            "ioc_value": "v0id.sne4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:10:17",
            "last_seen_utc": "2025-10-25 11:17:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626488": [
        {
            "ioc_value": "2t.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:09:38",
            "last_seen_utc": "2025-10-25 11:13:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626487": [
        {
            "ioc_value": "azure.q0spi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 11:01:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626486": [
        {
            "ioc_value": "i3.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:57:15",
            "last_seen_utc": "2025-10-25 11:01:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626485": [
        {
            "ioc_value": "8t.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:48:23",
            "last_seen_utc": "2025-10-25 10:49:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626484": [
        {
            "ioc_value": "raven.q0spi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:44:01",
            "last_seen_utc": "2025-10-25 10:49:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626479": [
        {
            "ioc_value": "lb.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:38:14",
            "last_seen_utc": "2025-10-25 10:44:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626478": [
        {
            "ioc_value": "maple.q0spi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626477": [
        {
            "ioc_value": "tide.sne4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:34:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626475": [
        {
            "ioc_value": "lm.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:27:57",
            "last_seen_utc": "2025-10-25 10:34:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626472": [
        {
            "ioc_value": "www.npa-eportal.digital-service.elster-de.status-drive.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-25 10:25:37",
            "last_seen_utc": "2025-10-25 10:25:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626473": [
        {
            "ioc_value": "package2879-core-maht-improved.s3.ap-northeast-2.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-25 10:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626460": [
        {
            "ioc_value": "4f.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:17:55",
            "last_seen_utc": "2025-10-25 10:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626459": [
        {
            "ioc_value": "r0se.sne4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:10:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626458": [
        {
            "ioc_value": "5w.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:07:47",
            "last_seen_utc": "2025-10-25 10:10:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626457": [
        {
            "ioc_value": "zebra.fenod.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:05:25",
            "last_seen_utc": "2025-10-25 10:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626456": [
        {
            "ioc_value": "y2.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 10:03:35",
            "last_seen_utc": "2025-10-25 10:05:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626436": [
        {
            "ioc_value": "lf.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:57:54",
            "last_seen_utc": "2025-10-25 09:59:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626435": [
        {
            "ioc_value": "cedar.fenod.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:55:05",
            "last_seen_utc": "2025-10-25 09:59:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626433": [
        {
            "ioc_value": "alumibro.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-25 09:50:05",
            "last_seen_utc": "2025-11-08 12:45:07",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626434": [
        {
            "ioc_value": "meeukdt.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-25 09:50:05",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626431": [
        {
            "ioc_value": "3u.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:47:31",
            "last_seen_utc": "2025-10-25 22:59:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626430": [
        {
            "ioc_value": "m1nt.sne4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:47:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626428": [
        {
            "ioc_value": "flint.fenod.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:40:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626427": [
        {
            "ioc_value": "ln.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:38:35",
            "last_seen_utc": "2025-10-25 09:47:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626425": [
        {
            "ioc_value": "9o.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:28:13",
            "last_seen_utc": "2025-10-25 09:33:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626424": [
        {
            "ioc_value": "bark.sne4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:28:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626423": [
        {
            "ioc_value": "prism.fenod.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:26:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626422": [
        {
            "ioc_value": "8h.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:18:27",
            "last_seen_utc": "2025-10-25 09:28:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626230": [
        {
            "ioc_value": "cpanel.sayyesmovement.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-25 09:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115431460463392231",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1626421": [
        {
            "ioc_value": "6y.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 09:07:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626419": [
        {
            "ioc_value": "fern.sne4p.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:59:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626418": [
        {
            "ioc_value": "a1.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:58:08",
            "last_seen_utc": "2025-10-25 08:59:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626417": [
        {
            "ioc_value": "Iyr1c.fenod.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:52:11",
            "last_seen_utc": "2025-10-25 08:59:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626413": [
        {
            "ioc_value": "rn.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:47:49",
            "last_seen_utc": "2025-10-25 08:52:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626407": [
        {
            "ioc_value": "9f.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:38:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626406": [
        {
            "ioc_value": "m3t.5u5vbu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:35:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626405": [
        {
            "ioc_value": "amber.fenod.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:29:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626404": [
        {
            "ioc_value": "ak.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:28:49",
            "last_seen_utc": "2025-10-25 08:35:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626403": [
        {
            "ioc_value": "ba.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:14:24",
            "last_seen_utc": "2025-10-25 08:18:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626402": [
        {
            "ioc_value": "b4nz.xf7-27.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:09:54",
            "last_seen_utc": "2025-10-25 08:18:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626401": [
        {
            "ioc_value": "o4.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:07:44",
            "last_seen_utc": "2025-10-25 08:09:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626400": [
        {
            "ioc_value": "g6k2.5u5vbu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 08:04:59",
            "last_seen_utc": "2025-10-25 08:09:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626382": [
        {
            "ioc_value": "rg.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 07:58:25",
            "last_seen_utc": "2025-10-25 08:05:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626381": [
        {
            "ioc_value": "y8ce.xf7-27.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 07:52:29",
            "last_seen_utc": "2025-10-25 08:01:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626380": [
        {
            "ioc_value": "aw.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 07:48:23",
            "last_seen_utc": "2025-10-25 07:52:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626377": [
        {
            "ioc_value": "segy.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-25 07:42:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phishing,TyKit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626378": [
        {
            "ioc_value": "segy.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-25 07:42:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phishing,TyKit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626379": [
        {
            "ioc_value": "segy2.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-25 07:42:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phishing,TyKit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626376": [
        {
            "ioc_value": "segy.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-25 07:42:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phishing,TyKit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626374": [
        {
            "ioc_value": "modgovindia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-25 07:41:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "APT36,c2,TransparentTribe",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626375": [
        {
            "ioc_value": "newforsomething.rest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-25 07:41:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "APT36,c2,TransparentTribe",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626373": [
        {
            "ioc_value": "k3um.xf7-27.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 07:40:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626372": [
        {
            "ioc_value": "w.5u5vbu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 07:38:24",
            "last_seen_utc": "2025-10-25 07:48:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626371": [
        {
            "ioc_value": "yn.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 07:38:07",
            "last_seen_utc": "2025-10-25 07:40:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626370": [
        {
            "ioc_value": "joiner.best",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-25 07:35:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "zphp",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626368": [
        {
            "ioc_value": "final-highlight.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-25 07:34:04",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626367": [
        {
            "ioc_value": "cofof37797-42209.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-25 07:33:44",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626366": [
        {
            "ioc_value": "mirainetvbot.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-25 07:33:31",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626357": [
        {
            "ioc_value": "customers-commander.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-25 07:32:36",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626358": [
        {
            "ioc_value": "law-necklace.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-25 07:32:36",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626359": [
        {
            "ioc_value": "message-their.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-25 07:32:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626360": [
        {
            "ioc_value": "perfect-shut.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-25 07:32:36",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626361": [
        {
            "ioc_value": "qiuehwefu-62319.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-25 07:32:36",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626356": [
        {
            "ioc_value": "cards-latin.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-25 07:32:35",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626354": [
        {
            "ioc_value": "assettocorsamain.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-25 07:31:52",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1626350": [
        {
            "ioc_value": "0wr.xf7-27.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 07:29:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626346": [
        {
            "ioc_value": "r0z1.5u5vbu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 07:21:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626345": [
        {
            "ioc_value": "fx.plx5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 07:21:05",
            "last_seen_utc": "2025-10-25 07:29:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626344": [
        {
            "ioc_value": "b8q.5u5vbu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 06:48:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626343": [
        {
            "ioc_value": "s9lp.xf7-27.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 06:42:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626342": [
        {
            "ioc_value": "9y.njur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 06:28:31",
            "last_seen_utc": "2025-10-25 06:35:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626341": [
        {
            "ioc_value": "g1tb.xf7-27.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 06:21:31",
            "last_seen_utc": "2025-10-25 06:35:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626340": [
        {
            "ioc_value": "n4.5u5vbu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626339": [
        {
            "ioc_value": "40.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 06:17:56",
            "last_seen_utc": "2025-10-25 06:21:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626336": [
        {
            "ioc_value": "leetaka1337.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-25 06:04:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251025-e9fzbszncl",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626337": [
        {
            "ioc_value": "fogueteiro.webhop.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-25 06:04:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251025-d7bq6ahm7x",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626333": [
        {
            "ioc_value": "c4w.9i3mpa6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 05:54:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626332": [
        {
            "ioc_value": "qv5a.xb1-60.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 05:50:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626331": [
        {
            "ioc_value": "bf.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 05:38:54",
            "last_seen_utc": "2025-10-25 05:39:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626330": [
        {
            "ioc_value": "20.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 05:28:52",
            "last_seen_utc": "2025-10-25 05:29:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626329": [
        {
            "ioc_value": "m6dx.xb1-60.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 05:20:48",
            "last_seen_utc": "2025-10-25 05:39:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626328": [
        {
            "ioc_value": "h3v9.9i3mpa6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 05:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626327": [
        {
            "ioc_value": "c6.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 05:18:15",
            "last_seen_utc": "2025-10-25 05:20:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626326": [
        {
            "ioc_value": "6d.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 05:08:26",
            "last_seen_utc": "2025-10-25 05:15:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626325": [
        {
            "ioc_value": "j2yr.xb1-60.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 05:00:38",
            "last_seen_utc": "2025-10-25 05:15:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626324": [
        {
            "ioc_value": "ry.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:58:26",
            "last_seen_utc": "2025-10-25 05:00:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626323": [
        {
            "ioc_value": "p0.9i3mpa6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:54:52",
            "last_seen_utc": "2025-10-25 05:08:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626322": [
        {
            "ioc_value": "1c.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:48:16",
            "last_seen_utc": "2025-10-25 04:54:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626321": [
        {
            "ioc_value": "t8kc.xb1-60.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:46:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626320": [
        {
            "ioc_value": "fm.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:38:00",
            "last_seen_utc": "2025-10-25 04:46:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626319": [
        {
            "ioc_value": "x7m.9i3mpa6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626318": [
        {
            "ioc_value": "kj.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:28:00",
            "last_seen_utc": "2025-10-25 04:29:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626317": [
        {
            "ioc_value": "w9.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:18:20",
            "last_seen_utc": "2025-10-25 04:19:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626316": [
        {
            "ioc_value": "d8.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:07:44",
            "last_seen_utc": "2025-10-25 04:15:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626305": [
        {
            "ioc_value": "n4wq.xb1-60.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 04:01:28",
            "last_seen_utc": "2025-10-25 04:19:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626299": [
        {
            "ioc_value": "kz1.9i3mpa6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:59:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626298": [
        {
            "ioc_value": "s4.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:57:54",
            "last_seen_utc": "2025-10-25 04:01:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626297": [
        {
            "ioc_value": "5q.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:47:52",
            "last_seen_utc": "2025-10-25 03:54:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626296": [
        {
            "ioc_value": "pz7h.xb1-60.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:44:35",
            "last_seen_utc": "2025-10-25 03:54:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626295": [
        {
            "ioc_value": "yf.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:37:14",
            "last_seen_utc": "2025-10-25 03:44:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626294": [
        {
            "ioc_value": "we.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:27:28",
            "last_seen_utc": "2025-10-25 03:34:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626293": [
        {
            "ioc_value": "t2.9i3mpa6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:25:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626292": [
        {
            "ioc_value": "u1jd.fv0-93.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:24:21",
            "last_seen_utc": "2025-10-25 03:34:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626291": [
        {
            "ioc_value": "2p.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:18:03",
            "last_seen_utc": "2025-10-25 03:25:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626290": [
        {
            "ioc_value": "11.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:08:16",
            "last_seen_utc": "2025-10-25 03:09:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626289": [
        {
            "ioc_value": "ck4v.fv0-93.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 03:00:26",
            "last_seen_utc": "2025-10-25 03:09:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626288": [
        {
            "ioc_value": "03.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:57:49",
            "last_seen_utc": "2025-10-25 03:00:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626287": [
        {
            "ioc_value": "vz8.4a7vci9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:56:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626286": [
        {
            "ioc_value": "oe.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:47:34",
            "last_seen_utc": "2025-10-25 02:56:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626285": [
        {
            "ioc_value": "5qzn.fv0-93.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:46:22",
            "last_seen_utc": "2025-10-25 02:49:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626284": [
        {
            "ioc_value": "90.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:37:49",
            "last_seen_utc": "2025-10-25 02:46:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626283": [
        {
            "ioc_value": "b7.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:25:33",
            "last_seen_utc": "2025-10-25 02:28:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626282": [
        {
            "ioc_value": "jd5.fv0-93.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:24:16",
            "last_seen_utc": "2025-10-25 02:28:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626281": [
        {
            "ioc_value": "ue.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:17:20",
            "last_seen_utc": "2025-10-25 02:24:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626280": [
        {
            "ioc_value": "y7p2.4a7vci9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:09:08",
            "last_seen_utc": "2025-10-25 02:18:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626279": [
        {
            "ioc_value": "07.plx5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:08:27",
            "last_seen_utc": "2025-10-25 02:09:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626278": [
        {
            "ioc_value": "w3ta.fv0-93.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 02:03:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626277": [
        {
            "ioc_value": "a1.4a7vci9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626276": [
        {
            "ioc_value": "oz.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:57:27",
            "last_seen_utc": "2025-10-25 02:03:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626275": [
        {
            "ioc_value": "r8gk.fv0-93.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:46:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626274": [
        {
            "ioc_value": "sw.njur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:46:04",
            "last_seen_utc": "2025-10-25 01:46:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626273": [
        {
            "ioc_value": "6b.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:41:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626272": [
        {
            "ioc_value": "7p.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:38:10",
            "last_seen_utc": "2025-10-25 15:34:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626271": [
        {
            "ioc_value": "m0k4.4a7vci9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:34:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626270": [
        {
            "ioc_value": "0p.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:27:43",
            "last_seen_utc": "2025-10-25 01:35:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626269": [
        {
            "ioc_value": "n7xs.cdn-6-38.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:24:47",
            "last_seen_utc": "2025-10-25 01:29:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626268": [
        {
            "ioc_value": "ke.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:17:58",
            "last_seen_utc": "2025-10-25 01:24:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626267": [
        {
            "ioc_value": "q3x.4a7vci9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:10:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626266": [
        {
            "ioc_value": "kl.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 01:07:36",
            "last_seen_utc": "2025-10-25 01:10:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626265": [
        {
            "ioc_value": "mc.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:57:34",
            "last_seen_utc": "2025-10-25 01:03:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626264": [
        {
            "ioc_value": "p0la.cdn-6-38.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:57:31",
            "last_seen_utc": "2025-10-25 01:03:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626263": [
        {
            "ioc_value": "mi.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:48:49",
            "last_seen_utc": "2025-10-25 00:57:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626262": [
        {
            "ioc_value": "c4hz.cdn-6-38.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:42:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626260": [
        {
            "ioc_value": "aa.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:37:11",
            "last_seen_utc": "2025-10-25 00:42:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626259": [
        {
            "ioc_value": "d9.4a7vci9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:36:19",
            "last_seen_utc": "2025-10-25 00:39:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626258": [
        {
            "ioc_value": "v8.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:20:40",
            "last_seen_utc": "2025-10-25 00:36:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626257": [
        {
            "ioc_value": "w5en.cdn-6-38.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:16:43",
            "last_seen_utc": "2025-10-25 00:23:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626256": [
        {
            "ioc_value": "rz3.1e2u2a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:15:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626255": [
        {
            "ioc_value": "rz.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:15:08",
            "last_seen_utc": "2025-10-25 00:16:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626254": [
        {
            "ioc_value": "ik.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-25 00:08:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626249": [
        {
            "ioc_value": "y3tb.cdn-6-38.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:59:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626248": [
        {
            "ioc_value": "6u.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:53:51",
            "last_seen_utc": "2025-10-25 00:04:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626247": [
        {
            "ioc_value": "r6mp.cdn-3-29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:41:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626246": [
        {
            "ioc_value": "dm.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:37:49",
            "last_seen_utc": "2025-10-24 23:41:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626245": [
        {
            "ioc_value": "kq0x.cdn-3-29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:28:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626244": [
        {
            "ioc_value": "3v.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:27:27",
            "last_seen_utc": "2025-10-24 23:28:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626243": [
        {
            "ioc_value": "i5.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:18:35",
            "last_seen_utc": "2025-10-24 23:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626242": [
        {
            "ioc_value": "g0x8.1e2u2a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:10:32",
            "last_seen_utc": "2025-10-24 23:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626241": [
        {
            "ioc_value": "l2.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:08:56",
            "last_seen_utc": "2025-10-24 23:10:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626240": [
        {
            "ioc_value": "f7du.cdn-3-29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 23:04:18",
            "last_seen_utc": "2025-10-24 23:10:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626239": [
        {
            "ioc_value": "et.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:56:07",
            "last_seen_utc": "2025-10-24 23:04:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626238": [
        {
            "ioc_value": "v9c3.cdn-3-29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:50:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626236": [
        {
            "ioc_value": "cu.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:48:06",
            "last_seen_utc": "2025-10-24 22:50:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626235": [
        {
            "ioc_value": "q2wl.cdn-3-29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:39:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626234": [
        {
            "ioc_value": "b5.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:37:45",
            "last_seen_utc": "2025-10-24 22:39:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626233": [
        {
            "ioc_value": "tq.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:28:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626232": [
        {
            "ioc_value": "w4.1e2u2a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:24:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626231": [
        {
            "ioc_value": "h3kp.cdn-2-45.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:22:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626229": [
        {
            "ioc_value": "78.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:17:41",
            "last_seen_utc": "2025-10-24 22:24:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626228": [
        {
            "ioc_value": "bm.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 22:07:54",
            "last_seen_utc": "2025-10-24 22:08:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626214": [
        {
            "ioc_value": "zx2a.cdn-2-45.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:59:50",
            "last_seen_utc": "2025-10-24 22:08:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626213": [
        {
            "ioc_value": "mr.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:57:49",
            "last_seen_utc": "2025-10-24 21:59:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626212": [
        {
            "ioc_value": "t0.1e2u2a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:50:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626211": [
        {
            "ioc_value": "vb.plx5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:47:28",
            "last_seen_utc": "2025-10-24 21:50:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626209": [
        {
            "ioc_value": "g3.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:38:33",
            "last_seen_utc": "2025-10-24 21:42:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626208": [
        {
            "ioc_value": "m4rs.cdn-2-45.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:35:59",
            "last_seen_utc": "2025-10-24 21:42:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626207": [
        {
            "ioc_value": "c7p1.1e2u2a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:29:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626206": [
        {
            "ioc_value": "5m.njur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:28:20",
            "last_seen_utc": "2025-10-24 21:35:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626205": [
        {
            "ioc_value": "n9.1e2u2a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:23:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626204": [
        {
            "ioc_value": "t9fe.cdn-2-45.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626203": [
        {
            "ioc_value": "s0.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:18:03",
            "last_seen_utc": "2025-10-24 21:23:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626202": [
        {
            "ioc_value": "bq6.cdn-2-45.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:12:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626201": [
        {
            "ioc_value": "y8m.6e5a5u3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:09:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626200": [
        {
            "ioc_value": "d0.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 21:08:11",
            "last_seen_utc": "2025-10-24 21:12:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626199": [
        {
            "ioc_value": "fz.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 20:57:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626197": [
        {
            "ioc_value": "console.ctrlx-redops.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-24 20:48:44",
            "last_seen_utc": "2025-11-24 11:49:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1626196": [
        {
            "ioc_value": "te.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 20:47:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626195": [
        {
            "ioc_value": "tide.qytan.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 20:43:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626194": [
        {
            "ioc_value": "p7.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 20:38:29",
            "last_seen_utc": "2025-10-24 20:43:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626193": [
        {
            "ioc_value": "l00p.qytan.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 20:28:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626192": [
        {
            "ioc_value": "17.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 20:27:26",
            "last_seen_utc": "2025-10-24 20:28:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626191": [
        {
            "ioc_value": "lg.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 20:23:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626190": [
        {
            "ioc_value": "snow.qytan.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 20:11:25",
            "last_seen_utc": "2025-10-24 20:22:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626189": [
        {
            "ioc_value": "55.ziqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 20:08:38",
            "last_seen_utc": "2025-10-24 20:11:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626188": [
        {
            "ioc_value": "ameli-vitale-guadeloupe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-24 20:01:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/213.209.143.41+ameli-vitale-guadeloupe.com",
            "tags": "AS214943,C2,censys,Gafgyt,open-dir,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626186": [
        {
            "ioc_value": "paketzustellungen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-24 20:01:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/213.209.143.41+paketzustellungen.com",
            "tags": "AS214943,C2,censys,Gafgyt,open-dir,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626187": [
        {
            "ioc_value": "www.colis-suspendu-2025.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-24 20:01:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/213.209.143.41+www.colis-suspendu-2025.com",
            "tags": "AS214943,C2,censys,Gafgyt,open-dir,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626185": [
        {
            "ioc_value": "banking.bankaustria.at.dswcontracting.work",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-24 20:01:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.241.8+banking.bankaustria.at.dswcontracting.work",
            "tags": "AS214943,C2,censys,Gafgyt,open-dir,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626175": [
        {
            "ioc_value": "vq.zi-qa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 19:58:07",
            "last_seen_utc": "2025-10-24 20:02:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626174": [
        {
            "ioc_value": "s6.yjor.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 19:48:12",
            "last_seen_utc": "2025-10-24 19:51:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626173": [
        {
            "ioc_value": "h0me.qytan.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 19:46:51",
            "last_seen_utc": "2025-10-24 19:51:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626171": [
        {
            "ioc_value": "kr.xvo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 19:38:09",
            "last_seen_utc": "2025-10-24 19:46:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626170": [
        {
            "ioc_value": "cg.xer-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 19:27:55",
            "last_seen_utc": "2025-10-24 19:31:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626169": [
        {
            "ioc_value": "4k.x-vo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 19:17:53",
            "last_seen_utc": "2025-10-24 19:26:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626168": [
        {
            "ioc_value": "5eed.qytan.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 19:12:28",
            "last_seen_utc": "2025-10-24 19:31:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626167": [
        {
            "ioc_value": "dd.vuln5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 19:07:36",
            "last_seen_utc": "2025-10-24 19:12:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626166": [
        {
            "ioc_value": "k.6e5a5u3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 19:03:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626164": [
        {
            "ioc_value": "unmeonj.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-24 19:01:37",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626165": [
        {
            "ioc_value": "jamelik.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-24 19:01:37",
            "last_seen_utc": "2025-11-18 08:45:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626163": [
        {
            "ioc_value": "road.qytan.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:57:36",
            "last_seen_utc": "2025-10-24 19:07:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626162": [
        {
            "ioc_value": "wx.twy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:57:35",
            "last_seen_utc": "2025-10-24 19:07:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626161": [
        {
            "ioc_value": "lc.twy-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:47:32",
            "last_seen_utc": "2025-10-24 18:57:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626155": [
        {
            "ioc_value": "l1me.mab7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626154": [
        {
            "ioc_value": "t2w.8y5o8a8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:40:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626153": [
        {
            "ioc_value": "c2.t4mox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:37:15",
            "last_seen_utc": "2025-10-24 18:43:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626152": [
        {
            "ioc_value": "wz.su4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:28:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626150": [
        {
            "ioc_value": "wave.mab7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:24:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626149": [
        {
            "ioc_value": "br.su-4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:17:59",
            "last_seen_utc": "2025-10-24 18:24:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626148": [
        {
            "ioc_value": "lj.slaq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:07:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626147": [
        {
            "ioc_value": "g0ld.mab7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:06:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626146": [
        {
            "ioc_value": "r4n.8y5o8a8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 18:04:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626140": [
        {
            "ioc_value": "fg.rvox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:56:50",
            "last_seen_utc": "2025-10-24 18:06:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626139": [
        {
            "ioc_value": "hg.r8li.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:47:35",
            "last_seen_utc": "2025-10-24 17:54:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626138": [
        {
            "ioc_value": "s1ft.mab7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:46:39",
            "last_seen_utc": "2025-10-24 17:54:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626137": [
        {
            "ioc_value": "dp.plx5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:37:33",
            "last_seen_utc": "2025-10-24 17:46:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626136": [
        {
            "ioc_value": "2w.plx-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:27:24",
            "last_seen_utc": "2025-10-25 06:48:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626135": [
        {
            "ioc_value": "leaf.mab7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:21:15",
            "last_seen_utc": "2025-10-24 17:31:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626134": [
        {
            "ioc_value": "91.njur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:17:08",
            "last_seen_utc": "2025-10-24 17:21:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626133": [
        {
            "ioc_value": "m0k3.8y5o8a8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:14:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626132": [
        {
            "ioc_value": "vz.n-jur.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:08:43",
            "last_seen_utc": "2025-10-24 17:14:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626128": [
        {
            "ioc_value": "c00l.mab7o.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 17:01:08",
            "last_seen_utc": "2025-10-24 17:10:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626127": [
        {
            "ioc_value": "ss.meqt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 16:58:09",
            "last_seen_utc": "2025-10-25 05:54:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626126": [
        {
            "ioc_value": "pk.m7lo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 16:49:54",
            "last_seen_utc": "2025-10-24 16:51:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626125": [
        {
            "ioc_value": "qz8.8y5o8a8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 16:46:32",
            "last_seen_utc": "2025-10-24 16:51:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626124": [
        {
            "ioc_value": "xg.loxr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 16:37:37",
            "last_seen_utc": "2025-10-24 16:46:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626123": [
        {
            "ioc_value": "qi.ko-lu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 16:25:32",
            "last_seen_utc": "2025-10-24 16:27:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626122": [
        {
            "ioc_value": "v1.8y5o8a8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 16:19:41",
            "last_seen_utc": "2025-10-24 16:27:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626121": [
        {
            "ioc_value": "89.jeqr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 16:07:54",
            "last_seen_utc": "2025-10-24 16:19:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626120": [
        {
            "ioc_value": "fIne.0zvel.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 16:04:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626119": [
        {
            "ioc_value": "something0x.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-10-24 16:02:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/62.60.131.230+something0x.at",
            "tags": "AS208137,C2,censys,FPS12,odyssey,panel,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626117": [
        {
            "ioc_value": "www.multas-impagas2025.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-24 16:02:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/213.209.143.41+www.multas-impagas2025.com",
            "tags": "AS214943,C2,censys,Gafgyt,open-dir,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626111": [
        {
            "ioc_value": "c3.g-lim.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 15:57:33",
            "last_seen_utc": "2025-10-24 16:04:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626107": [
        {
            "ioc_value": "gor.technicalprorj.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-24 15:51:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1626108": [
        {
            "ioc_value": "gor.orca-trade.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-24 15:51:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1626104": [
        {
            "ioc_value": "c0ld.0zvel.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 15:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626103": [
        {
            "ioc_value": "dn.b2-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 15:46:15",
            "last_seen_utc": "2025-10-24 20:22:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626102": [
        {
            "ioc_value": "32.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 15:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626101": [
        {
            "ioc_value": "rope.0zvel.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 15:29:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626100": [
        {
            "ioc_value": "1v.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 15:28:14",
            "last_seen_utc": "2025-10-24 15:29:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626099": [
        {
            "ioc_value": "m4.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 15:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626098": [
        {
            "ioc_value": "ze.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 15:03:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626097": [
        {
            "ioc_value": "1w.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 14:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626096": [
        {
            "ioc_value": "5tar.0zvel.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 14:53:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626076": [
        {
            "ioc_value": "openjsc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-24 14:47:56",
            "last_seen_utc": "2025-10-24 13:18:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115429335568947989",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1626081": [
        {
            "ioc_value": "plavomore.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-24 14:47:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115429335568947989",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1626095": [
        {
            "ioc_value": "m3.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 14:41:21",
            "last_seen_utc": "2025-10-24 14:53:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626094": [
        {
            "ioc_value": "sc.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 14:30:33",
            "last_seen_utc": "2025-10-24 14:36:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626093": [
        {
            "ioc_value": "h0pe.0zvel.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 14:21:38",
            "last_seen_utc": "2025-10-24 14:36:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626092": [
        {
            "ioc_value": "0k.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 14:18:26",
            "last_seen_utc": "2025-10-24 14:21:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626091": [
        {
            "ioc_value": "4p.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 14:10:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626090": [
        {
            "ioc_value": "no.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:59:54",
            "last_seen_utc": "2025-10-24 14:02:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626089": [
        {
            "ioc_value": "4n.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626088": [
        {
            "ioc_value": "wind.0zvel.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:58:07",
            "last_seen_utc": "2025-10-24 14:02:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626087": [
        {
            "ioc_value": "d7.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:48:03",
            "last_seen_utc": "2025-10-24 13:58:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626086": [
        {
            "ioc_value": "lake.rjofi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:43:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626085": [
        {
            "ioc_value": "iz.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:37:46",
            "last_seen_utc": "2025-10-24 13:43:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626084": [
        {
            "ioc_value": "nq.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:27:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626083": [
        {
            "ioc_value": "5x.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626074": [
        {
            "ioc_value": "i1se.rjofi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:13:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626073": [
        {
            "ioc_value": "8y.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 13:09:17",
            "last_seen_utc": "2025-10-24 13:13:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626072": [
        {
            "ioc_value": "zp.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 12:57:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626070": [
        {
            "ioc_value": "6s.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 12:50:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626069": [
        {
            "ioc_value": "46.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 12:38:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626067": [
        {
            "ioc_value": "2c.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 12:28:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626066": [
        {
            "ioc_value": "r00m.rjofi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 12:24:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626065": [
        {
            "ioc_value": "4v.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 12:17:54",
            "last_seen_utc": "2025-10-24 12:24:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626063": [
        {
            "ioc_value": "1h.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 12:08:06",
            "last_seen_utc": "2025-10-24 12:10:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626062": [
        {
            "ioc_value": "s1de.rjofi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 12:06:57",
            "last_seen_utc": "2025-10-24 12:10:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626054": [
        {
            "ioc_value": "zbj2025.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-24 12:02:05",
            "last_seen_utc": "2025-11-07 12:55:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-llevpayldn",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626052": [
        {
            "ioc_value": "abril04.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-24 12:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-nrqv9ayrfm",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626053": [
        {
            "ioc_value": "metmanagermandatesxxxxme.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-24 12:00:31",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-kjx3taet5f",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626050": [
        {
            "ioc_value": "plentymattersub.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-24 12:00:22",
            "last_seen_utc": "2025-11-08 10:27:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-gyde6sdv6g",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626051": [
        {
            "ioc_value": "pradaguccimaneto.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-24 12:00:22",
            "last_seen_utc": "2025-11-08 10:27:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-gyde6sdv6g",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626048": [
        {
            "ioc_value": "choose-cited.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-24 12:00:21",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-hxn1yseq7w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626049": [
        {
            "ioc_value": "manythingsilove.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-24 12:00:21",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-gyde6sdv6g",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626047": [
        {
            "ioc_value": "person-pencil.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-24 12:00:20",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-hytylaxqak",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626045": [
        {
            "ioc_value": "Undetected123-42839.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-24 12:00:19",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-k5j33sev4f",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626046": [
        {
            "ioc_value": "M1dn1ght-32162.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-24 12:00:19",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-jzsmlayjbk",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1626043": [
        {
            "ioc_value": "nr.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:59:43",
            "last_seen_utc": "2025-10-24 12:07:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626042": [
        {
            "ioc_value": "bark.rjofi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:49:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626041": [
        {
            "ioc_value": "c9.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:48:53",
            "last_seen_utc": "2025-10-24 11:49:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626040": [
        {
            "ioc_value": "moon.rjofi.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:37:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626039": [
        {
            "ioc_value": "77.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:37:25",
            "last_seen_utc": "2025-10-24 11:39:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626038": [
        {
            "ioc_value": "mesh.treqz.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:34:22",
            "last_seen_utc": "2025-10-24 11:39:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626037": [
        {
            "ioc_value": "ua.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:27:14",
            "last_seen_utc": "2025-10-24 11:34:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626036": [
        {
            "ioc_value": "c0re.treqz.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626035": [
        {
            "ioc_value": "z6.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:18:32",
            "last_seen_utc": "2025-10-24 11:20:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626034": [
        {
            "ioc_value": "dune.treqz.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:12:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626033": [
        {
            "ioc_value": "gum.dor8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:09:40",
            "last_seen_utc": "2025-10-24 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626032": [
        {
            "ioc_value": "ny.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:07:52",
            "last_seen_utc": "2025-10-24 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626031": [
        {
            "ioc_value": "gem.dor8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:03:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626030": [
        {
            "ioc_value": "r1se.treqz.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 11:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626029": [
        {
            "ioc_value": "dr.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:58:06",
            "last_seen_utc": "2025-10-24 11:03:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626026": [
        {
            "ioc_value": "fj.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:47:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626025": [
        {
            "ioc_value": "gl0w.treqz.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:45:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626024": [
        {
            "ioc_value": "far.dor8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:40:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626023": [
        {
            "ioc_value": "py.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:40:03",
            "last_seen_utc": "2025-10-24 10:45:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626022": [
        {
            "ioc_value": "kz.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:27:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626021": [
        {
            "ioc_value": "0a.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626020": [
        {
            "ioc_value": "mint.treqz.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:13:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626019": [
        {
            "ioc_value": "ea.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:08:10",
            "last_seen_utc": "2025-10-24 10:13:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626012": [
        {
            "ioc_value": "wiIder.syc0aq8uy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 10:00:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626005": [
        {
            "ioc_value": "cj.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:57:19",
            "last_seen_utc": "2025-10-24 10:00:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626004": [
        {
            "ioc_value": "0v.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:49:03",
            "last_seen_utc": "2025-10-24 09:50:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626003": [
        {
            "ioc_value": "ie.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:45:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1626001": [
        {
            "ioc_value": "sm1Ie.syc0aq8uy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:37:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1626000": [
        {
            "ioc_value": "jz.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:29:05",
            "last_seen_utc": "2025-10-24 09:37:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625999": [
        {
            "ioc_value": "elm.dor8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:28:59",
            "last_seen_utc": "2025-10-24 09:32:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625998": [
        {
            "ioc_value": "securepainelx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-24 09:23:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625996": [
        {
            "ioc_value": "zt.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:17:55",
            "last_seen_utc": "2025-10-24 09:28:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625993": [
        {
            "ioc_value": "leaf0.syc0aq8uy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:11:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625992": [
        {
            "ioc_value": "a3.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:08:38",
            "last_seen_utc": "2025-10-24 09:11:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625991": [
        {
            "ioc_value": "ear.dor8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 09:02:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625977": [
        {
            "ioc_value": "gIass5.syc0aq8uy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625976": [
        {
            "ioc_value": "s1.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:58:41",
            "last_seen_utc": "2025-10-24 09:02:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625975": [
        {
            "ioc_value": "8b.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:54:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625974": [
        {
            "ioc_value": "waveO.syc0aq8uy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:49:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625970": [
        {
            "ioc_value": "6z.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:46:16",
            "last_seen_utc": "2025-10-24 08:49:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625962": [
        {
            "ioc_value": "princess-mens-club.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-24 08:44:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha,PhantomCaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625963": [
        {
            "ioc_value": "princess-mens.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-24 08:44:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha,PhantomCaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625964": [
        {
            "ioc_value": "bsnowcommunications.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-24 08:44:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha,PhantomCaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625965": [
        {
            "ioc_value": "lapas.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-24 08:44:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha,PhantomCaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625966": [
        {
            "ioc_value": "zoomconference.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-24 08:44:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha,PhantomCaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625967": [
        {
            "ioc_value": "goodhillsenterprise.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-24 08:44:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha,PhantomCaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625968": [
        {
            "ioc_value": "aerobionix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-24 08:44:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha,PhantomCaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625969": [
        {
            "ioc_value": "zoomconference.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-24 08:44:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha,PhantomCaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625961": [
        {
            "ioc_value": "user-highly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-24 08:42:44",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625959": [
        {
            "ioc_value": "mpannukwummadunawaoo.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-24 08:42:14",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625958": [
        {
            "ioc_value": "asdfasfasdf3-42172.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-24 08:42:00",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625957": [
        {
            "ioc_value": "lopezsierra20.casacam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-24 08:41:34",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625952": [
        {
            "ioc_value": "kingspy.freemyip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-24 08:40:36",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625953": [
        {
            "ioc_value": "loganwolverin2027.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-24 08:40:36",
            "last_seen_utc": "2025-11-07 12:55:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625951": [
        {
            "ioc_value": "fatisabi.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-24 08:40:35",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625940": [
        {
            "ioc_value": "l5.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:37:21",
            "last_seen_utc": "2025-10-24 08:38:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625939": [
        {
            "ioc_value": "xj.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:28:36",
            "last_seen_utc": "2025-10-24 08:34:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625938": [
        {
            "ioc_value": "sil3nt.syc0aq8uy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:28:12",
            "last_seen_utc": "2025-10-24 08:38:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625937": [
        {
            "ioc_value": "dot.dor8y.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:28:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625936": [
        {
            "ioc_value": "gb.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:17:07",
            "last_seen_utc": "2025-10-24 08:28:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625935": [
        {
            "ioc_value": "green1.syc0aq8uy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:16:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625934": [
        {
            "ioc_value": "pn.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-24 08:10:38",
            "last_seen_utc": "2025-10-24 08:16:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625928": [
        {
            "ioc_value": "pagomulta2025.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-24 08:01:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/213.209.143.41+pagomulta2025.com",
            "tags": "AS214943,C2,censys,Gafgyt,open-dir,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625929": [
        {
            "ioc_value": "formulaire-mondialrelay-pro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-24 08:01:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/213.209.143.41+formulaire-mondialrelay-pro.com",
            "tags": "AS214943,C2,censys,Gafgyt,open-dir,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625930": [
        {
            "ioc_value": "entrepots-colis-2025.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-24 08:01:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/213.209.143.41+entrepots-colis-2025.info",
            "tags": "AS214943,C2,censys,Gafgyt,open-dir,RAILNET",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625916": [
        {
            "ioc_value": "neverlandstop.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-24 07:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625915": [
        {
            "ioc_value": "chickaboom.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-24 07:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://any.run/report/6c0c809060dca43795f724aeae924802bc4cac170c48053a74f9c97d85460573/5d807284-8f63-4b90-a544-466a84df1b14",
            "tags": "anyrun,c2,domain,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625911": [
        {
            "ioc_value": "stg.server24x.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-24 07:00:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625912": [
        {
            "ioc_value": "stg.mistonecorp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-24 07:00:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625669": [
        {
            "ioc_value": "investor.veranofund.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-24 06:15:58",
            "last_seen_utc": "2025-10-24 08:44:34",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115424962478423221",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1625671": [
        {
            "ioc_value": "estate.verano.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-24 06:15:57",
            "last_seen_utc": "2025-10-24 08:44:34",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115424965712969631",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1625675": [
        {
            "ioc_value": "cpanel.paquetesparaorlando.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-24 06:15:57",
            "last_seen_utc": "2025-10-24 08:44:34",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115424974579598406",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1625676": [
        {
            "ioc_value": "configure.visionsflorida.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-24 06:15:55",
            "last_seen_utc": "2025-10-24 08:44:34",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115424977349594835",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1625887": [
        {
            "ioc_value": "demo.halfmoonboulder.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-24 06:15:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115426261653111498",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1625905": [
        {
            "ioc_value": "elumadns.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-24 06:04:42",
            "last_seen_utc": "2025-11-07 12:55:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-ayymsacq8v",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625904": [
        {
            "ioc_value": "elumadns.eluma101.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-24 06:04:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-ayymsacq8v",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625898": [
        {
            "ioc_value": "coorpfree9.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-24 06:00:26",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-d1dxyawrct",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625897": [
        {
            "ioc_value": "la-supreme.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-24 06:00:11",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251024-awag6swkbz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625732": [
        {
            "ioc_value": "khamyp.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-23 20:48:45",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625733": [
        {
            "ioc_value": "servgkp.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-23 20:48:45",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625725": [
        {
            "ioc_value": "indef.locker",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-23 20:47:55",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625726": [
        {
            "ioc_value": "canonjo.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-23 20:47:55",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625727": [
        {
            "ioc_value": "cypridy.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-23 20:47:55",
            "last_seen_utc": "2025-10-28 23:14:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625728": [
        {
            "ioc_value": "refowdr.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-23 20:47:55",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625729": [
        {
            "ioc_value": "scratfx.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-23 20:47:55",
            "last_seen_utc": "2025-11-08 12:45:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625730": [
        {
            "ioc_value": "denihwc.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-23 20:47:55",
            "last_seen_utc": "2025-10-25 14:42:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625731": [
        {
            "ioc_value": "sternbg.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-23 20:47:55",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625721": [
        {
            "ioc_value": "peace7.sys7yn0iy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 20:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625720": [
        {
            "ioc_value": "sn.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 20:18:10",
            "last_seen_utc": "2025-10-23 20:21:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625719": [
        {
            "ioc_value": "light0.sys7yn0iy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 20:08:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625718": [
        {
            "ioc_value": "wn.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 20:07:51",
            "last_seen_utc": "2025-10-23 20:08:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625714": [
        {
            "ioc_value": "remote2.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-23 20:03:16",
            "last_seen_utc": "2025-10-23 22:00:51",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+remote2.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625707": [
        {
            "ioc_value": "auth.ricountyassoc.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 20:02:58",
            "last_seen_utc": "2025-10-23 22:00:30",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+auth.ricountyassoc.store",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625708": [
        {
            "ioc_value": "csp.newmmaintenanhomes.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 20:02:58",
            "last_seen_utc": "2025-10-23 22:00:30",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+csp.newmmaintenanhomes.online",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625704": [
        {
            "ioc_value": "office.othersepoxfrontier-win.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 20:02:57",
            "last_seen_utc": "2025-10-23 22:00:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+office.othersepoxfrontier-win.cloud",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625705": [
        {
            "ioc_value": "id.grcuc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 20:02:57",
            "last_seen_utc": "2025-10-23 22:00:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+id.grcuc.net",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625706": [
        {
            "ioc_value": "msfed.othersepoxfrontier-win.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 20:02:57",
            "last_seen_utc": "2025-10-23 22:00:30",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+msfed.othersepoxfrontier-win.cloud",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625701": [
        {
            "ioc_value": "sci.ricountyassoc.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 20:02:56",
            "last_seen_utc": "2025-10-23 22:00:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+sci.ricountyassoc.store",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625702": [
        {
            "ioc_value": "id.othersepoxfrontier-win.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 20:02:56",
            "last_seen_utc": "2025-10-23 22:00:25",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+id.othersepoxfrontier-win.cloud",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625703": [
        {
            "ioc_value": "outlook.optumseragamaglas-ouns.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 20:02:56",
            "last_seen_utc": "2025-10-23 22:00:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+outlook.optumseragamaglas-ouns.cloud",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625700": [
        {
            "ioc_value": "sziget.dupsiteszta.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 20:02:55",
            "last_seen_utc": "2025-10-23 22:00:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.43.207.58+sziget.dupsiteszta.hu",
            "tags": "AS62214,C2,censys,Havoc,RACKFOREST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625692": [
        {
            "ioc_value": "storm1.sys7yn0iy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625691": [
        {
            "ioc_value": "8w.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:57:58",
            "last_seen_utc": "2025-10-23 19:59:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625690": [
        {
            "ioc_value": "cIoud6.sys7yn0iy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:49:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625689": [
        {
            "ioc_value": "b4.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:47:29",
            "last_seen_utc": "2025-10-23 19:49:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625688": [
        {
            "ioc_value": "2o.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:38:45",
            "last_seen_utc": "2025-10-23 19:42:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625687": [
        {
            "ioc_value": "dreamS.sys7yn0iy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:34:41",
            "last_seen_utc": "2025-10-23 19:42:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625686": [
        {
            "ioc_value": "w2.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:27:12",
            "last_seen_utc": "2025-10-23 19:38:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625685": [
        {
            "ioc_value": "bay.k4tem.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:24:09",
            "last_seen_utc": "2025-10-23 19:38:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625684": [
        {
            "ioc_value": "gg.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:17:24",
            "last_seen_utc": "2025-10-23 19:24:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625683": [
        {
            "ioc_value": "power5.sys7yn0iy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:11:26",
            "last_seen_utc": "2025-10-23 19:22:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625681": [
        {
            "ioc_value": "5n.kaq51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 19:08:10",
            "last_seen_utc": "2025-10-23 19:11:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625680": [
        {
            "ioc_value": "96.j8ro.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 18:57:52",
            "last_seen_utc": "2025-10-23 18:58:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625678": [
        {
            "ioc_value": "truth3.sys7yn0iy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 18:51:13",
            "last_seen_utc": "2025-10-23 18:58:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625674": [
        {
            "ioc_value": "vm.hyk5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 18:48:06",
            "last_seen_utc": "2025-10-23 18:51:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625664": [
        {
            "ioc_value": "1y.fe-k2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 18:34:47",
            "last_seen_utc": "2025-10-23 18:41:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625663": [
        {
            "ioc_value": "rl.d5en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 18:27:32",
            "last_seen_utc": "2025-10-23 18:28:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625662": [
        {
            "ioc_value": "ash.k4tem.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 18:18:39",
            "last_seen_utc": "2025-10-23 18:28:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625661": [
        {
            "ioc_value": "q2.d5-en.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 18:14:43",
            "last_seen_utc": "2025-10-23 18:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625660": [
        {
            "ioc_value": "s2.b2ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 18:07:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625657": [
        {
            "ioc_value": "trial-ask.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-23 18:02:31",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251023-vhc2csfy8d",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625656": [
        {
            "ioc_value": "available-screw.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-23 18:02:30",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251023-vhc2csfy8d",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625654": [
        {
            "ioc_value": "restaurants-hold.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-23 18:02:29",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251023-vyjh3sgq9z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625653": [
        {
            "ioc_value": "0i.a-zon.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 17:57:30",
            "last_seen_utc": "2025-10-23 18:04:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625652": [
        {
            "ioc_value": "ace.k4tem.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 17:54:45",
            "last_seen_utc": "2025-10-23 17:59:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625651": [
        {
            "ioc_value": "t6.3druv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 17:48:33",
            "last_seen_utc": "2025-10-23 17:54:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625650": [
        {
            "ioc_value": "xi.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 17:38:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625649": [
        {
            "ioc_value": "op.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 17:26:43",
            "last_seen_utc": "2025-10-23 17:27:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625648": [
        {
            "ioc_value": "body.vsmu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 17:23:32",
            "last_seen_utc": "2025-10-23 17:27:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625647": [
        {
            "ioc_value": "fa.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 17:19:01",
            "last_seen_utc": "2025-10-23 17:23:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625646": [
        {
            "ioc_value": "ma.fenod.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 17:09:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625645": [
        {
            "ioc_value": "boat.vsmu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 16:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625644": [
        {
            "ioc_value": "pe.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 16:57:24",
            "last_seen_utc": "2025-10-23 16:58:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625630": [
        {
            "ioc_value": "polysies.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-23 16:52:12",
            "last_seen_utc": "2025-10-23 16:15:52",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115424371781475664",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1625635": [
        {
            "ioc_value": "powerbrokermagazine.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-23 16:52:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115424371781475664",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1625642": [
        {
            "ioc_value": "maelootp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-23 16:48:58",
            "last_seen_utc": "2025-12-14 11:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625641": [
        {
            "ioc_value": "ax.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 16:47:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625640": [
        {
            "ioc_value": "blue.vsmu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 16:37:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625639": [
        {
            "ioc_value": "no.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 16:37:19",
            "last_seen_utc": "2025-10-23 16:37:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625638": [
        {
            "ioc_value": "oy.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 16:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625637": [
        {
            "ioc_value": "es.fenod.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 16:18:13",
            "last_seen_utc": "2025-10-23 16:19:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625628": [
        {
            "ioc_value": "bear.vsmu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 16:13:35",
            "last_seen_utc": "2025-10-23 16:19:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625626": [
        {
            "ioc_value": "ha.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 16:07:54",
            "last_seen_utc": "2025-10-23 16:13:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625623": [
        {
            "ioc_value": "allenkeith.newmmaintenanhomes.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 16:02:46",
            "last_seen_utc": "2025-10-23 22:00:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+allenkeith.newmmaintenanhomes.online",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625624": [
        {
            "ioc_value": "dotfoods.tonescapesccbnv.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 16:02:46",
            "last_seen_utc": "2025-10-23 22:00:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+dotfoods.tonescapesccbnv.live",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625621": [
        {
            "ioc_value": "c2.clc2.cl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 16:02:45",
            "last_seen_utc": "2025-10-23 22:00:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/54.163.75.207+c2.clc2.cl",
            "tags": "AMAZON-AES,AS14618,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625622": [
        {
            "ioc_value": "o.tonescapesccbnv.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 16:02:45",
            "last_seen_utc": "2025-10-23 22:00:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+o.tonescapesccbnv.live",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625620": [
        {
            "ioc_value": "office.newmmaintenanhomes.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 16:02:44",
            "last_seen_utc": "2025-10-23 22:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+office.newmmaintenanhomes.online",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625619": [
        {
            "ioc_value": "equityprods.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-10-23 16:02:42",
            "last_seen_utc": "2025-10-23 22:00:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.73.222+equityprods.com",
            "tags": "AS401120,C2,censys,CHEAPY-HOST,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625618": [
        {
            "ioc_value": "ow.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:57:55",
            "last_seen_utc": "2025-10-23 16:02:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625617": [
        {
            "ioc_value": "base.vsmu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:53:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625616": [
        {
            "ioc_value": "so.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:47:38",
            "last_seen_utc": "2025-10-23 15:53:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625615": [
        {
            "ioc_value": "et.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:37:49",
            "last_seen_utc": "2025-10-23 15:44:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625614": [
        {
            "ioc_value": "strongO.res4ev7oy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:32:26",
            "last_seen_utc": "2025-10-23 15:44:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625613": [
        {
            "ioc_value": "bank.vsmu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:26:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625612": [
        {
            "ioc_value": "pi.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:25:44",
            "last_seen_utc": "2025-10-23 15:32:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625608": [
        {
            "ioc_value": "ne.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:17:18",
            "last_seen_utc": "2025-10-23 15:20:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625607": [
        {
            "ioc_value": "sIeep4.res4ev7oy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:08:42",
            "last_seen_utc": "2025-10-23 15:20:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625606": [
        {
            "ioc_value": "band.vsmu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:08:23",
            "last_seen_utc": "2025-10-23 15:19:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625604": [
        {
            "ioc_value": "iu.server24x.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-23 15:03:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625605": [
        {
            "ioc_value": "iu.mistonecorp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-23 15:03:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625599": [
        {
            "ioc_value": "wo.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 15:00:25",
            "last_seen_utc": "2025-10-23 15:08:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625598": [
        {
            "ioc_value": "oh.fenod.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 14:48:05",
            "last_seen_utc": "2025-10-23 14:48:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625597": [
        {
            "ioc_value": "barbnormadasolkuidfsa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-23 14:36:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.240.59",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625596": [
        {
            "ioc_value": "sharpekolasdomeyko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-23 14:33:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.240.57",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625595": [
        {
            "ioc_value": "bIaze7.res4ev7oy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 14:32:22",
            "last_seen_utc": "2025-10-23 14:48:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625594": [
        {
            "ioc_value": "te.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 14:31:42",
            "last_seen_utc": "2025-10-23 14:32:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625593": [
        {
            "ioc_value": "gukolinanyamannoklo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-23 14:31:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.92.240.50",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625589": [
        {
            "ioc_value": "id.newmmaintenanhomes.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 14:30:11",
            "last_seen_utc": "2025-10-23 22:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+id.newmmaintenanhomes.online",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625590": [
        {
            "ioc_value": "portal-cdn.newmmaintenanhomes.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 14:30:11",
            "last_seen_utc": "2025-10-23 22:00:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+portal-cdn.newmmaintenanhomes.online",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625586": [
        {
            "ioc_value": "auth.newmmaintenanhomes.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 14:30:10",
            "last_seen_utc": "2025-10-23 22:00:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+auth.newmmaintenanhomes.online",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625587": [
        {
            "ioc_value": "portal-cdn.tonescapesccbnv.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 14:30:10",
            "last_seen_utc": "2025-10-23 22:00:25",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+portal-cdn.tonescapesccbnv.live",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625588": [
        {
            "ioc_value": "dotfoods.newmmaintenanhomes.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 14:30:10",
            "last_seen_utc": "2025-10-23 22:00:30",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+dotfoods.newmmaintenanhomes.online",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625585": [
        {
            "ioc_value": "web-login-cdn.tonescapesccbnv.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 14:30:09",
            "last_seen_utc": "2025-10-23 22:00:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+web-login-cdn.tonescapesccbnv.live",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625576": [
        {
            "ioc_value": "clear1.res4ev7oy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 13:33:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625575": [
        {
            "ioc_value": "hb9.9z2503.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 13:28:00",
            "last_seen_utc": "2025-10-23 13:37:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625574": [
        {
            "ioc_value": "um.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 13:17:56",
            "last_seen_utc": "2025-10-23 13:28:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625573": [
        {
            "ioc_value": "shadow5.res4ev7oy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 13:09:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625572": [
        {
            "ioc_value": "ba.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 13:07:01",
            "last_seen_utc": "2025-10-23 13:09:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625571": [
        {
            "ioc_value": "t.y.mistonecorp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-23 13:04:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625566": [
        {
            "ioc_value": "www.furykris.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-23 12:50:38",
            "last_seen_utc": "2025-12-06 01:52:39",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625565": [
        {
            "ioc_value": "namemic.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-23 12:50:26",
            "last_seen_utc": "2025-12-14 11:48:10",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625564": [
        {
            "ioc_value": "evil.ritademo.io.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-23 12:50:22",
            "last_seen_utc": "2025-12-14 11:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625563": [
        {
            "ioc_value": "na.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 12:47:30",
            "last_seen_utc": "2025-10-23 12:52:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625562": [
        {
            "ioc_value": "night0.res4ev7oy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 12:45:45",
            "last_seen_utc": "2025-10-23 12:52:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625561": [
        {
            "ioc_value": "ar.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 12:37:42",
            "last_seen_utc": "2025-10-23 12:45:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625560": [
        {
            "ioc_value": "t1x.9z2503.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 12:33:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625559": [
        {
            "ioc_value": "ox.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 12:22:12",
            "last_seen_utc": "2025-10-23 12:33:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625558": [
        {
            "ioc_value": "c7.9z2503.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 12:14:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625557": [
        {
            "ioc_value": "aw.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 12:08:13",
            "last_seen_utc": "2025-10-23 12:16:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625556": [
        {
            "ioc_value": "favorali.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bit_rat",
            "malware_alias": null,
            "malware_printable": "BitRAT",
            "first_seen_utc": "2025-10-23 12:06:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251023-myh9babq7x",
            "tags": "bitrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625543": [
        {
            "ioc_value": "metillacanduiuitmanagerman.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-23 12:02:16",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251023-k536ysaq4x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625542": [
        {
            "ioc_value": "stormS.tuful32io3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 12:01:08",
            "last_seen_utc": "2025-10-23 12:16:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625541": [
        {
            "ioc_value": "we.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 11:59:26",
            "last_seen_utc": "2025-10-23 12:01:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625540": [
        {
            "ioc_value": "r8m2.9z2503.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 11:44:25",
            "last_seen_utc": "2025-10-23 12:01:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625538": [
        {
            "ioc_value": "fIame2.tuful32io3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 11:34:22",
            "last_seen_utc": "2025-10-23 11:41:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625529": [
        {
            "ioc_value": "ti.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 11:27:09",
            "last_seen_utc": "2025-10-23 11:34:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625525": [
        {
            "ioc_value": "alafair.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.castleloader",
            "malware_alias": null,
            "malware_printable": "CASTLELOADER",
            "first_seen_utc": "2025-10-23 11:15:36",
            "last_seen_utc": "2025-10-23 11:15:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "CastleLoader,drb-ra",
            "anonymous": "0",
            "reporter": "drb_ra"
        }
    ],
    "1625526": [
        {
            "ioc_value": "wereatwar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.castleloader",
            "malware_alias": null,
            "malware_printable": "CASTLELOADER",
            "first_seen_utc": "2025-10-23 11:15:36",
            "last_seen_utc": "2025-10-23 11:15:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "CastleLoader,drb-ra",
            "anonymous": "0",
            "reporter": "drb_ra"
        }
    ],
    "1625527": [
        {
            "ioc_value": "www.bethschwier.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.castleloader",
            "malware_alias": null,
            "malware_printable": "CASTLELOADER",
            "first_seen_utc": "2025-10-23 11:15:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "CastleLoader,drb-ra",
            "anonymous": "0",
            "reporter": "drb_ra"
        }
    ],
    "1625507": [
        {
            "ioc_value": "y4.9z2503.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 10:52:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625500": [
        {
            "ioc_value": "br1ght.tuful32io3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 10:48:49",
            "last_seen_utc": "2025-10-23 10:58:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625499": [
        {
            "ioc_value": "do.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 10:47:25",
            "last_seen_utc": "2025-10-23 10:52:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625495": [
        {
            "ioc_value": "a8x.6ck9465.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 10:14:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625494": [
        {
            "ioc_value": "stoneO.tuful32io3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 10:02:19",
            "last_seen_utc": "2025-10-23 10:07:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625474": [
        {
            "ioc_value": "smart1.tuful32io3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 09:49:33",
            "last_seen_utc": "2025-10-23 09:55:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625473": [
        {
            "ioc_value": "my.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 09:49:27",
            "last_seen_utc": "2025-10-23 09:55:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625466": [
        {
            "ioc_value": "www.zoomwebinviiite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-23 09:46:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "GoToResolve,LogMeIn,LogMeInResolve",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625465": [
        {
            "ioc_value": "qz7.6ck9465.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 09:43:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625464": [
        {
            "ioc_value": "y0kv.93i197934.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 09:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625463": [
        {
            "ioc_value": "ut.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 09:37:33",
            "last_seen_utc": "2025-10-23 09:43:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625459": [
        {
            "ioc_value": "om.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 09:27:15",
            "last_seen_utc": "2025-10-23 13:37:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625460": [
        {
            "ioc_value": "t.y.server24x.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-23 09:27:15",
            "last_seen_utc": "2025-10-23 09:27:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625457": [
        {
            "ioc_value": "ya.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 09:17:26",
            "last_seen_utc": "2025-10-23 09:19:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625452": [
        {
            "ioc_value": "w8jr.93i197934.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 09:10:48",
            "last_seen_utc": "2025-10-23 09:30:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625451": [
        {
            "ioc_value": "sh.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 09:07:30",
            "last_seen_utc": "2025-10-23 09:10:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625449": [
        {
            "ioc_value": "c1nx.93i197934.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 08:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625448": [
        {
            "ioc_value": "mi.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 08:53:10",
            "last_seen_utc": "2025-10-23 08:59:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625447": [
        {
            "ioc_value": "released-temple.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-23 08:50:33",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625400": [
        {
            "ioc_value": "sellea-ims.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lokipws",
            "malware_alias": "Burkina,Loki,LokiBot,LokiPWS",
            "malware_printable": "Loki Password Stealer (PWS)",
            "first_seen_utc": "2025-10-23 08:36:01",
            "last_seen_utc": "2025-11-21 23:48:04",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=sellea-ims.cfd",
            "tags": "Lokibot,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625381": [
        {
            "ioc_value": "thenewflights.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-23 07:47:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/suyog41/status/1981257934446481622",
            "tags": "c2,domain,stealer,Valkyrie",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625380": [
        {
            "ioc_value": "z4qe.49o103159.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 07:40:27",
            "last_seen_utc": "2025-10-23 07:46:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625379": [
        {
            "ioc_value": "fe.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 07:38:23",
            "last_seen_utc": "2025-10-23 07:40:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625377": [
        {
            "ioc_value": "k3.6ck9465.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 07:34:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625375": [
        {
            "ioc_value": "ho.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 07:29:07",
            "last_seen_utc": "2025-10-23 07:34:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625373": [
        {
            "ioc_value": "b9th.49o103159.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 07:24:25",
            "last_seen_utc": "2025-10-23 07:30:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625372": [
        {
            "ioc_value": "bo.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 07:24:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625371": [
        {
            "ioc_value": "m2fv.49o103159.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 07:18:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625367": [
        {
            "ioc_value": "a.t.rizbegadget.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-23 07:15:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625368": [
        {
            "ioc_value": "a.t.memphis-eg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-23 07:15:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625364": [
        {
            "ioc_value": "x3q.q-0-spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 07:12:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625362": [
        {
            "ioc_value": "network.spamhaussupport.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-23 07:10:38",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e71d8cf30af1dce46914dc3c606d0d4a6a7ab92e15a062df1e5c68a9de08bb09/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625360": [
        {
            "ioc_value": "miraiv5.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-23 07:08:53",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/65cd17f005e69328555bad075f900970aa3d28e7f8fae50a72e38730f89e97a8/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625359": [
        {
            "ioc_value": "ef.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 07:07:54",
            "last_seen_utc": "2025-10-23 07:18:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625356": [
        {
            "ioc_value": "droby88.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-23 07:02:08",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1f18c0aa35ed69699e5940e5466858684823060977fd2612558e3071ed6efade/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625351": [
        {
            "ioc_value": "aa.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:57:34",
            "last_seen_utc": "2025-10-23 07:00:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625347": [
        {
            "ioc_value": "x7bk.49o103159.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:48:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625346": [
        {
            "ioc_value": "da.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:47:45",
            "last_seen_utc": "2025-10-23 06:48:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625345": [
        {
            "ioc_value": "bratanchill.accessdennied.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-23 06:47:44",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/237607d4c58479b2aa6849532c0a6c505a2c37072b1494e4474b5057a3d5364f/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625343": [
        {
            "ioc_value": "k2wr.31e854642.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625342": [
        {
            "ioc_value": "a9.q-0-spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:34:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625341": [
        {
            "ioc_value": "nu.fenod.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:32:51",
            "last_seen_utc": "2025-10-23 06:37:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625339": [
        {
            "ioc_value": "ed.trowy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:28:17",
            "last_seen_utc": "2025-10-23 09:49:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625337": [
        {
            "ioc_value": "s0gx.31e854642.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:22:25",
            "last_seen_utc": "2025-10-23 06:32:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625335": [
        {
            "ioc_value": "oi.vakun.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:18:32",
            "last_seen_utc": "2025-10-23 10:02:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625334": [
        {
            "ioc_value": "am.jg7ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 06:04:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625332": [
        {
            "ioc_value": "s15.csgo.co.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-23 06:03:41",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251023-gn1sqafx5c",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625333": [
        {
            "ioc_value": "kets4eki.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-23 06:03:41",
            "last_seen_utc": "2025-11-07 12:55:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/251023-gn1sqafx5c",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625330": [
        {
            "ioc_value": "pradeepprabhu705.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-23 06:02:12",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251023-dwqe6sev8h",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625327": [
        {
            "ioc_value": "en.fenod.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:57:58",
            "last_seen_utc": "2025-10-23 10:58:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625326": [
        {
            "ioc_value": "restaurant-kids-working-naturally.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-23 05:54:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "XWorm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625325": [
        {
            "ioc_value": "t5hl.31e854642.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:53:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625322": [
        {
            "ioc_value": "hell.dedicated-coords.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-23 05:48:16",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625321": [
        {
            "ioc_value": "mo.uht3o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:48:11",
            "last_seen_utc": "2025-10-23 11:44:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625319": [
        {
            "ioc_value": "receive-walter.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-23 05:47:45",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625317": [
        {
            "ioc_value": "xoilaczzzdz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-23 05:47:12",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625315": [
        {
            "ioc_value": "emily21314-21959.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-23 05:47:11",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625316": [
        {
            "ioc_value": "loganwolverin2026.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-23 05:47:11",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1625307": [
        {
            "ioc_value": "q8md.31e854642.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:40:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625305": [
        {
            "ioc_value": "re.sne4p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:34:21",
            "last_seen_utc": "2025-10-23 05:40:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625304": [
        {
            "ioc_value": "g4n0.q-0-spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:33:22",
            "last_seen_utc": "2025-10-23 05:36:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625303": [
        {
            "ioc_value": "ag.lizqa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:27:35",
            "last_seen_utc": "2025-10-23 10:14:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625302": [
        {
            "ioc_value": "j3vp.31e854642.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:20:21",
            "last_seen_utc": "2025-10-23 05:32:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625301": [
        {
            "ioc_value": "mu.q0spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:17:49",
            "last_seen_utc": "2025-10-23 05:20:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625300": [
        {
            "ioc_value": "i7b3x8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 05:07:33",
            "last_seen_utc": "2025-10-23 05:08:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625299": [
        {
            "ioc_value": "e4r6k9l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:58:16",
            "last_seen_utc": "2025-10-23 05:02:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625297": [
        {
            "ioc_value": "r9cb.37i658094.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:54:39",
            "last_seen_utc": "2025-10-23 05:08:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625296": [
        {
            "ioc_value": "y8t4s2w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:47:22",
            "last_seen_utc": "2025-10-23 04:54:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625295": [
        {
            "ioc_value": "u5p1d7qg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:38:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625294": [
        {
            "ioc_value": "h2mx.37i658094.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:30:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625293": [
        {
            "ioc_value": "s5x8jq1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:28:21",
            "last_seen_utc": "2025-10-23 04:30:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625292": [
        {
            "ioc_value": "g1l6m9p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:18:04",
            "last_seen_utc": "2025-10-23 04:23:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625291": [
        {
            "ioc_value": "l7x.q-0-spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:12:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625290": [
        {
            "ioc_value": "g4ny.37i658094.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:12:15",
            "last_seen_utc": "2025-10-23 04:23:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625289": [
        {
            "ioc_value": "o2v9c4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 04:07:51",
            "last_seen_utc": "2025-10-23 04:12:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625274": [
        {
            "ioc_value": "v1zt.37i658094.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:59:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625273": [
        {
            "ioc_value": "h3z2m8b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:57:31",
            "last_seen_utc": "2025-10-23 03:59:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625272": [
        {
            "ioc_value": "w0f7n3ty.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:47:45",
            "last_seen_utc": "2025-10-23 03:49:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625271": [
        {
            "ioc_value": "a9v3c2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:37:22",
            "last_seen_utc": "2025-10-23 03:38:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625270": [
        {
            "ioc_value": "p6qw.37i658094.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:30:47",
            "last_seen_utc": "2025-10-23 03:49:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625269": [
        {
            "ioc_value": "n3p9sle.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:28:37",
            "last_seen_utc": "2025-10-23 03:30:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625268": [
        {
            "ioc_value": "e2.q-0-spi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:28:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625267": [
        {
            "ioc_value": "r7h0g4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:18:23",
            "last_seen_utc": "2025-10-23 03:28:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625266": [
        {
            "ioc_value": "n0jm.30u241207.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:11:52",
            "last_seen_utc": "2025-10-23 03:20:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625265": [
        {
            "ioc_value": "m1d8g4hf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:08:02",
            "last_seen_utc": "2025-10-23 03:11:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625264": [
        {
            "ioc_value": "v0q.jg-7-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 03:04:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625263": [
        {
            "ioc_value": "k8jv1m2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:58:11",
            "last_seen_utc": "2025-10-23 03:04:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625262": [
        {
            "ioc_value": "c7hv.30u241207.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:56:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625261": [
        {
            "ioc_value": "p38md1r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:47:53",
            "last_seen_utc": "2025-10-23 02:56:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625260": [
        {
            "ioc_value": "y2sk.30u241207.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:42:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625259": [
        {
            "ioc_value": "b2z7r5k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:37:38",
            "last_seen_utc": "2025-10-23 02:42:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625258": [
        {
            "ioc_value": "l8rd.30u241207.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:34:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625257": [
        {
            "ioc_value": "t4c6yx8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:28:45",
            "last_seen_utc": "2025-10-23 02:34:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625256": [
        {
            "ioc_value": "hn3.jg-7-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:23:13",
            "last_seen_utc": "2025-10-23 02:29:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625255": [
        {
            "ioc_value": "z1pc.30u241207.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625254": [
        {
            "ioc_value": "qw59f3d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:17:58",
            "last_seen_utc": "2025-10-23 02:23:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625253": [
        {
            "ioc_value": "c9.jg-7-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:10:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625252": [
        {
            "ioc_value": "f0rq.54o477354.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:08:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625251": [
        {
            "ioc_value": "l2b9nzt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 02:07:35",
            "last_seen_utc": "2025-10-23 02:10:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625250": [
        {
            "ioc_value": "t6bn.54o477354.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:57:36",
            "last_seen_utc": "2025-10-23 02:00:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625249": [
        {
            "ioc_value": "x9k4f2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:57:19",
            "last_seen_utc": "2025-10-23 02:00:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625248": [
        {
            "ioc_value": "1m.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:48:35",
            "last_seen_utc": "2025-10-23 01:57:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625246": [
        {
            "ioc_value": "z7t2.jg-7-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:43:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625245": [
        {
            "ioc_value": "m3zy.54o477354.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:40:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625244": [
        {
            "ioc_value": "c8.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:38:13",
            "last_seen_utc": "2025-10-23 01:43:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625243": [
        {
            "ioc_value": "p1a.jg-7-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:34:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625242": [
        {
            "ioc_value": "a9wt.54o477354.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:31:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625241": [
        {
            "ioc_value": "p0.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:27:49",
            "last_seen_utc": "2025-10-23 01:34:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625240": [
        {
            "ioc_value": "0z.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:17:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625239": [
        {
            "ioc_value": "v3.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:12:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625237": [
        {
            "ioc_value": "u2kh.54o477354.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:10:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625236": [
        {
            "ioc_value": "h1.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 01:07:37",
            "last_seen_utc": "2025-10-23 01:10:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625235": [
        {
            "ioc_value": "s.imm-yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625234": [
        {
            "ioc_value": "f6.jg-7-ra.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:49:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625233": [
        {
            "ioc_value": "t1.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:47:31",
            "last_seen_utc": "2025-10-23 00:49:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625232": [
        {
            "ioc_value": "r9.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:37:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625231": [
        {
            "ioc_value": "bq.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:28:29",
            "last_seen_utc": "2025-10-23 00:35:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625229": [
        {
            "ioc_value": "w6qc.60e533569.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:24:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625228": [
        {
            "ioc_value": "q0h.uht-3-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:23:11",
            "last_seen_utc": "2025-10-23 00:35:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625227": [
        {
            "ioc_value": "x2.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:18:11",
            "last_seen_utc": "2025-10-23 00:24:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625226": [
        {
            "ioc_value": "pc.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:07:55",
            "last_seen_utc": "2025-10-23 00:09:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625224": [
        {
            "ioc_value": "web-login-cdn.kelvrion.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 00:03:25",
            "last_seen_utc": "2025-10-23 10:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+web-login-cdn.kelvrion.com",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625223": [
        {
            "ioc_value": "sp.authpoint.usa.kelvrion.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-23 00:03:23",
            "last_seen_utc": "2025-10-23 10:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+sp.authpoint.usa.kelvrion.com",
            "tags": "AS29802,C2,censys,Havoc,HVC-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625218": [
        {
            "ioc_value": "d0mu.60e533569.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-23 00:01:51",
            "last_seen_utc": "2025-10-23 00:09:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625217": [
        {
            "ioc_value": "m8.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:58:07",
            "last_seen_utc": "2025-10-23 00:01:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625216": [
        {
            "ioc_value": "m5x.uht-3-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:53:32",
            "last_seen_utc": "2025-10-22 23:58:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625215": [
        {
            "ioc_value": "a.ahz-ya.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:47:49",
            "last_seen_utc": "2025-10-22 23:53:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625214": [
        {
            "ioc_value": "y4np.60e533569.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:45:30",
            "last_seen_utc": "2025-10-22 23:53:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625213": [
        {
            "ioc_value": "k0.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:38:02",
            "last_seen_utc": "2025-10-22 23:45:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625212": [
        {
            "ioc_value": "wz.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:27:44",
            "last_seen_utc": "2025-10-22 23:34:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625210": [
        {
            "ioc_value": "r2.uht-3-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:24:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625209": [
        {
            "ioc_value": "s1vr.60e533569.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:21:06",
            "last_seen_utc": "2025-10-22 23:34:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625207": [
        {
            "ioc_value": "h2.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:17:28",
            "last_seen_utc": "2025-10-22 23:24:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625205": [
        {
            "ioc_value": "k7fx.60e533569.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:10:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625204": [
        {
            "ioc_value": "k4w3.uht-3-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:08:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625203": [
        {
            "ioc_value": "q.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 23:07:42",
            "last_seen_utc": "2025-10-22 23:10:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625202": [
        {
            "ioc_value": "y8n.uht-3-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:59:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625201": [
        {
            "ioc_value": "e3pz.11u812580.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:55:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625200": [
        {
            "ioc_value": "xt.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:50:46",
            "last_seen_utc": "2025-10-22 22:59:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625199": [
        {
            "ioc_value": "n5.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:48:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625197": [
        {
            "ioc_value": "u9q.sne-4-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:39:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625196": [
        {
            "ioc_value": "h9wl.11u812580.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:39:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625195": [
        {
            "ioc_value": "b.owp-oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:38:20",
            "last_seen_utc": "2025-10-22 22:39:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625194": [
        {
            "ioc_value": "x.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:28:02",
            "last_seen_utc": "2025-10-22 22:32:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625193": [
        {
            "ioc_value": "q5ya.11u812580.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:23:13",
            "last_seen_utc": "2025-10-22 22:32:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625192": [
        {
            "ioc_value": "bw6.sne-4-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625191": [
        {
            "ioc_value": "h9.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:17:43",
            "last_seen_utc": "2025-10-22 22:23:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625190": [
        {
            "ioc_value": "t5.sne-4-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625189": [
        {
            "ioc_value": "tq.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:07:55",
            "last_seen_utc": "2025-10-22 22:09:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625187": [
        {
            "ioc_value": "x0dn.11u812580.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 22:03:44",
            "last_seen_utc": "2025-10-22 22:09:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625173": [
        {
            "ioc_value": "allenkeith.mstoresabotaniud.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:42",
            "last_seen_utc": "2025-10-23 00:03:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+allenkeith.mstoresabotaniud.site",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625171": [
        {
            "ioc_value": "dotfoods.othersepoxfrontier-win.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:41",
            "last_seen_utc": "2025-10-23 00:03:25",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+dotfoods.othersepoxfrontier-win.cloud",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625172": [
        {
            "ioc_value": "dotfoods.mellor-engineering.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:41",
            "last_seen_utc": "2025-10-23 00:03:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+dotfoods.mellor-engineering.cloud",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625168": [
        {
            "ioc_value": "loginii.kelvrion.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:40",
            "last_seen_utc": "2025-10-23 00:03:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+loginii.kelvrion.com",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625169": [
        {
            "ioc_value": "portal-cdn.mstoresabotaniud.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:40",
            "last_seen_utc": "2025-10-23 00:03:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+portal-cdn.mstoresabotaniud.site",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625170": [
        {
            "ioc_value": "csp.mellor-engineering.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:40",
            "last_seen_utc": "2025-10-23 00:03:25",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+csp.mellor-engineering.cloud",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625166": [
        {
            "ioc_value": "dotfoods.grcuc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:39",
            "last_seen_utc": "2025-10-23 00:03:25",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+dotfoods.grcuc.net",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625167": [
        {
            "ioc_value": "allenkeith.grcuc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:39",
            "last_seen_utc": "2025-10-23 00:03:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+allenkeith.grcuc.net",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625163": [
        {
            "ioc_value": "loginii.optumseragamaglas-ouns.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:38",
            "last_seen_utc": "2025-10-23 00:03:23",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+loginii.optumseragamaglas-ouns.cloud",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625164": [
        {
            "ioc_value": "portal-cdn.kelvrion.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:38",
            "last_seen_utc": "2025-10-23 00:03:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+portal-cdn.kelvrion.com",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625165": [
        {
            "ioc_value": "usa.optumseragamaglas-ouns.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:38",
            "last_seen_utc": "2025-10-23 00:03:23",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+usa.optumseragamaglas-ouns.cloud",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625162": [
        {
            "ioc_value": "auth.mstoresabotaniud.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 22:00:37",
            "last_seen_utc": "2025-10-23 00:03:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.227.196.113+auth.mstoresabotaniud.site",
            "tags": "AS29802,C2,censys,HVC-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1625158": [
        {
            "ioc_value": "z1.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:57:37",
            "last_seen_utc": "2025-10-22 22:03:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625157": [
        {
            "ioc_value": "bd.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:47:19",
            "last_seen_utc": "2025-10-22 21:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625156": [
        {
            "ioc_value": "b6tj.11u812580.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:40:59",
            "last_seen_utc": "2025-10-22 21:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625155": [
        {
            "ioc_value": "q7.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:37:31",
            "last_seen_utc": "2025-10-22 21:40:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625154": [
        {
            "ioc_value": "x0v4.sne-4-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:29:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625153": [
        {
            "ioc_value": "g.yxb-au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:27:13",
            "last_seen_utc": "2025-10-22 21:29:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625152": [
        {
            "ioc_value": "v4sz.08u073852.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:23:46",
            "last_seen_utc": "2025-10-22 21:29:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625151": [
        {
            "ioc_value": "xq.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:17:56",
            "last_seen_utc": "2025-10-22 21:23:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625150": [
        {
            "ioc_value": "g8k1.08u073852.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:08:17",
            "last_seen_utc": "2025-10-22 21:17:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625149": [
        {
            "ioc_value": "h7.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 21:08:10",
            "last_seen_utc": "2025-10-22 21:17:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625147": [
        {
            "ioc_value": "pv.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:57:51",
            "last_seen_utc": "2025-10-22 21:08:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625145": [
        {
            "ioc_value": "r2qm.08u073852.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:49:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625144": [
        {
            "ioc_value": "a1.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:48:04",
            "last_seen_utc": "2025-10-22 20:49:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625143": [
        {
            "ioc_value": "zt.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:37:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625142": [
        {
            "ioc_value": "n3yl.08u073852.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:28:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625141": [
        {
            "ioc_value": "n3.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:27:27",
            "last_seen_utc": "2025-10-22 20:28:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625140": [
        {
            "ioc_value": "j2.sne-4-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:26:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625138": [
        {
            "ioc_value": "e.y742au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:17:37",
            "last_seen_utc": "2025-10-22 20:26:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625137": [
        {
            "ioc_value": "c9w5.08u073852.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:12:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625135": [
        {
            "ioc_value": "z9.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 20:07:19",
            "last_seen_utc": "2025-10-22 20:12:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625127": [
        {
            "ioc_value": "account.jamesriver-ins.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 20:03:19",
            "last_seen_utc": "2025-10-22 22:00:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.216.130.82+account.jamesriver-ins.com",
            "tags": "AMAZON-AES,AS14618,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625116": [
        {
            "ioc_value": "t0uq.99y401874.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 19:54:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625115": [
        {
            "ioc_value": "qb.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 19:50:22",
            "last_seen_utc": "2025-10-22 19:54:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625114": [
        {
            "ioc_value": "m2.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 19:07:40",
            "last_seen_utc": "2025-10-22 19:13:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625113": [
        {
            "ioc_value": "ns.cs.endorsec.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-22 18:49:19",
            "last_seen_utc": "2025-12-14 11:48:10",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1625104": [
        {
            "ioc_value": "x.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 18:14:51",
            "last_seen_utc": "2025-10-22 18:17:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625103": [
        {
            "ioc_value": "7july-lithuania.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.orcus_rat",
            "malware_alias": "Schnorchel",
            "malware_printable": "Orcus RAT",
            "first_seen_utc": "2025-10-22 18:06:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-qbe5xs1rbt",
            "tags": "C2,domain,orcus,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625102": [
        {
            "ioc_value": "p-zinc.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-22 18:03:22",
            "last_seen_utc": "2025-11-07 12:55:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-pse1ta1nhz",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625098": [
        {
            "ioc_value": "given-delete.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 18:02:11",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-tfnveagm8t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625099": [
        {
            "ioc_value": "supremogtarp.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 18:02:11",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-sbqmrsgj2y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625097": [
        {
            "ioc_value": "fazoxxd-45223.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 18:02:10",
            "last_seen_utc": "2025-11-07 12:55:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-tl37aagn5w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625095": [
        {
            "ioc_value": "ball.k4tem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 17:31:25",
            "last_seen_utc": "2025-10-22 19:08:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625093": [
        {
            "ioc_value": "pl.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 17:14:38",
            "last_seen_utc": "2025-10-22 17:31:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1625077": [
        {
            "ioc_value": "xeljson.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-22 16:27:54",
            "last_seen_utc": "2025-10-22 16:20:33",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115418727497119748",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1625082": [
        {
            "ioc_value": "stgeorgelight.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-22 16:27:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115418727497119748",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1625086": [
        {
            "ioc_value": "p.x.rizbegadget.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-22 16:22:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625087": [
        {
            "ioc_value": "p.x.memphis-eg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-22 16:22:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1625075": [
        {
            "ioc_value": "rdp.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 16:05:33",
            "last_seen_utc": "2025-10-22 22:03:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+rdp.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1625037": [
        {
            "ioc_value": "z7hd.99y401874.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:49:27",
            "last_seen_utc": "2025-10-22 19:13:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1625010": [
        {
            "ioc_value": "h3.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:48:23",
            "last_seen_utc": "2025-10-22 15:49:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624908": [
        {
            "ioc_value": "back.k4tem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:43:50",
            "last_seen_utc": "2025-10-22 15:48:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624888": [
        {
            "ioc_value": "s.i261au.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:37:19",
            "last_seen_utc": "2025-10-22 15:43:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624887": [
        {
            "ioc_value": "p1kx.99y401874.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:37:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624885": [
        {
            "ioc_value": "x8.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:28:02",
            "last_seen_utc": "2025-10-22 15:37:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624884": [
        {
            "ioc_value": "baby.k4tem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:25:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624882": [
        {
            "ioc_value": "h9.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:18:14",
            "last_seen_utc": "2025-10-22 15:25:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624881": [
        {
            "ioc_value": "tq.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:07:48",
            "last_seen_utc": "2025-10-22 15:11:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624880": [
        {
            "ioc_value": "away.k4tem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:06:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624879": [
        {
            "ioc_value": "j8r2.99y401874.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 15:02:06",
            "last_seen_utc": "2025-10-22 15:11:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624877": [
        {
            "ioc_value": "updata.mgil01.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-22 14:59:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624878": [
        {
            "ioc_value": "service.oneipsoft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-22 14:59:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624873": [
        {
            "ioc_value": "myoffice.techralsolution.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 14:59:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html",
            "tags": "c2,CrowDoor",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624874": [
        {
            "ioc_value": "helpdesk.athenatechlabs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 14:59:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html",
            "tags": "c2,CrowDoor",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624875": [
        {
            "ioc_value": "afddd9d14453d4f9-1e185df7e4.ap-southeast-mnl.timcorpnet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 14:59:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html",
            "tags": "c2,CrowDoor",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624876": [
        {
            "ioc_value": "back-trust-aurora.cluster-ctrjumtpbmf.mnl-east-2.timcorpnet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 14:59:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html",
            "tags": "c2,CrowDoor",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624857": [
        {
            "ioc_value": "z1.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 14:57:44",
            "last_seen_utc": "2025-10-22 15:06:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624855": [
        {
            "ioc_value": "m4v.99y401874.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 14:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624854": [
        {
            "ioc_value": "bd.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 14:40:49",
            "last_seen_utc": "2025-10-22 14:46:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624853": [
        {
            "ioc_value": "area.k4tem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 14:32:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624852": [
        {
            "ioc_value": "q4.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 14:27:22",
            "last_seen_utc": "2025-10-22 14:32:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624851": [
        {
            "ioc_value": "also.k4tem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 14:23:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624850": [
        {
            "ioc_value": "g.i924ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 14:18:29",
            "last_seen_utc": "2025-10-22 14:23:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624849": [
        {
            "ioc_value": "p9.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 14:08:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624846": [
        {
            "ioc_value": "caIm7.res4ev7oy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:58:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624845": [
        {
            "ioc_value": "h7.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:58:23",
            "last_seen_utc": "2025-10-22 13:58:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624844": [
        {
            "ioc_value": "able.k4tem.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:53:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624843": [
        {
            "ioc_value": "wi1dO.res4ev7oy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:52:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624842": [
        {
            "ioc_value": "x.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:48:34",
            "last_seen_utc": "2025-10-22 13:53:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624841": [
        {
            "ioc_value": "gent1e.res4ev7oy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:38:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624840": [
        {
            "ioc_value": "t1.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:38:05",
            "last_seen_utc": "2025-10-22 13:38:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624839": [
        {
            "ioc_value": "dust5.res4ev7oy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:30:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624838": [
        {
            "ioc_value": "t2m4.rv6324.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:28:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624837": [
        {
            "ioc_value": "zc.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:27:48",
            "last_seen_utc": "2025-10-22 13:30:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624836": [
        {
            "ioc_value": "qdqwrqwrwqrqw.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-22 13:25:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1799754/0/iochtml",
            "tags": "c2,domain,joesandbox,payloads,Rhadamanthys",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624835": [
        {
            "ioc_value": "flow3.res4ev7oy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:22:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624833": [
        {
            "ioc_value": "kx6.rv6324.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624832": [
        {
            "ioc_value": "n3.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:16:31",
            "last_seen_utc": "2025-10-22 13:22:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624830": [
        {
            "ioc_value": "graceoppo45.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-22 13:10:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1779788/0/html",
            "tags": "c2,domain,joesandbox,rat,Remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624829": [
        {
            "ioc_value": "averolucas.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-22 13:08:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1754326/0/html",
            "tags": "c2,domain,joesandbox,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624828": [
        {
            "ioc_value": "a.o-y3ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:07:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624827": [
        {
            "ioc_value": "mi1d.res4ev7oy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 13:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624826": [
        {
            "ioc_value": "q1.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:57:42",
            "last_seen_utc": "2025-10-22 13:00:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624825": [
        {
            "ioc_value": "86xh43yr0x006.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-22 12:49:47",
            "last_seen_utc": "2025-11-23 07:47:34",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624824": [
        {
            "ioc_value": "b1.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:48:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624816": [
        {
            "ioc_value": "actualizadoswin11.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-22 12:44:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624817": [
        {
            "ioc_value": "tipseptbk.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-22 12:44:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624818": [
        {
            "ioc_value": "11655nightfileremciiiixxxxx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-22 12:44:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624819": [
        {
            "ioc_value": "moneyexchangeworld.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-22 12:44:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624809": [
        {
            "ioc_value": "yhhgff.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624810": [
        {
            "ioc_value": "dgam6am.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624811": [
        {
            "ioc_value": "nov-cleaner.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624800": [
        {
            "ioc_value": "second-flickr.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624801": [
        {
            "ioc_value": "vxnjhdhs-35196.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624802": [
        {
            "ioc_value": "cracktui-34704.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624803": [
        {
            "ioc_value": "likely-preliminary.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624804": [
        {
            "ioc_value": "fresd.serveblog.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624805": [
        {
            "ioc_value": "boy-racial.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624806": [
        {
            "ioc_value": "uk-weight.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624807": [
        {
            "ioc_value": "football-reached.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624808": [
        {
            "ioc_value": "parts-quite.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-22 12:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624783": [
        {
            "ioc_value": "coorpfree3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624784": [
        {
            "ioc_value": "v1.authorandrewsmith.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624773": [
        {
            "ioc_value": "donationcode.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624774": [
        {
            "ioc_value": "djaber.synology.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624775": [
        {
            "ioc_value": "buy-cake.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624776": [
        {
            "ioc_value": "v2.buildingmaterialsandclimate.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624777": [
        {
            "ioc_value": "madxteam.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624778": [
        {
            "ioc_value": "cause-seems.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624779": [
        {
            "ioc_value": "problem-locking.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624780": [
        {
            "ioc_value": "gatex.xoilaczzzcz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624781": [
        {
            "ioc_value": "war.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624782": [
        {
            "ioc_value": "unnnnnnknownnnnn-49954.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624768": [
        {
            "ioc_value": "little-vegetables.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-22 12:44:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624769": [
        {
            "ioc_value": "campestre.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-22 12:44:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624771": [
        {
            "ioc_value": "spam.authorandrewsmith.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:00",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624772": [
        {
            "ioc_value": "v1.buildingmaterialsandclimate.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:44:00",
            "last_seen_utc": "2025-12-12 18:38:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "22October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1624767": [
        {
            "ioc_value": "w.rv6324.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:38:29",
            "last_seen_utc": "2025-10-22 12:43:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624766": [
        {
            "ioc_value": "r7.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:38:19",
            "last_seen_utc": "2025-10-22 12:43:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624765": [
        {
            "ioc_value": "x5.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:37:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624764": [
        {
            "ioc_value": "deepO.res4ev7oy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:29:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624763": [
        {
            "ioc_value": "p7z1.rv6324.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:28:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624762": [
        {
            "ioc_value": "vk.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:28:13",
            "last_seen_utc": "2025-10-22 12:29:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624759": [
        {
            "ioc_value": "m8.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:17:56",
            "last_seen_utc": "2025-10-22 12:22:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624756": [
        {
            "ioc_value": "qx2m.97ie88e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:10:26",
            "last_seen_utc": "2025-10-22 12:22:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624757": [
        {
            "ioc_value": "g3c.rv6324.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:10:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624753": [
        {
            "ioc_value": "s.y-o7uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 12:04:03",
            "last_seen_utc": "2025-10-22 12:10:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624751": [
        {
            "ioc_value": "gra.nadimgadget.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-22 12:03:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624752": [
        {
            "ioc_value": "gra.khabeir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-22 12:03:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624741": [
        {
            "ioc_value": "pactohistorico2029.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:02:37",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-nh7gmsdn6x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624740": [
        {
            "ioc_value": "coorpfree7.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 12:02:36",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-n5dsvasjan",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624739": [
        {
            "ioc_value": "myupdaterem.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-22 12:02:20",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-g95zkahw7d",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624738": [
        {
            "ioc_value": "westy.karslioglu-tr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-22 12:02:19",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-nk6ywszlat",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624735": [
        {
            "ioc_value": "a5v9.97ie88e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:59:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624734": [
        {
            "ioc_value": "q9.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:57:46",
            "last_seen_utc": "2025-10-22 11:59:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624733": [
        {
            "ioc_value": "x7.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:47:26",
            "last_seen_utc": "2025-10-22 11:49:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624732": [
        {
            "ioc_value": "7eud.97ie88e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:42:32",
            "last_seen_utc": "2025-10-22 11:49:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624731": [
        {
            "ioc_value": "pt.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:37:33",
            "last_seen_utc": "2025-10-22 11:42:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624730": [
        {
            "ioc_value": "n0.rv6324.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:31:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624728": [
        {
            "ioc_value": "lx0c.97ie88e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:29:11",
            "last_seen_utc": "2025-10-22 11:36:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624727": [
        {
            "ioc_value": "z1.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:27:11",
            "last_seen_utc": "2025-10-22 11:36:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624726": [
        {
            "ioc_value": "f1y6.97ie88e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624725": [
        {
            "ioc_value": "4.o-a4eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:14:21",
            "last_seen_utc": "2025-10-22 11:17:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624724": [
        {
            "ioc_value": "1m.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:05:05",
            "last_seen_utc": "2025-10-22 11:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624723": [
        {
            "ioc_value": "4tqm.28ae00i7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 11:01:19",
            "last_seen_utc": "2025-10-22 11:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624722": [
        {
            "ioc_value": "c8.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 10:58:19",
            "last_seen_utc": "2025-10-22 11:01:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624721": [
        {
            "ioc_value": "qk8.bl8205.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 10:53:45",
            "last_seen_utc": "2025-10-22 10:59:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624717": [
        {
            "ioc_value": "p0.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 10:47:57",
            "last_seen_utc": "2025-10-22 10:53:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624716": [
        {
            "ioc_value": "0z.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 10:30:43",
            "last_seen_utc": "2025-10-22 10:35:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624715": [
        {
            "ioc_value": "sr5b.28ae00i7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 10:28:32",
            "last_seen_utc": "2025-10-22 10:35:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624714": [
        {
            "ioc_value": "v3.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 10:18:54",
            "last_seen_utc": "2025-10-22 10:28:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624713": [
        {
            "ioc_value": "h1.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 10:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624712": [
        {
            "ioc_value": "s.t-pay3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 10:07:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624697": [
        {
            "ioc_value": "t1.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:57:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624696": [
        {
            "ioc_value": "y.bl8205.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:54:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624695": [
        {
            "ioc_value": "2wpx.28ae00i7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:51:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624694": [
        {
            "ioc_value": "r9.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:47:13",
            "last_seen_utc": "2025-10-22 09:54:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624693": [
        {
            "ioc_value": "bq.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:39:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624692": [
        {
            "ioc_value": "d3j7.28ae00i7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:31:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624684": [
        {
            "ioc_value": "x2.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:28:08",
            "last_seen_utc": "2025-10-22 09:31:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624683": [
        {
            "ioc_value": "pc.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624682": [
        {
            "ioc_value": "m5q1.bl8205.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:11:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624681": [
        {
            "ioc_value": "m8.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 09:09:30",
            "last_seen_utc": "2025-10-22 09:11:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624680": [
        {
            "ioc_value": "r2t.bl8205.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 08:50:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624679": [
        {
            "ioc_value": "a.x-ceu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 08:45:42",
            "last_seen_utc": "2025-10-22 08:50:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624677": [
        {
            "ioc_value": "k0.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 08:37:23",
            "last_seen_utc": "2025-10-22 08:37:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624676": [
        {
            "ioc_value": "c4.bl8205.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 08:34:13",
            "last_seen_utc": "2025-10-22 08:37:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624675": [
        {
            "ioc_value": "wz.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 08:28:05",
            "last_seen_utc": "2025-10-22 08:34:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624674": [
        {
            "ioc_value": "h2.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 08:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624673": [
        {
            "ioc_value": "q.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 08:08:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624663": [
        {
            "ioc_value": "xt.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 07:58:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624662": [
        {
            "ioc_value": "n5.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 07:42:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624661": [
        {
            "ioc_value": "b.f-xiu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 07:37:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624660": [
        {
            "ioc_value": "a9.zm6392.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 07:33:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624657": [
        {
            "ioc_value": "ftp.nadimgadget.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-22 07:27:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624658": [
        {
            "ioc_value": "ftp.khabeir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-22 07:27:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624656": [
        {
            "ioc_value": "x.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 07:27:39",
            "last_seen_utc": "2025-10-22 07:33:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624653": [
        {
            "ioc_value": "h9.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 07:17:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624651": [
        {
            "ioc_value": "tq.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 07:07:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624650": [
        {
            "ioc_value": "x7p4.zm6392.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 06:59:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624649": [
        {
            "ioc_value": "z1.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 06:59:11",
            "last_seen_utc": "2025-10-22 06:59:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624648": [
        {
            "ioc_value": "d1.zm6392.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 06:49:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624647": [
        {
            "ioc_value": "q7.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 06:40:18",
            "last_seen_utc": "2025-10-22 06:49:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624645": [
        {
            "ioc_value": "g.v-bua0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 06:27:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624644": [
        {
            "ioc_value": "xq.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 06:17:40",
            "last_seen_utc": "2025-10-22 06:17:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624643": [
        {
            "ioc_value": "wq0n.zm6392.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 06:02:53",
            "last_seen_utc": "2025-10-22 06:17:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624642": [
        {
            "ioc_value": "newduck1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-22 06:02:38",
            "last_seen_utc": "2025-11-07 12:55:18",
            "confidence_level": 100,
            "reference": "https://tria.ge/251022-c3lvwszpcj",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624641": [
        {
            "ioc_value": "h7.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 06:02:18",
            "last_seen_utc": "2025-10-22 06:02:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624217": [
        {
            "ioc_value": "owa.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:49:07",
            "last_seen_utc": "2025-10-21 16:03:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+owa.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1624215": [
        {
            "ioc_value": "bcfremote.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:49:06",
            "last_seen_utc": "2025-10-21 16:03:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+bcfremote.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1624216": [
        {
            "ioc_value": "vpn.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:49:06",
            "last_seen_utc": "2025-10-21 16:03:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+vpn.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1624190": [
        {
            "ioc_value": "charityjs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-22 05:49:01",
            "last_seen_utc": "2025-10-22 05:26:12",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115412577502371476",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1624185": [
        {
            "ioc_value": "archive.orlandoluxuryproperties.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-22 05:48:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1624267": [
        {
            "ioc_value": "hs-analytics.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-22 05:48:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,NetSupport",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1624268": [
        {
            "ioc_value": "static-hotjar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-22 05:48:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,NetSupport",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1624269": [
        {
            "ioc_value": "mawp.us",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-22 05:48:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,NetSupport",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1624270": [
        {
            "ioc_value": "utahlvs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-22 05:48:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,NetSupport",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1624271": [
        {
            "ioc_value": "hollywoodquarterly.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-22 05:48:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,NetSupport",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1624336": [
        {
            "ioc_value": "api.securebootupdatesystem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-22 05:48:52",
            "last_seen_utc": "2025-10-22 04:03:17",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.93.243+api.securebootupdatesystem.com",
            "tags": "AS13335,C2,censys,CLOUDFLARENET",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1624639": [
        {
            "ioc_value": "l8k.zm6392.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 05:48:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624638": [
        {
            "ioc_value": "pv.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 05:47:24",
            "last_seen_utc": "2025-10-22 05:48:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624637": [
        {
            "ioc_value": "a1.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 05:37:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624636": [
        {
            "ioc_value": "carprlce.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:29:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "CAPI",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624633": [
        {
            "ioc_value": "logixbrands.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:29:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624634": [
        {
            "ioc_value": "wisvetsmuseum.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:29:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624635": [
        {
            "ioc_value": "grossepointechamber.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:29:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624630": [
        {
            "ioc_value": "greatoldbroads.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:28:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624631": [
        {
            "ioc_value": "muld.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:28:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624632": [
        {
            "ioc_value": "batemanallenfuneralhome.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:28:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624629": [
        {
            "ioc_value": "s3.zm6392.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 05:28:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624628": [
        {
            "ioc_value": "pan.tenire.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:28:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Operation Silk Lure",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624627": [
        {
            "ioc_value": "zt.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 05:27:20",
            "last_seen_utc": "2025-10-22 05:28:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624626": [
        {
            "ioc_value": "git.zionministry.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-22 05:26:59",
            "last_seen_utc": "2025-11-20 23:03:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624624": [
        {
            "ioc_value": "botnet.smmpower.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-22 05:25:34",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624616": [
        {
            "ioc_value": "n3.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 05:18:03",
            "last_seen_utc": "2025-10-22 05:19:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624615": [
        {
            "ioc_value": "y2.lb3091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 05:13:40",
            "last_seen_utc": "2025-10-22 05:19:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624614": [
        {
            "ioc_value": "e.2f8-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 05:08:16",
            "last_seen_utc": "2025-10-22 05:13:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624613": [
        {
            "ioc_value": "z9.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 04:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624612": [
        {
            "ioc_value": "t04m.lb3091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 04:53:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624611": [
        {
            "ioc_value": "m2.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 04:47:41",
            "last_seen_utc": "2025-10-22 04:53:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624610": [
        {
            "ioc_value": "x.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 04:37:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624609": [
        {
            "ioc_value": "b.lb3091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 04:28:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624608": [
        {
            "ioc_value": "pl.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 04:27:31",
            "last_seen_utc": "2025-10-22 04:28:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624607": [
        {
            "ioc_value": "v9x2.lb3091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 04:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624606": [
        {
            "ioc_value": "h3.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 04:17:17",
            "last_seen_utc": "2025-10-22 04:19:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624605": [
        {
            "ioc_value": "s.3x6-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 04:07:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624579": [
        {
            "ioc_value": "h1z.lb3091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 03:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624578": [
        {
            "ioc_value": "x8.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 03:58:11",
            "last_seen_utc": "2025-10-22 03:58:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624577": [
        {
            "ioc_value": "h9.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 03:47:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624576": [
        {
            "ioc_value": "tq.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 03:39:09",
            "last_seen_utc": "2025-10-22 03:40:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624575": [
        {
            "ioc_value": "q5.lb3091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 03:36:48",
            "last_seen_utc": "2025-10-22 03:40:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624574": [
        {
            "ioc_value": "z1.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 03:27:48",
            "last_seen_utc": "2025-10-22 03:36:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624573": [
        {
            "ioc_value": "bd.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 03:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624572": [
        {
            "ioc_value": "q4.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 03:10:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624571": [
        {
            "ioc_value": "k9r.8d9691.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 03:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624570": [
        {
            "ioc_value": "g.9b9-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 02:57:49",
            "last_seen_utc": "2025-10-22 03:10:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624569": [
        {
            "ioc_value": "u0b.8d9691.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 02:52:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624567": [
        {
            "ioc_value": "p9.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 02:47:32",
            "last_seen_utc": "2025-10-22 02:52:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624566": [
        {
            "ioc_value": "h7.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 02:41:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624565": [
        {
            "ioc_value": "m7y1.8d9691.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 02:37:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624564": [
        {
            "ioc_value": "x.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 02:28:05",
            "last_seen_utc": "2025-10-22 02:37:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624563": [
        {
            "ioc_value": "t1.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 02:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624562": [
        {
            "ioc_value": "zc.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 02:07:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624561": [
        {
            "ioc_value": "n3.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 01:57:41",
            "last_seen_utc": "2025-10-22 02:07:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624560": [
        {
            "ioc_value": "p.8d9691.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 01:54:17",
            "last_seen_utc": "2025-10-22 02:07:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624559": [
        {
            "ioc_value": "a.1vd-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 01:47:54",
            "last_seen_utc": "2025-10-22 01:54:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624558": [
        {
            "ioc_value": "a3zq.8d9691.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 01:39:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624557": [
        {
            "ioc_value": "q1.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 01:37:44",
            "last_seen_utc": "2025-10-22 01:39:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624556": [
        {
            "ioc_value": "b1.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 01:23:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624555": [
        {
            "ioc_value": "f6.8d9691.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 01:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624554": [
        {
            "ioc_value": "r7.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 01:18:36",
            "last_seen_utc": "2025-10-22 01:19:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624553": [
        {
            "ioc_value": "x.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 01:07:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624552": [
        {
            "ioc_value": "vk.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 00:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624551": [
        {
            "ioc_value": "m8.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 00:48:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624550": [
        {
            "ioc_value": "s.0vs-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 00:37:55",
            "last_seen_utc": "2025-10-22 00:43:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624549": [
        {
            "ioc_value": "rz3.5m9081.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 00:34:03",
            "last_seen_utc": "2025-10-22 00:43:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624548": [
        {
            "ioc_value": "w1.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 00:28:38",
            "last_seen_utc": "2025-10-22 00:34:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624547": [
        {
            "ioc_value": "h3.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 00:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624546": [
        {
            "ioc_value": "q9.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-22 00:07:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624543": [
        {
            "ioc_value": "x7.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 23:57:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624542": [
        {
            "ioc_value": "g0x8.5m9081.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 23:52:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624361": [
        {
            "ioc_value": "pt.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 23:47:23",
            "last_seen_utc": "2025-10-21 23:52:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624360": [
        {
            "ioc_value": "z1.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 23:38:06",
            "last_seen_utc": "2025-10-21 23:43:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624359": [
        {
            "ioc_value": "w4.5m9081.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 23:35:15",
            "last_seen_utc": "2025-10-21 23:43:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624358": [
        {
            "ioc_value": "4.9wb-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 23:28:21",
            "last_seen_utc": "2025-10-21 23:35:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624357": [
        {
            "ioc_value": "t5.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 23:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624356": [
        {
            "ioc_value": "t1va.5m9081.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 23:14:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624355": [
        {
            "ioc_value": "x1.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 23:07:47",
            "last_seen_utc": "2025-10-21 23:14:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624352": [
        {
            "ioc_value": "z9.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 22:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624351": [
        {
            "ioc_value": "m0.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 22:47:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624350": [
        {
            "ioc_value": "a4.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 22:37:43",
            "last_seen_utc": "2025-10-21 22:42:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624349": [
        {
            "ioc_value": "c7p.5m9081.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 22:32:55",
            "last_seen_utc": "2025-10-21 22:42:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624348": [
        {
            "ioc_value": "83.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 22:28:26",
            "last_seen_utc": "2025-10-21 22:32:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624347": [
        {
            "ioc_value": "n9.5m9081.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 22:28:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624346": [
        {
            "ioc_value": "2.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 22:18:39",
            "last_seen_utc": "2025-10-21 22:28:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624345": [
        {
            "ioc_value": "y.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 22:06:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624334": [
        {
            "ioc_value": "44.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 21:58:11",
            "last_seen_utc": "2025-10-21 22:03:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624333": [
        {
            "ioc_value": "j.5h4553.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 21:50:57",
            "last_seen_utc": "2025-10-21 22:03:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624332": [
        {
            "ioc_value": "g9.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 21:45:14",
            "last_seen_utc": "2025-10-21 21:50:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624331": [
        {
            "ioc_value": "xb0n.5h4553.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 21:38:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624330": [
        {
            "ioc_value": "x7.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 21:38:00",
            "last_seen_utc": "2025-10-21 21:40:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624329": [
        {
            "ioc_value": "5n.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 21:30:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624328": [
        {
            "ioc_value": "8.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 21:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624327": [
        {
            "ioc_value": "q2.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 21:07:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624326": [
        {
            "ioc_value": "1k.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 20:57:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624325": [
        {
            "ioc_value": "d5.5h4553.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 20:54:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624322": [
        {
            "ioc_value": "0a.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 20:47:10",
            "last_seen_utc": "2025-10-21 20:54:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624321": [
        {
            "ioc_value": "c7.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 20:37:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624320": [
        {
            "ioc_value": "h4.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 20:28:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624319": [
        {
            "ioc_value": "qz1a.5h4553.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 20:24:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624318": [
        {
            "ioc_value": "90.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 20:17:51",
            "last_seen_utc": "2025-10-21 20:24:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624316": [
        {
            "ioc_value": "ip-5-199-166-102.003.ptr.cherryservers.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-10-21 20:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/5.199.166.102+ip-5-199-166-102.003.ptr.cherryservers.net",
            "tags": "AS216444,C2,censys,CHERRYSERVERS4-AS,odyssey,panel,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624314": [
        {
            "ioc_value": "3.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 20:08:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624311": [
        {
            "ioc_value": "login.cdn.tripleclickads.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 20:03:15",
            "last_seen_utc": "2025-10-21 22:00:52",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/54.82.10.70+login.cdn.tripleclickads.com",
            "tags": "AMAZON-AES,AS14618,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624296": [
        {
            "ioc_value": "z8.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624294": [
        {
            "ioc_value": "k2.5h4553.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:54:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624293": [
        {
            "ioc_value": "05.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:47:49",
            "last_seen_utc": "2025-10-21 19:54:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624292": [
        {
            "ioc_value": "h2k.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:37:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624291": [
        {
            "ioc_value": "b.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:34:28",
            "last_seen_utc": "2025-10-21 19:37:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624290": [
        {
            "ioc_value": "84.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624289": [
        {
            "ioc_value": "p9y3.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624288": [
        {
            "ioc_value": "k9.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:17:24",
            "last_seen_utc": "2025-10-21 19:20:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624287": [
        {
            "ioc_value": "22.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:10:07",
            "last_seen_utc": "2025-10-21 19:11:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624286": [
        {
            "ioc_value": "x.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 19:05:17",
            "last_seen_utc": "2025-10-21 19:11:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624285": [
        {
            "ioc_value": "7.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 18:58:21",
            "last_seen_utc": "2025-10-21 19:05:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624283": [
        {
            "ioc_value": "b0t.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 18:48:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624280": [
        {
            "ioc_value": "99.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 18:46:52",
            "last_seen_utc": "2025-10-21 18:48:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624277": [
        {
            "ioc_value": "qm4z.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 18:38:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624276": [
        {
            "ioc_value": "3a.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 18:37:51",
            "last_seen_utc": "2025-10-21 18:38:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624275": [
        {
            "ioc_value": "x.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 18:21:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624273": [
        {
            "ioc_value": "w7.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 18:12:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624272": [
        {
            "ioc_value": "08.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 18:08:38",
            "last_seen_utc": "2025-10-21 18:12:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624264": [
        {
            "ioc_value": "22312mandayyyyyreymcuxe.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-21 18:02:04",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251021-t7s87swpfm",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624263": [
        {
            "ioc_value": "w2.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 17:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624262": [
        {
            "ioc_value": "71.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 17:48:33",
            "last_seen_utc": "2025-10-21 17:49:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624261": [
        {
            "ioc_value": "9s.qcet8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 17:42:54",
            "last_seen_utc": "2025-10-21 17:49:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624259": [
        {
            "ioc_value": "4.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 17:38:15",
            "last_seen_utc": "2025-10-21 17:42:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624258": [
        {
            "ioc_value": "ry.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 17:26:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624256": [
        {
            "ioc_value": "n2.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 17:16:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624251": [
        {
            "ioc_value": "api.filtergoyrdo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-21 17:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1798831/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624252": [
        {
            "ioc_value": "api.goolagstalinmore.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-21 17:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1798831/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624253": [
        {
            "ioc_value": "api.shimoneaprel.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-21 17:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1798831/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624254": [
        {
            "ioc_value": "api.managerfjo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-21 17:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1798831/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624250": [
        {
            "ioc_value": "api.khljokas.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-21 17:12:35",
            "last_seen_utc": "2025-10-21 17:13:58",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1798831/0/iochtml",
            "tags": "c2,domain,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624246": [
        {
            "ioc_value": "1w.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 17:07:43",
            "last_seen_utc": "2025-10-21 17:11:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624241": [
        {
            "ioc_value": "holyrms.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-21 17:04:23",
            "last_seen_utc": "2025-10-23 20:50:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624242": [
        {
            "ioc_value": "gallgqu.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-21 17:04:23",
            "last_seen_utc": "2025-10-23 20:50:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624243": [
        {
            "ioc_value": "gjellyb.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-21 17:04:23",
            "last_seen_utc": "2025-10-23 20:50:08",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624244": [
        {
            "ioc_value": "pabuloa.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-21 17:04:23",
            "last_seen_utc": "2025-11-18 08:45:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624240": [
        {
            "ioc_value": "j5.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 16:57:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624239": [
        {
            "ioc_value": "zdj.qcet8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 16:48:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624238": [
        {
            "ioc_value": "5t.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 16:47:35",
            "last_seen_utc": "2025-10-21 16:48:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624236": [
        {
            "ioc_value": "81.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 16:38:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624235": [
        {
            "ioc_value": "3l.s61y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 16:28:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624234": [
        {
            "ioc_value": "g7.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 16:16:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624233": [
        {
            "ioc_value": "uf8.qcet8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 16:12:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624229": [
        {
            "ioc_value": "sip.nadimgadget.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-21 16:11:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624230": [
        {
            "ioc_value": "sip.khabeir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-21 16:11:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624226": [
        {
            "ioc_value": "84.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 16:08:19",
            "last_seen_utc": "2025-10-21 16:12:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624209": [
        {
            "ioc_value": "55.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 15:58:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624208": [
        {
            "ioc_value": "64.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 15:48:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624207": [
        {
            "ioc_value": "p6v3.1397u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 15:36:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624206": [
        {
            "ioc_value": "01.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 15:33:52",
            "last_seen_utc": "2025-10-21 15:36:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624205": [
        {
            "ioc_value": "12.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 15:28:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624204": [
        {
            "ioc_value": "77.d55u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 15:17:44",
            "last_seen_utc": "2025-10-21 15:24:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624203": [
        {
            "ioc_value": "h4n0.1397u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 15:10:57",
            "last_seen_utc": "2025-10-21 15:24:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624202": [
        {
            "ioc_value": "04.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 15:07:27",
            "last_seen_utc": "2025-10-21 15:10:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624201": [
        {
            "ioc_value": "d5r.qcet8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624200": [
        {
            "ioc_value": "32.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:57:40",
            "last_seen_utc": "2025-10-21 14:59:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624199": [
        {
            "ioc_value": "08.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:47:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624198": [
        {
            "ioc_value": "xdv.qcet8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:44:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624197": [
        {
            "ioc_value": "76.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:38:02",
            "last_seen_utc": "2025-10-21 14:44:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624196": [
        {
            "ioc_value": "10.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:28:16",
            "last_seen_utc": "2025-10-21 14:29:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624195": [
        {
            "ioc_value": "shineO.sys7yn0iy5.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:25:07",
            "last_seen_utc": "2025-10-21 14:29:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624194": [
        {
            "ioc_value": "93.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:17:56",
            "last_seen_utc": "2025-10-21 14:25:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624188": [
        {
            "ioc_value": "41.k59ee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:09:11",
            "last_seen_utc": "2025-10-21 14:14:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624187": [
        {
            "ioc_value": "softS.sys7yn0iy5.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 14:06:01",
            "last_seen_utc": "2025-10-21 14:14:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624186": [
        {
            "ioc_value": "89.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:58:21",
            "last_seen_utc": "2025-10-21 14:06:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624184": [
        {
            "ioc_value": "uk.1397u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:54:26",
            "last_seen_utc": "2025-10-21 14:05:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624183": [
        {
            "ioc_value": "gr0w.sys7yn0iy5.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:50:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624182": [
        {
            "ioc_value": "a9.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:48:53",
            "last_seen_utc": "2025-10-21 13:54:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624181": [
        {
            "ioc_value": "us.1397u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:35:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624180": [
        {
            "ioc_value": "30.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:32:55",
            "last_seen_utc": "2025-10-21 13:41:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624179": [
        {
            "ioc_value": "r1se.sys7yn0iy5.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:30:29",
            "last_seen_utc": "2025-10-21 13:41:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624178": [
        {
            "ioc_value": "27.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:28:42",
            "last_seen_utc": "2025-10-21 13:30:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624177": [
        {
            "ioc_value": "s0lar.sys7yn0iy5.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:22:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624025": [
        {
            "ioc_value": "www.4kdownload-en.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:52",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624026": [
        {
            "ioc_value": "4kdownloade.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:52",
            "last_seen_utc": "2025-11-20 20:11:25",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624027": [
        {
            "ioc_value": "ninjaone.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:51",
            "last_seen_utc": "2025-10-21 07:27:33",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624028": [
        {
            "ioc_value": "metatreadar5.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:50",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624029": [
        {
            "ioc_value": "is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:50",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624030": [
        {
            "ioc_value": "app-microsoft.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:50",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624031": [
        {
            "ioc_value": "wondershars.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:49",
            "last_seen_utc": "2025-11-20 20:11:25",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624032": [
        {
            "ioc_value": "manageengines.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:49",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624035": [
        {
            "ioc_value": "manageengines.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:48",
            "last_seen_utc": "2025-11-20 20:11:25",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624033": [
        {
            "ioc_value": "www.ninjaone.pw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:47",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624034": [
        {
            "ioc_value": "manageengine.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:47",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624036": [
        {
            "ioc_value": "apps-microsoft.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:46",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624037": [
        {
            "ioc_value": "wondershared.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:46",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624038": [
        {
            "ioc_value": "wondershared.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:45",
            "last_seen_utc": "2025-11-20 20:11:25",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624039": [
        {
            "ioc_value": "adspower.pw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:45",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624040": [
        {
            "ioc_value": "4kdownloade.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:44",
            "last_seen_utc": "2025-11-20 20:11:25",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624041": [
        {
            "ioc_value": "www.apps-microsoft.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:44",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624175": [
        {
            "ioc_value": "12.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:19:44",
            "last_seen_utc": "2025-10-21 13:22:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624176": [
        {
            "ioc_value": "z.1397u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 13:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624042": [
        {
            "ioc_value": "www.is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:43",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624043": [
        {
            "ioc_value": "ferrariworldabu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:43",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624044": [
        {
            "ioc_value": "video.4kdownload.pw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:43",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624045": [
        {
            "ioc_value": "metatradeer5.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:42",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624046": [
        {
            "ioc_value": "metatrader5.tech",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:33",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624047": [
        {
            "ioc_value": "cllcktlme.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:33",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624048": [
        {
            "ioc_value": "bamboohre.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:32",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624049": [
        {
            "ioc_value": "www.in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:32",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624050": [
        {
            "ioc_value": "in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 13:19:31",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624129": [
        {
            "ioc_value": "k.gooigle.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-21 13:19:29",
            "last_seen_utc": null,
            "confidence_level": 80,
            "reference": null,
            "tags": "FAKEUPDATES",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1624162": [
        {
            "ioc_value": "dezhoni.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 13:19:27",
            "last_seen_utc": "2025-10-27 15:16:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,REMPROXY",
            "anonymous": "0",
            "reporter": "BlackLotusLabs"
        }
    ],
    "1624174": [
        {
            "ioc_value": "1.1397u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 12:37:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624173": [
        {
            "ioc_value": "mo0n.sys7yn0iy5.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 12:35:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624161": [
        {
            "ioc_value": "60012.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 12:08:02",
            "last_seen_utc": "2025-10-21 12:37:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624156": [
        {
            "ioc_value": "nsfcoatings.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-21 12:02:03",
            "last_seen_utc": "2025-11-07 12:55:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/251021-ls75tavqb1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1624155": [
        {
            "ioc_value": "rOse2.tuful32io3.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 12:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624151": [
        {
            "ioc_value": "pt.t.nadimgadget.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-21 11:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624152": [
        {
            "ioc_value": "pt.t.khabeir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-21 11:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624148": [
        {
            "ioc_value": "2215.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:57:42",
            "last_seen_utc": "2025-10-21 12:00:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624147": [
        {
            "ioc_value": "dream5.tuful32io3.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:48:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624146": [
        {
            "ioc_value": "740.c70ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:47:53",
            "last_seen_utc": "2025-10-21 11:48:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624145": [
        {
            "ioc_value": "stI11.tuful32io3.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:39:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624144": [
        {
            "ioc_value": "06342.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:38:37",
            "last_seen_utc": "2025-10-21 11:39:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624143": [
        {
            "ioc_value": "sk1es.tuful32io3.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:31:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624142": [
        {
            "ioc_value": "719.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:28:50",
            "last_seen_utc": "2025-10-21 11:31:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624130": [
        {
            "ioc_value": "flame4.tuful32io3.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624128": [
        {
            "ioc_value": "3499013.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:18:20",
            "last_seen_utc": "2025-10-21 11:20:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624127": [
        {
            "ioc_value": "55728.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:08:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624126": [
        {
            "ioc_value": "120984.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 11:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624124": [
        {
            "ioc_value": "9031.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 10:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624121": [
        {
            "ioc_value": "b7lx.6362o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 10:41:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624120": [
        {
            "ioc_value": "482.r46eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 10:40:27",
            "last_seen_utc": "2025-10-21 10:41:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624119": [
        {
            "ioc_value": "office-winemagbk.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-21 10:29:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624118": [
        {
            "ioc_value": "office-winemag.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-21 10:29:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624117": [
        {
            "ioc_value": "ultrauraniummirai.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-21 10:29:05",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624116": [
        {
            "ioc_value": "us.bootcdncache.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-21 10:28:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624112": [
        {
            "ioc_value": "development-tour.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-21 10:28:07",
            "last_seen_utc": "2025-10-22 12:44:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1624103": [
        {
            "ioc_value": "drift.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 09:58:37",
            "last_seen_utc": "2025-10-21 10:02:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624102": [
        {
            "ioc_value": "w9r2.6362o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 09:51:39",
            "last_seen_utc": "2025-10-21 10:02:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624101": [
        {
            "ioc_value": "deb1t.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 09:48:19",
            "last_seen_utc": "2025-10-21 09:51:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624100": [
        {
            "ioc_value": "above55.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 09:30:19",
            "last_seen_utc": "2025-10-21 09:33:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624099": [
        {
            "ioc_value": "drain5.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 09:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624098": [
        {
            "ioc_value": "3mta.6362o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 09:20:20",
            "last_seen_utc": "2025-10-21 09:33:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624097": [
        {
            "ioc_value": "al1ve.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 09:17:52",
            "last_seen_utc": "2025-10-21 09:20:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624096": [
        {
            "ioc_value": "brand.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 09:10:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624094": [
        {
            "ioc_value": "am.d.nadimgadget.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-21 09:01:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624095": [
        {
            "ioc_value": "am.d.khabeir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-21 09:01:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624090": [
        {
            "ioc_value": "yk8q.6362o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:54:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624089": [
        {
            "ioc_value": "fiber.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:51:34",
            "last_seen_utc": "2025-10-21 08:54:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624087": [
        {
            "ioc_value": "clean.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:49:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624084": [
        {
            "ioc_value": "greet4.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:38:08",
            "last_seen_utc": "2025-10-21 08:41:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624083": [
        {
            "ioc_value": "c2d1.6362o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:30:44",
            "last_seen_utc": "2025-10-21 08:41:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624082": [
        {
            "ioc_value": "brlef33.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:28:22",
            "last_seen_utc": "2025-10-21 08:30:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624081": [
        {
            "ioc_value": "death.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:18:03",
            "last_seen_utc": "2025-10-21 08:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624080": [
        {
            "ioc_value": "f9m0.7i091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:11:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624079": [
        {
            "ioc_value": "me9x.9z2503.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:11:11",
            "last_seen_utc": "2025-10-21 08:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624078": [
        {
            "ioc_value": "fresh.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 08:07:47",
            "last_seen_utc": "2025-10-21 08:11:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624059": [
        {
            "ioc_value": "fla5h.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 07:58:01",
            "last_seen_utc": "2025-10-21 08:02:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624058": [
        {
            "ioc_value": "r4h8.9z2503.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 07:51:21",
            "last_seen_utc": "2025-10-21 08:02:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624057": [
        {
            "ioc_value": "keeniy8.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 07:47:44",
            "last_seen_utc": "2025-10-21 07:51:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624055": [
        {
            "ioc_value": "sd.e.airproservices.vu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-21 07:42:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624053": [
        {
            "ioc_value": "angry.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 07:37:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624052": [
        {
            "ioc_value": "1gzu.9z2503.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 07:33:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624051": [
        {
            "ioc_value": "lover.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 07:27:40",
            "last_seen_utc": "2025-10-21 07:33:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624021": [
        {
            "ioc_value": "nv.d.nadimgadget.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-21 07:22:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624022": [
        {
            "ioc_value": "nv.d.khabeir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-21 07:22:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1624018": [
        {
            "ioc_value": "kitty58.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 07:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624017": [
        {
            "ioc_value": "fa1se4.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 07:07:05",
            "last_seen_utc": "2025-10-21 07:11:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624016": [
        {
            "ioc_value": "g7k.7i091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 07:06:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624015": [
        {
            "ioc_value": "issue.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 06:53:13",
            "last_seen_utc": "2025-10-21 07:06:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624013": [
        {
            "ioc_value": "vj3c.9z2503.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 06:34:25",
            "last_seen_utc": "2025-10-21 06:54:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1624012": [
        {
            "ioc_value": "flour.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 06:24:31",
            "last_seen_utc": "2025-10-21 06:34:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1624005": [
        {
            "ioc_value": "swmgcamgigkoeoym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624006": [
        {
            "ioc_value": "swwywwymysoosecy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624007": [
        {
            "ioc_value": "ugyskuqgsecogmws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624008": [
        {
            "ioc_value": "ouuskcgsqcsqeaea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624009": [
        {
            "ioc_value": "kaygkkqaaomigeag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624010": [
        {
            "ioc_value": "ockieeauuccikoom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624011": [
        {
            "ioc_value": "aagkumoeiiuwgcmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623979": [
        {
            "ioc_value": "ywuyikoycygyekoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623980": [
        {
            "ioc_value": "wyawycgcgawuuggu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623981": [
        {
            "ioc_value": "amimoaukyccwiiuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623982": [
        {
            "ioc_value": "uaiekqwwkwmmcmcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623983": [
        {
            "ioc_value": "qmkccyaywogycika.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623984": [
        {
            "ioc_value": "kaueecsoycuwyeym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623985": [
        {
            "ioc_value": "scoquuogswecawyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623986": [
        {
            "ioc_value": "kuuiauyuaqskoikc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623987": [
        {
            "ioc_value": "ywyowqusaouwakaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623988": [
        {
            "ioc_value": "asgkogguuwqeswae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623989": [
        {
            "ioc_value": "amcoaamuokkuaiim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623990": [
        {
            "ioc_value": "yiegcaqscmimaqmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623991": [
        {
            "ioc_value": "wkicsyekaiqgsike.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623992": [
        {
            "ioc_value": "wkqyycemwyowmemu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623993": [
        {
            "ioc_value": "ycoumekgecwceaki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623994": [
        {
            "ioc_value": "gmwuocamqskikssi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623995": [
        {
            "ioc_value": "gmaumugqiqeyscek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623996": [
        {
            "ioc_value": "oiossggsomokycwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623997": [
        {
            "ioc_value": "euaokciwiscoggms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623998": [
        {
            "ioc_value": "ammksqmawiuigiak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623999": [
        {
            "ioc_value": "ckwywiaymkoycawu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624000": [
        {
            "ioc_value": "gseaucaogwegkgma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624001": [
        {
            "ioc_value": "kmecagoqocgwmcgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624002": [
        {
            "ioc_value": "sksmasusomqsuaks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624003": [
        {
            "ioc_value": "ywcmusqkqsecswuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1624004": [
        {
            "ioc_value": "wkgsmwgmuewmiues.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623955": [
        {
            "ioc_value": "qgyuguiocoogoaqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623956": [
        {
            "ioc_value": "scksmumaeygeycws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623957": [
        {
            "ioc_value": "yiqoqwgwquwkwkec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623958": [
        {
            "ioc_value": "swewcuiwioykeocc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623959": [
        {
            "ioc_value": "qycmggosiqsyqeei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623960": [
        {
            "ioc_value": "asamccekqygyaiac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623961": [
        {
            "ioc_value": "kaoasgikuakmyqmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623962": [
        {
            "ioc_value": "cewkckyqqamqimwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623963": [
        {
            "ioc_value": "eicgmakuucoymmuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623964": [
        {
            "ioc_value": "gsiamqakyuqekkeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623965": [
        {
            "ioc_value": "cqemuwiaaksyooco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623966": [
        {
            "ioc_value": "eusgiosuyequgmee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623967": [
        {
            "ioc_value": "ycemcyyqeaeuwmes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623968": [
        {
            "ioc_value": "ckuuwcmwememeyqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623969": [
        {
            "ioc_value": "eaggoyewkgyqssoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623970": [
        {
            "ioc_value": "eiwcqycgkkkoewwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623971": [
        {
            "ioc_value": "qgqkcumqquwmkyma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623972": [
        {
            "ioc_value": "asyiwwscsmmyayoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623973": [
        {
            "ioc_value": "cquumuisyegsocaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623974": [
        {
            "ioc_value": "amgeysakqwqyaqqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623975": [
        {
            "ioc_value": "eacessagkeyuyoue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623976": [
        {
            "ioc_value": "ugywwcuakiqkuays.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623977": [
        {
            "ioc_value": "qmggcmmokqkksqea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623978": [
        {
            "ioc_value": "wsyiwwiaqekewgmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623934": [
        {
            "ioc_value": "mkcuaaeqoiuiucca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623935": [
        {
            "ioc_value": "gsqycegygmwyiugu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623936": [
        {
            "ioc_value": "eoymuqqyimccymka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623937": [
        {
            "ioc_value": "geuciqogsqckemgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623938": [
        {
            "ioc_value": "gmemosewuagoeyga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623939": [
        {
            "ioc_value": "iquugaoqcysqmugm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623940": [
        {
            "ioc_value": "geeaoqiciggsiseq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623941": [
        {
            "ioc_value": "amuoywcqegayoeoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623942": [
        {
            "ioc_value": "euuiysseumcagmoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623943": [
        {
            "ioc_value": "kmmaoogiwcaqmisk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623944": [
        {
            "ioc_value": "ouikysisiuukcegi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623945": [
        {
            "ioc_value": "uuywqoweeyseeoow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623946": [
        {
            "ioc_value": "aakimguyswswaukw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623947": [
        {
            "ioc_value": "ywkcwowoioysmaka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623948": [
        {
            "ioc_value": "iwqsaaikmesokssa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623949": [
        {
            "ioc_value": "mkyewmwisgmsyucm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623950": [
        {
            "ioc_value": "icyywkmoouusqqmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623951": [
        {
            "ioc_value": "ycgcaaciwyksmwka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623952": [
        {
            "ioc_value": "kagmeyowkoikmywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623953": [
        {
            "ioc_value": "qywskgkggagcecis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623954": [
        {
            "ioc_value": "gmssuqkamcowccmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623912": [
        {
            "ioc_value": "gekqeckucieuuyku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623913": [
        {
            "ioc_value": "sqiiamieemsaeqes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623914": [
        {
            "ioc_value": "eikicwsouokqemyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623915": [
        {
            "ioc_value": "eiuiwueymwwykwuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623916": [
        {
            "ioc_value": "iwegacwgoockcuio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623917": [
        {
            "ioc_value": "uasymysgswcuysoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623918": [
        {
            "ioc_value": "uaueeayyciwquugw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623919": [
        {
            "ioc_value": "kauyuyagowykwmci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623920": [
        {
            "ioc_value": "sqegqcokmssmokyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623921": [
        {
            "ioc_value": "qygiswmeiimywuuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623922": [
        {
            "ioc_value": "ocogkwkcsoiuwkyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623923": [
        {
            "ioc_value": "gmyauomowwueaqgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623924": [
        {
            "ioc_value": "ousgwwwuusuuuwuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623925": [
        {
            "ioc_value": "gyqecaggymcamyuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623926": [
        {
            "ioc_value": "mkeaccaemmgeymew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623927": [
        {
            "ioc_value": "mqqmywcwcskumauo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623928": [
        {
            "ioc_value": "yommmmoswykocoqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623929": [
        {
            "ioc_value": "wyimeyuiqauemkyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623930": [
        {
            "ioc_value": "ocgqussywgiqsmcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623931": [
        {
            "ioc_value": "skcquagsucykaksy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623932": [
        {
            "ioc_value": "sqmogycykwmooask.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623933": [
        {
            "ioc_value": "cqwqiokiwquoemcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623893": [
        {
            "ioc_value": "yieogqimmuisiemo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623894": [
        {
            "ioc_value": "amokukwqcqcyagsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623895": [
        {
            "ioc_value": "yogsuuiqceuoeaia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623896": [
        {
            "ioc_value": "ugqskmcqaikeqyys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623897": [
        {
            "ioc_value": "uuauyicwscygsaym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623898": [
        {
            "ioc_value": "kuacyyswccgumwsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623899": [
        {
            "ioc_value": "aauakomkyskwguic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623900": [
        {
            "ioc_value": "mesociiyeyiewiwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623901": [
        {
            "ioc_value": "yiaskaiskigyugym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623902": [
        {
            "ioc_value": "yiwmgckmgkeqqscm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623903": [
        {
            "ioc_value": "uusyqkmeasawwoig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623904": [
        {
            "ioc_value": "sqqeekuoiysmuyse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623905": [
        {
            "ioc_value": "asyyymkiqikwoqim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623906": [
        {
            "ioc_value": "kumcekgsqaqaqqgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623907": [
        {
            "ioc_value": "ywkcswoyqiseqeqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623908": [
        {
            "ioc_value": "aseowmieoeuyceaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623909": [
        {
            "ioc_value": "euoeesekwcaiegoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623910": [
        {
            "ioc_value": "qsaykscswquqskag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623911": [
        {
            "ioc_value": "gekmioeaseigmcoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623871": [
        {
            "ioc_value": "meiswkcsyasiiyco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623872": [
        {
            "ioc_value": "gswqqguamsikeawe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623873": [
        {
            "ioc_value": "wkwuemsuweckimms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623874": [
        {
            "ioc_value": "eiugwgicwoaoeekg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623875": [
        {
            "ioc_value": "wsaymkmeoqkweqom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623876": [
        {
            "ioc_value": "cwiacaoimsyeqaog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623877": [
        {
            "ioc_value": "uamakekeaywqekgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623878": [
        {
            "ioc_value": "ooekayaacssukiua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623879": [
        {
            "ioc_value": "ugqgkugimuecauwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623880": [
        {
            "ioc_value": "ouckwugumkuywyuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623881": [
        {
            "ioc_value": "ckqeymmcckqcmkge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623882": [
        {
            "ioc_value": "ceeuaeusouywueoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623883": [
        {
            "ioc_value": "kuoswqosgsygwgyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623884": [
        {
            "ioc_value": "wyqoigwsysyguymq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623885": [
        {
            "ioc_value": "kgoywwoecuuuesss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623886": [
        {
            "ioc_value": "amuqaagqgucwqawu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623887": [
        {
            "ioc_value": "iwwekcmkukkcqugg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623888": [
        {
            "ioc_value": "iwcwguweoqciuios.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623889": [
        {
            "ioc_value": "wkoouwucmogmymmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623890": [
        {
            "ioc_value": "ceciiwkcomkuwmsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623891": [
        {
            "ioc_value": "ocouuisyeywqgoii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623892": [
        {
            "ioc_value": "cwcgsgeuuqueoiue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623848": [
        {
            "ioc_value": "wkumoqggwumacocg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623849": [
        {
            "ioc_value": "wysuwyukekuekkoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623850": [
        {
            "ioc_value": "eiqqekccamcaacea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623851": [
        {
            "ioc_value": "gmcyyyuacccgoyoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623852": [
        {
            "ioc_value": "ycagqsysaimeucmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623853": [
        {
            "ioc_value": "eusmqcgoycueqceo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623854": [
        {
            "ioc_value": "iciyesoumayeqmca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623855": [
        {
            "ioc_value": "iwyumwamkamkygsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623856": [
        {
            "ioc_value": "gsiauogciekwcumq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623857": [
        {
            "ioc_value": "ouessuiamsmyiaeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623858": [
        {
            "ioc_value": "gmyceuoawemqeaog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623859": [
        {
            "ioc_value": "aaguiaoegcugwycm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623860": [
        {
            "ioc_value": "scwwokqksssasqau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623861": [
        {
            "ioc_value": "swsiueyimeyieuas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623862": [
        {
            "ioc_value": "cqyemuequosaoeoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623863": [
        {
            "ioc_value": "cwsikwcyikaoyyew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623864": [
        {
            "ioc_value": "kmgucwqacuamieoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623865": [
        {
            "ioc_value": "gsigykwceqgcyqeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623866": [
        {
            "ioc_value": "skiisgwsuegicesc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623867": [
        {
            "ioc_value": "qgumaymeqcgamoqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623868": [
        {
            "ioc_value": "ycyyggkueyiigsau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623869": [
        {
            "ioc_value": "sweyikswmwssiiyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623870": [
        {
            "ioc_value": "kgkequuwciqcwyga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623827": [
        {
            "ioc_value": "iqkycwgigqmuiagw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623828": [
        {
            "ioc_value": "scgaoiaouigscmgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623829": [
        {
            "ioc_value": "uaoseciimsqaukae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623830": [
        {
            "ioc_value": "amwkmegkqkwsosys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623831": [
        {
            "ioc_value": "ugmisuusguiuqogs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623832": [
        {
            "ioc_value": "ugemyeykskqskygk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623833": [
        {
            "ioc_value": "iwgakqyesuewcqcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623834": [
        {
            "ioc_value": "aaeskoiogyuoiiys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623835": [
        {
            "ioc_value": "aakmagcessyikmsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623836": [
        {
            "ioc_value": "iwgcemyaiwokgguw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623837": [
        {
            "ioc_value": "oooaacyqwkeqsyge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623838": [
        {
            "ioc_value": "icaocoomwsewakec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623839": [
        {
            "ioc_value": "wyqqwokkciqysoes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623840": [
        {
            "ioc_value": "oiuqogmeismuygem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623841": [
        {
            "ioc_value": "ouaomegeqccoqcmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623842": [
        {
            "ioc_value": "eiwqsecgysmsumww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623843": [
        {
            "ioc_value": "ceqgkakksuqissss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623844": [
        {
            "ioc_value": "kmiamicwwgaamyks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623845": [
        {
            "ioc_value": "cqqcmwmqccoiusei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623846": [
        {
            "ioc_value": "wekocacgywqowiee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623847": [
        {
            "ioc_value": "scqkkawwaeiuycuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623806": [
        {
            "ioc_value": "swauwimmmissmcms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623807": [
        {
            "ioc_value": "iwgmiewcewkgkkqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623808": [
        {
            "ioc_value": "ckgqosiuuwqaqygc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623809": [
        {
            "ioc_value": "scgukyykcmyomkci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623810": [
        {
            "ioc_value": "wsieiqmcwqocyusa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623811": [
        {
            "ioc_value": "ceimmkygecccckoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623812": [
        {
            "ioc_value": "ouieaoyseyqwiiya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623813": [
        {
            "ioc_value": "wewukkwqsqyakayg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623814": [
        {
            "ioc_value": "uaqeceyckomekqog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623815": [
        {
            "ioc_value": "scsscmswgggeywyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623816": [
        {
            "ioc_value": "kmaqyicgmmmmaiuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623817": [
        {
            "ioc_value": "mekqiiisagweyoou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623818": [
        {
            "ioc_value": "wssmawikkqqauegg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623819": [
        {
            "ioc_value": "qggcqyeowiscciqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623820": [
        {
            "ioc_value": "ycaiaygqekiewgqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623821": [
        {
            "ioc_value": "oomwquaskiukqwgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623822": [
        {
            "ioc_value": "icksacmyguyywoei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623823": [
        {
            "ioc_value": "agqyccsmsqskmumm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623824": [
        {
            "ioc_value": "oisqwyieguqiueko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623825": [
        {
            "ioc_value": "sccaaeoqyugimqcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623826": [
        {
            "ioc_value": "ocuaucauimyykgqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623783": [
        {
            "ioc_value": "kmwgasiacysyossq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623784": [
        {
            "ioc_value": "geecgqqmoieoakok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623785": [
        {
            "ioc_value": "iwyomgkswswwqqoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623786": [
        {
            "ioc_value": "uookygcsymgckkam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623787": [
        {
            "ioc_value": "aacuiqmqaiqyoyys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623788": [
        {
            "ioc_value": "oiwumogkikcwsykc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623789": [
        {
            "ioc_value": "kgcoieckuccqksis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623790": [
        {
            "ioc_value": "weeagiiucyysiagk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623791": [
        {
            "ioc_value": "oiciquqaaikuismy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623792": [
        {
            "ioc_value": "oiqycewuuyiimciu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623793": [
        {
            "ioc_value": "yoauiuaukyqssgoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623794": [
        {
            "ioc_value": "ceocikqwyqgsqusu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623795": [
        {
            "ioc_value": "aayewisqiiwgcaca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623796": [
        {
            "ioc_value": "qysmqymoqkgacmok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623797": [
        {
            "ioc_value": "oowumwuwkicakmya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623798": [
        {
            "ioc_value": "kgkyeekeiuyocqas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623799": [
        {
            "ioc_value": "easkemuwwccgaiuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623800": [
        {
            "ioc_value": "asmuaogcoukimgye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623801": [
        {
            "ioc_value": "qmccmioyoicqeaie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623802": [
        {
            "ioc_value": "ywmmakciemuuamqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623803": [
        {
            "ioc_value": "kusgqkiiiausmcoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623804": [
        {
            "ioc_value": "uumggimemkkwaoae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623805": [
        {
            "ioc_value": "cqiiuiioioiwqimk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623759": [
        {
            "ioc_value": "ckwsgcqyeokqgmoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623760": [
        {
            "ioc_value": "ckuemewioukyuqgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623761": [
        {
            "ioc_value": "scsgmogsimwwsmci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623762": [
        {
            "ioc_value": "ociyykwkywcgiyyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623763": [
        {
            "ioc_value": "gmmmeqiweugkscim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623764": [
        {
            "ioc_value": "yoamwsqkqecsqiak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623765": [
        {
            "ioc_value": "wesgcoaoioyysmsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623766": [
        {
            "ioc_value": "kgcukwuaawsygeke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623767": [
        {
            "ioc_value": "eaiuqkcoseoegogc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623768": [
        {
            "ioc_value": "aswmmqikumcgcgis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623769": [
        {
            "ioc_value": "meqomgsakqugsqcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623770": [
        {
            "ioc_value": "aacwmeqkgoouwimu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623771": [
        {
            "ioc_value": "eiwkccyoaswiuowq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623772": [
        {
            "ioc_value": "qmiuuueksmgoesys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623773": [
        {
            "ioc_value": "wecusossiessimes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623774": [
        {
            "ioc_value": "euowsamwkmciamek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623775": [
        {
            "ioc_value": "qmwsgiagsuamcwui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623776": [
        {
            "ioc_value": "wyiewaoawmgqyqqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623777": [
        {
            "ioc_value": "wkcmemeeoewcmsmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623778": [
        {
            "ioc_value": "skmoaaiquceogqou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623779": [
        {
            "ioc_value": "uoomuiusqaayyiag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623780": [
        {
            "ioc_value": "qyskcswqiqwmqygg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623781": [
        {
            "ioc_value": "yiokmeaeumsouwkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623782": [
        {
            "ioc_value": "eukcqqekisosueqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623736": [
        {
            "ioc_value": "kmkaoqassqwiiqgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623737": [
        {
            "ioc_value": "wyeomeumqiqsucsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623738": [
        {
            "ioc_value": "ceioouyescacusam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623739": [
        {
            "ioc_value": "uoiwameagqsouaog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623740": [
        {
            "ioc_value": "ycucgwkgaykgegko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623741": [
        {
            "ioc_value": "qsasqkuaisouukeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623742": [
        {
            "ioc_value": "ickguksagkouasmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623743": [
        {
            "ioc_value": "ycqsumqucumqqewg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623744": [
        {
            "ioc_value": "wykesscioqssgsgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623745": [
        {
            "ioc_value": "cwkksumkecuagygk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623746": [
        {
            "ioc_value": "ywkkekkigcmcyske.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623747": [
        {
            "ioc_value": "gmooumomqkayomki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623748": [
        {
            "ioc_value": "uggwekaokcicociy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623749": [
        {
            "ioc_value": "kgauegcwuouyuyqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623750": [
        {
            "ioc_value": "weuooasoqeeiqaqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623751": [
        {
            "ioc_value": "ouayeueuaywwyemu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623752": [
        {
            "ioc_value": "eacoiemqessaeaqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623753": [
        {
            "ioc_value": "uusiywouyuwiosuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623754": [
        {
            "ioc_value": "ocaoaeyyqiugqyye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623755": [
        {
            "ioc_value": "eikaoggkgokmieao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623756": [
        {
            "ioc_value": "eosewymswesqsguy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623757": [
        {
            "ioc_value": "gymokcoqccqkgcsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623758": [
        {
            "ioc_value": "icigmaigekmmeeso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623713": [
        {
            "ioc_value": "qywgyesskoiyosse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623714": [
        {
            "ioc_value": "wsaiyywwesiaguyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623715": [
        {
            "ioc_value": "kuuugqwscqeumoki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623716": [
        {
            "ioc_value": "uguiecwmywkooqiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623717": [
        {
            "ioc_value": "euwyyqscyycuyqkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623718": [
        {
            "ioc_value": "gyuuiqmiksmsyegc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623719": [
        {
            "ioc_value": "asgmmoacqememywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623720": [
        {
            "ioc_value": "qykmiacakyeuusis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623721": [
        {
            "ioc_value": "agmmcecssugequmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623722": [
        {
            "ioc_value": "gmiamgeakwaksesq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623723": [
        {
            "ioc_value": "wsskiuymmqisiokc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623724": [
        {
            "ioc_value": "wyisaigemckkswwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623725": [
        {
            "ioc_value": "qsgwuugkswcgwoqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623726": [
        {
            "ioc_value": "oowkocoaqqaqekic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623727": [
        {
            "ioc_value": "ycyomaweoayewwwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623728": [
        {
            "ioc_value": "oiuaceawkswcweia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623729": [
        {
            "ioc_value": "ouacuwscyuuecwku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623730": [
        {
            "ioc_value": "myuwuisoqwgggoew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623731": [
        {
            "ioc_value": "mywqemyegckmscqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623732": [
        {
            "ioc_value": "asakqugqquoagcya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623733": [
        {
            "ioc_value": "kgkyckcyayegqcma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623734": [
        {
            "ioc_value": "icoqokmmyqiagoew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623735": [
        {
            "ioc_value": "scoiisokaeycsgoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623692": [
        {
            "ioc_value": "eogooiqeouoougkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623693": [
        {
            "ioc_value": "kgiikguckuggkuqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623694": [
        {
            "ioc_value": "mkauigugcaoicymm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623695": [
        {
            "ioc_value": "oiooeuioqewgeyia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623696": [
        {
            "ioc_value": "mecmwogmuqiggaik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623697": [
        {
            "ioc_value": "ouyyqsseywwuekqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623698": [
        {
            "ioc_value": "ywsggqkqmmiggaoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623699": [
        {
            "ioc_value": "ywgsucussesagikq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623700": [
        {
            "ioc_value": "ascasmmyussayysc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623701": [
        {
            "ioc_value": "cqgmmwkmcwmiwuka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623702": [
        {
            "ioc_value": "swwuaqoamkksecge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623703": [
        {
            "ioc_value": "ugsauaciiyuaomqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623704": [
        {
            "ioc_value": "wkmkqieiyucwykge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623705": [
        {
            "ioc_value": "qmickmwaakkqoguw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623706": [
        {
            "ioc_value": "qgucwqcowwiucqec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623707": [
        {
            "ioc_value": "wswaysmegacgogqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623708": [
        {
            "ioc_value": "kaiwuuokqsoaiakm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623709": [
        {
            "ioc_value": "gymouiiiimwsaqqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623710": [
        {
            "ioc_value": "amwcwueewgemuquw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623711": [
        {
            "ioc_value": "ycawimkuoqyicqkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623712": [
        {
            "ioc_value": "oiacmaasgsqeiaek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623671": [
        {
            "ioc_value": "mqsqokqaeyoywock.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623672": [
        {
            "ioc_value": "sceemewqmiikuoiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623673": [
        {
            "ioc_value": "kamkguwakwcamoya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623674": [
        {
            "ioc_value": "kuueaqqweiimquks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623675": [
        {
            "ioc_value": "aaocuwcuwiaocuiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623676": [
        {
            "ioc_value": "wyewiuiiaeaaecwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623677": [
        {
            "ioc_value": "euiegeyseyqyuyge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623678": [
        {
            "ioc_value": "qsimseuayguucygo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623679": [
        {
            "ioc_value": "wyusaicykuaeyske.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623680": [
        {
            "ioc_value": "wykmumusqaqqgqgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623681": [
        {
            "ioc_value": "qycokamiqogyqgmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623682": [
        {
            "ioc_value": "ywqkemwuesimamga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623683": [
        {
            "ioc_value": "ceqikkgqigmayyoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623684": [
        {
            "ioc_value": "yoeuiqiqyiyawcgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623685": [
        {
            "ioc_value": "gysccowmiqcoqaas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623686": [
        {
            "ioc_value": "qseqkmwmwiskmsim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623687": [
        {
            "ioc_value": "mqauyawuyemomgmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623688": [
        {
            "ioc_value": "qyeqmaogcqaiuuga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623689": [
        {
            "ioc_value": "ckywwseueguwyyye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623690": [
        {
            "ioc_value": "skamuccygiqoqock.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623691": [
        {
            "ioc_value": "qgsesyccsskgeqau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623651": [
        {
            "ioc_value": "cekcciaawcksagks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623652": [
        {
            "ioc_value": "eacecoguuecwakss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623653": [
        {
            "ioc_value": "cqggokcqsmyouwos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623654": [
        {
            "ioc_value": "ooigsiugkoimyasy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623655": [
        {
            "ioc_value": "scomgmqaosaocqau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623656": [
        {
            "ioc_value": "asqoamkwackwaeom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623657": [
        {
            "ioc_value": "qmsomaweaymcqikg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623658": [
        {
            "ioc_value": "mymmcqaaegiceaoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623659": [
        {
            "ioc_value": "iqskeyyecuqysiwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623660": [
        {
            "ioc_value": "eoyamacygskkyuae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623661": [
        {
            "ioc_value": "eucyiakiwusykgeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623662": [
        {
            "ioc_value": "swimcyiskqcooayc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623663": [
        {
            "ioc_value": "eoqkwsawwqkiecmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623664": [
        {
            "ioc_value": "wyckyysqyowgamga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623665": [
        {
            "ioc_value": "eaqyymuqcceqyasw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623666": [
        {
            "ioc_value": "aamgkumciccakioe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623667": [
        {
            "ioc_value": "ceyoagkmaoaauiyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623668": [
        {
            "ioc_value": "yoiyagiwkyuscuik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623669": [
        {
            "ioc_value": "euyywugygymaygms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623670": [
        {
            "ioc_value": "gyeiwookikuwqwyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623629": [
        {
            "ioc_value": "mkqccoigegeaosme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623630": [
        {
            "ioc_value": "oogeycuwcakgicwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623631": [
        {
            "ioc_value": "kaeqgugwooikaqmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623632": [
        {
            "ioc_value": "gskmcmiawywuwake.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623633": [
        {
            "ioc_value": "ugackmayyokuisya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623634": [
        {
            "ioc_value": "eiaaeaesuwyuqkam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623635": [
        {
            "ioc_value": "gmamgosakeqegcek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623636": [
        {
            "ioc_value": "qyiyauieimmseowc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623637": [
        {
            "ioc_value": "qskusagqsousoycg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623638": [
        {
            "ioc_value": "qsqgwyemuycmuqcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623639": [
        {
            "ioc_value": "scmyquyoaumgkcik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623640": [
        {
            "ioc_value": "kmuiaaiqykcmwygs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623641": [
        {
            "ioc_value": "sqsyykycgkuckuwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623642": [
        {
            "ioc_value": "iqckeqqemcgoasqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623643": [
        {
            "ioc_value": "mymssuweuwioskai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623644": [
        {
            "ioc_value": "wyiukkqyekkswsai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623645": [
        {
            "ioc_value": "gyqssmwciuyiogom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623646": [
        {
            "ioc_value": "wekauykisssmaaoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623647": [
        {
            "ioc_value": "qmgawkemgguucuyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623648": [
        {
            "ioc_value": "kaqqykckugouuikw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623649": [
        {
            "ioc_value": "sckgusqaookqause.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623650": [
        {
            "ioc_value": "kuyqymgswkicaoie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623608": [
        {
            "ioc_value": "asciqygsawkwgeig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623609": [
        {
            "ioc_value": "wyakqwocyaucaguk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623610": [
        {
            "ioc_value": "iqaqkcoomukaasoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623611": [
        {
            "ioc_value": "cewsouosgkiuakou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623612": [
        {
            "ioc_value": "oioiamiskqkcsigu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623613": [
        {
            "ioc_value": "oowmoamiyeeuicog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623614": [
        {
            "ioc_value": "ooyweawmyguqoumm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623615": [
        {
            "ioc_value": "meyyyogogweeemek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623616": [
        {
            "ioc_value": "eowkwooyakkowoku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623617": [
        {
            "ioc_value": "yoyeowegskgyeigs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623618": [
        {
            "ioc_value": "skmegkkesmiucqqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623619": [
        {
            "ioc_value": "qgmoqgkggiycoeem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623620": [
        {
            "ioc_value": "mqeeukocqkkyoiyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623621": [
        {
            "ioc_value": "qskeuiaqmggkcgkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623622": [
        {
            "ioc_value": "amaegcuysasmqqcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623623": [
        {
            "ioc_value": "assksumawamqycum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623624": [
        {
            "ioc_value": "mqumccokieqasmqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623625": [
        {
            "ioc_value": "kasacogqgiiiaswm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623626": [
        {
            "ioc_value": "skycecsmkqwymqmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623627": [
        {
            "ioc_value": "qgogygycqkacoaeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623628": [
        {
            "ioc_value": "agoamgkwoqwimusg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623586": [
        {
            "ioc_value": "iqwmkouaaqkwigcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623587": [
        {
            "ioc_value": "skymgyissemgeseg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623588": [
        {
            "ioc_value": "gecscueqwoyummya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623589": [
        {
            "ioc_value": "kgycaewyegisyggw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623590": [
        {
            "ioc_value": "icgckmiwcuyugame.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623591": [
        {
            "ioc_value": "qyeecsomseumyqko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623592": [
        {
            "ioc_value": "askowksuogwyuogi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623593": [
        {
            "ioc_value": "eowscyiguugyueso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623594": [
        {
            "ioc_value": "wsaucqikaascqyco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623595": [
        {
            "ioc_value": "wsgkaqeucgswcyau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623596": [
        {
            "ioc_value": "iwqukwcyawyoqueg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623597": [
        {
            "ioc_value": "mkkakossueqewwkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623598": [
        {
            "ioc_value": "ooooyamuaaeemsgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623599": [
        {
            "ioc_value": "iwmgougwkaukiiuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623600": [
        {
            "ioc_value": "agikwekycywyyiak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623601": [
        {
            "ioc_value": "oucwawsguqsoyowm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623602": [
        {
            "ioc_value": "eiwecgsggmoamicw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623603": [
        {
            "ioc_value": "kuiqmmyseswoeeko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623604": [
        {
            "ioc_value": "kmcqwemqcywemwwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623605": [
        {
            "ioc_value": "ookmuuwmoqmumueg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623606": [
        {
            "ioc_value": "cqsmccyawymamwyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623607": [
        {
            "ioc_value": "yomaoyceoswiwoue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623562": [
        {
            "ioc_value": "uomgwcugyayskkwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623563": [
        {
            "ioc_value": "skuiceyumkusucmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623564": [
        {
            "ioc_value": "gsaosqukyaqsmuce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623565": [
        {
            "ioc_value": "ooswmewcicmaoisy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623566": [
        {
            "ioc_value": "kgeykcmsqgkosgcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623567": [
        {
            "ioc_value": "ycweuyyukgyewksw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623568": [
        {
            "ioc_value": "oigakugegoggsqcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623569": [
        {
            "ioc_value": "iickgicasqsiwauo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623570": [
        {
            "ioc_value": "eikocykiuasceeoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623571": [
        {
            "ioc_value": "iquocemmieiusayk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623572": [
        {
            "ioc_value": "youckywkcogwgyys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623573": [
        {
            "ioc_value": "icwawukewoqseugy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623574": [
        {
            "ioc_value": "amaysymmyywqiuuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623575": [
        {
            "ioc_value": "ascmkwwoiacimgak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623576": [
        {
            "ioc_value": "yogccgoqossywyyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623577": [
        {
            "ioc_value": "kaaqsuoysgiwcwmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623578": [
        {
            "ioc_value": "cecgsoawsoccuasy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623579": [
        {
            "ioc_value": "ceysoogkggkwicem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623580": [
        {
            "ioc_value": "sqoygsaegscmeaii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623581": [
        {
            "ioc_value": "mkiqywikmqqksqew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623582": [
        {
            "ioc_value": "ooqsueceweqiukwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623583": [
        {
            "ioc_value": "wyygmiaaseaceuqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623584": [
        {
            "ioc_value": "uuagmqgqguouwoys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623585": [
        {
            "ioc_value": "mqyamequmemiwqek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623541": [
        {
            "ioc_value": "gyakakeciaggiaku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623542": [
        {
            "ioc_value": "gyassaqsquqgaswk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623543": [
        {
            "ioc_value": "oukqaqgeysesaqki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623544": [
        {
            "ioc_value": "eakikqeqqqgiauag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623545": [
        {
            "ioc_value": "gsayqmqciyoimgqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623546": [
        {
            "ioc_value": "skawyuqmciygsiaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623547": [
        {
            "ioc_value": "ceoqkucwuaiciimq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623548": [
        {
            "ioc_value": "wyiuemsioueuyiok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623549": [
        {
            "ioc_value": "yikckuwmawcwagqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623550": [
        {
            "ioc_value": "ameksysaugiueiok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623551": [
        {
            "ioc_value": "kagysmucqwwsegku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623552": [
        {
            "ioc_value": "uuaeacqsicywogsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623553": [
        {
            "ioc_value": "scauwqkmigiwkicc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623554": [
        {
            "ioc_value": "iqasayuyymgikcaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623555": [
        {
            "ioc_value": "kueocoosysmcqeyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623556": [
        {
            "ioc_value": "yoqawmmqqkiciyqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623557": [
        {
            "ioc_value": "mkaoymumaoaueksm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623558": [
        {
            "ioc_value": "kgcwameykaicgsqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623559": [
        {
            "ioc_value": "yoewmgsqwqsoaqys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623560": [
        {
            "ioc_value": "oueeoiecuccgwgys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623561": [
        {
            "ioc_value": "kawgmaqsigewcgke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623519": [
        {
            "ioc_value": "iwwqkogaioooeuyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623520": [
        {
            "ioc_value": "gscimcgwoyqemuog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623521": [
        {
            "ioc_value": "ousukqcsyaogmcsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623522": [
        {
            "ioc_value": "iqssogkkuywqiisg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623523": [
        {
            "ioc_value": "qgcemsmqaugccmky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623524": [
        {
            "ioc_value": "cwisyaikmaaqwamc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623525": [
        {
            "ioc_value": "uaoqiaawiuwieege.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623526": [
        {
            "ioc_value": "icykwasuaacgwaee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623527": [
        {
            "ioc_value": "qyguimkmeokusgky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623528": [
        {
            "ioc_value": "ougmaoekgyauausg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623529": [
        {
            "ioc_value": "wygciamkccyqwycs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623530": [
        {
            "ioc_value": "skycwasymcaiwuwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623531": [
        {
            "ioc_value": "qgyyuwoqeowmguew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623532": [
        {
            "ioc_value": "iwkwaaggciocikwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623533": [
        {
            "ioc_value": "ooyuuqgqygqeoqwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623534": [
        {
            "ioc_value": "euqqyogkiwgmcsci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623535": [
        {
            "ioc_value": "ckcyiqqwgqymksii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623536": [
        {
            "ioc_value": "ycsmmcwioqwigimw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623537": [
        {
            "ioc_value": "oueyqioaeykqmcqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623538": [
        {
            "ioc_value": "qgwsomsqymkcmiaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623539": [
        {
            "ioc_value": "iqcsiosakqwimimi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623540": [
        {
            "ioc_value": "mqeqicuisykeasck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623497": [
        {
            "ioc_value": "uuqgqiiyoeiqsiwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623498": [
        {
            "ioc_value": "gmmyyequceqmsika.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623499": [
        {
            "ioc_value": "iqqqaiuoogwkugka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623500": [
        {
            "ioc_value": "oioqoeiyameqegas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623501": [
        {
            "ioc_value": "yiswgmcemycqqaes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623502": [
        {
            "ioc_value": "iceiwmgsqkewgaeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623503": [
        {
            "ioc_value": "uuoumkiccuqmmswu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623504": [
        {
            "ioc_value": "qmwskasumegeguqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623505": [
        {
            "ioc_value": "kmqeeqoiogwwggws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623506": [
        {
            "ioc_value": "ceogmsymuuqgeewi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623507": [
        {
            "ioc_value": "kuukomqeusawwqyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623508": [
        {
            "ioc_value": "geuagkcgyqswgyuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623509": [
        {
            "ioc_value": "cqyakeeeycumymma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623510": [
        {
            "ioc_value": "qsmkwaiieiemsowy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623511": [
        {
            "ioc_value": "wkewkqiyaqeeksuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623512": [
        {
            "ioc_value": "asmmyakcckqsssys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623513": [
        {
            "ioc_value": "kaoceymuieueakue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623514": [
        {
            "ioc_value": "myukomuskauwcsks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623515": [
        {
            "ioc_value": "ywskisigcwaaewug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623516": [
        {
            "ioc_value": "qmgqgsmygaywuyuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623517": [
        {
            "ioc_value": "eumgumiuiuyyseyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623518": [
        {
            "ioc_value": "gywugqkaaaykwkoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623474": [
        {
            "ioc_value": "uoymseiyiioeuwkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623475": [
        {
            "ioc_value": "myuwwuiuweqcucmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623476": [
        {
            "ioc_value": "mqwemgogmosacuqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623477": [
        {
            "ioc_value": "gymossqgigmmwcse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623478": [
        {
            "ioc_value": "amaaymyseygywisu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623479": [
        {
            "ioc_value": "asmacgkmgymgeokw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623480": [
        {
            "ioc_value": "kmkaimceayoegqcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623481": [
        {
            "ioc_value": "meqaumiukcgoewkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623482": [
        {
            "ioc_value": "aasesukmoeugkgom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623483": [
        {
            "ioc_value": "ocmysucieswskgcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623484": [
        {
            "ioc_value": "eoyagkwmowiooumc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623485": [
        {
            "ioc_value": "weisqkcuskossucm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623486": [
        {
            "ioc_value": "gyqaskqigooaumoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623487": [
        {
            "ioc_value": "ckskugowqmauqgks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623488": [
        {
            "ioc_value": "qmeowauemeagwusc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623489": [
        {
            "ioc_value": "wkiokuykuwmaiygc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623490": [
        {
            "ioc_value": "aaiaugmkkieswias.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623491": [
        {
            "ioc_value": "ocowckaykqoqmmmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623492": [
        {
            "ioc_value": "kmigoymaawmcmeeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623493": [
        {
            "ioc_value": "cqgsuiqwukcygoym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623494": [
        {
            "ioc_value": "uamekwieguoakekq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623495": [
        {
            "ioc_value": "yoecakimkauaaiug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623496": [
        {
            "ioc_value": "youuswgkqeoqsckc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623454": [
        {
            "ioc_value": "ookiaueqiiagcccg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623455": [
        {
            "ioc_value": "meissswgwqcwqcsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623456": [
        {
            "ioc_value": "agkacceusukyauqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623457": [
        {
            "ioc_value": "cwgamaaiwskaiwoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623458": [
        {
            "ioc_value": "gmgcuwqmqaeswwuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623459": [
        {
            "ioc_value": "qgmcsceaoegkgmmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623460": [
        {
            "ioc_value": "mqwssuisoeukemke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623461": [
        {
            "ioc_value": "cqkmmugmegswiyig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623462": [
        {
            "ioc_value": "mkkemammskoaooia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623463": [
        {
            "ioc_value": "iiammimscuyeoymg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623464": [
        {
            "ioc_value": "aseueekuosowqssc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623465": [
        {
            "ioc_value": "meuemwguyykwooeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623466": [
        {
            "ioc_value": "gmmigukyamgcmugw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623467": [
        {
            "ioc_value": "ocyiuwyugkmcuqmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623468": [
        {
            "ioc_value": "eokieyckaoyiskcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623469": [
        {
            "ioc_value": "qsygwgwikeqckgiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623470": [
        {
            "ioc_value": "yisgkysuykysiqgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623471": [
        {
            "ioc_value": "agcoquqkqewamcko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623472": [
        {
            "ioc_value": "eoukskaqosmsuasq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623473": [
        {
            "ioc_value": "wkukqeeuyyekmeki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623433": [
        {
            "ioc_value": "ycmaoqaaiwcemicw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623434": [
        {
            "ioc_value": "iqaqkawmciuqkyek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623435": [
        {
            "ioc_value": "ywicuwoqwoecswcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623436": [
        {
            "ioc_value": "iwqikwkkuiiymimi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623437": [
        {
            "ioc_value": "qsecoecmsyiaeuec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623438": [
        {
            "ioc_value": "qsesmoqkeqimkgko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623439": [
        {
            "ioc_value": "kawwmkeomocyuoki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623440": [
        {
            "ioc_value": "meucowoiiauygwim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623441": [
        {
            "ioc_value": "scsckqqqgwcgwoke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623442": [
        {
            "ioc_value": "uouwkiyqsoemyyuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623443": [
        {
            "ioc_value": "ywiiaouqogogugci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623444": [
        {
            "ioc_value": "sciumamwimkaswuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623445": [
        {
            "ioc_value": "qsoymmioyasemwqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623446": [
        {
            "ioc_value": "yiqwcgukumyuqgqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623447": [
        {
            "ioc_value": "cwwaigiuaqymssgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623448": [
        {
            "ioc_value": "oumswgimawqeause.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623449": [
        {
            "ioc_value": "uuwkikuuymqukoeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623450": [
        {
            "ioc_value": "aaqioewgoeegoyom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623451": [
        {
            "ioc_value": "skaociskuqmkgemk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623452": [
        {
            "ioc_value": "oimycyykisesayci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623453": [
        {
            "ioc_value": "euakeicowcemekeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623415": [
        {
            "ioc_value": "uggmsouwumgygqee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623416": [
        {
            "ioc_value": "sccgqiuwmgcuwoia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623417": [
        {
            "ioc_value": "agiausoqqqiegsqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623418": [
        {
            "ioc_value": "ywmyicsgscuyseum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623419": [
        {
            "ioc_value": "mykgmukmuqiaoemq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623420": [
        {
            "ioc_value": "kawokwywmaqqccwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623421": [
        {
            "ioc_value": "icmkwggkyyywaiiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623422": [
        {
            "ioc_value": "weacwmqwaiaqouqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623423": [
        {
            "ioc_value": "eoauaqaccgaewiky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623424": [
        {
            "ioc_value": "qmmsmsgyomkiwciy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623425": [
        {
            "ioc_value": "mqummsegswyiouyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623426": [
        {
            "ioc_value": "iqeecaoskeikomme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623427": [
        {
            "ioc_value": "aaeykcaqusesoysq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623428": [
        {
            "ioc_value": "qycokyeimwogquqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623429": [
        {
            "ioc_value": "amwqacasqgiwksym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623430": [
        {
            "ioc_value": "amewywgwciyacsso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623431": [
        {
            "ioc_value": "ouguqgikyuuimeue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623432": [
        {
            "ioc_value": "ouqyaokukoswyicw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623398": [
        {
            "ioc_value": "gyygqkuckawayeqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623399": [
        {
            "ioc_value": "mqwosayocyomicma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623400": [
        {
            "ioc_value": "cwsgkkqqesegecqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623401": [
        {
            "ioc_value": "ycauiaswuygigoea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623402": [
        {
            "ioc_value": "skmaiikwmywcmigm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623403": [
        {
            "ioc_value": "aaaosggyucmygsww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623404": [
        {
            "ioc_value": "iwiyyckuwumyaewm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623405": [
        {
            "ioc_value": "amwscicsoqayokug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623406": [
        {
            "ioc_value": "mkmccciakgsckcky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623407": [
        {
            "ioc_value": "qmcwykygwgogweue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623408": [
        {
            "ioc_value": "qmgmukiwewyiiaoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623409": [
        {
            "ioc_value": "eaisskgoikcwuyag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623410": [
        {
            "ioc_value": "eiakisykwamsygsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623411": [
        {
            "ioc_value": "qgwyowemcegieaam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623412": [
        {
            "ioc_value": "qymockqecaqgseie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623413": [
        {
            "ioc_value": "mkaksmkgwcwgagsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623414": [
        {
            "ioc_value": "yiqmcuwmmkswqmye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623396": [
        {
            "ioc_value": "kmoimkoeygusussm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623397": [
        {
            "ioc_value": "amogkeeeieeskymm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623385": [
        {
            "ioc_value": "qmoykyowyeumcsmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623386": [
        {
            "ioc_value": "eiqysswawcmyagww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623387": [
        {
            "ioc_value": "eisgacmckiowmcwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623388": [
        {
            "ioc_value": "uuoiisoiokewkusg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623389": [
        {
            "ioc_value": "uaeygimikqskkcga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623390": [
        {
            "ioc_value": "qsuqiumkimgmaysa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623391": [
        {
            "ioc_value": "mesmmkwsogysqcgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623392": [
        {
            "ioc_value": "ckoggmmowiwsugkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623393": [
        {
            "ioc_value": "yosoygsgcuawoeia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623394": [
        {
            "ioc_value": "kukiksiqawiuaeoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623395": [
        {
            "ioc_value": "qggqkgiykkykaqwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623363": [
        {
            "ioc_value": "ocwuisckykkgaais.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623364": [
        {
            "ioc_value": "ouskeocuycaksocm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623365": [
        {
            "ioc_value": "uaqukskwsqwmqeku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623366": [
        {
            "ioc_value": "iceuwegeqqaeqseg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623367": [
        {
            "ioc_value": "cwkcmyggaememgog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623368": [
        {
            "ioc_value": "cwumoqqcomccoagg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623369": [
        {
            "ioc_value": "oisasiuuyoyiwmwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623370": [
        {
            "ioc_value": "iqesyawoaasigsey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623371": [
        {
            "ioc_value": "myqyqqgkgiuoooui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623372": [
        {
            "ioc_value": "uuicqsqwaiugcmuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623373": [
        {
            "ioc_value": "cqcgqwaqcoesqeas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623374": [
        {
            "ioc_value": "eusyaocuyqsussuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623375": [
        {
            "ioc_value": "oiiowwciwksuqqgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623376": [
        {
            "ioc_value": "meqyygqiikcqymae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623377": [
        {
            "ioc_value": "wkkgmaeiaougeiog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623378": [
        {
            "ioc_value": "uocqgkuuewiiyeua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623379": [
        {
            "ioc_value": "mymiqiuckkmsmsqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623380": [
        {
            "ioc_value": "eaagwewyeiswmwac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623381": [
        {
            "ioc_value": "icywigaokmewuuyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623382": [
        {
            "ioc_value": "mkecogyoscikqkeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623383": [
        {
            "ioc_value": "cwscqmagucawokws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623384": [
        {
            "ioc_value": "cwgeygkamuwaiyus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623342": [
        {
            "ioc_value": "cqywkouyeesmscmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623343": [
        {
            "ioc_value": "ckqimeceiegymgkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623344": [
        {
            "ioc_value": "gswmaeymicaiycia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623345": [
        {
            "ioc_value": "ugqaoicaiisueyag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623346": [
        {
            "ioc_value": "myiskcemogyakmcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623347": [
        {
            "ioc_value": "uoaugqmgceeaciai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623348": [
        {
            "ioc_value": "iiyicsuiaiyciauy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623349": [
        {
            "ioc_value": "uaoisisysskqaskg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623350": [
        {
            "ioc_value": "uaoauwwioiawsowu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623351": [
        {
            "ioc_value": "cwmyommiqcwauegm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623352": [
        {
            "ioc_value": "iicoioeaewosauie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623353": [
        {
            "ioc_value": "gsecegcigyiaoqgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623354": [
        {
            "ioc_value": "gmiukywwooeuumus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623355": [
        {
            "ioc_value": "aagcgekugkkgmwmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623356": [
        {
            "ioc_value": "ckesmqaawwiwuymm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623357": [
        {
            "ioc_value": "gyyegmyoqesioqii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623358": [
        {
            "ioc_value": "mkmmskkukqgmqism.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623359": [
        {
            "ioc_value": "wyugwuosuwcqucoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623360": [
        {
            "ioc_value": "eoqemoawgikwikmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623361": [
        {
            "ioc_value": "iiyswoqmsiouaacs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623362": [
        {
            "ioc_value": "skqsaoscqcywiqqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623325": [
        {
            "ioc_value": "cqggigykumoycssg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623326": [
        {
            "ioc_value": "qsgckqekmeogooei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623327": [
        {
            "ioc_value": "iwguswkueycuoeio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623328": [
        {
            "ioc_value": "oiaicosgikiuaicm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623329": [
        {
            "ioc_value": "wkowegcqyiakuwow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623330": [
        {
            "ioc_value": "aamyuyasecoegwss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623331": [
        {
            "ioc_value": "qgckkukaiioecaom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623332": [
        {
            "ioc_value": "ouecaqeqkiwkygak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623333": [
        {
            "ioc_value": "mkyguayygycgqmco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623334": [
        {
            "ioc_value": "gyiweggimywqciqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623335": [
        {
            "ioc_value": "wkyougmcwyssauui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623336": [
        {
            "ioc_value": "qyeumokkeoougaee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623337": [
        {
            "ioc_value": "uumgwcsoasaaymkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623338": [
        {
            "ioc_value": "gmomuwegkksiusqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623339": [
        {
            "ioc_value": "uowuicmumiscaecy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623340": [
        {
            "ioc_value": "kameegwwygsqimcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623341": [
        {
            "ioc_value": "uaaqkkkmeaikqmak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623306": [
        {
            "ioc_value": "qgeakoemukkyqwom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623307": [
        {
            "ioc_value": "ywigsomyekqcwowu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623308": [
        {
            "ioc_value": "agmuukmgcugysakc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623309": [
        {
            "ioc_value": "icayyssoikqykmmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623310": [
        {
            "ioc_value": "swsgoeyygsuwuooo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623311": [
        {
            "ioc_value": "wyeuwsiawigaquky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623312": [
        {
            "ioc_value": "gsekwokweacsmkis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623313": [
        {
            "ioc_value": "asoqcqcymamwumkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623314": [
        {
            "ioc_value": "iqouyaeuaocyuawc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623315": [
        {
            "ioc_value": "gmmeuiuseeycwkgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623316": [
        {
            "ioc_value": "wkkaakwmkkamooqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623317": [
        {
            "ioc_value": "ooyeoasemmqyoeiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623318": [
        {
            "ioc_value": "uaqsuoymewwkiagw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623319": [
        {
            "ioc_value": "yowkweauqkwoewae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623320": [
        {
            "ioc_value": "kmswaiaykyukiuka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623321": [
        {
            "ioc_value": "sqoaiigqiiygkomq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623322": [
        {
            "ioc_value": "ocswecquqmcqqoyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623323": [
        {
            "ioc_value": "qgykmmaigaowkgau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623324": [
        {
            "ioc_value": "sqwaoesouogyyyaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623286": [
        {
            "ioc_value": "uaeuuiiqoiusqkei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623287": [
        {
            "ioc_value": "iiesiismqaqsyeqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623288": [
        {
            "ioc_value": "asigeoogwgsakweo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623289": [
        {
            "ioc_value": "sqmueuywwiossoma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623290": [
        {
            "ioc_value": "qgsakmuwuggqekce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623291": [
        {
            "ioc_value": "ocswsssamecuyyus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623292": [
        {
            "ioc_value": "wyeogmsossiqqcce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623293": [
        {
            "ioc_value": "ooimgucgsmqyckuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623294": [
        {
            "ioc_value": "kgcmsqcaeeeweoom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623295": [
        {
            "ioc_value": "gsssqawksgmeosio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623296": [
        {
            "ioc_value": "uucaoagmiauaqemy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623297": [
        {
            "ioc_value": "iiquawcuimowweci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623298": [
        {
            "ioc_value": "uowsskyycuqkywug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623299": [
        {
            "ioc_value": "uoquwwcgikokqewo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623300": [
        {
            "ioc_value": "cwkqcqggmekaagyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623301": [
        {
            "ioc_value": "eusowgqiekwkgemy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623302": [
        {
            "ioc_value": "eukooycososmowou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623303": [
        {
            "ioc_value": "cwcmkkoiwesieeeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623304": [
        {
            "ioc_value": "cweesqaiqqacmwos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623305": [
        {
            "ioc_value": "oieuceuumkgykisc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623269": [
        {
            "ioc_value": "qsimkecwaiywyymu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623270": [
        {
            "ioc_value": "swmoomuacyoocgwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623271": [
        {
            "ioc_value": "yowoikgkcqaqycec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623272": [
        {
            "ioc_value": "ugmggwcwegwkwwmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623273": [
        {
            "ioc_value": "qmoyeogsuwuousoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623274": [
        {
            "ioc_value": "wskgqwessgwiaamq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623275": [
        {
            "ioc_value": "ocqgaysmigqemywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623276": [
        {
            "ioc_value": "agmceiesyaueoiyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623277": [
        {
            "ioc_value": "amqaskmekkwqkwiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623278": [
        {
            "ioc_value": "uaciuoscacuycauq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623279": [
        {
            "ioc_value": "qmumsmkgiqsssogu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623280": [
        {
            "ioc_value": "ckgqygyyiuaqakug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623281": [
        {
            "ioc_value": "kmqwqqwuoggecsei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623282": [
        {
            "ioc_value": "mycqoaeeoqewewuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623283": [
        {
            "ioc_value": "skqqmmuccuqiowuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623284": [
        {
            "ioc_value": "yoewcqugqwieuywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623285": [
        {
            "ioc_value": "eukwmcwswmiiuwmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623247": [
        {
            "ioc_value": "ckksmwsysaaouewo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623248": [
        {
            "ioc_value": "agguuwgaysasmumk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623249": [
        {
            "ioc_value": "yoqcgsumgmaikois.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623250": [
        {
            "ioc_value": "cequeayyosuesgma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623251": [
        {
            "ioc_value": "ceeiaskumqycqsgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623252": [
        {
            "ioc_value": "kmmwmmokayacqsos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623253": [
        {
            "ioc_value": "gyksqageokuycuqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623254": [
        {
            "ioc_value": "gyskuykyguimcmgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623255": [
        {
            "ioc_value": "kmmiesuaaqiagykg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623256": [
        {
            "ioc_value": "sccmaeieukoygaaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623257": [
        {
            "ioc_value": "sqemcgkqouoiaeog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623258": [
        {
            "ioc_value": "aamkkyyokugieamw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623259": [
        {
            "ioc_value": "aaieyymcyuiysqou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623260": [
        {
            "ioc_value": "wyqiswckqkymssgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623261": [
        {
            "ioc_value": "gygumayikyumwqqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623262": [
        {
            "ioc_value": "amkiucmwaagmyukm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623263": [
        {
            "ioc_value": "uussksckoooesmou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623264": [
        {
            "ioc_value": "oicyayiqcgqewwgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623265": [
        {
            "ioc_value": "ugswkeiqaoiymmcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623266": [
        {
            "ioc_value": "skiuggogkgycmswm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623267": [
        {
            "ioc_value": "myqwgseuewgiusyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623268": [
        {
            "ioc_value": "iiueikascyumgook.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623223": [
        {
            "ioc_value": "kmogygcagsomaqio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623224": [
        {
            "ioc_value": "uggqaeussgqymmae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623225": [
        {
            "ioc_value": "oiwwgouqmwiwkqys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623226": [
        {
            "ioc_value": "eiycwqwuywqkwiow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623227": [
        {
            "ioc_value": "gmkcocageewaeeyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623228": [
        {
            "ioc_value": "uuagiwmuoiuacueo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623229": [
        {
            "ioc_value": "swagiukoogqsawcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623230": [
        {
            "ioc_value": "gyogowiakukeceeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623231": [
        {
            "ioc_value": "ckiuyamakwuaamey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623232": [
        {
            "ioc_value": "ckwmuwkiesieceyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623233": [
        {
            "ioc_value": "qygyoekciekiqsuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623234": [
        {
            "ioc_value": "myswewuwckssuuey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623235": [
        {
            "ioc_value": "iqkacoksmswmikwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623236": [
        {
            "ioc_value": "qygwwkwgcqmsesoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623237": [
        {
            "ioc_value": "weqqwcwgsgwmuqoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623238": [
        {
            "ioc_value": "wecgygswksqwkisq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623239": [
        {
            "ioc_value": "kmcgomakuoiikcyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623240": [
        {
            "ioc_value": "ugmmaqigimcgqmyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623241": [
        {
            "ioc_value": "qmmqoaimycaewucq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623242": [
        {
            "ioc_value": "ocskcmkyomeymkqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623243": [
        {
            "ioc_value": "myocugksiqwuimuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623244": [
        {
            "ioc_value": "wyecugiccgcewsua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623245": [
        {
            "ioc_value": "uagsgemmciosukma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623246": [
        {
            "ioc_value": "mkwmeuqqiekkqkga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623200": [
        {
            "ioc_value": "oiyyegmuswyyqyig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623201": [
        {
            "ioc_value": "ouiawimesyqwikgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623202": [
        {
            "ioc_value": "cekeigikgaegekmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623203": [
        {
            "ioc_value": "eiaykoqiueckcwgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623204": [
        {
            "ioc_value": "cwgkwacwesiwqiqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623205": [
        {
            "ioc_value": "mkcwaigkqcucysyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623206": [
        {
            "ioc_value": "yiiykiwugcgmsugg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623207": [
        {
            "ioc_value": "geyyegoaguiyakoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623208": [
        {
            "ioc_value": "mqqiyqsyeiuwuqoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623209": [
        {
            "ioc_value": "kaqogyqwamcgogai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623210": [
        {
            "ioc_value": "kuuauicaiuwcmoqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623211": [
        {
            "ioc_value": "ceumwewqqugykcmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623212": [
        {
            "ioc_value": "kagsyykysgoakeou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623213": [
        {
            "ioc_value": "ickqywquiwcqogyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623214": [
        {
            "ioc_value": "weweamwkwciuuwas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623215": [
        {
            "ioc_value": "ycecaygqusgwkiue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623216": [
        {
            "ioc_value": "qmgieqscuomwimem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623217": [
        {
            "ioc_value": "wkcyywmwuiciuiim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623218": [
        {
            "ioc_value": "mywescoykuiqksma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623219": [
        {
            "ioc_value": "uogmowmuwkyoyeuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623220": [
        {
            "ioc_value": "eawqqiqaacissiiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623221": [
        {
            "ioc_value": "euqwwkyoqegyqasm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623222": [
        {
            "ioc_value": "cqyikiacwsgsyqyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623180": [
        {
            "ioc_value": "oiycuawakywokkem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623181": [
        {
            "ioc_value": "amgquqsgqaywweag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623182": [
        {
            "ioc_value": "oougyaycugqogyma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623183": [
        {
            "ioc_value": "yckqsouqaycoaemo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623184": [
        {
            "ioc_value": "memukqwoogwosuky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623185": [
        {
            "ioc_value": "mqkkocseqmqgiqsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623186": [
        {
            "ioc_value": "eikysqyuisuseiae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623187": [
        {
            "ioc_value": "qgwgysiieukauiqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623188": [
        {
            "ioc_value": "scweaisgweecuwsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623189": [
        {
            "ioc_value": "ammmeiisacwkusci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623190": [
        {
            "ioc_value": "swqqwksiuuoiaowg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623191": [
        {
            "ioc_value": "ugogamiqkeeaauyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623192": [
        {
            "ioc_value": "oumuouekasmyuuuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623193": [
        {
            "ioc_value": "gsseakqiwmiaqcck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623194": [
        {
            "ioc_value": "kusmywkmikcycokw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623195": [
        {
            "ioc_value": "qgsqgiycmoammkmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623196": [
        {
            "ioc_value": "wyuccyuyqqoocwsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623197": [
        {
            "ioc_value": "qskymeqiioycauau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623198": [
        {
            "ioc_value": "iceymoosgecukosm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623199": [
        {
            "ioc_value": "uuiasiguauaummiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623157": [
        {
            "ioc_value": "uaqmyeeigqeyaoea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623158": [
        {
            "ioc_value": "wemgoieimwkuwuki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623159": [
        {
            "ioc_value": "ugwciqomuwsocmuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623160": [
        {
            "ioc_value": "scekkugeyiqgsyya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623161": [
        {
            "ioc_value": "uuismwewweckgcua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623162": [
        {
            "ioc_value": "aaowaugsmgmeuaya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623163": [
        {
            "ioc_value": "kuoiscaekuuewgek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623164": [
        {
            "ioc_value": "uuymguqwuwemgiuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623165": [
        {
            "ioc_value": "yigueawiwoeqgqwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623166": [
        {
            "ioc_value": "ickogmwckqqiiqsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623167": [
        {
            "ioc_value": "gsmuoomcgoguesuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623168": [
        {
            "ioc_value": "gssqeoeimyqqwkgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623169": [
        {
            "ioc_value": "qywicgcsoawekaqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623170": [
        {
            "ioc_value": "mygecimusmicawug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623171": [
        {
            "ioc_value": "uoioaiwmgyuwkuee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623172": [
        {
            "ioc_value": "wkmyssasuakyyimy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623173": [
        {
            "ioc_value": "sweykuemqkykyciu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623174": [
        {
            "ioc_value": "oogwioyuskmaamqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623175": [
        {
            "ioc_value": "mqqwkywcccaoeusa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623176": [
        {
            "ioc_value": "eaesicsukqasuuiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623177": [
        {
            "ioc_value": "mekmkwcgsgkqesom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623178": [
        {
            "ioc_value": "eiskwuqqqeqcywwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623179": [
        {
            "ioc_value": "skwioosccgmoakay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623136": [
        {
            "ioc_value": "sqwoemykegsaomgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623137": [
        {
            "ioc_value": "gemysceqmquseisu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623138": [
        {
            "ioc_value": "wskiswymwsmywskg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623139": [
        {
            "ioc_value": "ocecmucooowgsuqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623140": [
        {
            "ioc_value": "mqwmgqyckssqeaac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623141": [
        {
            "ioc_value": "yiyyciceiwuoscoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623142": [
        {
            "ioc_value": "amqgoooyyeigiaou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623143": [
        {
            "ioc_value": "qymwyogeggcyqmqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623144": [
        {
            "ioc_value": "asweouqeoeooccau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623145": [
        {
            "ioc_value": "wyewowgcgwaemwos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623146": [
        {
            "ioc_value": "aayyoaomogeeyqeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623147": [
        {
            "ioc_value": "wsuqmywmcqeawuys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623148": [
        {
            "ioc_value": "ckweqskaikeowcio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623149": [
        {
            "ioc_value": "qsucyquqqkmuqeog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623150": [
        {
            "ioc_value": "gycigaiwoueuouew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623151": [
        {
            "ioc_value": "qmeowicggwmkagmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623152": [
        {
            "ioc_value": "ycucegaqkmgewsms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623153": [
        {
            "ioc_value": "ouosgumeusayayki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623154": [
        {
            "ioc_value": "kuyicyqoucacoyoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623155": [
        {
            "ioc_value": "wsgawyuoayakksme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623156": [
        {
            "ioc_value": "qygwcmwcoeswgaqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623115": [
        {
            "ioc_value": "ockiiaqoiyqgquke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623116": [
        {
            "ioc_value": "oiuuqeqeomommqii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623117": [
        {
            "ioc_value": "kgcikemiigosscck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623118": [
        {
            "ioc_value": "euswyqisamaosums.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623119": [
        {
            "ioc_value": "agmmkmcqckiysiiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623120": [
        {
            "ioc_value": "qmsqukskyssecqcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623121": [
        {
            "ioc_value": "geiegauqayqoysmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623122": [
        {
            "ioc_value": "iqmsckikykaeuyqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623123": [
        {
            "ioc_value": "ceagasaamwmaaqoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623124": [
        {
            "ioc_value": "ouuoksimsekaqwoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623125": [
        {
            "ioc_value": "eusmsicogmwquyoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623126": [
        {
            "ioc_value": "mkoeyigawygqiqse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623127": [
        {
            "ioc_value": "mquqewggeeoymyey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623128": [
        {
            "ioc_value": "mqmysuoiikeoauqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623129": [
        {
            "ioc_value": "iweuqemgykuscmwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623130": [
        {
            "ioc_value": "ceayagiwcmgkgwsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623131": [
        {
            "ioc_value": "kuqyigaioiwgoosi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623132": [
        {
            "ioc_value": "ckggyeacqkuewaay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623133": [
        {
            "ioc_value": "swweicewicgugice.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623134": [
        {
            "ioc_value": "cqcayeqekecoemmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623135": [
        {
            "ioc_value": "qmqscgqmieysqime.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623094": [
        {
            "ioc_value": "yickgqscyeymaogu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623095": [
        {
            "ioc_value": "ugyyskiwoewoqoki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623096": [
        {
            "ioc_value": "ugwqykckkqaiqgeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623097": [
        {
            "ioc_value": "uugwqyugaeaekggo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623098": [
        {
            "ioc_value": "wsqogeaegwoiauyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623099": [
        {
            "ioc_value": "iqeiakaaqecqwiym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623100": [
        {
            "ioc_value": "agoacmscywiwaqkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623101": [
        {
            "ioc_value": "eukegeioesigwkui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623102": [
        {
            "ioc_value": "yimaosyeyocaokao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623103": [
        {
            "ioc_value": "oigwoycoiykysgey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623104": [
        {
            "ioc_value": "wyoisyuekwaoccou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623105": [
        {
            "ioc_value": "asosayguoamgasey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623106": [
        {
            "ioc_value": "iqwmwoakgccgoyie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623107": [
        {
            "ioc_value": "eioeiecuuwssmamy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623108": [
        {
            "ioc_value": "ouigeoowkcysiicq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623109": [
        {
            "ioc_value": "qsmqceqyugiukkos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623110": [
        {
            "ioc_value": "amssweawgiysgaiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623111": [
        {
            "ioc_value": "cwueoocegccwsegi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623112": [
        {
            "ioc_value": "qyeskcuacmwosiaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623113": [
        {
            "ioc_value": "ckeeqwossgmyasgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623114": [
        {
            "ioc_value": "kuuigawssgmuoakc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623073": [
        {
            "ioc_value": "cwwemecgwksewyqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623074": [
        {
            "ioc_value": "ywyekkskgwamckuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623075": [
        {
            "ioc_value": "wssykomcyagwsuye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623076": [
        {
            "ioc_value": "iiuokqcyqgeasmas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623077": [
        {
            "ioc_value": "euqcgameuicaeuiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623078": [
        {
            "ioc_value": "amwaswigyuyaueeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623079": [
        {
            "ioc_value": "mqaesugcyusuegco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623080": [
        {
            "ioc_value": "asogagikayyqwmsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623081": [
        {
            "ioc_value": "eoyyqewiayaiuimo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623082": [
        {
            "ioc_value": "gmymcgakwmwcgokm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623083": [
        {
            "ioc_value": "myiiweyiogagqgqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623084": [
        {
            "ioc_value": "oikwocikycoawkaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623085": [
        {
            "ioc_value": "swocgwccgeakeqka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623086": [
        {
            "ioc_value": "mkuueuiosyqkeuua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623087": [
        {
            "ioc_value": "ckiaecewseqeaowu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623088": [
        {
            "ioc_value": "gsgqccwomwiuuimi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623089": [
        {
            "ioc_value": "eaiyauucmguicmis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623090": [
        {
            "ioc_value": "skmcwsssieusmsem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623091": [
        {
            "ioc_value": "skeeuqqocmowmsai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623092": [
        {
            "ioc_value": "wkuskwmgoicuecmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623093": [
        {
            "ioc_value": "swuqogymwqukqgkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623054": [
        {
            "ioc_value": "gyqucsaiusiauwsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623055": [
        {
            "ioc_value": "gsimqeeskmqawcec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623056": [
        {
            "ioc_value": "iwakoommwkioouek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623057": [
        {
            "ioc_value": "sckcgscieukceess.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623058": [
        {
            "ioc_value": "myeugmmaqgseeewi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623059": [
        {
            "ioc_value": "wskgugiicumyyeig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623060": [
        {
            "ioc_value": "asmwkccwgcoqsicq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623061": [
        {
            "ioc_value": "yimeiugeggssskqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623062": [
        {
            "ioc_value": "kgwqogwagmsqqawg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623063": [
        {
            "ioc_value": "qysamoukgeqwywsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623064": [
        {
            "ioc_value": "scyqiocswuqicqiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623065": [
        {
            "ioc_value": "agsqyookkqgouauk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623066": [
        {
            "ioc_value": "qgeaeisamesyqkeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623067": [
        {
            "ioc_value": "gmoegcqyyaiqgiow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623068": [
        {
            "ioc_value": "qmsgaguiymwmqkqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623069": [
        {
            "ioc_value": "weeqeaogcsywkcci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623070": [
        {
            "ioc_value": "ooqeuymkeuguwccs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623071": [
        {
            "ioc_value": "wyowgiicscqkqiqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623072": [
        {
            "ioc_value": "ycqciiiuogymaoss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623035": [
        {
            "ioc_value": "mysmouqemisiaess.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623036": [
        {
            "ioc_value": "ckqaagoisemqcsac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623037": [
        {
            "ioc_value": "oocgggssueyqukmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623038": [
        {
            "ioc_value": "kgmsqcoyuaeiamcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623039": [
        {
            "ioc_value": "oiscsqmymmyakqgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623040": [
        {
            "ioc_value": "qmuiayaowkguoees.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623041": [
        {
            "ioc_value": "yomkucgggwycyekw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623042": [
        {
            "ioc_value": "aakgcieqswsimkeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623043": [
        {
            "ioc_value": "occsgaosgocoqoie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623044": [
        {
            "ioc_value": "yosggmamkkcqcgmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623045": [
        {
            "ioc_value": "mkgimayegawwuosq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623046": [
        {
            "ioc_value": "ameiimaueegyycku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623047": [
        {
            "ioc_value": "oummecouoqueayiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623048": [
        {
            "ioc_value": "ousuecesskqckkka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623049": [
        {
            "ioc_value": "uuoieayiekaqsmkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623050": [
        {
            "ioc_value": "cekimuacwueqmuas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623051": [
        {
            "ioc_value": "skcsmowaumuiyoio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623052": [
        {
            "ioc_value": "cksmwgykwcckciqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623053": [
        {
            "ioc_value": "ooymqqseyuuuiecg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623014": [
        {
            "ioc_value": "mkcgicccqimqygwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623015": [
        {
            "ioc_value": "qyawseckioygqayk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623016": [
        {
            "ioc_value": "cwmgakiaswummska.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623017": [
        {
            "ioc_value": "ckweicukgkkooaqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623018": [
        {
            "ioc_value": "gmmemossiigyciio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623019": [
        {
            "ioc_value": "wsciiccgoqckkwui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623020": [
        {
            "ioc_value": "agkqosoiuiwkqowm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623021": [
        {
            "ioc_value": "icmqwgoommeyysgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623022": [
        {
            "ioc_value": "kggyuekakcocqoeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623023": [
        {
            "ioc_value": "uuqomsqqciewqmei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623024": [
        {
            "ioc_value": "oiaguekwmmmcuose.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623025": [
        {
            "ioc_value": "aseamacuakimgewg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623026": [
        {
            "ioc_value": "ywmiwwugmuyomuak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623027": [
        {
            "ioc_value": "gmuusguwumkawywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623028": [
        {
            "ioc_value": "cwwcomqqgqmgeccg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623029": [
        {
            "ioc_value": "yiogcqaemmymuqae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623030": [
        {
            "ioc_value": "swouwsakeisgegiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623031": [
        {
            "ioc_value": "qygowwwwacqqwuis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623032": [
        {
            "ioc_value": "ascoswoooqmccokg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623033": [
        {
            "ioc_value": "ycyeyegwuekkyqwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623034": [
        {
            "ioc_value": "oceicwoomiaoimmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622995": [
        {
            "ioc_value": "eiuiugqaekwqacuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622996": [
        {
            "ioc_value": "ugceyaewcgyuqkio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622997": [
        {
            "ioc_value": "gyqagkweiawgssmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622998": [
        {
            "ioc_value": "weacumkguscewsku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622999": [
        {
            "ioc_value": "geqkuoaqsumigyyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623000": [
        {
            "ioc_value": "ougeawmakwicieaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623001": [
        {
            "ioc_value": "wysyosmmioowimou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623002": [
        {
            "ioc_value": "aaoqugugsqoaoeao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623003": [
        {
            "ioc_value": "eiqcouqmaoaumikg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623004": [
        {
            "ioc_value": "kawcksocueuaycoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623005": [
        {
            "ioc_value": "ooyquyosaqqgcwio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623006": [
        {
            "ioc_value": "eucwqoqieuosiksi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623007": [
        {
            "ioc_value": "oicyayyiuykseyag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623008": [
        {
            "ioc_value": "eomiceiqssukimss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623009": [
        {
            "ioc_value": "qymisgwaumuoakwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623010": [
        {
            "ioc_value": "qgckeqeymcqkokik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623011": [
        {
            "ioc_value": "ywseuekyqawqiowo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623012": [
        {
            "ioc_value": "mqucyaiwewkqaimy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1623013": [
        {
            "ioc_value": "icgiekeaekyciasg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622976": [
        {
            "ioc_value": "oicqkwakmikcykmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622977": [
        {
            "ioc_value": "cwkewmkkykqkmeuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622978": [
        {
            "ioc_value": "wssgwaaumwsegeoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622979": [
        {
            "ioc_value": "uoqukwescaieasck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622980": [
        {
            "ioc_value": "ugcwecmmwwgeigse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622981": [
        {
            "ioc_value": "qswcmkacmauowqcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622982": [
        {
            "ioc_value": "iccouiewowcgmkks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622983": [
        {
            "ioc_value": "yogaaegwsiucyugw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622984": [
        {
            "ioc_value": "geoeakaoswcsgcyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622985": [
        {
            "ioc_value": "eomuismywiyicyoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622986": [
        {
            "ioc_value": "wsqiikisyqceoosa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622987": [
        {
            "ioc_value": "qgswcygmsycoowak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622988": [
        {
            "ioc_value": "meymoiqyoqwuisso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622989": [
        {
            "ioc_value": "weucmeqqyuguamue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622990": [
        {
            "ioc_value": "yiucyseowsiyquom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622991": [
        {
            "ioc_value": "ckoasgeimsekmwcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622992": [
        {
            "ioc_value": "ycwgcgoyewemewmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622993": [
        {
            "ioc_value": "sccmqqwqcecyiwum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622994": [
        {
            "ioc_value": "qguaagkouguosqga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622955": [
        {
            "ioc_value": "wsigmimyiiiicqca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622956": [
        {
            "ioc_value": "uuqgkiiwcuyuucke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622957": [
        {
            "ioc_value": "uaeiusmwqemguakm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622958": [
        {
            "ioc_value": "gykeqoeiiymckwqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622959": [
        {
            "ioc_value": "sqoeauyqqwwocqgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622960": [
        {
            "ioc_value": "uukkgsiawyscsmim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622961": [
        {
            "ioc_value": "cwkyaesowuoqsciu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622962": [
        {
            "ioc_value": "ywkskaiyoiaqmmso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622963": [
        {
            "ioc_value": "iqkwucggmciiwmwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622964": [
        {
            "ioc_value": "kmiaoqysaggssiio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622965": [
        {
            "ioc_value": "qssueyqmeysscgsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622966": [
        {
            "ioc_value": "weamyyeoyoqsumks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622967": [
        {
            "ioc_value": "cwuukqgmmimuyiua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622968": [
        {
            "ioc_value": "ugaioyqiicmcwcgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622969": [
        {
            "ioc_value": "uumkcimioiokmogq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622970": [
        {
            "ioc_value": "eimwuggukswscwme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622971": [
        {
            "ioc_value": "iqgsayuoumkiemgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622972": [
        {
            "ioc_value": "kawqwggomwmmiuqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622973": [
        {
            "ioc_value": "mkugoyqscqwakgas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622974": [
        {
            "ioc_value": "icmmgoaciysqmmgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622975": [
        {
            "ioc_value": "kasyweiomoggmgoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622933": [
        {
            "ioc_value": "cqmkuyecsyemqsuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622934": [
        {
            "ioc_value": "cqsmgwqqeuuosusu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622935": [
        {
            "ioc_value": "eaeokkguegioaaae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622936": [
        {
            "ioc_value": "ugqcsewsucaagkak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622937": [
        {
            "ioc_value": "meckaiomywekycwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622938": [
        {
            "ioc_value": "gmgsosiqwcsmewss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622939": [
        {
            "ioc_value": "uoscscioeauyioqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622940": [
        {
            "ioc_value": "sqkigiaukmewukkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622941": [
        {
            "ioc_value": "swmysykcmyskyaek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622942": [
        {
            "ioc_value": "qsgoomcskemmwaki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622943": [
        {
            "ioc_value": "ycqsoequcosicmye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622944": [
        {
            "ioc_value": "wyiqwmuisiauiccg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622945": [
        {
            "ioc_value": "oumimkwggegacgsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622946": [
        {
            "ioc_value": "uosiaeussuogmiic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622947": [
        {
            "ioc_value": "myyaqaegcumskqwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622948": [
        {
            "ioc_value": "cwqweiuwsiscecoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622949": [
        {
            "ioc_value": "gyouoyoamgsgqkuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622950": [
        {
            "ioc_value": "uasoquqggmmmuqua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622951": [
        {
            "ioc_value": "ugoeiogqmyqwqamk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622952": [
        {
            "ioc_value": "scawooooacuceyqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622953": [
        {
            "ioc_value": "eougmskmkseiqeem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622954": [
        {
            "ioc_value": "mycymoskosmemuye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622910": [
        {
            "ioc_value": "uagkokwuimeokmmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622911": [
        {
            "ioc_value": "gsakcgyqswousoui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622912": [
        {
            "ioc_value": "kasoqkiymyygcqmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622913": [
        {
            "ioc_value": "aswsgiauomcmymae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622914": [
        {
            "ioc_value": "uokaygiaseqggqik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622915": [
        {
            "ioc_value": "qgoaquwsyauuceew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622916": [
        {
            "ioc_value": "geysasyuaocskgsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622917": [
        {
            "ioc_value": "uacimkisiqsgqguo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622918": [
        {
            "ioc_value": "swuiwewyiogiowea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622919": [
        {
            "ioc_value": "iiokismyigokyaoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622920": [
        {
            "ioc_value": "cwyqkaikwikiugoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622921": [
        {
            "ioc_value": "agasmwwgoqwuoiai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622922": [
        {
            "ioc_value": "ocmggowuicgmeeqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622923": [
        {
            "ioc_value": "skwiecokmiiqgmom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622924": [
        {
            "ioc_value": "meugcygwcuwoqgis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622925": [
        {
            "ioc_value": "swgusaiyieoiygsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622926": [
        {
            "ioc_value": "swywymmswicqiwos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622927": [
        {
            "ioc_value": "gsygswmieqoyciwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622928": [
        {
            "ioc_value": "oimuweomwswocyuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622929": [
        {
            "ioc_value": "scuacgmigmuaiwga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622930": [
        {
            "ioc_value": "kusyuyseeomiyksw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622931": [
        {
            "ioc_value": "ocyisiswcuskcsyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622932": [
        {
            "ioc_value": "cwqwegswqgqkwgoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622888": [
        {
            "ioc_value": "asqoegqeyaqsyswy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622889": [
        {
            "ioc_value": "qmeqcogymogqeeak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622890": [
        {
            "ioc_value": "aaaoisqckkysmicy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622891": [
        {
            "ioc_value": "skcccqgsoeoqcowy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622892": [
        {
            "ioc_value": "oiqysecscyyyewgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622893": [
        {
            "ioc_value": "weuacyygamwyesyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622894": [
        {
            "ioc_value": "cquomgceyyecswmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622895": [
        {
            "ioc_value": "oiwocuwwoasyeuec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622896": [
        {
            "ioc_value": "eoocoyyyeuaqmewu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622897": [
        {
            "ioc_value": "scmswyoowaoayogs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622898": [
        {
            "ioc_value": "uosuioguuwuqgycq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622899": [
        {
            "ioc_value": "skkeyoegiaosasua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622900": [
        {
            "ioc_value": "kmmcwmwciocaesea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622901": [
        {
            "ioc_value": "gyiemkscyagsgyqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622902": [
        {
            "ioc_value": "uayeqaysciiqkuwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622903": [
        {
            "ioc_value": "ouaqguoigskgsawc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622904": [
        {
            "ioc_value": "scuwckmomykiamey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622905": [
        {
            "ioc_value": "yciumkugkkiqyeee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622906": [
        {
            "ioc_value": "wsgogiecscyoicsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622907": [
        {
            "ioc_value": "gmaiyuyougegsqqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622908": [
        {
            "ioc_value": "sqycguccyiaoqesc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622909": [
        {
            "ioc_value": "iceamemcwkmsuumk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622865": [
        {
            "ioc_value": "geuscwogyyueuami.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622866": [
        {
            "ioc_value": "skioeuggawquukug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622867": [
        {
            "ioc_value": "eikgwuyeuguksiqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622868": [
        {
            "ioc_value": "eauwmueyiaemageg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622869": [
        {
            "ioc_value": "yiiwwaimsiksacug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622870": [
        {
            "ioc_value": "qswsgsaosueociee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622871": [
        {
            "ioc_value": "eaoowgqsyaeeygws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622872": [
        {
            "ioc_value": "kmqusmkokciiywcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622873": [
        {
            "ioc_value": "kaciwqyciwieqayq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622874": [
        {
            "ioc_value": "kumsacuioagikoye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622875": [
        {
            "ioc_value": "myeiasyeycgakqes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622876": [
        {
            "ioc_value": "agywyyggkmaaasko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622877": [
        {
            "ioc_value": "yiauweeigoyasgwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622878": [
        {
            "ioc_value": "kgigaygiqsyykssg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622879": [
        {
            "ioc_value": "oiwcoucmayowwiac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622880": [
        {
            "ioc_value": "wywcqswuccsaicsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622881": [
        {
            "ioc_value": "iiiqkioeqioywokg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622882": [
        {
            "ioc_value": "skmesyyoeasmceqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622883": [
        {
            "ioc_value": "wscgocoquaaikguw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622884": [
        {
            "ioc_value": "askokooegwuckmec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622885": [
        {
            "ioc_value": "cqwqcwqamuuequya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622886": [
        {
            "ioc_value": "icwkgaqkgygqsyis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622887": [
        {
            "ioc_value": "kmiemquqgaicqaeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622844": [
        {
            "ioc_value": "wyccussoyagmqsyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622845": [
        {
            "ioc_value": "wewcogmkakqkemys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622846": [
        {
            "ioc_value": "swaqsgcamsceowwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622847": [
        {
            "ioc_value": "eosqwcguqisscyuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622848": [
        {
            "ioc_value": "wyyemecyiwmcuuka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622849": [
        {
            "ioc_value": "ououeokuaemgmwks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622850": [
        {
            "ioc_value": "kuousugeswcsqeuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622851": [
        {
            "ioc_value": "ceoiueyucuacewsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622852": [
        {
            "ioc_value": "kmucueciagkucsgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622853": [
        {
            "ioc_value": "qswgismkceakcquc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622854": [
        {
            "ioc_value": "mkgaycsesmaamkei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622855": [
        {
            "ioc_value": "scqgmowgwkumiosw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622856": [
        {
            "ioc_value": "mqqckeyssewciqgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622857": [
        {
            "ioc_value": "iwimciqikkmqsoca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622858": [
        {
            "ioc_value": "iqkaouksyegmewse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622859": [
        {
            "ioc_value": "qgusiiiimqayioeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622860": [
        {
            "ioc_value": "wyiqwsimwsmygmga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622861": [
        {
            "ioc_value": "mkcwqsoiymocigyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622862": [
        {
            "ioc_value": "cqiockamygwyoeiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622863": [
        {
            "ioc_value": "gsogewooecuogaam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622864": [
        {
            "ioc_value": "uucmyuseugqyasci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622823": [
        {
            "ioc_value": "wkqqyuquyiwyqquy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622824": [
        {
            "ioc_value": "iiqgggmiwoskwwqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622825": [
        {
            "ioc_value": "qmeegwyayawkwsgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622826": [
        {
            "ioc_value": "kuyccyaaooayasgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622827": [
        {
            "ioc_value": "aaqusoouguqgeikk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622828": [
        {
            "ioc_value": "agisiioumgkossgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622829": [
        {
            "ioc_value": "qskcsogwciymgmiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622830": [
        {
            "ioc_value": "amgcwmigkuogkqgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622831": [
        {
            "ioc_value": "eomowwywaeqmuymi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622832": [
        {
            "ioc_value": "eoqooqkkqgkyqmke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622833": [
        {
            "ioc_value": "eagsquywiycquogq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622834": [
        {
            "ioc_value": "wsgicgsegiqikcyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622835": [
        {
            "ioc_value": "aauioaccqcywwoqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622836": [
        {
            "ioc_value": "iiwwcgqisciwaiew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622837": [
        {
            "ioc_value": "kgmciogwiycykwce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622838": [
        {
            "ioc_value": "qsuyaucsqqiswsya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622839": [
        {
            "ioc_value": "kmusymmkqyscamoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622840": [
        {
            "ioc_value": "geamgqmeseksiwiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622841": [
        {
            "ioc_value": "eomsaiiqcuqcqeia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622842": [
        {
            "ioc_value": "wsioamssimgcyeyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622843": [
        {
            "ioc_value": "aakqageckseiaauu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622801": [
        {
            "ioc_value": "wkaeyyysoqqmqiee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622802": [
        {
            "ioc_value": "skiukmiwkmemciwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622803": [
        {
            "ioc_value": "eikksqiqqogmgsew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622804": [
        {
            "ioc_value": "ugeosgigwmwgqyiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622805": [
        {
            "ioc_value": "gyygeggwyowsqgcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622806": [
        {
            "ioc_value": "gywkigesesaoqoau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622807": [
        {
            "ioc_value": "yowqqkqeywimqyue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622808": [
        {
            "ioc_value": "ouqowuqyukygccoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622809": [
        {
            "ioc_value": "ycycyegsgsicmqgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622810": [
        {
            "ioc_value": "gmesmaecssysweaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622811": [
        {
            "ioc_value": "iqkmgkewcqgkisco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622812": [
        {
            "ioc_value": "kaqucaeiikoecggo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622813": [
        {
            "ioc_value": "kgimeosymaeykygc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622814": [
        {
            "ioc_value": "wegycakeiswacqwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622815": [
        {
            "ioc_value": "uusumugsiugwmcys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622816": [
        {
            "ioc_value": "wyywwiamggsuwewk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622817": [
        {
            "ioc_value": "ouuokqiwicesamya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622818": [
        {
            "ioc_value": "myaecmyccycsocys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622819": [
        {
            "ioc_value": "qgymgaasuamgaeea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622820": [
        {
            "ioc_value": "easoemomuukuyisa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622821": [
        {
            "ioc_value": "kgsyuegmokckymoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622822": [
        {
            "ioc_value": "swgqeeeogoiysasw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622781": [
        {
            "ioc_value": "swkkkmquewakasue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622782": [
        {
            "ioc_value": "kgyyawcycyqeseie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622783": [
        {
            "ioc_value": "uucyqiwcaouagwwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622784": [
        {
            "ioc_value": "ycqmewqqmiwckuoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622785": [
        {
            "ioc_value": "ugocmqkokqaaowww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622786": [
        {
            "ioc_value": "mymmoooikksakski.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622787": [
        {
            "ioc_value": "kumayeusaueyckgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622788": [
        {
            "ioc_value": "kmqqagewysucmikc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622789": [
        {
            "ioc_value": "amiiygsekiwgmyam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622790": [
        {
            "ioc_value": "swciuoyswogmikku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622791": [
        {
            "ioc_value": "iiceocgcsueuqyyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622792": [
        {
            "ioc_value": "mqwymisaeyyaqkqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622793": [
        {
            "ioc_value": "iwwymmiymmcmaesy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622794": [
        {
            "ioc_value": "ocsceieomeqwooam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622795": [
        {
            "ioc_value": "myweukommegmqosq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622796": [
        {
            "ioc_value": "yciyeeiqwymsqcss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622797": [
        {
            "ioc_value": "gyagseaewikmwasm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622798": [
        {
            "ioc_value": "swsuoukaqcuegcme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622799": [
        {
            "ioc_value": "eoqcyqqiowcsasye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622800": [
        {
            "ioc_value": "agkuqgwqwosueumm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622758": [
        {
            "ioc_value": "wegeuuymegyquiag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622759": [
        {
            "ioc_value": "ougykycygiocgomi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622760": [
        {
            "ioc_value": "yogqesyakgueuquo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622761": [
        {
            "ioc_value": "oiwqkiiuewcemgis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622762": [
        {
            "ioc_value": "aayowmowcemucyay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622763": [
        {
            "ioc_value": "ocuywqsocewwmeus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622764": [
        {
            "ioc_value": "eoequmgayugiyiqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622765": [
        {
            "ioc_value": "cqumgemskyoscgyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622766": [
        {
            "ioc_value": "qsgimgomisgoaaos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622767": [
        {
            "ioc_value": "qmoueauokcccaiao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622768": [
        {
            "ioc_value": "oiqawowuuisuiyoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622769": [
        {
            "ioc_value": "eauggoiqgseamcmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622770": [
        {
            "ioc_value": "ocsegqcgmgoagosa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622771": [
        {
            "ioc_value": "iqgsiawsaamageye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622772": [
        {
            "ioc_value": "cwqiksmquisuwuay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622773": [
        {
            "ioc_value": "cqqgciyyauuewkms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622774": [
        {
            "ioc_value": "cqeeqkismssewsca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622775": [
        {
            "ioc_value": "cwwucqcaqqcwgemi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622776": [
        {
            "ioc_value": "yoyowqisyykwecce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622777": [
        {
            "ioc_value": "iweyycoegwkseeye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622778": [
        {
            "ioc_value": "skcweioikwsgeomy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622779": [
        {
            "ioc_value": "uockiaeekwugwesg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622780": [
        {
            "ioc_value": "uuyeqooiggmywmsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622733": [
        {
            "ioc_value": "qsmqqoyqocweqeai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622734": [
        {
            "ioc_value": "ooikawqecuqcuski.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622735": [
        {
            "ioc_value": "agiqaegwwqcqyuek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622736": [
        {
            "ioc_value": "oiquuqsgegcagymc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622737": [
        {
            "ioc_value": "geggkeuesqseqeym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622738": [
        {
            "ioc_value": "wsockoysqmwsumwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622739": [
        {
            "ioc_value": "wsacwoaqicegeeuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622740": [
        {
            "ioc_value": "asyeawykwguwwmic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622741": [
        {
            "ioc_value": "kgscsagwswwkugas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622742": [
        {
            "ioc_value": "kgskyyaiuiusgyks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622743": [
        {
            "ioc_value": "cwqyyeeaiyysyyia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622744": [
        {
            "ioc_value": "scykcekwmyoeekss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622745": [
        {
            "ioc_value": "uugwkwoueiqqkayo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622746": [
        {
            "ioc_value": "uowaoyeoacwqegay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622747": [
        {
            "ioc_value": "ywygcicqgmoesqee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622748": [
        {
            "ioc_value": "yccysgsaayqaugoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622749": [
        {
            "ioc_value": "yiycuygekyuscemw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622750": [
        {
            "ioc_value": "euoewuemuiygmyyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622751": [
        {
            "ioc_value": "sqouosiwyymmcimi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622752": [
        {
            "ioc_value": "ycykasiciouugcio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622753": [
        {
            "ioc_value": "cwesosyqyyosgekk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622754": [
        {
            "ioc_value": "mykgaguksmsscayq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622755": [
        {
            "ioc_value": "iqyuyiiqmmeemkag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622756": [
        {
            "ioc_value": "eacisqakiqkokciq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622757": [
        {
            "ioc_value": "kgmycykauuqmamky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622711": [
        {
            "ioc_value": "qyeqmmcymqgysugg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622712": [
        {
            "ioc_value": "uguumwcsikkogaew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622713": [
        {
            "ioc_value": "qmwueqgiqaieqwkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622714": [
        {
            "ioc_value": "ocgkawsaisawicgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622715": [
        {
            "ioc_value": "ywgwkieiuwiougwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622716": [
        {
            "ioc_value": "sqceiuewgcmugsac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622717": [
        {
            "ioc_value": "qssiswamekksqqck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622718": [
        {
            "ioc_value": "cqysaiuuuuaokacw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622719": [
        {
            "ioc_value": "sqoaimqcosacauqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622720": [
        {
            "ioc_value": "uuqcuqegeyeeckam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622721": [
        {
            "ioc_value": "sciweaiogamcasce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622722": [
        {
            "ioc_value": "wsgaqucquugosgww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622723": [
        {
            "ioc_value": "uoaciuemesammwau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622724": [
        {
            "ioc_value": "ousiokuwosimemuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622725": [
        {
            "ioc_value": "cqiyqyaccmiqcaei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622726": [
        {
            "ioc_value": "gyseaagyigmawgmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622727": [
        {
            "ioc_value": "mqmkoauysaqiisig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622728": [
        {
            "ioc_value": "easiaoaqkuuoukyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622729": [
        {
            "ioc_value": "mekucigeumaymcww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622730": [
        {
            "ioc_value": "aagqqimiusmqwawe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622731": [
        {
            "ioc_value": "kuwkeeouqaaueaqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622732": [
        {
            "ioc_value": "sqsecwwgwweagqqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622690": [
        {
            "ioc_value": "iqyiweauysksumqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622691": [
        {
            "ioc_value": "skwescwiqqauuuoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622692": [
        {
            "ioc_value": "ugcoyokokqgqasmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622693": [
        {
            "ioc_value": "weoyouiqaqwkgwci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622694": [
        {
            "ioc_value": "amwyayiwwokagoss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622695": [
        {
            "ioc_value": "aswgeqsmacycueyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622696": [
        {
            "ioc_value": "kmecmsoqsqoogeow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622697": [
        {
            "ioc_value": "meoecyuemmeiqoia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622698": [
        {
            "ioc_value": "kukoyksmkaqswgcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622699": [
        {
            "ioc_value": "kugssqwakigisgqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622700": [
        {
            "ioc_value": "uuckomuaigsqeieq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622701": [
        {
            "ioc_value": "icocgmoykkmsgkkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622702": [
        {
            "ioc_value": "kgciukaemigywues.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622703": [
        {
            "ioc_value": "cksawaqosguwmqsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622704": [
        {
            "ioc_value": "uuqkgwigakoyogmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622705": [
        {
            "ioc_value": "ugssseoeuomiwkqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622706": [
        {
            "ioc_value": "ocemuwgogagmwkio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622707": [
        {
            "ioc_value": "wsyqkywoceiegaem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622708": [
        {
            "ioc_value": "yoiqswsggckikuoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622709": [
        {
            "ioc_value": "qswyigqekaaiuiqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622710": [
        {
            "ioc_value": "amgceawwigeywkwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622669": [
        {
            "ioc_value": "iceoisqukumsmokw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622670": [
        {
            "ioc_value": "mkgyeyqyqiasyqsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622671": [
        {
            "ioc_value": "uukuikogawukgewc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622672": [
        {
            "ioc_value": "ycyycaymwqiymkmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622673": [
        {
            "ioc_value": "yoeeseowioycemki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622674": [
        {
            "ioc_value": "aaeukqkokyemqgso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622675": [
        {
            "ioc_value": "uooqqkagcgmqaace.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622676": [
        {
            "ioc_value": "eaoyuocswysewsia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622677": [
        {
            "ioc_value": "cqgiqqwkqoecwkmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622678": [
        {
            "ioc_value": "amgkmmiekscsmegg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622679": [
        {
            "ioc_value": "wkaggmqiciquksic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622680": [
        {
            "ioc_value": "kmiaaasmumiogsim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622681": [
        {
            "ioc_value": "iwkasuyyaosouaoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622682": [
        {
            "ioc_value": "ocgysiswmgqmiics.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622683": [
        {
            "ioc_value": "aameyuomyumkacuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622684": [
        {
            "ioc_value": "kaeuwgcmwwesaayk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622685": [
        {
            "ioc_value": "mkcmymcywqsiqwsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622686": [
        {
            "ioc_value": "weckawegqgmqqmoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622687": [
        {
            "ioc_value": "ckkqkcwkkgamyygg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622688": [
        {
            "ioc_value": "iwqmqcygigcocseg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622689": [
        {
            "ioc_value": "scysgswqoaekgoig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622648": [
        {
            "ioc_value": "mqcaqusqesuecmgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622649": [
        {
            "ioc_value": "ckeooaemkeeqosow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622650": [
        {
            "ioc_value": "eiwocqmeygakwuow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622651": [
        {
            "ioc_value": "ocemmwaaiqmegwyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622652": [
        {
            "ioc_value": "kacqygoikuqkuuya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622653": [
        {
            "ioc_value": "yiqgkkecaauomuym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622654": [
        {
            "ioc_value": "qsieyiaickymyocu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622655": [
        {
            "ioc_value": "sqiigckwkqeqcqqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622656": [
        {
            "ioc_value": "ycwkyikcukaassig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622657": [
        {
            "ioc_value": "cwousyauiswaiemy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622658": [
        {
            "ioc_value": "mysaoqaqakaymicc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622659": [
        {
            "ioc_value": "gmqyiqumkeoisakc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622660": [
        {
            "ioc_value": "wkuqqeycsuismesm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622661": [
        {
            "ioc_value": "ammeskmcagaoqcos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622662": [
        {
            "ioc_value": "ooygksqssiesssea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622663": [
        {
            "ioc_value": "cwkcmuymcgwiqqiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622664": [
        {
            "ioc_value": "cwgqueeegkwgyoye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622665": [
        {
            "ioc_value": "agegymukewmuycqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622666": [
        {
            "ioc_value": "skiagwoqksqacogg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622667": [
        {
            "ioc_value": "ociiyicmqukugyoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622668": [
        {
            "ioc_value": "kacscwoyiiiemkie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622627": [
        {
            "ioc_value": "wsuqiqggewwgqyqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622628": [
        {
            "ioc_value": "ugoqgeyosayuucuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622629": [
        {
            "ioc_value": "gywwwosuyaaggyim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622630": [
        {
            "ioc_value": "oocyiwqskisqemgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622631": [
        {
            "ioc_value": "wkwkgsgwosscyqmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622632": [
        {
            "ioc_value": "geoaecmssquuiiqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622633": [
        {
            "ioc_value": "oiosgqgoicgimyqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622634": [
        {
            "ioc_value": "iqsuiyssiqgcuuug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622635": [
        {
            "ioc_value": "gmgaisisekuwqioi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622636": [
        {
            "ioc_value": "eosqwcaucqoauggs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622637": [
        {
            "ioc_value": "qswakegwqmmcwsik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622638": [
        {
            "ioc_value": "uaaeayayysiamgac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622639": [
        {
            "ioc_value": "eoweueqqauuyqgoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622640": [
        {
            "ioc_value": "iwkmiyuuegsmakmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622641": [
        {
            "ioc_value": "askicosywqscgyga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622642": [
        {
            "ioc_value": "wseiukeoggiqksoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622643": [
        {
            "ioc_value": "myesuogwmqucyqmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622644": [
        {
            "ioc_value": "uggaiaauyymmeack.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622645": [
        {
            "ioc_value": "amicgegscaocqasq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622646": [
        {
            "ioc_value": "cqgkeyykoumyiscq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622647": [
        {
            "ioc_value": "scomgoewukmyokmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622606": [
        {
            "ioc_value": "amwgqgokgwqmmiie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622607": [
        {
            "ioc_value": "agugwcuqkeougyie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622608": [
        {
            "ioc_value": "ckisuagwawucsywo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622609": [
        {
            "ioc_value": "mqggemqaimsgukou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622610": [
        {
            "ioc_value": "aasicsuowuwieqea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622611": [
        {
            "ioc_value": "iquckqioqgcywoee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622612": [
        {
            "ioc_value": "wkeacwkiiuwcceio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622613": [
        {
            "ioc_value": "amiwimammswyccca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622614": [
        {
            "ioc_value": "gykoywoawagaeysw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622615": [
        {
            "ioc_value": "ugmioeemqwswmsay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622616": [
        {
            "ioc_value": "wkomacagwocmmoka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622617": [
        {
            "ioc_value": "aguaiymmwmeeiqsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622618": [
        {
            "ioc_value": "skigkiocawcowwym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622619": [
        {
            "ioc_value": "kugqimywicacyqyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622620": [
        {
            "ioc_value": "iwakmyuoqkokammw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622621": [
        {
            "ioc_value": "euqqmayiiyyamauy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622622": [
        {
            "ioc_value": "cqsksgscguogomka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622623": [
        {
            "ioc_value": "kaguaqoqciweoocs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622624": [
        {
            "ioc_value": "qmiaeiyyasasiwgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622625": [
        {
            "ioc_value": "kmsaqimoqowyiekc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622626": [
        {
            "ioc_value": "eiiesgaygayuquwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622585": [
        {
            "ioc_value": "eoismocimkoekawy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622586": [
        {
            "ioc_value": "wsomywewaucieiii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622587": [
        {
            "ioc_value": "qgoocuwsicsoqoai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622588": [
        {
            "ioc_value": "kawioogawyiyqakg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622589": [
        {
            "ioc_value": "oomakmuegkqkeuew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622590": [
        {
            "ioc_value": "wecwgoogaqgekyec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622591": [
        {
            "ioc_value": "gsocekcoewaaeugs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622592": [
        {
            "ioc_value": "eougwmewqyeyisko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622593": [
        {
            "ioc_value": "easuiuwgymskwmyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622594": [
        {
            "ioc_value": "skoycwkoicggggsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622595": [
        {
            "ioc_value": "iqsikqkyyumkyuka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622596": [
        {
            "ioc_value": "mquawouasegygkuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622597": [
        {
            "ioc_value": "gysweeasaqcwsygy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622598": [
        {
            "ioc_value": "weiceuwkgiskgkki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622599": [
        {
            "ioc_value": "iigicckkukugsmay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622600": [
        {
            "ioc_value": "asuoeogecssqgeua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622601": [
        {
            "ioc_value": "ckguaecogswusiuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622602": [
        {
            "ioc_value": "eiskmmokmgcsogyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622603": [
        {
            "ioc_value": "kuuwasosygeaumom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622604": [
        {
            "ioc_value": "uucwsuwcgyogmaqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622605": [
        {
            "ioc_value": "gyaoyuueymsemmac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622564": [
        {
            "ioc_value": "kmoyieimycouwaas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622565": [
        {
            "ioc_value": "wemkkmeacikcqkaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622566": [
        {
            "ioc_value": "amwsogsqyaqowykk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622567": [
        {
            "ioc_value": "eakckycgegqmayco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622568": [
        {
            "ioc_value": "gewsacewoewciwga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622569": [
        {
            "ioc_value": "wywwoakuisomyuis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622570": [
        {
            "ioc_value": "kuuigiwamcuuoumc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622571": [
        {
            "ioc_value": "eiawomuoiogaskoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622572": [
        {
            "ioc_value": "sqcsaeggykigwuem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622573": [
        {
            "ioc_value": "mkaoieikmwecqeyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622574": [
        {
            "ioc_value": "amokwyskwsciwyse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622575": [
        {
            "ioc_value": "meyiqiiogkckecsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622576": [
        {
            "ioc_value": "wywsqiyqqueuiuso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622577": [
        {
            "ioc_value": "ugeemuokssekyeae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622578": [
        {
            "ioc_value": "wsccygwcukyouimy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622579": [
        {
            "ioc_value": "iqamiagcmaauiqym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622580": [
        {
            "ioc_value": "eakwcuaoioecsuya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622581": [
        {
            "ioc_value": "mkwimiuqemoswqim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622582": [
        {
            "ioc_value": "uagywgywmimgimgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622583": [
        {
            "ioc_value": "cwcuoskaycswigyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622584": [
        {
            "ioc_value": "mqeguysmgsiicamw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622544": [
        {
            "ioc_value": "wycqmcwauuuakicw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622545": [
        {
            "ioc_value": "kmwsigqwigkgcmeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622546": [
        {
            "ioc_value": "uoquocskyueycsqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622547": [
        {
            "ioc_value": "gmgooigmkicamoai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622548": [
        {
            "ioc_value": "mqiggcuuuousswwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622549": [
        {
            "ioc_value": "mkygkkckeeskkkoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622550": [
        {
            "ioc_value": "kgcqmegugiaemami.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622551": [
        {
            "ioc_value": "kmusaumcoogyiquq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622552": [
        {
            "ioc_value": "asmwcoasgqsikqom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622553": [
        {
            "ioc_value": "squiikkksywsgqow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622554": [
        {
            "ioc_value": "wseowugweegagqss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622555": [
        {
            "ioc_value": "eiiwcoyaycigwimk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622556": [
        {
            "ioc_value": "aggeiikqikmicies.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622557": [
        {
            "ioc_value": "amyoieauesyqaemk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622558": [
        {
            "ioc_value": "gyqsguqoeseysqik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622559": [
        {
            "ioc_value": "sqoeyckycuwkcgmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622560": [
        {
            "ioc_value": "ycugueewscouwugm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622561": [
        {
            "ioc_value": "cwsuysqskckoawoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622562": [
        {
            "ioc_value": "cekwmaoqmsaymeey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622563": [
        {
            "ioc_value": "gmisiwwgkekseswu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622521": [
        {
            "ioc_value": "wykoiysauaaigkwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622522": [
        {
            "ioc_value": "qgimmeoeimsocyei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622523": [
        {
            "ioc_value": "aauwsuiiekcquoec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622524": [
        {
            "ioc_value": "iwyquegmgqyikkcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622525": [
        {
            "ioc_value": "euyiugcyqoagwuwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622526": [
        {
            "ioc_value": "swscqmkyskqiawam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622527": [
        {
            "ioc_value": "eoioioseigwsmwcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622528": [
        {
            "ioc_value": "oisqkoacsqimwgoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622529": [
        {
            "ioc_value": "ouiyyocseoekocim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622530": [
        {
            "ioc_value": "ocoiiesmqimumcui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622531": [
        {
            "ioc_value": "eiggygggwsqisiyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622532": [
        {
            "ioc_value": "qywgeqkamgauwmmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622533": [
        {
            "ioc_value": "yioykqwmywoysmem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622534": [
        {
            "ioc_value": "qsqecmmqcymuucey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622535": [
        {
            "ioc_value": "wkcyqwwgcqoyecoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622536": [
        {
            "ioc_value": "gekqimuuewwuiagu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622537": [
        {
            "ioc_value": "uuasiiyyaycusyqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622538": [
        {
            "ioc_value": "aaemqmwisiegyiko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622539": [
        {
            "ioc_value": "eikcaaimkaecgwoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622540": [
        {
            "ioc_value": "iwkgacugaaemccuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622541": [
        {
            "ioc_value": "uacoisiqcoyiiego.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622542": [
        {
            "ioc_value": "kgaisgyooscecgik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622543": [
        {
            "ioc_value": "oicqeccouucwiiqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622498": [
        {
            "ioc_value": "wsgasseeakeycsui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622499": [
        {
            "ioc_value": "iqmeasuccsssiggi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622500": [
        {
            "ioc_value": "iiiauwiiumwgokyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622501": [
        {
            "ioc_value": "qsamewmaieyoemcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622502": [
        {
            "ioc_value": "gyyiwqyyyymossew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622503": [
        {
            "ioc_value": "kmqaoocyesagqgmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622504": [
        {
            "ioc_value": "kmuogogiqscocuoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622505": [
        {
            "ioc_value": "sqwegsyymkeiqmym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622506": [
        {
            "ioc_value": "iqegwuoaoeosqeww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622507": [
        {
            "ioc_value": "uoyiywamcqcamyaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622508": [
        {
            "ioc_value": "meiqewqkkoikygeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622509": [
        {
            "ioc_value": "uakusqeceiiyaqui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622510": [
        {
            "ioc_value": "kgacycegiiyeqcga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622511": [
        {
            "ioc_value": "meyymukkckoqeags.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622512": [
        {
            "ioc_value": "ycawswmeywiksgki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622513": [
        {
            "ioc_value": "sckmssycqwaiqamw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622514": [
        {
            "ioc_value": "qguoscskywaamcik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622515": [
        {
            "ioc_value": "occoyasgeqgcywgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622516": [
        {
            "ioc_value": "geooqweeecaeuoqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622517": [
        {
            "ioc_value": "ooyakgymmekgoako.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622518": [
        {
            "ioc_value": "amkiwsmyigomkumg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622519": [
        {
            "ioc_value": "mqussskiksiuiswu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622520": [
        {
            "ioc_value": "uggkkuygmsooqwgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622476": [
        {
            "ioc_value": "qmqwockuikgwoakq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622477": [
        {
            "ioc_value": "qsywcocgqgommcci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622478": [
        {
            "ioc_value": "ookqmwkkaomekqcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622479": [
        {
            "ioc_value": "gsawaqyysukeiiaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622480": [
        {
            "ioc_value": "uuumeuqmamoqaeso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622481": [
        {
            "ioc_value": "ugymicsueuaikmkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622482": [
        {
            "ioc_value": "skugaekqiyuyaamq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622483": [
        {
            "ioc_value": "eigocwywqaqoikkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622484": [
        {
            "ioc_value": "iisuugsaiqkyakmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622485": [
        {
            "ioc_value": "euyygeuqscacqeko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622486": [
        {
            "ioc_value": "mkcoiwcsiqqauoaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622487": [
        {
            "ioc_value": "yoimekgwsyksoyyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622488": [
        {
            "ioc_value": "ugyeemqgcmeiaouq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622489": [
        {
            "ioc_value": "yccsuiqsiqwumasw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622490": [
        {
            "ioc_value": "gmsawamaqmsoysce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622491": [
        {
            "ioc_value": "iqqwwcwmseyaswis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622492": [
        {
            "ioc_value": "sqsoswycqiegmwko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622493": [
        {
            "ioc_value": "cquaesmssuwwooum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622494": [
        {
            "ioc_value": "kgwoeymawcaucqss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622495": [
        {
            "ioc_value": "meeikwqkwiogoiqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622496": [
        {
            "ioc_value": "oiicqocoouoomqua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622497": [
        {
            "ioc_value": "qymaeaguqiiiegqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622454": [
        {
            "ioc_value": "weqgoggmiuscecss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622455": [
        {
            "ioc_value": "ougemmuiqewuusok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622456": [
        {
            "ioc_value": "eacqyoaoymyyiimm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622457": [
        {
            "ioc_value": "oicoyqugwywqaisk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622458": [
        {
            "ioc_value": "kuqmkikmcaamgymy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622459": [
        {
            "ioc_value": "eimaqcmogcskagks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622460": [
        {
            "ioc_value": "meoaeaqqisqaassy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622461": [
        {
            "ioc_value": "amasiakuauqwumke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622462": [
        {
            "ioc_value": "icacwoqmqmmwksiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622463": [
        {
            "ioc_value": "wycuekmuekwiasgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622464": [
        {
            "ioc_value": "uuikcggqcgqickom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622465": [
        {
            "ioc_value": "sckokcqsuwwsyice.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622466": [
        {
            "ioc_value": "qgykoiscuiuaycwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622467": [
        {
            "ioc_value": "gmkmygkeyimaywsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622468": [
        {
            "ioc_value": "wksgiyegmacsukom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622469": [
        {
            "ioc_value": "euuyuymceckwuemg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622470": [
        {
            "ioc_value": "iciisgucgeyysaqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622471": [
        {
            "ioc_value": "ugkcywgwawciigiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622472": [
        {
            "ioc_value": "iiyceqmukagwksyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622473": [
        {
            "ioc_value": "gsokismaeqccyuew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622474": [
        {
            "ioc_value": "mycoewaksumyuqae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622475": [
        {
            "ioc_value": "qgsqmwkyuysoyymu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622429": [
        {
            "ioc_value": "icqygiuqacyucysi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622430": [
        {
            "ioc_value": "wekayewsgiweqsuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622431": [
        {
            "ioc_value": "meuyykcukweuosok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622432": [
        {
            "ioc_value": "ckakgeiwaegocwes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622433": [
        {
            "ioc_value": "iicumyeekmkogkuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622434": [
        {
            "ioc_value": "skgmuasqumoyimks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622435": [
        {
            "ioc_value": "mywmumyogoymgces.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622436": [
        {
            "ioc_value": "ouegguqmumeeuuuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622437": [
        {
            "ioc_value": "icgiiumswkaussgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622438": [
        {
            "ioc_value": "kgukwmyecogguqyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622439": [
        {
            "ioc_value": "mqiwwoecqckkgoyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622440": [
        {
            "ioc_value": "cwemosgyecuaccgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622441": [
        {
            "ioc_value": "ycgcoiaaegyeyyug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622442": [
        {
            "ioc_value": "skggmeiyewuwamow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622443": [
        {
            "ioc_value": "uoseqcoamasceuks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622444": [
        {
            "ioc_value": "ycggioisgsawsyuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622445": [
        {
            "ioc_value": "eumacsgkmocqweoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622446": [
        {
            "ioc_value": "ooqecmayoeessguo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622447": [
        {
            "ioc_value": "ycgukyqesomumikg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622448": [
        {
            "ioc_value": "ckwicskesuymkyic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622449": [
        {
            "ioc_value": "asewwwkaeagwgqau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622450": [
        {
            "ioc_value": "ociikeaukowiksaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622451": [
        {
            "ioc_value": "cekoayeggwoacigq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622452": [
        {
            "ioc_value": "asywmockuqywsecm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622453": [
        {
            "ioc_value": "gyogcogaaogggucw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622408": [
        {
            "ioc_value": "ugseumscmocusyee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622409": [
        {
            "ioc_value": "memeykasuqacusic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622410": [
        {
            "ioc_value": "iqkkuaakakusoucy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622411": [
        {
            "ioc_value": "iquiokmuacqwqwii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622412": [
        {
            "ioc_value": "gsswsauwiwcagaoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622413": [
        {
            "ioc_value": "qskuycyaqmqssioe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622414": [
        {
            "ioc_value": "gykuuqekoicueecm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622415": [
        {
            "ioc_value": "eoywuwwsmauuwucw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622416": [
        {
            "ioc_value": "kaqkgccqwqeckuem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622417": [
        {
            "ioc_value": "wkcymwqkkaiswekq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622418": [
        {
            "ioc_value": "gmsigymwcgkoqkou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622419": [
        {
            "ioc_value": "kuqmakmckmgiokyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622420": [
        {
            "ioc_value": "wkwakywqsigmwaca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622421": [
        {
            "ioc_value": "cqisimmcwaywiyeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622422": [
        {
            "ioc_value": "uawucyqkukowokyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622423": [
        {
            "ioc_value": "eaekkygwoqqaiwok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622424": [
        {
            "ioc_value": "geusoogaeoymacyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622425": [
        {
            "ioc_value": "mekyaqsmwgoiuqam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622426": [
        {
            "ioc_value": "ocqmyqoeywsweukc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622427": [
        {
            "ioc_value": "skaigkqeugcwesem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622428": [
        {
            "ioc_value": "wyssmcuwuqqskmyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622386": [
        {
            "ioc_value": "eimyeymumyqguicw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622387": [
        {
            "ioc_value": "ceiiggmecieoswog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622388": [
        {
            "ioc_value": "cwkakugioaoumywu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622389": [
        {
            "ioc_value": "yiamogemoommaqma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622390": [
        {
            "ioc_value": "uasecgsiyymwewqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622391": [
        {
            "ioc_value": "geooqeckkswqcwsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622392": [
        {
            "ioc_value": "cwyqwkgmycsimsyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622393": [
        {
            "ioc_value": "megiswiweuqmekoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622394": [
        {
            "ioc_value": "kukcqsmcqowwaqyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622395": [
        {
            "ioc_value": "qgakcwwuceoauoea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622396": [
        {
            "ioc_value": "qmuwoaymuysuggaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622397": [
        {
            "ioc_value": "oouaamqygqmkqige.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622398": [
        {
            "ioc_value": "uaasyeuqoqkagomg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622399": [
        {
            "ioc_value": "oiuiiuckyaaeoeka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622400": [
        {
            "ioc_value": "gsgwwwqmisceawwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622401": [
        {
            "ioc_value": "yoqeosqcygasmkku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622402": [
        {
            "ioc_value": "gmywoaycoqsiskie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622403": [
        {
            "ioc_value": "occosmsimggeyqko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622404": [
        {
            "ioc_value": "eaauqskkomkeaoqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622405": [
        {
            "ioc_value": "qsuimwaycciskmcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622406": [
        {
            "ioc_value": "gyuoasckycesuaaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622407": [
        {
            "ioc_value": "gewawaaesaygsqkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622364": [
        {
            "ioc_value": "ckgiagoseayeeowc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622365": [
        {
            "ioc_value": "uaqyiogmqcsckakg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622366": [
        {
            "ioc_value": "cqmomisckgcsyqcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622367": [
        {
            "ioc_value": "gsmkmukkykmygwik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622368": [
        {
            "ioc_value": "ckaikuowoesmscia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622369": [
        {
            "ioc_value": "ouakcmyesmgeguee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622370": [
        {
            "ioc_value": "gmqiwcoywumeasgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622371": [
        {
            "ioc_value": "iqeacucqkocegakk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622372": [
        {
            "ioc_value": "sceigymmuowsawyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622373": [
        {
            "ioc_value": "cqqmywkagymeocca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622374": [
        {
            "ioc_value": "yigkywwcioyscokw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622375": [
        {
            "ioc_value": "mqcoqqocoqugeimg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622376": [
        {
            "ioc_value": "mqgckoeseemsiywk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622377": [
        {
            "ioc_value": "oicocqqeyaagmkok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622378": [
        {
            "ioc_value": "aaoiuaueaggkmgcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622379": [
        {
            "ioc_value": "gmceyqkcakiaoogq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622380": [
        {
            "ioc_value": "wykcckeyyyyaccmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622381": [
        {
            "ioc_value": "gyqgmiccacysamos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622382": [
        {
            "ioc_value": "amkkwywomsimoosy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622383": [
        {
            "ioc_value": "gsimeimssakcoiky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622384": [
        {
            "ioc_value": "qmwcqgmqwsawooqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622385": [
        {
            "ioc_value": "eagmgkcqgwoguwgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622343": [
        {
            "ioc_value": "mqewgqqakuqiwsga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622344": [
        {
            "ioc_value": "geamweuswcicogsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622345": [
        {
            "ioc_value": "meuksckqaqoacosk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622346": [
        {
            "ioc_value": "ywqguaoomougyaek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622347": [
        {
            "ioc_value": "ywuqkqmwgycgooae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622348": [
        {
            "ioc_value": "kacasgwicccywewc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622349": [
        {
            "ioc_value": "mkiskgkacmcakmqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622350": [
        {
            "ioc_value": "icwawueyamkucuaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622351": [
        {
            "ioc_value": "eocmksmuwgakeiio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622352": [
        {
            "ioc_value": "kagqumgiugumokcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622353": [
        {
            "ioc_value": "askucqieisyeakek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622354": [
        {
            "ioc_value": "gmewwimsouoocimc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622355": [
        {
            "ioc_value": "gmgiyuugwwuiccuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622356": [
        {
            "ioc_value": "eaqkwsekgwiwueki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622357": [
        {
            "ioc_value": "qscoockuimkacqau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622358": [
        {
            "ioc_value": "amuysaamiocsqmmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622359": [
        {
            "ioc_value": "kmccqgesciyqowyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622360": [
        {
            "ioc_value": "scoeqgkuaaeamiwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622361": [
        {
            "ioc_value": "oioqoaqmwicyowwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622362": [
        {
            "ioc_value": "iqycwocqyygkkgyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622363": [
        {
            "ioc_value": "ocescowyokqyqeqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622319": [
        {
            "ioc_value": "iwmgeseekgmsyqeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622320": [
        {
            "ioc_value": "gsigaomuayquqwwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622321": [
        {
            "ioc_value": "geiooyyeasisokky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622322": [
        {
            "ioc_value": "gmuwmcguawkawooc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622323": [
        {
            "ioc_value": "aaogqekocagewcic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622324": [
        {
            "ioc_value": "kmkomawyuwcgqyei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622325": [
        {
            "ioc_value": "eucmcwomoemceqek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622326": [
        {
            "ioc_value": "yiyugqyqaasciygm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622327": [
        {
            "ioc_value": "mqigmsoueomgkoca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622328": [
        {
            "ioc_value": "aseoosiaewwywike.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622329": [
        {
            "ioc_value": "oicsiycwoaooewcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622330": [
        {
            "ioc_value": "myuygmuqkywemogk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622331": [
        {
            "ioc_value": "wsaceysuoiyuewwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622332": [
        {
            "ioc_value": "uumaakcmsmauogyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622333": [
        {
            "ioc_value": "ooicgcicaiekcqey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622334": [
        {
            "ioc_value": "amuyoykckoqwieka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622335": [
        {
            "ioc_value": "iwqegmaossqooqqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622336": [
        {
            "ioc_value": "iwiiksugggiwkcqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622337": [
        {
            "ioc_value": "asyokauugeueqcoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622338": [
        {
            "ioc_value": "qgooimqqqccaokiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622339": [
        {
            "ioc_value": "eiqkoygaouayqsck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622340": [
        {
            "ioc_value": "scwaeqiwkeaoyqwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622341": [
        {
            "ioc_value": "icwiugoqscacoqko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622342": [
        {
            "ioc_value": "cqeowiccyassacgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622295": [
        {
            "ioc_value": "kmugsmyiowigcgog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622296": [
        {
            "ioc_value": "askiigyykawkqkco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622297": [
        {
            "ioc_value": "wyyuwewkiyegmwse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622298": [
        {
            "ioc_value": "gmemqsskiagoguiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622299": [
        {
            "ioc_value": "uocuiysseyossyia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622300": [
        {
            "ioc_value": "ckimgmsowewgcicq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622301": [
        {
            "ioc_value": "gyuiciimawycuium.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622302": [
        {
            "ioc_value": "yiwmcwwgeyokogsu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622303": [
        {
            "ioc_value": "sqkumykgsoiquyyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622304": [
        {
            "ioc_value": "qmycygsioswggocq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622305": [
        {
            "ioc_value": "cwoesuegeogomysg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622306": [
        {
            "ioc_value": "qgswqiamimcacqki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622307": [
        {
            "ioc_value": "aauqmgwasyeaeyom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622308": [
        {
            "ioc_value": "asesskcqauoqqosc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622309": [
        {
            "ioc_value": "gyuwcammywwiaiyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622310": [
        {
            "ioc_value": "wegwyewyaookigqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622311": [
        {
            "ioc_value": "eagquaawkwycmyak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622312": [
        {
            "ioc_value": "eaiwyqoqwiqqwoyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622313": [
        {
            "ioc_value": "eokyeukeiweawaai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622314": [
        {
            "ioc_value": "iqicooewceueciss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622315": [
        {
            "ioc_value": "eiswiaugesuoawai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622316": [
        {
            "ioc_value": "iwwwiqmaukwwkyma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622317": [
        {
            "ioc_value": "kgiaugwwgqwocqoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622318": [
        {
            "ioc_value": "mkymkuoaqccycsqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622273": [
        {
            "ioc_value": "cwokaicumkqeaeme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622274": [
        {
            "ioc_value": "eisqeysmqksaeqmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622275": [
        {
            "ioc_value": "qgkouemsossquuyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622276": [
        {
            "ioc_value": "kmgyaoiuougkaski.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622277": [
        {
            "ioc_value": "cqkgiwuoceguioei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622278": [
        {
            "ioc_value": "oomwugawmsckcakm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622279": [
        {
            "ioc_value": "eagimiwoowwmygia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622280": [
        {
            "ioc_value": "scyguuacwkqwswms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622281": [
        {
            "ioc_value": "ckusckeqigwuyigk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622282": [
        {
            "ioc_value": "myscwmsskwkamyyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622283": [
        {
            "ioc_value": "uokmsamcciismwoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622284": [
        {
            "ioc_value": "qmaeowwkyiugoesc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622285": [
        {
            "ioc_value": "uagsimymikoaugqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622286": [
        {
            "ioc_value": "uawoyymikgkcsaaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622287": [
        {
            "ioc_value": "sqwuwkooywocuski.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622288": [
        {
            "ioc_value": "agsokgiawwawyuqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622289": [
        {
            "ioc_value": "easqseuokyeoymwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622290": [
        {
            "ioc_value": "ywokoaiukumamaki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622291": [
        {
            "ioc_value": "aakgqagcckqsyaew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622292": [
        {
            "ioc_value": "asyocqgoseuckwyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622293": [
        {
            "ioc_value": "mkqaiqegycukgmsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622294": [
        {
            "ioc_value": "uaackikossweioos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622250": [
        {
            "ioc_value": "ceiaeyoqysywagkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622251": [
        {
            "ioc_value": "qgewcwmokwuwqgcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622252": [
        {
            "ioc_value": "gsiikkasykswiyya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622253": [
        {
            "ioc_value": "kgemiugoimosmqmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622254": [
        {
            "ioc_value": "ooosckscwgcwwsyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622255": [
        {
            "ioc_value": "eocsqiuscaeqguoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622256": [
        {
            "ioc_value": "wyqwwsyoaqqqwawa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622257": [
        {
            "ioc_value": "sccqeqyggyicscak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622258": [
        {
            "ioc_value": "aaseoewwqcsguqwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622259": [
        {
            "ioc_value": "ywuouyqeaukmeouw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622260": [
        {
            "ioc_value": "ascuykwiusogyouo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622261": [
        {
            "ioc_value": "oomoooyiiwukqsim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622262": [
        {
            "ioc_value": "kguyaeeksqcqyoey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622263": [
        {
            "ioc_value": "kmmmwqoccggoqowo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622264": [
        {
            "ioc_value": "cwsqguioggaoauwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622265": [
        {
            "ioc_value": "wyqmygkuckyqaqoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622266": [
        {
            "ioc_value": "iqykwygwuqqwyiau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622267": [
        {
            "ioc_value": "iqqqemgwwiqamgoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622268": [
        {
            "ioc_value": "uusgekecmkeaiwiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622269": [
        {
            "ioc_value": "oomueaowesammggq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622270": [
        {
            "ioc_value": "yiisqqugiawosqkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622271": [
        {
            "ioc_value": "iwmsoquiocaaiuse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622272": [
        {
            "ioc_value": "gsywsoemmmgekyka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622227": [
        {
            "ioc_value": "myymmymemiwyoewg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622228": [
        {
            "ioc_value": "qyeckegcweqaioqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622229": [
        {
            "ioc_value": "amcmsskuyuasswig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622230": [
        {
            "ioc_value": "kgymsuemiyqmkumg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622231": [
        {
            "ioc_value": "mqiokeyckawauacs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622232": [
        {
            "ioc_value": "ouqkowuogasaekcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622233": [
        {
            "ioc_value": "uuiqowcamiwuqoka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622234": [
        {
            "ioc_value": "kuqyaauiagckuyow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622235": [
        {
            "ioc_value": "gmwsckgwsemuaacc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622236": [
        {
            "ioc_value": "iwmqywuuyoyaagkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622237": [
        {
            "ioc_value": "amkssewcmweyicim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622238": [
        {
            "ioc_value": "uagcacigasyqgiqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622239": [
        {
            "ioc_value": "uukisqweocukekuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622240": [
        {
            "ioc_value": "agayagckwyqckmiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622241": [
        {
            "ioc_value": "ouwoaimagmuaoikg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622242": [
        {
            "ioc_value": "qgeskmqcuqmoqgai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622243": [
        {
            "ioc_value": "qgicumywoqcykgig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622244": [
        {
            "ioc_value": "eascuakmmsmwgyce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622245": [
        {
            "ioc_value": "amusquaeeuukeqoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622246": [
        {
            "ioc_value": "kgioieikmicmocyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622247": [
        {
            "ioc_value": "ugisigyskequykaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622248": [
        {
            "ioc_value": "yosakqwiiiwqwook.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622249": [
        {
            "ioc_value": "uuoiemaewsiwamac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622208": [
        {
            "ioc_value": "gskogiukyycsqcue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622209": [
        {
            "ioc_value": "iimkyeeqeugicuws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622210": [
        {
            "ioc_value": "gmacmcqqaeyiqwie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622211": [
        {
            "ioc_value": "gmwwqgaigwuwmmqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622212": [
        {
            "ioc_value": "geysckgyiiqaaqek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622213": [
        {
            "ioc_value": "swqoskewmcokqwak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622214": [
        {
            "ioc_value": "kgiqiwewiacgkswk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622215": [
        {
            "ioc_value": "kmkamswyuuscksyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622216": [
        {
            "ioc_value": "eawkyyakumqeygcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622217": [
        {
            "ioc_value": "gsseegmsoeewauaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622218": [
        {
            "ioc_value": "ywequqoksggayiis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622219": [
        {
            "ioc_value": "aaywuykyewmeccuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622220": [
        {
            "ioc_value": "ycuyaywmyqquswce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622221": [
        {
            "ioc_value": "amokisymokgkkmuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622222": [
        {
            "ioc_value": "oowgisaoqicoqcum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622223": [
        {
            "ioc_value": "meqmgqackyyksega.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622224": [
        {
            "ioc_value": "iwkkmowgememcsoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622225": [
        {
            "ioc_value": "ouumouicauycyoig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622226": [
        {
            "ioc_value": "uoygoocymauuaeqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622187": [
        {
            "ioc_value": "ocykykimokyqeyaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622188": [
        {
            "ioc_value": "agawwqwcocccicei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622189": [
        {
            "ioc_value": "qsicqosiecgqcqeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622190": [
        {
            "ioc_value": "mkyyusiwqecesgke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622191": [
        {
            "ioc_value": "qmiiiawomogqmgcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622192": [
        {
            "ioc_value": "aguwuieqaiqgoaoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622193": [
        {
            "ioc_value": "cwwuemigqgcyemog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622194": [
        {
            "ioc_value": "iqmwgkeumugmeqqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622195": [
        {
            "ioc_value": "gmygiuaacieoaiqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622196": [
        {
            "ioc_value": "uguugmgackgomeoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622197": [
        {
            "ioc_value": "oogsgcocusiqywkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622198": [
        {
            "ioc_value": "gycsiyuiseiaguca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622199": [
        {
            "ioc_value": "cwusikkusiqwkgka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622200": [
        {
            "ioc_value": "geekauwaiaeqgimy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622201": [
        {
            "ioc_value": "sqwmiyemyeicqceo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622202": [
        {
            "ioc_value": "eiswuqkymciggiuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622203": [
        {
            "ioc_value": "qgicsqyyaosggmuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622204": [
        {
            "ioc_value": "gsscosaoigcycmow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622205": [
        {
            "ioc_value": "swyueeocqqqaegoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622206": [
        {
            "ioc_value": "cqgweyugwgoqeoqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622207": [
        {
            "ioc_value": "iwikiegcqemoskgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622168": [
        {
            "ioc_value": "easeskyukakkssok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622169": [
        {
            "ioc_value": "agguqykmmceakeqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622170": [
        {
            "ioc_value": "wsseugymmgqoseag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622171": [
        {
            "ioc_value": "ceyugyuwucoawwuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622172": [
        {
            "ioc_value": "iwausuyueeaiygoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622173": [
        {
            "ioc_value": "cqamsceuwqowqewi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622174": [
        {
            "ioc_value": "icuawuogcygcogam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622175": [
        {
            "ioc_value": "uukwgueyaoouiyqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622176": [
        {
            "ioc_value": "oicqaaeyaqqosqww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622177": [
        {
            "ioc_value": "ugguyiuiqqocmmse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622178": [
        {
            "ioc_value": "wskoggaaoeeigmos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622179": [
        {
            "ioc_value": "aakkuysmuoesweoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622180": [
        {
            "ioc_value": "geicssmomgskquci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622181": [
        {
            "ioc_value": "oossyeskymucasoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622182": [
        {
            "ioc_value": "gywmucaoacgoagum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622183": [
        {
            "ioc_value": "uguiaeuymsqowsma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622184": [
        {
            "ioc_value": "mqooayqmkyceokkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622185": [
        {
            "ioc_value": "oiwqggeaqumegiws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622186": [
        {
            "ioc_value": "uosuigmuqieyoooe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622156": [
        {
            "ioc_value": "sqcuwcawoqsocyys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622157": [
        {
            "ioc_value": "yiyygiicayumqkuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622158": [
        {
            "ioc_value": "cqeomequeeeeysgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622159": [
        {
            "ioc_value": "ycqeccgisusoyemk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622160": [
        {
            "ioc_value": "megiiaeomsmgwywu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622161": [
        {
            "ioc_value": "ouqokqmkicayggcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622162": [
        {
            "ioc_value": "qgcqswmikwkqeaae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622163": [
        {
            "ioc_value": "mycwiueueagaoqee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622164": [
        {
            "ioc_value": "qywkaqiqcoicqcwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622165": [
        {
            "ioc_value": "amqqaauewseqowiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622166": [
        {
            "ioc_value": "uaemusigikyqaeso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622167": [
        {
            "ioc_value": "asmimoogusysyoie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622146": [
        {
            "ioc_value": "wsuoysmyewmyeiwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622147": [
        {
            "ioc_value": "ceuwcgcemuoqommm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622148": [
        {
            "ioc_value": "geawiyaceyccmsec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622149": [
        {
            "ioc_value": "qsqequaocwqowouu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622150": [
        {
            "ioc_value": "weoyuaokqwciegqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622151": [
        {
            "ioc_value": "iiogsoeuksewaqae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622152": [
        {
            "ioc_value": "iikguwcckkysseeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622153": [
        {
            "ioc_value": "ckakgimyegcemksy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622154": [
        {
            "ioc_value": "uockwuoiaskimaya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622155": [
        {
            "ioc_value": "ywiuiqowugcekacg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622125": [
        {
            "ioc_value": "uagkquwqwqckewew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622126": [
        {
            "ioc_value": "uawwugqgqgiegsqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622127": [
        {
            "ioc_value": "kawoiawekmgckese.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622128": [
        {
            "ioc_value": "wymmicyciooicwiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622129": [
        {
            "ioc_value": "ugwcwygiqymyimck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622130": [
        {
            "ioc_value": "iqgqgimiegyccuys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622131": [
        {
            "ioc_value": "iqkiimoagwcsygqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622132": [
        {
            "ioc_value": "ugkesasuyiagcsmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622133": [
        {
            "ioc_value": "cqyuekosksgyamma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622134": [
        {
            "ioc_value": "icyigamgcqwweois.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622135": [
        {
            "ioc_value": "ouwwqmywkauiyyou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622136": [
        {
            "ioc_value": "yoeowwkkgkiwciki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622137": [
        {
            "ioc_value": "gsiaiguwcgsoiwoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622138": [
        {
            "ioc_value": "wsimoccmkcciogse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622139": [
        {
            "ioc_value": "myceekimoooeyqcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622140": [
        {
            "ioc_value": "agymosymgyiksiua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622141": [
        {
            "ioc_value": "wewsquuwaywymywm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622142": [
        {
            "ioc_value": "mkuwiouyceooeicw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622143": [
        {
            "ioc_value": "ckuuewcogywskueu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622144": [
        {
            "ioc_value": "iwusoeicomiskqgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622145": [
        {
            "ioc_value": "asausuowoumyyssg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622104": [
        {
            "ioc_value": "yokswcwaqcmiygcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622105": [
        {
            "ioc_value": "kakciaaccasaamau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622106": [
        {
            "ioc_value": "iqauuqioicumieik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622107": [
        {
            "ioc_value": "iquoosqyeimgayym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622108": [
        {
            "ioc_value": "aggqceoaeccuocum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622109": [
        {
            "ioc_value": "kgssqasoqewwsmwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622110": [
        {
            "ioc_value": "mksiaiyccmccuecw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622111": [
        {
            "ioc_value": "eosacgqcgwwkgouw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622112": [
        {
            "ioc_value": "qmaeqawiyksquusi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622113": [
        {
            "ioc_value": "qymwqauowagyemey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622114": [
        {
            "ioc_value": "aakmqmkaqggoggoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622115": [
        {
            "ioc_value": "ywmcokgguckaeaui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622116": [
        {
            "ioc_value": "iiwugsuseemymuem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622117": [
        {
            "ioc_value": "mkekweuswgcqwacy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622118": [
        {
            "ioc_value": "ooyaeaysgqesakki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622119": [
        {
            "ioc_value": "mqywaekkmkessgao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622120": [
        {
            "ioc_value": "ugkciseuesckgisy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622121": [
        {
            "ioc_value": "iwwiogqqwcwoqkau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622122": [
        {
            "ioc_value": "uoiyeqassqigoime.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622123": [
        {
            "ioc_value": "qgmuikmwiwiwsswa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622124": [
        {
            "ioc_value": "oiaoykwkikeqqwsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622084": [
        {
            "ioc_value": "geusywaqmggskeqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622085": [
        {
            "ioc_value": "cqqmqsusykegyugy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622086": [
        {
            "ioc_value": "yimmyssqoeugoeia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622087": [
        {
            "ioc_value": "iicoukoycyowiggw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622088": [
        {
            "ioc_value": "kmegyqewcgyoeemk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622089": [
        {
            "ioc_value": "sqykcewawakewyye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622090": [
        {
            "ioc_value": "uoqekweacwecwkgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622091": [
        {
            "ioc_value": "uoqwacywasyeeowk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622092": [
        {
            "ioc_value": "uuewauqkaeuwwqcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622093": [
        {
            "ioc_value": "gycqeyqoqoiykykg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622094": [
        {
            "ioc_value": "uakiuqugeyiegcsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622095": [
        {
            "ioc_value": "wyameswuymsuyuis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622096": [
        {
            "ioc_value": "eoweuguooeeumuuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622097": [
        {
            "ioc_value": "ascmgqwyqkwwmuio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622098": [
        {
            "ioc_value": "uoqyemwwysauquec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622099": [
        {
            "ioc_value": "uoamgwumekwcqkcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622100": [
        {
            "ioc_value": "cwqsqygggkwqsiok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622101": [
        {
            "ioc_value": "kgeimkisuikqoewe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622102": [
        {
            "ioc_value": "ooisygssiwaqmowm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622103": [
        {
            "ioc_value": "yoyoaigaaiciuowy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622063": [
        {
            "ioc_value": "eowiqaikgaaeuweo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622064": [
        {
            "ioc_value": "oissacweacagsiiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622065": [
        {
            "ioc_value": "cwqyaysukcosgauw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622066": [
        {
            "ioc_value": "wsuyuyymeoaaoemg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622067": [
        {
            "ioc_value": "ocaoysmuakqaqwge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622068": [
        {
            "ioc_value": "ouqqesiygioaommi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622069": [
        {
            "ioc_value": "cqacuamqckyiamsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622070": [
        {
            "ioc_value": "mksmcuysmweqsemo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622071": [
        {
            "ioc_value": "cwsusaucwesauqkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622072": [
        {
            "ioc_value": "scmcaqeyyaeoksuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622073": [
        {
            "ioc_value": "ycyummmeiqiiwwug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622074": [
        {
            "ioc_value": "wscgsqwsoqqqiauo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622075": [
        {
            "ioc_value": "ywgmqwsgacyuekgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622076": [
        {
            "ioc_value": "yceaacuwywikocmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622077": [
        {
            "ioc_value": "kgeceqaaumwcucgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622078": [
        {
            "ioc_value": "kgaqsmaiuewqagce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622079": [
        {
            "ioc_value": "sqsuequaaiwmaesi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622080": [
        {
            "ioc_value": "ycwqgooyuqgaoiwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622081": [
        {
            "ioc_value": "iioqagimwasugwca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622082": [
        {
            "ioc_value": "gmuckkusawmkkwkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622083": [
        {
            "ioc_value": "qgwmegwaaekoomqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622041": [
        {
            "ioc_value": "agamggmimsmcekcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622042": [
        {
            "ioc_value": "skswukgeakmcemgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622043": [
        {
            "ioc_value": "skmooyyeicyqycim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622044": [
        {
            "ioc_value": "squucmgqegqgsuyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622045": [
        {
            "ioc_value": "amwkygawuiygkscw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622046": [
        {
            "ioc_value": "kgmeqcsmcemwkqaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622047": [
        {
            "ioc_value": "uuayaqwygisyigus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622048": [
        {
            "ioc_value": "agceceaqmwquoyce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622049": [
        {
            "ioc_value": "wkgikmekmamqmuau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622050": [
        {
            "ioc_value": "skuguwkeyaaqiiks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622051": [
        {
            "ioc_value": "skseuiceskwmyqgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622052": [
        {
            "ioc_value": "cwyiikiwykigwkeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622053": [
        {
            "ioc_value": "kgwwaqikomaemuuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622054": [
        {
            "ioc_value": "qsoqcoiiwumggsik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622055": [
        {
            "ioc_value": "geuwumqkgokkqwou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622056": [
        {
            "ioc_value": "asocqyeggeaoumis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622057": [
        {
            "ioc_value": "eosokkwqaokauicm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622058": [
        {
            "ioc_value": "uokqkcqwmgiawwwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622059": [
        {
            "ioc_value": "uoqqessmeuegimqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622060": [
        {
            "ioc_value": "ckwosakwwkimoqow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622061": [
        {
            "ioc_value": "icqcaoauwygyoiyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622062": [
        {
            "ioc_value": "weycmigcomkmgkic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622018": [
        {
            "ioc_value": "iqqmcikgoigaeuoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622019": [
        {
            "ioc_value": "ywyqiuyccuisaawo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622020": [
        {
            "ioc_value": "asigemmcuaewmkai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622021": [
        {
            "ioc_value": "uawakkosogygemqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622022": [
        {
            "ioc_value": "qsowyycwgqqeykmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622023": [
        {
            "ioc_value": "iigiyakwekaoqmii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622024": [
        {
            "ioc_value": "sciyyskmqwkiiecm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622025": [
        {
            "ioc_value": "oiqgqkgacamsyssa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622026": [
        {
            "ioc_value": "cegeygeqcaoiacsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622027": [
        {
            "ioc_value": "myuoeoawoiceiosy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622028": [
        {
            "ioc_value": "cksmoicoikksqmii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622029": [
        {
            "ioc_value": "mkeikwycgmsowqew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622030": [
        {
            "ioc_value": "kgecwgaaigqumyey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622031": [
        {
            "ioc_value": "meaquomwkooceieu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622032": [
        {
            "ioc_value": "qmyooiqeeomussem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622033": [
        {
            "ioc_value": "scuumyqkyuaoiwew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622034": [
        {
            "ioc_value": "ywwmwoqmgyqgokay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622035": [
        {
            "ioc_value": "ywkiiwmqmaiwaeiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622036": [
        {
            "ioc_value": "qyuiwycqaiocqskw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622037": [
        {
            "ioc_value": "yiwmqwgoqsqceyko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622038": [
        {
            "ioc_value": "kgkwisawcogaaacq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622039": [
        {
            "ioc_value": "geiqkceamaoaiiaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622040": [
        {
            "ioc_value": "yomkeaisuyksyyww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621997": [
        {
            "ioc_value": "icoucuwwmeyoyauk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621998": [
        {
            "ioc_value": "qsmoewyuyeuksgyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621999": [
        {
            "ioc_value": "sqoqumkywgowgikk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622000": [
        {
            "ioc_value": "eomkwokqcsgkamiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622001": [
        {
            "ioc_value": "mqkwouwuueuoyaqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622002": [
        {
            "ioc_value": "ywueyakacegogyug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622003": [
        {
            "ioc_value": "kusogyockcqieqgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622004": [
        {
            "ioc_value": "qykqcyigmyqieium.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622005": [
        {
            "ioc_value": "swseqkcceiemwoks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622006": [
        {
            "ioc_value": "gysisesiqqssyqiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622007": [
        {
            "ioc_value": "qyuqesuimyyymoos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622008": [
        {
            "ioc_value": "sciswaieycmagokq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622009": [
        {
            "ioc_value": "qmcewcayimieguog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622010": [
        {
            "ioc_value": "mycamwookoeossuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622011": [
        {
            "ioc_value": "myoogewsawqmiugu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622012": [
        {
            "ioc_value": "eoqwwwummaooausa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622013": [
        {
            "ioc_value": "kgwmewmamukaeige.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622014": [
        {
            "ioc_value": "weuqkuieuuwwysqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622015": [
        {
            "ioc_value": "eoakkickimeywyik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622016": [
        {
            "ioc_value": "meyiausymesymuqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1622017": [
        {
            "ioc_value": "yowucqscmmcmmuyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621975": [
        {
            "ioc_value": "scimiseieuiyiagu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621976": [
        {
            "ioc_value": "gekiocyqsokgwqmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621977": [
        {
            "ioc_value": "oioeemqkweyqocuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621978": [
        {
            "ioc_value": "ocggwuieqaceeeom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621979": [
        {
            "ioc_value": "ociigusgsoauaysm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621980": [
        {
            "ioc_value": "yckkuuquoqaiegiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621981": [
        {
            "ioc_value": "weyokgoiyeqaommu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621982": [
        {
            "ioc_value": "uagcuyqkqcmcwkyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621983": [
        {
            "ioc_value": "oigmwqmigsyeqewo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621984": [
        {
            "ioc_value": "wykguygusqmggaqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621985": [
        {
            "ioc_value": "yoquomeiokwgoqea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621986": [
        {
            "ioc_value": "skqukeeykqcesgea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621987": [
        {
            "ioc_value": "iqsgkqkomaquqyiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621988": [
        {
            "ioc_value": "qyuiycaauaqgqwke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621989": [
        {
            "ioc_value": "euwumueayqaksmaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621990": [
        {
            "ioc_value": "gyacgqyysyyquaqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621991": [
        {
            "ioc_value": "geuqggmocyisayug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621992": [
        {
            "ioc_value": "wkokaoaooukymqoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621993": [
        {
            "ioc_value": "eouyuuuimeaucewm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621994": [
        {
            "ioc_value": "qgqwaqoiagiyksgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621995": [
        {
            "ioc_value": "ywgwkusaioagmmmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621996": [
        {
            "ioc_value": "eogcamggqmcoauue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621953": [
        {
            "ioc_value": "ouqwwykegmwqgags.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621954": [
        {
            "ioc_value": "wswkgoqcaocyucuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621955": [
        {
            "ioc_value": "myesyumkisquscqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621956": [
        {
            "ioc_value": "wkmeieqysqywkqoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621957": [
        {
            "ioc_value": "weimomuuuksiguki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621958": [
        {
            "ioc_value": "icwsqyagkmicmiga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621959": [
        {
            "ioc_value": "mqyouwekgciuywqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621960": [
        {
            "ioc_value": "asguacsqcaumsiqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621961": [
        {
            "ioc_value": "meowwsmkqggcagys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621962": [
        {
            "ioc_value": "iquoucsysikggowo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621963": [
        {
            "ioc_value": "myqoiygoswukocum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621964": [
        {
            "ioc_value": "sqeweqgecgmyeeei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621965": [
        {
            "ioc_value": "swsekmsoqyggseoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621966": [
        {
            "ioc_value": "amuegoouwguoeoga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621967": [
        {
            "ioc_value": "eokyayaeowsowgiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621968": [
        {
            "ioc_value": "iwskaqewaeayuksc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621969": [
        {
            "ioc_value": "ugoqcoqkmmkaiaem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621970": [
        {
            "ioc_value": "aakgyeokkmegmcsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621971": [
        {
            "ioc_value": "kuikccwiciasqyqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621972": [
        {
            "ioc_value": "asuwkaukgkgwiyok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621973": [
        {
            "ioc_value": "gygwcmowmykqccum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621974": [
        {
            "ioc_value": "ooegoasouiueamym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621928": [
        {
            "ioc_value": "sckcawcwkmmqaywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621929": [
        {
            "ioc_value": "sqsosaaekgawykmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621930": [
        {
            "ioc_value": "ceumyskwssagmmkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621931": [
        {
            "ioc_value": "ywkusmeeqkwgwqwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621932": [
        {
            "ioc_value": "agwkmsckqekwacyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621933": [
        {
            "ioc_value": "uaumiiwamequusyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621934": [
        {
            "ioc_value": "uagamemuyqeskkek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621935": [
        {
            "ioc_value": "uukosueyacsgcesy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621936": [
        {
            "ioc_value": "wyiswayukugikcck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621937": [
        {
            "ioc_value": "eakikckgyokmwugm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621938": [
        {
            "ioc_value": "occiasooqqqsuuqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621939": [
        {
            "ioc_value": "ywcawqisaqgyoacs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621940": [
        {
            "ioc_value": "cwgkwoaeowiesigu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621941": [
        {
            "ioc_value": "amaieuyoseoqaywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621942": [
        {
            "ioc_value": "uayaeeewqagyqusw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621943": [
        {
            "ioc_value": "ugyikuquesqysukg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621944": [
        {
            "ioc_value": "aswyckgewwokoouq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621945": [
        {
            "ioc_value": "kaqaymyoewyuqoag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621946": [
        {
            "ioc_value": "aagoiegqgqgqwmom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621947": [
        {
            "ioc_value": "ywokyocuqqeqcewc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621948": [
        {
            "ioc_value": "wyqsywmygguumocw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621949": [
        {
            "ioc_value": "cqessommgeeaymkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621950": [
        {
            "ioc_value": "cqcumqgieyimasye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621951": [
        {
            "ioc_value": "oicccisgoguaemuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621952": [
        {
            "ioc_value": "ycyaecwcuckscoqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621904": [
        {
            "ioc_value": "gseyskiwoiqmoqky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621905": [
        {
            "ioc_value": "cwaweqieycwqiqui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621906": [
        {
            "ioc_value": "qggiqsqcqooqaiaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621907": [
        {
            "ioc_value": "myuuwuayoyeqasms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621908": [
        {
            "ioc_value": "qyusaomkuqyougus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621909": [
        {
            "ioc_value": "weokimigqyyekwge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621910": [
        {
            "ioc_value": "qsaeamgkeoowoegg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621911": [
        {
            "ioc_value": "asksucqecakcwkei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621912": [
        {
            "ioc_value": "iiycgwcimyomwkse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621913": [
        {
            "ioc_value": "ckewmsecwmusmkmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621914": [
        {
            "ioc_value": "ceeigcigkgmagcoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621915": [
        {
            "ioc_value": "kuwimmkeksmemywq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621916": [
        {
            "ioc_value": "uugsagogkwcoqwik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621917": [
        {
            "ioc_value": "gyyyeuicciiwuqcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621918": [
        {
            "ioc_value": "eueciuuwecmkcack.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621919": [
        {
            "ioc_value": "sqokscceiwgcemys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621920": [
        {
            "ioc_value": "sqaoqykkuyigwyky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621921": [
        {
            "ioc_value": "wkgqsauqawkqyuyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621922": [
        {
            "ioc_value": "eiqskmsgukssscmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621923": [
        {
            "ioc_value": "wsueegsmiymwoegs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621924": [
        {
            "ioc_value": "qysaqqkeaacqmyyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621925": [
        {
            "ioc_value": "euyyascegeqmaymc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621926": [
        {
            "ioc_value": "euugmkqkguacogau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621927": [
        {
            "ioc_value": "ouciyosoesycesag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621881": [
        {
            "ioc_value": "uuwgckaucikckqwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621882": [
        {
            "ioc_value": "uoikyywmmgcwigwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621883": [
        {
            "ioc_value": "aaqmgomqaoisakia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621884": [
        {
            "ioc_value": "gsoeieawusmeeism.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621885": [
        {
            "ioc_value": "kgamousgsiweucuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621886": [
        {
            "ioc_value": "eumymuoeiykyisss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621887": [
        {
            "ioc_value": "eociysuimsouukiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621888": [
        {
            "ioc_value": "qmskuiuciyoyoskg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621889": [
        {
            "ioc_value": "mqgaaqoqicqsqwae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621890": [
        {
            "ioc_value": "ywoeeoaamekscieg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621891": [
        {
            "ioc_value": "uoukwkkieiuiyssi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621892": [
        {
            "ioc_value": "cwoskqcsiwkuymmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621893": [
        {
            "ioc_value": "yiqokqqmsciiykki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621894": [
        {
            "ioc_value": "amcsoewcqsmkowse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621895": [
        {
            "ioc_value": "kmcsqwwmaiioagwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621896": [
        {
            "ioc_value": "asawmmcikyieoyuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621897": [
        {
            "ioc_value": "gsymqocmsaqaoqsu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621898": [
        {
            "ioc_value": "ywgggsgeukaeoymu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621899": [
        {
            "ioc_value": "wsuuakqmyeeukgcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621900": [
        {
            "ioc_value": "iwwouwcaskkaaeqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621901": [
        {
            "ioc_value": "uaoaosaqsemamyqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621902": [
        {
            "ioc_value": "swaauogosyuusouc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621903": [
        {
            "ioc_value": "uuqkqkkwwsugsmsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621857": [
        {
            "ioc_value": "ugeamueimegaemmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621858": [
        {
            "ioc_value": "kuoeiwqywwoquooi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621859": [
        {
            "ioc_value": "uoyqywyomwawgeoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621860": [
        {
            "ioc_value": "scoqaokqsocqieoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621861": [
        {
            "ioc_value": "kgqwqykokooisews.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621862": [
        {
            "ioc_value": "wemssumeikwgsiic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621863": [
        {
            "ioc_value": "cwkqsqwmougwkiwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621864": [
        {
            "ioc_value": "sccesimsageawmci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621865": [
        {
            "ioc_value": "oicieyoyygqsawac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621866": [
        {
            "ioc_value": "aassosgkqccuuugg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621867": [
        {
            "ioc_value": "qgywgmikkcowumcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621868": [
        {
            "ioc_value": "qmeoaymiqueuawsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621869": [
        {
            "ioc_value": "uaoaqiameaicuksq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621870": [
        {
            "ioc_value": "uaeekgueguwmoqaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621871": [
        {
            "ioc_value": "sqwqksqiwgcwkkuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621872": [
        {
            "ioc_value": "ckuqmkcukqwsgsau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621873": [
        {
            "ioc_value": "kmuweockwcuswsig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621874": [
        {
            "ioc_value": "iqmeakkeygeeegga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621875": [
        {
            "ioc_value": "iqicwcsaaocqwqwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621876": [
        {
            "ioc_value": "scyomqyqkmcyykiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621877": [
        {
            "ioc_value": "uaymkyygucmeegag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621878": [
        {
            "ioc_value": "amwoimoymomcygwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621879": [
        {
            "ioc_value": "qyuuywyaeakgwwui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621880": [
        {
            "ioc_value": "uggkcicimykawogy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621834": [
        {
            "ioc_value": "wsyomgsoycamiukw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621835": [
        {
            "ioc_value": "aaksekiumqsuoymk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621836": [
        {
            "ioc_value": "mewqeygssayqqouy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621837": [
        {
            "ioc_value": "gyyakccsaumigsis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621838": [
        {
            "ioc_value": "mksyamaqqqcucogi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621839": [
        {
            "ioc_value": "ycmgkmokikimsgeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621840": [
        {
            "ioc_value": "memkwisyuamuuomk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621841": [
        {
            "ioc_value": "kmcquegiauekeaou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621842": [
        {
            "ioc_value": "qgmucqcqmuymyecs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621843": [
        {
            "ioc_value": "wsyqewmcieocykug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621844": [
        {
            "ioc_value": "cwgoqewuckwymoyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621845": [
        {
            "ioc_value": "euiwmogeykycuasa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621846": [
        {
            "ioc_value": "amwmucqaksqqwcey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621847": [
        {
            "ioc_value": "geousugcewaeesig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621848": [
        {
            "ioc_value": "iiimcgswkikuukma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621849": [
        {
            "ioc_value": "ckyugsuuamwkmyeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621850": [
        {
            "ioc_value": "ocayowmyiuwggksa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621851": [
        {
            "ioc_value": "iqqeeswymmugaoou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621852": [
        {
            "ioc_value": "qmmwwmqowkmewyyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621853": [
        {
            "ioc_value": "yikimwqawukieoeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621854": [
        {
            "ioc_value": "swkoiksmouksygqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621855": [
        {
            "ioc_value": "wyieuqmeaaqaammu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621856": [
        {
            "ioc_value": "qmcygicycyumcwwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621812": [
        {
            "ioc_value": "kmgagyyucsakwwke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621813": [
        {
            "ioc_value": "qsagqseaieoukcam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621814": [
        {
            "ioc_value": "sweyoacmomkqckeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621815": [
        {
            "ioc_value": "assumauoioasqose.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621816": [
        {
            "ioc_value": "scwcuykqieegesey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621817": [
        {
            "ioc_value": "ckumimqmuiyaeyaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621818": [
        {
            "ioc_value": "kuiciqmceqosmqis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621819": [
        {
            "ioc_value": "aaqmckiesquacsic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621820": [
        {
            "ioc_value": "iwiuqqeycuqeuiai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621821": [
        {
            "ioc_value": "weouoiouiyqsemye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621822": [
        {
            "ioc_value": "amusccywwoemguyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621823": [
        {
            "ioc_value": "ycaqmsaeiscqycye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621824": [
        {
            "ioc_value": "ckwogwaquyuuicus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621825": [
        {
            "ioc_value": "iioqgycckcswaugm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621826": [
        {
            "ioc_value": "kukkoawakaaymgei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621827": [
        {
            "ioc_value": "qgyyswmayqmwgccy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621828": [
        {
            "ioc_value": "eaqgsyqcqkccysga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621829": [
        {
            "ioc_value": "qsqgegscgsqguauw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621830": [
        {
            "ioc_value": "swguyyewyecuwgki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621831": [
        {
            "ioc_value": "scuskgywusckcwyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621832": [
        {
            "ioc_value": "cwawicacaguemmuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621833": [
        {
            "ioc_value": "sqmgggoyicoyaigg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621790": [
        {
            "ioc_value": "yiqyskqskewayggs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621791": [
        {
            "ioc_value": "ckuaoaaimyuqeqia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621792": [
        {
            "ioc_value": "uumuosukusimaoae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621793": [
        {
            "ioc_value": "geiqmqmmqececgii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621794": [
        {
            "ioc_value": "uoacukmoyogegeyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621795": [
        {
            "ioc_value": "eiasiamoowimkegs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621796": [
        {
            "ioc_value": "gewmuakmwgsgyoso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621797": [
        {
            "ioc_value": "gygeccyqskqemymq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621798": [
        {
            "ioc_value": "wecaeguyqcmiscqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621799": [
        {
            "ioc_value": "aseuyayuccoccwwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621800": [
        {
            "ioc_value": "yoiomwsaqmiakqoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621801": [
        {
            "ioc_value": "gsiiuemqogekiyik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621802": [
        {
            "ioc_value": "aaewyqcsqmkesise.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621803": [
        {
            "ioc_value": "ocqwaiacmkimumyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621804": [
        {
            "ioc_value": "agoaqukiiciiaamu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621805": [
        {
            "ioc_value": "amowgicsguiimeoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621806": [
        {
            "ioc_value": "amiyckcgssekwgek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621807": [
        {
            "ioc_value": "eosgciqkecuwwwku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621808": [
        {
            "ioc_value": "wygmqiwwuumoqgok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621809": [
        {
            "ioc_value": "kmcgkgsqmcowmuco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621810": [
        {
            "ioc_value": "qgouwemuagmiuyso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621811": [
        {
            "ioc_value": "aaamoauuacmqqkye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621769": [
        {
            "ioc_value": "wykoewsmgwiwuwwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621770": [
        {
            "ioc_value": "wsuqgqyksguomeyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621771": [
        {
            "ioc_value": "qgsawsiiqkimqoku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621772": [
        {
            "ioc_value": "ycccwycewwegioia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621773": [
        {
            "ioc_value": "yiasqwaeykyuocck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621774": [
        {
            "ioc_value": "mkmquwewkuqkqucu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621775": [
        {
            "ioc_value": "qmeyeqekeoucyskw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621776": [
        {
            "ioc_value": "eowisoyckooqwyis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621777": [
        {
            "ioc_value": "yowqywieoegcuuui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621778": [
        {
            "ioc_value": "aaoeqowcwoimwwmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621779": [
        {
            "ioc_value": "ywiyowkgyguceeou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621780": [
        {
            "ioc_value": "geqesgaogmwqoaes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621781": [
        {
            "ioc_value": "uakciiwgwioiokuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621782": [
        {
            "ioc_value": "yigkmkgmoimgcqse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621783": [
        {
            "ioc_value": "wkqaiicugioqkimw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621784": [
        {
            "ioc_value": "wkwyyemoqoaiaomc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621785": [
        {
            "ioc_value": "wyscuggamgssgmqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621786": [
        {
            "ioc_value": "myawogcgywqckcku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621787": [
        {
            "ioc_value": "ocwscsauuuwcegiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621788": [
        {
            "ioc_value": "kacwuqcussuegkwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621789": [
        {
            "ioc_value": "gyqmcakqqsyggsaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621747": [
        {
            "ioc_value": "gmowigyumggocuia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621748": [
        {
            "ioc_value": "iimsysemyqsukcqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621749": [
        {
            "ioc_value": "kggkyuwwocuwgwgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621750": [
        {
            "ioc_value": "gyisosgesmyaqoau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621751": [
        {
            "ioc_value": "ouicyccwaggqyemc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621752": [
        {
            "ioc_value": "cwuseqwuowgsycum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621753": [
        {
            "ioc_value": "yckieqiaeguickuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621754": [
        {
            "ioc_value": "skaqyqyiygmgcoie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621755": [
        {
            "ioc_value": "eiqmimoomwqoeqey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621756": [
        {
            "ioc_value": "uuskmsyesiayqyig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621757": [
        {
            "ioc_value": "ooqkacooekiciuge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621758": [
        {
            "ioc_value": "gyauqssoeqecyyqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621759": [
        {
            "ioc_value": "wyqoqkquwsewuigk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621760": [
        {
            "ioc_value": "gskkqecoucomweem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621761": [
        {
            "ioc_value": "ugswaskugcieoymy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621762": [
        {
            "ioc_value": "gmsiueqyoeuggika.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621763": [
        {
            "ioc_value": "mygkawqsmuuyqsog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621764": [
        {
            "ioc_value": "ousikauayicowksu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621765": [
        {
            "ioc_value": "oosaccgkocwgqqqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621766": [
        {
            "ioc_value": "cqymgcuuykiysqma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621767": [
        {
            "ioc_value": "asocemswkwcyoioa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621768": [
        {
            "ioc_value": "asosoqeyccggecqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621726": [
        {
            "ioc_value": "cqymkmksiccswccw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621727": [
        {
            "ioc_value": "eoomicyaqqckmckk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621728": [
        {
            "ioc_value": "eooqmisayuskumgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621729": [
        {
            "ioc_value": "wkweimiscakygcoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621730": [
        {
            "ioc_value": "myseeioqicigywwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621731": [
        {
            "ioc_value": "eiqimoeasucagycy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621732": [
        {
            "ioc_value": "scsqskceouiyasyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621733": [
        {
            "ioc_value": "swqismsyoegkscue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621734": [
        {
            "ioc_value": "mkwkgouaqggagyoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621735": [
        {
            "ioc_value": "mqyekkmgioycyoqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621736": [
        {
            "ioc_value": "scikigaqwmamakwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621737": [
        {
            "ioc_value": "agycwsusgmyiqekm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621738": [
        {
            "ioc_value": "iqkeukyqeuuaeyss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621739": [
        {
            "ioc_value": "iqmgkuseaeoiucaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621740": [
        {
            "ioc_value": "sqykqkyycuscckyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621741": [
        {
            "ioc_value": "ooiogismccaskekk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621742": [
        {
            "ioc_value": "amyyqikwcmakcgkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621743": [
        {
            "ioc_value": "uuumwkwcskuiyyyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621744": [
        {
            "ioc_value": "sqmoiommseeuyssg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621745": [
        {
            "ioc_value": "scsemwckomoksoek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621746": [
        {
            "ioc_value": "uoouqgyaaqosyegy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621704": [
        {
            "ioc_value": "ugoaskaiaigiicck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621705": [
        {
            "ioc_value": "eokksmqmcqwuyoaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621706": [
        {
            "ioc_value": "uoskeiiycssqwqeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621707": [
        {
            "ioc_value": "gmcoieigykgqyywi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621708": [
        {
            "ioc_value": "cksyqyakiykwgywo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621709": [
        {
            "ioc_value": "cqeekcwouewqmwic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621710": [
        {
            "ioc_value": "cqsgsuakeeoeeoqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621711": [
        {
            "ioc_value": "oimwycikcewemqkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621712": [
        {
            "ioc_value": "kamiagausawmaysq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621713": [
        {
            "ioc_value": "wkuuaqkemuaqgaqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621714": [
        {
            "ioc_value": "gmqmcqeoumqoukay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621715": [
        {
            "ioc_value": "ywmuseuusqqosmsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621716": [
        {
            "ioc_value": "uggqwwoykikuuoey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621717": [
        {
            "ioc_value": "kgkgmuiemyoesymu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621718": [
        {
            "ioc_value": "ooyqiqeysaukysei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621719": [
        {
            "ioc_value": "asoaggeygsqcueuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621720": [
        {
            "ioc_value": "wkuusoumegcmsuei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621721": [
        {
            "ioc_value": "ycociaayuwoiauyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621722": [
        {
            "ioc_value": "gmmmyguomwmcawow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621723": [
        {
            "ioc_value": "ceucuuigwqwouimu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621724": [
        {
            "ioc_value": "gswywoucwyeqqoqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621725": [
        {
            "ioc_value": "mkcggqyeiceamkok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621682": [
        {
            "ioc_value": "occsgymeockukuio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621683": [
        {
            "ioc_value": "kuogawgmcoyimkek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621684": [
        {
            "ioc_value": "ugiwwsoouykucqce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621685": [
        {
            "ioc_value": "yieeqkwkakaiiswa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621686": [
        {
            "ioc_value": "ooogwekogsakeqwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621687": [
        {
            "ioc_value": "ugmywiyowuucoise.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621688": [
        {
            "ioc_value": "geukucsawqwkasgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621689": [
        {
            "ioc_value": "meewuewcsgmigwoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621690": [
        {
            "ioc_value": "oceccsuimammooce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621691": [
        {
            "ioc_value": "aakqckwqswaqsmyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621692": [
        {
            "ioc_value": "wykeogggeauquswu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621693": [
        {
            "ioc_value": "icgkiqomceyimewm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621694": [
        {
            "ioc_value": "swicioemaqoywqkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621695": [
        {
            "ioc_value": "cksuqucsacmuqcmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621696": [
        {
            "ioc_value": "gsqcqooaiqouuygq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621697": [
        {
            "ioc_value": "eaauqswcqkymouis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621698": [
        {
            "ioc_value": "uomaaoqcckggkygc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621699": [
        {
            "ioc_value": "iqeqkgqwwwaowmak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621700": [
        {
            "ioc_value": "wkoukessyumwmiwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621701": [
        {
            "ioc_value": "icewweuksmiyugga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621702": [
        {
            "ioc_value": "oomuyqmgicegkeka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621703": [
        {
            "ioc_value": "ugmgkwceiyqqgkea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621663": [
        {
            "ioc_value": "meomaucccqocwais.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621664": [
        {
            "ioc_value": "agyckykgowaocwgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621665": [
        {
            "ioc_value": "scioosegosyukwgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621666": [
        {
            "ioc_value": "wscqcykyowoqoaga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621667": [
        {
            "ioc_value": "ocmigqsucgeismos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621668": [
        {
            "ioc_value": "wkaqsoqeiayckuck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621669": [
        {
            "ioc_value": "swqgmqgaimkgcaeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621670": [
        {
            "ioc_value": "wecawoacwekqwkeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621671": [
        {
            "ioc_value": "cweqaemoacywmgge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621672": [
        {
            "ioc_value": "qyakqgomuggmsyyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621673": [
        {
            "ioc_value": "kamwycqkoskauaqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621674": [
        {
            "ioc_value": "ocqqasaoogauyisg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621675": [
        {
            "ioc_value": "uomgciseagoyqugu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621676": [
        {
            "ioc_value": "sqmquwocoikosoge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621677": [
        {
            "ioc_value": "weoekkemsuwwmgyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621678": [
        {
            "ioc_value": "amayyiaqsuekqcci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621679": [
        {
            "ioc_value": "gsswocskmgmwkwic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621680": [
        {
            "ioc_value": "wymiyqckquawgeic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621681": [
        {
            "ioc_value": "ugqwacqysswmkeay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621641": [
        {
            "ioc_value": "gsmcocacwywwscgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621642": [
        {
            "ioc_value": "ywcmqimeeqkakequ.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621643": [
        {
            "ioc_value": "ywqsogkiguwwagmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621644": [
        {
            "ioc_value": "agsykeucmucaaeka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621645": [
        {
            "ioc_value": "euakeioskasyyeoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621646": [
        {
            "ioc_value": "oogyoquosiwawkck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621647": [
        {
            "ioc_value": "qmkciwmmseiksaqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621648": [
        {
            "ioc_value": "ckokqokmsaomymqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621649": [
        {
            "ioc_value": "kmoqoggskgomqwsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621650": [
        {
            "ioc_value": "occowqucoecoyqmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621651": [
        {
            "ioc_value": "iqmwumuakcqiecuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621652": [
        {
            "ioc_value": "youccywgmwuoqyio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621653": [
        {
            "ioc_value": "uaykiwyykmkyuyee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621654": [
        {
            "ioc_value": "amuycmceaggggwki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621655": [
        {
            "ioc_value": "geoyeaowukyyogmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621656": [
        {
            "ioc_value": "mqawcgymywkieaee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621657": [
        {
            "ioc_value": "ckwcsuseiawkmsie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621658": [
        {
            "ioc_value": "gmuokwgigyoeouyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621659": [
        {
            "ioc_value": "kuicokomoyeiqkku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621660": [
        {
            "ioc_value": "oiiameagikwgwwcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621661": [
        {
            "ioc_value": "kgyymsccacmggeyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621662": [
        {
            "ioc_value": "weokquaacswwmoaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621622": [
        {
            "ioc_value": "qsqgcusyeygkuqyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621623": [
        {
            "ioc_value": "sciamguiuuymcaqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621624": [
        {
            "ioc_value": "easkcaoawcieqmmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621625": [
        {
            "ioc_value": "agwaemkcqkqqigie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621626": [
        {
            "ioc_value": "ywacociawiasigaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621627": [
        {
            "ioc_value": "wswuewakqyygeaay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621628": [
        {
            "ioc_value": "sqyioigquwqagccc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621629": [
        {
            "ioc_value": "qsaeaaiwgiassmig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621630": [
        {
            "ioc_value": "amauucycaogswmau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621631": [
        {
            "ioc_value": "gsqwyegyuyqggmqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621632": [
        {
            "ioc_value": "gswoayegycccuiam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621633": [
        {
            "ioc_value": "ouaccaacmsgwqewm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621634": [
        {
            "ioc_value": "ocsaeekimoegmmgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621635": [
        {
            "ioc_value": "skusiyqgycocmuyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621636": [
        {
            "ioc_value": "ouwwewmuyacskqoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621637": [
        {
            "ioc_value": "qskyuqciqkksqyou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621638": [
        {
            "ioc_value": "yiwmymogoqmsqaqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621639": [
        {
            "ioc_value": "gegisweeumqgywoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621640": [
        {
            "ioc_value": "mqcmqakkusoqcoku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621604": [
        {
            "ioc_value": "asakucuoaokamicy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621605": [
        {
            "ioc_value": "cqqcuyuoasogqckm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621606": [
        {
            "ioc_value": "gyooyeisiqaocygi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621607": [
        {
            "ioc_value": "qyqkkgwamwqwkyui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621608": [
        {
            "ioc_value": "qyawswsowiaosago.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621609": [
        {
            "ioc_value": "sqaaycwsiwyyegwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621610": [
        {
            "ioc_value": "wsukowyuyqikgyyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621611": [
        {
            "ioc_value": "aaigemcwogaasyyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621612": [
        {
            "ioc_value": "oikieuemqwugaawo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621613": [
        {
            "ioc_value": "swqceosukcgwgsqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621614": [
        {
            "ioc_value": "cqusmasuyiaswgyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621615": [
        {
            "ioc_value": "sqicgukykksqwuwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621616": [
        {
            "ioc_value": "eoaqgcacuasqsksw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621617": [
        {
            "ioc_value": "ugoeyumuegommequ.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621618": [
        {
            "ioc_value": "gmmeycqqeemmsiwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621619": [
        {
            "ioc_value": "uoyoyegqouskswee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621620": [
        {
            "ioc_value": "ouwqamyeouyguyec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621621": [
        {
            "ioc_value": "gygqggwcyekciiec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621583": [
        {
            "ioc_value": "uuycsqkcqscgiywc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621584": [
        {
            "ioc_value": "ckyigqumswouauuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621585": [
        {
            "ioc_value": "mqacwumessaywuma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621586": [
        {
            "ioc_value": "aaskiecqogamgoku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621587": [
        {
            "ioc_value": "wsussmwmqayuggsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621588": [
        {
            "ioc_value": "kmqsmiwcasymaeic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621589": [
        {
            "ioc_value": "qskekoumwyeemkyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621590": [
        {
            "ioc_value": "yicoyegqmmyakqme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621591": [
        {
            "ioc_value": "ugakqywywcokmssa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621592": [
        {
            "ioc_value": "ugyskqasucuieycm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621593": [
        {
            "ioc_value": "gsymyayowmmqiigs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621594": [
        {
            "ioc_value": "wsoaosiimcsswsoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621595": [
        {
            "ioc_value": "uowesasqqoiuamwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621596": [
        {
            "ioc_value": "kakoiamcyqooygsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621597": [
        {
            "ioc_value": "mkqugeagkickckeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621598": [
        {
            "ioc_value": "ookcawmoyeekkugy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621599": [
        {
            "ioc_value": "ckeckeqowwicqgqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621600": [
        {
            "ioc_value": "agawaymsqyggcico.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621601": [
        {
            "ioc_value": "mqsiugscaouoycee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621602": [
        {
            "ioc_value": "aagswqssqcaiiqok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621603": [
        {
            "ioc_value": "wswcuawgyqcumoms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621562": [
        {
            "ioc_value": "qgyisyiqwsimmaea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621563": [
        {
            "ioc_value": "skwqiuasgyecqigu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621564": [
        {
            "ioc_value": "aguseuuwyceguayy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621565": [
        {
            "ioc_value": "mkswooiccqwccgmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621566": [
        {
            "ioc_value": "cqokgmmmmsasmaoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621567": [
        {
            "ioc_value": "yccuimgycgckoesq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621568": [
        {
            "ioc_value": "mekyqseekkeuyqko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621569": [
        {
            "ioc_value": "kmaawmciowugysme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621570": [
        {
            "ioc_value": "ywsuioeuuoeicsku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621571": [
        {
            "ioc_value": "eiaueewqiugqmoiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621572": [
        {
            "ioc_value": "iiyqsaccmomomege.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621573": [
        {
            "ioc_value": "ooaogwkgoameisue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621574": [
        {
            "ioc_value": "iccasagkyggkyswi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621575": [
        {
            "ioc_value": "mqiksaiugiuuigua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621576": [
        {
            "ioc_value": "qygiaimmqyswacaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621577": [
        {
            "ioc_value": "sqcquuykioqigieo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621578": [
        {
            "ioc_value": "aaemcaomasueqiwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621579": [
        {
            "ioc_value": "sksuusesiaooqeic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621580": [
        {
            "ioc_value": "gsgwmskgoeqcqqqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621581": [
        {
            "ioc_value": "mkuqeeegakqiukke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621582": [
        {
            "ioc_value": "eucmkwwagseayige.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621542": [
        {
            "ioc_value": "yiaawqkgyemqioai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621543": [
        {
            "ioc_value": "gekueaogiqouuose.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621544": [
        {
            "ioc_value": "sccyigoqeooioggi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621545": [
        {
            "ioc_value": "meoeksssiacaasqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621546": [
        {
            "ioc_value": "eiewecuummwmqgew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621547": [
        {
            "ioc_value": "qgeyiggekgwceysy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621548": [
        {
            "ioc_value": "agymcwemqcseogsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621549": [
        {
            "ioc_value": "ooimsgicwyqamywm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621550": [
        {
            "ioc_value": "uakuygwicwaoggqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621551": [
        {
            "ioc_value": "oiwkuyqsosmuqgua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621552": [
        {
            "ioc_value": "ckkcewakeekscyyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621553": [
        {
            "ioc_value": "eaquswuaogucqsmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621554": [
        {
            "ioc_value": "uoswcgsuiasqwaum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621555": [
        {
            "ioc_value": "myuyuscagmimqmaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621556": [
        {
            "ioc_value": "ousswoawskqmseck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621557": [
        {
            "ioc_value": "cqaoieyiwsgsgqqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621558": [
        {
            "ioc_value": "mkeymaosmgsewiak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621559": [
        {
            "ioc_value": "scsmaumkqqyomqao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621560": [
        {
            "ioc_value": "qykcycumuuuyoeye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621561": [
        {
            "ioc_value": "kaskuqeqyycyeaws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621522": [
        {
            "ioc_value": "gmwmgueauuqucams.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621523": [
        {
            "ioc_value": "kuugkeoaockaomeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621524": [
        {
            "ioc_value": "iimeegoygakkegca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621525": [
        {
            "ioc_value": "swaiimaieuqwssmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621526": [
        {
            "ioc_value": "mkamaiqmksumaaqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621527": [
        {
            "ioc_value": "scsqwccusiauouuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621528": [
        {
            "ioc_value": "gemmiuycgwomemmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621529": [
        {
            "ioc_value": "sqwucykoyuuaasso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621530": [
        {
            "ioc_value": "wsygomkeksemimsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621531": [
        {
            "ioc_value": "qgyqsqsqgmiaisym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621532": [
        {
            "ioc_value": "wyqykcscawucyaug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621533": [
        {
            "ioc_value": "qsaocoouwgwkqwsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621534": [
        {
            "ioc_value": "gyoyqeukicguesaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621535": [
        {
            "ioc_value": "meeosigekcwuqakw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621536": [
        {
            "ioc_value": "oiyeeyqeuwwewwgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621537": [
        {
            "ioc_value": "wkeaqewswcycomga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621538": [
        {
            "ioc_value": "skocegosoeumgikw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621539": [
        {
            "ioc_value": "skcoyuwgqkyayguc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621540": [
        {
            "ioc_value": "cwggskmoucugwcau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621541": [
        {
            "ioc_value": "mkmmegqqwcmosmkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621501": [
        {
            "ioc_value": "euwmawwmgsckayom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621502": [
        {
            "ioc_value": "ooiuauskiemmasia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621503": [
        {
            "ioc_value": "gsykougkcamiquua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621504": [
        {
            "ioc_value": "meiuyoyciouuikou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621505": [
        {
            "ioc_value": "ouoqaoguowygceig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621506": [
        {
            "ioc_value": "myguwcsuagwacaak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621507": [
        {
            "ioc_value": "wscymmeewiqwwikc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621508": [
        {
            "ioc_value": "ascscgosksckcaoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621509": [
        {
            "ioc_value": "cqascqecqiiiuqka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621510": [
        {
            "ioc_value": "cqioyiyggksqwaku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621511": [
        {
            "ioc_value": "asqimggimkyceqak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621512": [
        {
            "ioc_value": "mqyagykgoskwaues.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621513": [
        {
            "ioc_value": "kaeywimssgosgkuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621514": [
        {
            "ioc_value": "skaskeguwiuqawyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621515": [
        {
            "ioc_value": "qgiaowmiyaqsuuyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621516": [
        {
            "ioc_value": "qmoqciigcsqaiykm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621517": [
        {
            "ioc_value": "yiwssewigwyeyues.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621518": [
        {
            "ioc_value": "euqysukicmuuacom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621519": [
        {
            "ioc_value": "agcucwoegcgueauq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621520": [
        {
            "ioc_value": "gsgsccawqoowwaiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621521": [
        {
            "ioc_value": "asoewuieokuoguaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621481": [
        {
            "ioc_value": "meiamkmaawawmqki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621482": [
        {
            "ioc_value": "kumuikgeisgcmguk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621483": [
        {
            "ioc_value": "ywqiooyeesusmkik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621484": [
        {
            "ioc_value": "wyqmcswsqgeyuccq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621485": [
        {
            "ioc_value": "gyoamegucgsqsaok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621486": [
        {
            "ioc_value": "euwokokqecacmioy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621487": [
        {
            "ioc_value": "oiymauoesgckkmga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621488": [
        {
            "ioc_value": "qmcyguoowouuuiqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621489": [
        {
            "ioc_value": "oucceqgqmwwyksom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621490": [
        {
            "ioc_value": "skymwckkqmsagggs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621491": [
        {
            "ioc_value": "ocwccsuyuwewekmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621492": [
        {
            "ioc_value": "yoigwiqgykgmgceg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621493": [
        {
            "ioc_value": "cqmwiesquqwqqmeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621494": [
        {
            "ioc_value": "swiiwaseummcewiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621495": [
        {
            "ioc_value": "ugeiiiwqakcgcags.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621496": [
        {
            "ioc_value": "eaqgackckgcwocmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621497": [
        {
            "ioc_value": "gscesuucmewmgysc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621498": [
        {
            "ioc_value": "uokmieiqeueoigei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621499": [
        {
            "ioc_value": "iqssqqkaauigygas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621500": [
        {
            "ioc_value": "kawmgssmksaescso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621460": [
        {
            "ioc_value": "ugaaqaysymumceuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621461": [
        {
            "ioc_value": "uauecqosccmsygaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621462": [
        {
            "ioc_value": "uaqecaququuwmyme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621463": [
        {
            "ioc_value": "gemskesqkeskawcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621464": [
        {
            "ioc_value": "scqwymasocsiieoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621465": [
        {
            "ioc_value": "gswcqcmiseyyiyuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621466": [
        {
            "ioc_value": "cemgimuyiaewkysi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621467": [
        {
            "ioc_value": "gmgceguquyaosggw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621468": [
        {
            "ioc_value": "eoiisaauwemyoswc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621469": [
        {
            "ioc_value": "amikkmcuaewwiuys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621470": [
        {
            "ioc_value": "gyscumomwayumkmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621471": [
        {
            "ioc_value": "iwqmusugyeyccisq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621472": [
        {
            "ioc_value": "memkgacuamceagsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621473": [
        {
            "ioc_value": "eaoycimscgeaocos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621474": [
        {
            "ioc_value": "uosskykgaousoqyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621475": [
        {
            "ioc_value": "ywoqowaacomusqsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621476": [
        {
            "ioc_value": "cwecgkicskcggegi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621477": [
        {
            "ioc_value": "eukkaooguggmiims.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621478": [
        {
            "ioc_value": "uasqicsukiwckgkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621479": [
        {
            "ioc_value": "eauosyceuucisswc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621480": [
        {
            "ioc_value": "iieekcccegyigeam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621440": [
        {
            "ioc_value": "mekocusqgkgqewks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621441": [
        {
            "ioc_value": "cwsiiqmuagecceoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621442": [
        {
            "ioc_value": "aaygwyussskewwso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621443": [
        {
            "ioc_value": "ywgaimuyuskmgkcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621444": [
        {
            "ioc_value": "asmcomquuekeoueg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621445": [
        {
            "ioc_value": "kgesuqyioycogoks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621446": [
        {
            "ioc_value": "kgcigyggoacukiwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621447": [
        {
            "ioc_value": "ugcskqymkuimsako.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621448": [
        {
            "ioc_value": "eammmscswywemsco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621449": [
        {
            "ioc_value": "sqowycyayqwuwuye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621450": [
        {
            "ioc_value": "iqeeeyaaaaecwoki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621451": [
        {
            "ioc_value": "kuiyesowieeyqyck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621452": [
        {
            "ioc_value": "iwiawsggoaqskeqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621453": [
        {
            "ioc_value": "icqaeikcesmyaegy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621454": [
        {
            "ioc_value": "ooyaeyqoauiiokyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621455": [
        {
            "ioc_value": "uuwcwkckocuawcwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621456": [
        {
            "ioc_value": "eouukcyueokqkquo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621457": [
        {
            "ioc_value": "iiqiwoacgaqsswcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621458": [
        {
            "ioc_value": "iqceksoeuskgqgig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621459": [
        {
            "ioc_value": "skmoskmsmmycyosy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621420": [
        {
            "ioc_value": "ageuiacaieeasogo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621421": [
        {
            "ioc_value": "amigoecuqassagya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621422": [
        {
            "ioc_value": "weoiuocaceiesyig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621423": [
        {
            "ioc_value": "yckoiwcccqkwwamg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621424": [
        {
            "ioc_value": "eoqmceskugqimecu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621425": [
        {
            "ioc_value": "scgyicmseasskomc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621426": [
        {
            "ioc_value": "aawcsiaaocogkwqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621427": [
        {
            "ioc_value": "uogqoymogwsaywak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621428": [
        {
            "ioc_value": "iikgociuaysqyqgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621429": [
        {
            "ioc_value": "gyuoqqwckaakcycw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621430": [
        {
            "ioc_value": "qssiqayicqumcuaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621431": [
        {
            "ioc_value": "qyqiskkiommgkmeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621432": [
        {
            "ioc_value": "mqyyimcekygowoys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621433": [
        {
            "ioc_value": "mewooucywicioyie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621434": [
        {
            "ioc_value": "ceygqmikugcocqss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621435": [
        {
            "ioc_value": "eiayauewscoaomwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621436": [
        {
            "ioc_value": "ycmmiauqoksweaei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621437": [
        {
            "ioc_value": "eukggmyuwgcgwsuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621438": [
        {
            "ioc_value": "mkeosugsigkcaigi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621439": [
        {
            "ioc_value": "uuqogoossaioeuqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621401": [
        {
            "ioc_value": "kakowuoguaamesmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621402": [
        {
            "ioc_value": "skwaccgcwkkieius.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621403": [
        {
            "ioc_value": "uogiukmwuugqugis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621404": [
        {
            "ioc_value": "wyuecyuyeqkkqywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621405": [
        {
            "ioc_value": "cqooiyasakeiswyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621406": [
        {
            "ioc_value": "swwykigiuoqysmkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621407": [
        {
            "ioc_value": "agyawmeeucyeqkus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621408": [
        {
            "ioc_value": "iwskqgysqgegcckw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621409": [
        {
            "ioc_value": "ugasicaakgkqwecw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621410": [
        {
            "ioc_value": "ywosswmeaiyqsiiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621411": [
        {
            "ioc_value": "wsqgwmimmoqqscyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621412": [
        {
            "ioc_value": "qycsceeyeycwowyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621413": [
        {
            "ioc_value": "uagwckscaacuiemg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621414": [
        {
            "ioc_value": "qsuucouwqqywyuka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621415": [
        {
            "ioc_value": "geumcgqomoeqyoom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621416": [
        {
            "ioc_value": "mqsuqeukkyoimigs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621417": [
        {
            "ioc_value": "ckwcgukeykaeaqwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621418": [
        {
            "ioc_value": "cegeqamckumugkco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621419": [
        {
            "ioc_value": "kueyecaakiymycyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621379": [
        {
            "ioc_value": "skyuemykaqeywkeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621380": [
        {
            "ioc_value": "aswmikuaamasaeoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621381": [
        {
            "ioc_value": "swqogegaaykusgqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621382": [
        {
            "ioc_value": "oomicmyicmsgggqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621383": [
        {
            "ioc_value": "yoqsqyqqimwweigi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621384": [
        {
            "ioc_value": "ugcekocmuywecuei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621385": [
        {
            "ioc_value": "mecigomcgwsgqaei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621386": [
        {
            "ioc_value": "ocoqccogsyaciyms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621387": [
        {
            "ioc_value": "occayoiceeeeagsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621388": [
        {
            "ioc_value": "kaucwkgsycqwmycq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621389": [
        {
            "ioc_value": "amkiimeiksyouuuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621390": [
        {
            "ioc_value": "cqyosecekmigkcmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621391": [
        {
            "ioc_value": "uumyuaicaiwaoisc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621392": [
        {
            "ioc_value": "gseqwamigeogaoqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621393": [
        {
            "ioc_value": "ascwiciiweesooeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621394": [
        {
            "ioc_value": "eiwiwyqawwkcukak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621395": [
        {
            "ioc_value": "skogccuqeaowaawe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621396": [
        {
            "ioc_value": "ouiwccaakismciwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621397": [
        {
            "ioc_value": "ameeoeaemsieogwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621398": [
        {
            "ioc_value": "euiwmkwgwicyqose.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621399": [
        {
            "ioc_value": "kmgeoeaskcqoyiaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621400": [
        {
            "ioc_value": "ugwaoqcuasgascgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621357": [
        {
            "ioc_value": "uaegusscyksemeaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621358": [
        {
            "ioc_value": "oogsasquqoyemgao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621359": [
        {
            "ioc_value": "agkkoaucgusawguw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621360": [
        {
            "ioc_value": "gskysukuuiwukskc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621361": [
        {
            "ioc_value": "mqmuowqoqckeykec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621362": [
        {
            "ioc_value": "myokkcaogyaauqqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621363": [
        {
            "ioc_value": "ociueckuqkkyqkuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621364": [
        {
            "ioc_value": "yocyokswqqscowcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621365": [
        {
            "ioc_value": "ooqwoeikskueymue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621366": [
        {
            "ioc_value": "mkgykqmscaaiysys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621367": [
        {
            "ioc_value": "mqamqgmkycmwwgqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621368": [
        {
            "ioc_value": "ouukyowwaouqekss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621369": [
        {
            "ioc_value": "sqcgyqicoagykgua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621370": [
        {
            "ioc_value": "uoiamymkeiygqwwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621371": [
        {
            "ioc_value": "iqoyqiaqoggywwwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621372": [
        {
            "ioc_value": "ycqquqgaaqeequme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621373": [
        {
            "ioc_value": "cqeqgscicysuuako.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621374": [
        {
            "ioc_value": "kgkoiyokqmqkwass.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621375": [
        {
            "ioc_value": "ckcigqmcikagayke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621376": [
        {
            "ioc_value": "memmgmuwckoikcwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621377": [
        {
            "ioc_value": "ousgcuqsmucykcua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621378": [
        {
            "ioc_value": "qguigaekqgkuwayq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621336": [
        {
            "ioc_value": "ouuqyacgwkkmuqik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621337": [
        {
            "ioc_value": "eoqiieqaqqmqskcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621338": [
        {
            "ioc_value": "ocyugwkweiismeky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621339": [
        {
            "ioc_value": "gmyuaweuoessyamu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621340": [
        {
            "ioc_value": "uusseykumykeiaso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621341": [
        {
            "ioc_value": "cqowayqiquigwksc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621342": [
        {
            "ioc_value": "qssaokgmosokusqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621343": [
        {
            "ioc_value": "qmmmocwamauaakko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621344": [
        {
            "ioc_value": "agigyouyquwcwmoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621345": [
        {
            "ioc_value": "iiwgwkiwimkqoowg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621346": [
        {
            "ioc_value": "skisoiayqokckeiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621347": [
        {
            "ioc_value": "gmmgoiaasiasesem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621348": [
        {
            "ioc_value": "scooiqicaweeqgkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621349": [
        {
            "ioc_value": "ookysemmcwyskykw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621350": [
        {
            "ioc_value": "yicgeeamgcqicskc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621351": [
        {
            "ioc_value": "geiguoayoisagusy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621352": [
        {
            "ioc_value": "cwiqsuqwmkwwcmyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621353": [
        {
            "ioc_value": "sqsamucwgwgawqoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621354": [
        {
            "ioc_value": "ociyagocgaycwsyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621355": [
        {
            "ioc_value": "iqmmessmkuwceoyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621356": [
        {
            "ioc_value": "iwqoseomqckwwgwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621315": [
        {
            "ioc_value": "cekyekckeuugakcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621316": [
        {
            "ioc_value": "cwsywgcmqqsycuyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621317": [
        {
            "ioc_value": "uacwccqgygwgwogg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621318": [
        {
            "ioc_value": "swiauacqaecwaaog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621319": [
        {
            "ioc_value": "yocgowgkmmmayuwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621320": [
        {
            "ioc_value": "yoyeuccyickkaaiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621321": [
        {
            "ioc_value": "ckycioycgewwooii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621322": [
        {
            "ioc_value": "skwoqiyeissiwguk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621323": [
        {
            "ioc_value": "mymmauiuksywssca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621324": [
        {
            "ioc_value": "kaayyemskqkuuumm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621325": [
        {
            "ioc_value": "ooaqwocccmescgge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621326": [
        {
            "ioc_value": "yiqqmuqgwcsmyymy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621327": [
        {
            "ioc_value": "eomosgscgugsmwec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621328": [
        {
            "ioc_value": "iwsamgemgqoeiqqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621329": [
        {
            "ioc_value": "mqcsquiqskacooic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621330": [
        {
            "ioc_value": "gmaomagmqaquiagi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621331": [
        {
            "ioc_value": "gmooauomuwsesaag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621332": [
        {
            "ioc_value": "kmymgemuwqqyoqgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621333": [
        {
            "ioc_value": "yiioskuawwqeyyym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621334": [
        {
            "ioc_value": "uayiikaiwissgssm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621335": [
        {
            "ioc_value": "scssaimwasoysuue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621292": [
        {
            "ioc_value": "qmysyumwyackcuus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621293": [
        {
            "ioc_value": "qsgyiqcyygmqicqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621294": [
        {
            "ioc_value": "mkwkaqqcqkyauoie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621295": [
        {
            "ioc_value": "meuiciqesquisqsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621296": [
        {
            "ioc_value": "gskoaguisgioqoks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621297": [
        {
            "ioc_value": "oucamsuyiyccmiuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621298": [
        {
            "ioc_value": "aauoseowaoaikuuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621299": [
        {
            "ioc_value": "ywemckkeaoqgqagg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621300": [
        {
            "ioc_value": "cwcgikskcmqaqmye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621301": [
        {
            "ioc_value": "qscusiqwimagqcai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621302": [
        {
            "ioc_value": "cqmsoigiwgugoeqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621303": [
        {
            "ioc_value": "cwqamkwwguoykmku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621304": [
        {
            "ioc_value": "wkuoyyemoqogcoqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621305": [
        {
            "ioc_value": "sqiaswyowuissuuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621306": [
        {
            "ioc_value": "iqoyycigmqoygmsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621307": [
        {
            "ioc_value": "mywmuagskgwewwis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621308": [
        {
            "ioc_value": "oikmiswwmmkkegiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621309": [
        {
            "ioc_value": "yiooymqysymskuay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621310": [
        {
            "ioc_value": "cqeisiqsoiikaaew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621311": [
        {
            "ioc_value": "yceoqywkoaeoiaue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621312": [
        {
            "ioc_value": "gsqoieymgsywqqyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621313": [
        {
            "ioc_value": "gesgiaiyeawoesww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621314": [
        {
            "ioc_value": "uouqgoqwemuukwyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621272": [
        {
            "ioc_value": "mqqcwqqkcwyuoiys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621273": [
        {
            "ioc_value": "ckuaekmiiqikeaks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621274": [
        {
            "ioc_value": "aauqgooyoicuwgck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621275": [
        {
            "ioc_value": "skyqmimocgcsukiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621276": [
        {
            "ioc_value": "qmicawwgicewmwqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621277": [
        {
            "ioc_value": "qsyyowegwywyioiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621278": [
        {
            "ioc_value": "cqekumimwskqcmkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621279": [
        {
            "ioc_value": "gsqwcgukoswmgiks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621280": [
        {
            "ioc_value": "kasosacwwysicaei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621281": [
        {
            "ioc_value": "eagwcgyqiooguyqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621282": [
        {
            "ioc_value": "ywewwaaugicsyaqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621283": [
        {
            "ioc_value": "kuyqugagymocgqqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621284": [
        {
            "ioc_value": "geyswcqeumycawag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621285": [
        {
            "ioc_value": "qsgsmycaymagmoqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621286": [
        {
            "ioc_value": "amgcaswcsqsuyswc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621287": [
        {
            "ioc_value": "ouaemcokeoskwiae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621288": [
        {
            "ioc_value": "aswikimuokequqqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621289": [
        {
            "ioc_value": "gscikicmyeqwscou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621290": [
        {
            "ioc_value": "gmwuoaicuwquegko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621291": [
        {
            "ioc_value": "sksueawsuimkggmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621252": [
        {
            "ioc_value": "mqacwiaqccuggaeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621253": [
        {
            "ioc_value": "mkskmswwieosowwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621254": [
        {
            "ioc_value": "gyyeuemwgowqeyau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621255": [
        {
            "ioc_value": "eagemykmoukesmao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621256": [
        {
            "ioc_value": "uggkwsmgkcouiaik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621257": [
        {
            "ioc_value": "wykkayseauyeiiea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621258": [
        {
            "ioc_value": "uowqmoyaseqgymck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621259": [
        {
            "ioc_value": "uoqcacoukmsyiwic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621260": [
        {
            "ioc_value": "uuugmimomyiekoyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621261": [
        {
            "ioc_value": "cqoqaymkkikckusy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621262": [
        {
            "ioc_value": "icsgkgkyecgoyoqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621263": [
        {
            "ioc_value": "gsuogiwsicauaacs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621264": [
        {
            "ioc_value": "eowcusywwgguuasg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621265": [
        {
            "ioc_value": "ouyaikymauoymwwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621266": [
        {
            "ioc_value": "ywaucmqsoewquwcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621267": [
        {
            "ioc_value": "iqawqgqaeaiecqkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621268": [
        {
            "ioc_value": "kmwuawiaaskeiyow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621269": [
        {
            "ioc_value": "yiaagseqqwwsomqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621270": [
        {
            "ioc_value": "ammysoowumikyysg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621271": [
        {
            "ioc_value": "wkygyciiuywyywuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621232": [
        {
            "ioc_value": "iwmogoeoouaeksos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621233": [
        {
            "ioc_value": "scassomqcsqoasco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621234": [
        {
            "ioc_value": "mywkyomoukcuskos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621235": [
        {
            "ioc_value": "skuweqmymmemmguu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621236": [
        {
            "ioc_value": "oumkuqksmauyyuym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621237": [
        {
            "ioc_value": "cqqcusqyaigwaimy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621238": [
        {
            "ioc_value": "cqgycmaquokcaocu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621239": [
        {
            "ioc_value": "eaokceammcegmqsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621240": [
        {
            "ioc_value": "uguauaoooewyiyqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621241": [
        {
            "ioc_value": "eomokowyekososoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621242": [
        {
            "ioc_value": "wseosuogmcwagwse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621243": [
        {
            "ioc_value": "qgoyykqwsmomywuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621244": [
        {
            "ioc_value": "wygckegssisuyacm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621245": [
        {
            "ioc_value": "amkwwekcwowiwocq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621246": [
        {
            "ioc_value": "qsouoskoceyegwsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621247": [
        {
            "ioc_value": "eoweoieewsoiqocq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621248": [
        {
            "ioc_value": "memcgwqyccussask.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621249": [
        {
            "ioc_value": "yoiygeoescgmocwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621250": [
        {
            "ioc_value": "eiccgwsoyagyigms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621251": [
        {
            "ioc_value": "kueqmaqkwwwkykkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621211": [
        {
            "ioc_value": "wswgoasieoqcuwya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621212": [
        {
            "ioc_value": "ycycmkquagwscayo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621213": [
        {
            "ioc_value": "cqcmqwaakmqgisog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621214": [
        {
            "ioc_value": "iccqcmuuigsqkaiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621215": [
        {
            "ioc_value": "squcyessmgckioik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621216": [
        {
            "ioc_value": "iwyamoegqksoiqmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621217": [
        {
            "ioc_value": "iicamycamwicoeek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621218": [
        {
            "ioc_value": "wskeakuwamwmiakq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621219": [
        {
            "ioc_value": "eiauqsauaagcqiey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621220": [
        {
            "ioc_value": "sckywmcamecckgwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621221": [
        {
            "ioc_value": "weuugiiyeyigggcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621222": [
        {
            "ioc_value": "yiugcqoysiiyaweo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621223": [
        {
            "ioc_value": "gecseksciugeygqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621224": [
        {
            "ioc_value": "cwiiyowweokaoywm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621225": [
        {
            "ioc_value": "oiiacmusokwuucem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621226": [
        {
            "ioc_value": "mykowsmiskigqgkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621227": [
        {
            "ioc_value": "wsyiigscekwksouw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621228": [
        {
            "ioc_value": "agqeamksegyumqew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621229": [
        {
            "ioc_value": "ameoauwqwauuqsuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621230": [
        {
            "ioc_value": "mkeiygymuusmmocg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621231": [
        {
            "ioc_value": "eoqysiaseiesgacg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621190": [
        {
            "ioc_value": "uaekeicwoiuqqyoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621191": [
        {
            "ioc_value": "asoowkcugcykukwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621192": [
        {
            "ioc_value": "asgkemcieiackuqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621193": [
        {
            "ioc_value": "wyuqeiukkaakwuiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621194": [
        {
            "ioc_value": "gmmuoucyscakiask.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621195": [
        {
            "ioc_value": "aasyeeuuiqakemum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621196": [
        {
            "ioc_value": "ckemacmgsquiowim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621197": [
        {
            "ioc_value": "amqiywsseussswqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621198": [
        {
            "ioc_value": "kggkawcmiggguqes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621199": [
        {
            "ioc_value": "mesccigmyugkcwua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621200": [
        {
            "ioc_value": "kaeacckqwcqqquqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621201": [
        {
            "ioc_value": "wkaouoeaosuakmoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621202": [
        {
            "ioc_value": "kumegsqgycasgmea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621203": [
        {
            "ioc_value": "uoiwauywwwiuaucm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621204": [
        {
            "ioc_value": "eacmyqyoqisikiqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621205": [
        {
            "ioc_value": "oosgooyiwacmgyui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621206": [
        {
            "ioc_value": "euaicwgyumwuuesm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621207": [
        {
            "ioc_value": "cwakkeyeoscaioci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621208": [
        {
            "ioc_value": "geaucqawwmiaggek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621209": [
        {
            "ioc_value": "aguaegqkyegsiyai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621210": [
        {
            "ioc_value": "ceoeyemcumaougao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621167": [
        {
            "ioc_value": "meiwuukioomeoiys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621168": [
        {
            "ioc_value": "gsgaeakomawessmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621169": [
        {
            "ioc_value": "wkoaawgaqwkwieuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621170": [
        {
            "ioc_value": "iqesuswqccmucyqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621171": [
        {
            "ioc_value": "kumqieicsqcyogwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621172": [
        {
            "ioc_value": "scisicysmgosawyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621173": [
        {
            "ioc_value": "gysmkeeagimyaocg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621174": [
        {
            "ioc_value": "cqesocaqmokckooq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621175": [
        {
            "ioc_value": "scmwwskwiaswycsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621176": [
        {
            "ioc_value": "ouiqcemegckuecug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621177": [
        {
            "ioc_value": "iwgocegkecgeekgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621178": [
        {
            "ioc_value": "qgaweksiaqiuqamk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621179": [
        {
            "ioc_value": "uowccoceimqiuawa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621180": [
        {
            "ioc_value": "sqqesweguymmesiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621181": [
        {
            "ioc_value": "kggwyiuigekocako.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621182": [
        {
            "ioc_value": "gyggmewmuiuocwck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621183": [
        {
            "ioc_value": "gsmaskmgoeaacocg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621184": [
        {
            "ioc_value": "uummkqagqaugwgmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621185": [
        {
            "ioc_value": "cwocmcaywkmcaeyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621186": [
        {
            "ioc_value": "skgmsykycsaowmyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621187": [
        {
            "ioc_value": "gmcakemgwwyacgmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621188": [
        {
            "ioc_value": "yoguuiueugqqqyuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621189": [
        {
            "ioc_value": "eucsgueqakekekoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621145": [
        {
            "ioc_value": "uueisaoeoseecgea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621146": [
        {
            "ioc_value": "kuiqyqkkuecyyewa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621147": [
        {
            "ioc_value": "uogqyycsqmqguomw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621148": [
        {
            "ioc_value": "kaascicqcowcusyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621149": [
        {
            "ioc_value": "ooaeugggmickgiym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621150": [
        {
            "ioc_value": "amamsyyyqymomyck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621151": [
        {
            "ioc_value": "uugwuakwawmesokg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621152": [
        {
            "ioc_value": "iwyweomkmeqeskqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621153": [
        {
            "ioc_value": "scsgseksmekgasww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621154": [
        {
            "ioc_value": "aackciqeiawcwqak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621155": [
        {
            "ioc_value": "ocmaaomogooeoqke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621156": [
        {
            "ioc_value": "asksqwaiqskeyyuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621157": [
        {
            "ioc_value": "swamsmegqeimkkww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621158": [
        {
            "ioc_value": "gyeeqsgeyuqioyks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621159": [
        {
            "ioc_value": "asykgwyigeqcsuce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621160": [
        {
            "ioc_value": "iiaymicosouoaqky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621161": [
        {
            "ioc_value": "ckymymiasigcmqqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621162": [
        {
            "ioc_value": "aaegweyyacagcggg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621163": [
        {
            "ioc_value": "gmwaqgomqmeuaooa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621164": [
        {
            "ioc_value": "mesagkigquewussu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621165": [
        {
            "ioc_value": "uasceioosisosuei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621166": [
        {
            "ioc_value": "yiuwewoiqkyaqseg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621125": [
        {
            "ioc_value": "weycgkuegymqsuqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621126": [
        {
            "ioc_value": "euaamcikuueeqykg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621127": [
        {
            "ioc_value": "ugcwsweoiaockyuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621128": [
        {
            "ioc_value": "yoooawaicwciqioa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621129": [
        {
            "ioc_value": "uuiookmywomcakyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621130": [
        {
            "ioc_value": "skesoqyumkqcsgqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621131": [
        {
            "ioc_value": "gmcoomwwyycskqgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621132": [
        {
            "ioc_value": "kaceiwuumkwkuaow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621133": [
        {
            "ioc_value": "weksgooisgayssme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621134": [
        {
            "ioc_value": "qskouemeosysekum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621135": [
        {
            "ioc_value": "gscukumswusyocao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621136": [
        {
            "ioc_value": "meakqwmkccwmeoes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621137": [
        {
            "ioc_value": "qycqscwigowuewsu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621138": [
        {
            "ioc_value": "iqggmikekuakewga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621139": [
        {
            "ioc_value": "aaoosgyyiakaawiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621140": [
        {
            "ioc_value": "ugecsoiyccomsouu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621141": [
        {
            "ioc_value": "kgauykuuiekiicyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621142": [
        {
            "ioc_value": "swygemqommkyyeio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621143": [
        {
            "ioc_value": "cwuoqyiuwuqegoai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621144": [
        {
            "ioc_value": "qysoiyaokcciiysa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621106": [
        {
            "ioc_value": "uomkgcwwmsqceqge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621107": [
        {
            "ioc_value": "occaegeoyyaqqcww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621108": [
        {
            "ioc_value": "geeuaooiksgwywso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621109": [
        {
            "ioc_value": "oockaimiwwicyyeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621110": [
        {
            "ioc_value": "icwakygqyokgwsei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621111": [
        {
            "ioc_value": "oukmeesqiagoquys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621112": [
        {
            "ioc_value": "askwoqoycikskkim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621113": [
        {
            "ioc_value": "ckcwkasmkymymmqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621114": [
        {
            "ioc_value": "qgqgmwsccgmkcouu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621115": [
        {
            "ioc_value": "wsgqagoyacwigimk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621116": [
        {
            "ioc_value": "kaieyuiaoaaokemm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621117": [
        {
            "ioc_value": "swggywqaeougasqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621118": [
        {
            "ioc_value": "qsoieouwmguciwig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621119": [
        {
            "ioc_value": "agqkwicsokmogmgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621120": [
        {
            "ioc_value": "iwgaqowmaegskqwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621121": [
        {
            "ioc_value": "ougaquaimiyqsuqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621122": [
        {
            "ioc_value": "mysouqimoiaaswko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621123": [
        {
            "ioc_value": "mywkiemyeuokeqai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621124": [
        {
            "ioc_value": "eaqswgasigyqiyus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621084": [
        {
            "ioc_value": "gsuwiiygcqweugeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621085": [
        {
            "ioc_value": "mkqyqcmeeewuukqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621086": [
        {
            "ioc_value": "weiucaakagswsaiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621087": [
        {
            "ioc_value": "uuggkieasisyeooe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621088": [
        {
            "ioc_value": "ageucyueoyiooicu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621089": [
        {
            "ioc_value": "yoeosyaqwacwmsie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621090": [
        {
            "ioc_value": "ywuusyoyoawmqycw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621091": [
        {
            "ioc_value": "mykucwkqqmceewki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621092": [
        {
            "ioc_value": "geaymcuaqygoumuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621093": [
        {
            "ioc_value": "amiyucqywgoyumsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621094": [
        {
            "ioc_value": "weyccagoesyewuoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621095": [
        {
            "ioc_value": "ugyauimwwmcaskqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621096": [
        {
            "ioc_value": "qyyqyiwkiqekewce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621097": [
        {
            "ioc_value": "sqwuuymoiooywgwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621098": [
        {
            "ioc_value": "qgqsckikkmemwuiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621099": [
        {
            "ioc_value": "skumgicasquyaaes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621100": [
        {
            "ioc_value": "agysusgmimucakii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621101": [
        {
            "ioc_value": "swaquusiaossscmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621102": [
        {
            "ioc_value": "cqmeqmsamemqwwwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621103": [
        {
            "ioc_value": "wycoaigueqkmeige.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621104": [
        {
            "ioc_value": "wykcsawaqoiwsiis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621105": [
        {
            "ioc_value": "qywogmuiiceuccek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621062": [
        {
            "ioc_value": "oookywemcgougsoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621063": [
        {
            "ioc_value": "scwuqgwsiaaggoom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621064": [
        {
            "ioc_value": "mqeeymywmuqgsowa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621065": [
        {
            "ioc_value": "uuumeoycsikiiaoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621066": [
        {
            "ioc_value": "ocswwaiyoakceuyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621067": [
        {
            "ioc_value": "uogccseigcseskyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621068": [
        {
            "ioc_value": "ckgmqycgcgycummg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621069": [
        {
            "ioc_value": "gyiiqauoaeceeoso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621070": [
        {
            "ioc_value": "uaewuuiqygkqeesa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621071": [
        {
            "ioc_value": "wywggwuyyaomecmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621072": [
        {
            "ioc_value": "kaoigqysoseswcms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621073": [
        {
            "ioc_value": "qyusuqygosweaams.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621074": [
        {
            "ioc_value": "skomucuowekwoqau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621075": [
        {
            "ioc_value": "sksuwsyoucmiqwqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621076": [
        {
            "ioc_value": "eaikouykqeecmkog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621077": [
        {
            "ioc_value": "euukameyoimwogkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621078": [
        {
            "ioc_value": "mkesuyakmmcaaumi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621079": [
        {
            "ioc_value": "wkwwokeuewmcuaqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621080": [
        {
            "ioc_value": "eawqswmmcyqoqyqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621081": [
        {
            "ioc_value": "kacoccqcmyskscwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621082": [
        {
            "ioc_value": "cegwwgkuemwiuqmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621083": [
        {
            "ioc_value": "ywguieoukoakcqki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621042": [
        {
            "ioc_value": "ocmyyqmcmcgyawom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621043": [
        {
            "ioc_value": "ywkqwwqmwuquuays.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621044": [
        {
            "ioc_value": "eaesaaiewcmuaiuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621045": [
        {
            "ioc_value": "mkqogqcmwmqkioku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621046": [
        {
            "ioc_value": "uaqaimmicmumoaue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621047": [
        {
            "ioc_value": "asykkqamiuoqkmmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621048": [
        {
            "ioc_value": "yowsmwiyiucumwqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621049": [
        {
            "ioc_value": "kaqqakqssyksikya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621050": [
        {
            "ioc_value": "qgqygysyeskwyeya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621051": [
        {
            "ioc_value": "aaisagcccsuqgoqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621052": [
        {
            "ioc_value": "ckwyumcaowccwccq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621053": [
        {
            "ioc_value": "icksgygqwqkuyywa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621054": [
        {
            "ioc_value": "swaygkqsswaoceku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621055": [
        {
            "ioc_value": "oiqyacgwecyiuqgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621056": [
        {
            "ioc_value": "kaqqsgwmeyccmoce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621057": [
        {
            "ioc_value": "qykqsiockykmoamc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621058": [
        {
            "ioc_value": "iqukkimgugugskww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621059": [
        {
            "ioc_value": "ywyuayymauimgqce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621060": [
        {
            "ioc_value": "mqegwqsayuiagwow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621061": [
        {
            "ioc_value": "qsegkmggmuayqeqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621021": [
        {
            "ioc_value": "kgwsmmmmaoeogqkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621022": [
        {
            "ioc_value": "oowsmkeoqckgkimw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621023": [
        {
            "ioc_value": "qmcmqymyesaoaqii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621024": [
        {
            "ioc_value": "sqauyqekisyeewuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621025": [
        {
            "ioc_value": "cwqywkucakigiqmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621026": [
        {
            "ioc_value": "cecoccoqiegcmoes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621027": [
        {
            "ioc_value": "kuqyewuooqqksskk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621028": [
        {
            "ioc_value": "kmgumumaosesuuai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621029": [
        {
            "ioc_value": "yimuqygcsagsciuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621030": [
        {
            "ioc_value": "qsgugwasgmyooamc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621031": [
        {
            "ioc_value": "asaeqoiaqmsmgegy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621032": [
        {
            "ioc_value": "qyyuseaasckmwqma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621033": [
        {
            "ioc_value": "agukkoisskmumgmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621034": [
        {
            "ioc_value": "mycyaguyggkcoyoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621035": [
        {
            "ioc_value": "aaakqiokswgwoagc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621036": [
        {
            "ioc_value": "kasyagiookyskicm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621037": [
        {
            "ioc_value": "uaeugiauiyogmywa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621038": [
        {
            "ioc_value": "oocyuumkgsaqqgqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621039": [
        {
            "ioc_value": "kasuiggyiguasmow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621040": [
        {
            "ioc_value": "meussikigukckyio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621041": [
        {
            "ioc_value": "wkeumukukisiiwee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621001": [
        {
            "ioc_value": "eoikymcoqgoyukcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621002": [
        {
            "ioc_value": "myuwkasyawqekqww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621003": [
        {
            "ioc_value": "kuicysgogkaiaiak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621004": [
        {
            "ioc_value": "ckukkuqwcaoaywuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621005": [
        {
            "ioc_value": "weeaoskesiugsquk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621006": [
        {
            "ioc_value": "oogswkyiuaewgmqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621007": [
        {
            "ioc_value": "yciiwyisymamkkwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621008": [
        {
            "ioc_value": "ckwogykgioowomkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621009": [
        {
            "ioc_value": "kmaykokecweugeea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621010": [
        {
            "ioc_value": "ywegmweuqowisogu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621011": [
        {
            "ioc_value": "qgysumeiacemuoyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621012": [
        {
            "ioc_value": "askusgciesikiucq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621013": [
        {
            "ioc_value": "yiggyqqkyyswamea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621014": [
        {
            "ioc_value": "ooyieyacmyuiuiuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621015": [
        {
            "ioc_value": "eaoawccooaekowiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621016": [
        {
            "ioc_value": "kmqiaamkeqmkaigk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621017": [
        {
            "ioc_value": "eoskasyqougkqieg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621018": [
        {
            "ioc_value": "ocgeiimgaiymssow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621019": [
        {
            "ioc_value": "kugiumewocqwceoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621020": [
        {
            "ioc_value": "agusqgkkkqsmccee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620981": [
        {
            "ioc_value": "amussuqsagaeomsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620982": [
        {
            "ioc_value": "yiwcsumakwkgayco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620983": [
        {
            "ioc_value": "cwawsykwggccaceq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620984": [
        {
            "ioc_value": "ugoguokgksewkuku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620985": [
        {
            "ioc_value": "ycmomgkoekwgisuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620986": [
        {
            "ioc_value": "qgyaqkygsaywcmss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620987": [
        {
            "ioc_value": "gmsyoiimgwmakowu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620988": [
        {
            "ioc_value": "qmgoyiqgmqagekww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620989": [
        {
            "ioc_value": "uaeiiocyumccgeyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620990": [
        {
            "ioc_value": "euyeoeuisgayuqcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620991": [
        {
            "ioc_value": "uuqaiaokawywqoey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620992": [
        {
            "ioc_value": "oiomauygmowuoqsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620993": [
        {
            "ioc_value": "scqyaquiywwweyyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620994": [
        {
            "ioc_value": "aaekmaocssaqgwsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620995": [
        {
            "ioc_value": "ocykyyeuyiauqgym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620996": [
        {
            "ioc_value": "gegqkocigmeiigea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620997": [
        {
            "ioc_value": "gywucaiyqicymuek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620998": [
        {
            "ioc_value": "cqoekuemyiwmcssu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620999": [
        {
            "ioc_value": "ugymqwckgygeuqis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1621000": [
        {
            "ioc_value": "cwayykmaeeqyqkqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620961": [
        {
            "ioc_value": "geuemiuowaegomqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620962": [
        {
            "ioc_value": "iqiswusosceamisk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620963": [
        {
            "ioc_value": "iquwsgaomqeoqcsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620964": [
        {
            "ioc_value": "ouscugeoyuoowcog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620965": [
        {
            "ioc_value": "mkmgakgmqkoccqmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620966": [
        {
            "ioc_value": "gyaioaceqoeweqge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620967": [
        {
            "ioc_value": "kmiawiwyiukuywea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620968": [
        {
            "ioc_value": "gegygcuekymewumu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620969": [
        {
            "ioc_value": "gswmeoyqkyigoweq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620970": [
        {
            "ioc_value": "iqgkkwiyqaascguk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620971": [
        {
            "ioc_value": "kuiekuecyyqsoqou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620972": [
        {
            "ioc_value": "agekwgayemuqocak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620973": [
        {
            "ioc_value": "swcgaqasoesweqaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620974": [
        {
            "ioc_value": "cqamqegyqqmscccq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620975": [
        {
            "ioc_value": "sqyacsmggmuqysko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620976": [
        {
            "ioc_value": "uuosoiecuoekyeaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620977": [
        {
            "ioc_value": "qycmuakuaasmsmci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620978": [
        {
            "ioc_value": "eiwcqwiwaoeuccas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620979": [
        {
            "ioc_value": "eiyoykmsoaauewug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620980": [
        {
            "ioc_value": "ugyssywygycegeik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620938": [
        {
            "ioc_value": "gmiwwmoiuqysaiuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620939": [
        {
            "ioc_value": "uomssoiokyoeawyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620940": [
        {
            "ioc_value": "sqsascuugsocmoai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620941": [
        {
            "ioc_value": "mkqaysikywemeuak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620942": [
        {
            "ioc_value": "ooeuqqcogeiseckq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620943": [
        {
            "ioc_value": "ycywaymigoikwcis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620944": [
        {
            "ioc_value": "uueiiguaawccoqei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620945": [
        {
            "ioc_value": "cwgqweoeakmyaqke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620946": [
        {
            "ioc_value": "ceimqcgcycuousas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620947": [
        {
            "ioc_value": "myggaacgacewmmic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620948": [
        {
            "ioc_value": "iiqswmiumogicqgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620949": [
        {
            "ioc_value": "oooygckqyagicwuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620950": [
        {
            "ioc_value": "oogkeeiuioksmkiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620951": [
        {
            "ioc_value": "yogyiokgeiygewku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620952": [
        {
            "ioc_value": "uggmgsigokgcqgyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620953": [
        {
            "ioc_value": "iwwsksguuikywqae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620954": [
        {
            "ioc_value": "uocwqyockqegqiyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620955": [
        {
            "ioc_value": "ywakgoiwcaokmyag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620956": [
        {
            "ioc_value": "oiqekgaickgmmoyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620957": [
        {
            "ioc_value": "sweoqsyiywguyoiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620958": [
        {
            "ioc_value": "mkaouwaymgmaiiiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620959": [
        {
            "ioc_value": "wyoaamgcukgkuiwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620960": [
        {
            "ioc_value": "wymakiciasggcusi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620918": [
        {
            "ioc_value": "qsokmkwogkysoiga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620919": [
        {
            "ioc_value": "eakwiimaokukwmii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620920": [
        {
            "ioc_value": "scyuaygyiywewuqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620921": [
        {
            "ioc_value": "uumecoieeeicqeeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620922": [
        {
            "ioc_value": "qgucmaesagakiyou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620923": [
        {
            "ioc_value": "mykwsemqimimgsuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620924": [
        {
            "ioc_value": "agskoayooqcwyssm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620925": [
        {
            "ioc_value": "eukikyqwoyuikmku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620926": [
        {
            "ioc_value": "mkomawemawyseuqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620927": [
        {
            "ioc_value": "agqswoiaesawggek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620928": [
        {
            "ioc_value": "iwmeuwuqgawgaemy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620929": [
        {
            "ioc_value": "geskouekqkwmoomo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620930": [
        {
            "ioc_value": "aaogsioummyamcwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620931": [
        {
            "ioc_value": "uoeueuesuqmocwci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620932": [
        {
            "ioc_value": "kmcccgmwgowmkkiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620933": [
        {
            "ioc_value": "icmicqwqkceaykse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620934": [
        {
            "ioc_value": "amcwqackmmqouesu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620935": [
        {
            "ioc_value": "eawqaqgqqeeueuus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620936": [
        {
            "ioc_value": "kmkqmoyoykwgcmmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620937": [
        {
            "ioc_value": "oiucyukicmcyaoyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620904": [
        {
            "ioc_value": "eaaqkowaomeyyoei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620905": [
        {
            "ioc_value": "kauywggukwqaakqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620906": [
        {
            "ioc_value": "qgoueskmwiiuousc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620907": [
        {
            "ioc_value": "eicwwsiwwikuyaeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620908": [
        {
            "ioc_value": "ycoqwugkykscgkiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620909": [
        {
            "ioc_value": "cqiksyioeucceyws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620910": [
        {
            "ioc_value": "icqmequsammsqsgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620911": [
        {
            "ioc_value": "cksiccmoiseuiigk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620912": [
        {
            "ioc_value": "mekoyyaaumkkasek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620913": [
        {
            "ioc_value": "oussygwueqyawyqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620914": [
        {
            "ioc_value": "eiwyogwuiooqsmgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620915": [
        {
            "ioc_value": "wsyamckqiogsgosm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620916": [
        {
            "ioc_value": "ugkimayomaeomoyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620917": [
        {
            "ioc_value": "qsgsgwaaokueaies.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620902": [
        {
            "ioc_value": "kgqmkcussecugkyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620903": [
        {
            "ioc_value": "cwmkcmkssoaeqogi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620880": [
        {
            "ioc_value": "ycqwgcmouguiwwgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620881": [
        {
            "ioc_value": "iiyuoayoqwymuoqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620882": [
        {
            "ioc_value": "wsgwkqiuwykceqos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620883": [
        {
            "ioc_value": "eiaqskycusmmisyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620884": [
        {
            "ioc_value": "cwuamaeoymwsacyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620885": [
        {
            "ioc_value": "weeaqsosgogwwysc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620886": [
        {
            "ioc_value": "eumgciskcsmiiwwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620887": [
        {
            "ioc_value": "cwkgiuusossimyyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620888": [
        {
            "ioc_value": "asseemqgoggqysiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620889": [
        {
            "ioc_value": "meemyccacasckqaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620890": [
        {
            "ioc_value": "gmcoaiwwicskgeam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620891": [
        {
            "ioc_value": "eiqsqacgmiymegso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620892": [
        {
            "ioc_value": "gsgysusyieomgcgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620893": [
        {
            "ioc_value": "amiiiogegmmoyayc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620894": [
        {
            "ioc_value": "gyiqkokgkcwuguyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620895": [
        {
            "ioc_value": "oiuaiciewsceuwck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620896": [
        {
            "ioc_value": "meuoumeckgmockes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620897": [
        {
            "ioc_value": "yococoqmegesmgag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620898": [
        {
            "ioc_value": "iqgacasqscooyuuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620899": [
        {
            "ioc_value": "uoouayqgakwuaeeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620900": [
        {
            "ioc_value": "wkaqksuggmsqkqiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620901": [
        {
            "ioc_value": "kgeyyasumguiiomg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620859": [
        {
            "ioc_value": "iqccsskouwiokmmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620860": [
        {
            "ioc_value": "agwoygocouuswgam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620861": [
        {
            "ioc_value": "mkiykkwimogayeik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620862": [
        {
            "ioc_value": "iceqasiqkaakiaok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620863": [
        {
            "ioc_value": "ckcaimqkmygsaqsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620864": [
        {
            "ioc_value": "agueqamyqmggamus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620865": [
        {
            "ioc_value": "yoeqcsuusqmeuyos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620866": [
        {
            "ioc_value": "kumuiswekeiococc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620867": [
        {
            "ioc_value": "ocwwywoiiqcoyswq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620868": [
        {
            "ioc_value": "wkqcqokqugkoogiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620869": [
        {
            "ioc_value": "ookwekaugkowommy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620870": [
        {
            "ioc_value": "wekogqsmscwiuayk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620871": [
        {
            "ioc_value": "iiagaeqoocmogkgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620872": [
        {
            "ioc_value": "ugimewuiqaymikkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620873": [
        {
            "ioc_value": "yciimsyeeieyemyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620874": [
        {
            "ioc_value": "uoacymskyayiaqsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620875": [
        {
            "ioc_value": "kumqcyqeqoiwyees.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620876": [
        {
            "ioc_value": "wyaaqiiakgiemsus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620877": [
        {
            "ioc_value": "kgsaewqeagcsqgsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620878": [
        {
            "ioc_value": "cqeowagowsicsmky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620879": [
        {
            "ioc_value": "qmegwoeoauammgyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620838": [
        {
            "ioc_value": "eugigsgkqwmocoyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620839": [
        {
            "ioc_value": "eaeaqgeykkaqgmse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620840": [
        {
            "ioc_value": "scgioaukkmqqogmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620841": [
        {
            "ioc_value": "gskwkewqoegkmkqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620842": [
        {
            "ioc_value": "aamqicaewawiamoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620843": [
        {
            "ioc_value": "eiigmioumwegmcuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620844": [
        {
            "ioc_value": "agiywaiwokwismqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620845": [
        {
            "ioc_value": "uayooouicksesgmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620846": [
        {
            "ioc_value": "yiqowwqsaqwcqsek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620847": [
        {
            "ioc_value": "ckwoqeeuusogoeww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620848": [
        {
            "ioc_value": "sqgqkwiwwgmgaeca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620849": [
        {
            "ioc_value": "scumccwqmukugcsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620850": [
        {
            "ioc_value": "wsomiiwgcqqaekei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620851": [
        {
            "ioc_value": "gmuewuqcuuqeycqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620852": [
        {
            "ioc_value": "yokwkiamyqssooqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620853": [
        {
            "ioc_value": "uagkugyuemiuusyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620854": [
        {
            "ioc_value": "gygmkaacymqeykkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620855": [
        {
            "ioc_value": "cwaqocoqkscueoow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620856": [
        {
            "ioc_value": "ugsgmeqameiuyamq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620857": [
        {
            "ioc_value": "wymqwwmmqqwgmkmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620858": [
        {
            "ioc_value": "cecgokqkciamqiew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620816": [
        {
            "ioc_value": "qmgkuiuiwkwaceke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620817": [
        {
            "ioc_value": "gekuokawcsaycsaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620818": [
        {
            "ioc_value": "skimygukiaugseyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620819": [
        {
            "ioc_value": "skykqukeiooowwsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620820": [
        {
            "ioc_value": "qymoiqewawcmyiig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620821": [
        {
            "ioc_value": "yimweiiqecyaogqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620822": [
        {
            "ioc_value": "kgwkaiwggqkoqmgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620823": [
        {
            "ioc_value": "yocaimquaicsmgay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620824": [
        {
            "ioc_value": "ugmcmukmmiycaeas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620825": [
        {
            "ioc_value": "iwegqqyucecygmws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620826": [
        {
            "ioc_value": "qgkasaugyqoucmms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620827": [
        {
            "ioc_value": "skqsokicymkmkmqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620828": [
        {
            "ioc_value": "oiwuaauuuweecoug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620829": [
        {
            "ioc_value": "oouwgycyqkgyqmay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620830": [
        {
            "ioc_value": "qsqaegqacwoyyoaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620831": [
        {
            "ioc_value": "oicqyqowuaoyyasu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620832": [
        {
            "ioc_value": "kaqmkuqgwkasigek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620833": [
        {
            "ioc_value": "ouiikygukyeimugg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620834": [
        {
            "ioc_value": "kueguskykwiksgus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620835": [
        {
            "ioc_value": "qggcgeqwwwiaeiku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620836": [
        {
            "ioc_value": "iiesckckiikyoiwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620837": [
        {
            "ioc_value": "qssmcwgggwokeaqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620796": [
        {
            "ioc_value": "uuuqewoieeowiiew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620797": [
        {
            "ioc_value": "qseaqqgsqmegaecy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620798": [
        {
            "ioc_value": "icasgwkgkgakiuqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620799": [
        {
            "ioc_value": "oiiuagagmicgckgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620800": [
        {
            "ioc_value": "wymgwkssmkeggwam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620801": [
        {
            "ioc_value": "kmgesgewcouuaykq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620802": [
        {
            "ioc_value": "cegeuwmagouocaka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620803": [
        {
            "ioc_value": "iqyukcksceaemqca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620804": [
        {
            "ioc_value": "scyayagggmiwgiwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620805": [
        {
            "ioc_value": "kgkkgssauasckqye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620806": [
        {
            "ioc_value": "swyowgsysoakmeek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620807": [
        {
            "ioc_value": "mqycsqeuecoasoom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620808": [
        {
            "ioc_value": "eacggsiaimqiueeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620809": [
        {
            "ioc_value": "aguqkewoswyakosq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620810": [
        {
            "ioc_value": "qgiqskgsgioqgmkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620811": [
        {
            "ioc_value": "kuacsikauwkymois.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620812": [
        {
            "ioc_value": "wymqqkoaoqwwkugu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620813": [
        {
            "ioc_value": "yiieoggsyauuqkaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620814": [
        {
            "ioc_value": "mkyqimmkuuygukyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620815": [
        {
            "ioc_value": "eosscammquoymssw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620776": [
        {
            "ioc_value": "yoqmiemaqecigwcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620777": [
        {
            "ioc_value": "cksiuogeueuyqcmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620778": [
        {
            "ioc_value": "qgakyeicmgoamomo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620779": [
        {
            "ioc_value": "iqsieysmyymoewkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620780": [
        {
            "ioc_value": "wygkagqqmwgeiuuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620781": [
        {
            "ioc_value": "gyucyuokmyqkeyce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620782": [
        {
            "ioc_value": "kggegokouiaoocsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620783": [
        {
            "ioc_value": "gsekgcuiococqaee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620784": [
        {
            "ioc_value": "gsquuueeuskywisc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620785": [
        {
            "ioc_value": "ouqkuaiaemmycaia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620786": [
        {
            "ioc_value": "aacascowgokyscsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620787": [
        {
            "ioc_value": "wsiaiquemamyeoes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620788": [
        {
            "ioc_value": "wkciiiioyeegyuwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620789": [
        {
            "ioc_value": "wemagmoomekuwekc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620790": [
        {
            "ioc_value": "uasesgqcccumwqws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620791": [
        {
            "ioc_value": "iieiwawyqwocyeko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620792": [
        {
            "ioc_value": "asayuaweagccigoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620793": [
        {
            "ioc_value": "qmykugmciammwimm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620794": [
        {
            "ioc_value": "eisiiukyismuuqag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620795": [
        {
            "ioc_value": "uommakyosgyuyioa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620757": [
        {
            "ioc_value": "uaagsekuyoguieua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620758": [
        {
            "ioc_value": "ookqmugmqeyuecmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620759": [
        {
            "ioc_value": "eaqeaooiksawewuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620760": [
        {
            "ioc_value": "qyigigkiuagyykck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620761": [
        {
            "ioc_value": "sqwgqsiiycmwiwoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620762": [
        {
            "ioc_value": "uoogwmmymwigqqsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620763": [
        {
            "ioc_value": "kummcegyqaesagaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620764": [
        {
            "ioc_value": "eoyaygqekkcuoqsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620765": [
        {
            "ioc_value": "ammeaysssuquyuoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620766": [
        {
            "ioc_value": "gyaoummcsciweeai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620767": [
        {
            "ioc_value": "ckkecqgcoqucssag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620768": [
        {
            "ioc_value": "iweyimcsayscewao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620769": [
        {
            "ioc_value": "ouukemseqwsckuus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620770": [
        {
            "ioc_value": "gmoawaomqgoouisi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620771": [
        {
            "ioc_value": "gmmgcwuyygyecgey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620772": [
        {
            "ioc_value": "qyamkeagiikougwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620773": [
        {
            "ioc_value": "kgkgyuswoyqcegwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620774": [
        {
            "ioc_value": "swmqcyaaeuiyaycm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620775": [
        {
            "ioc_value": "ugaqykgaeewqqsuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620738": [
        {
            "ioc_value": "uoimqewuecsaykeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620739": [
        {
            "ioc_value": "ocygmuikimucccqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620740": [
        {
            "ioc_value": "kmuemcuiiiigeeie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620741": [
        {
            "ioc_value": "uaimqmksuyouyiwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620742": [
        {
            "ioc_value": "ickckggaoesqmwqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620743": [
        {
            "ioc_value": "ugymwukywoiikiya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620744": [
        {
            "ioc_value": "ugkqyuascauaqwyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620745": [
        {
            "ioc_value": "wycoumgusmaicmgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620746": [
        {
            "ioc_value": "ywukgeigsysuycus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620747": [
        {
            "ioc_value": "eicsioywskgmuwiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620748": [
        {
            "ioc_value": "wymammsosiiogiac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620749": [
        {
            "ioc_value": "oomeeywmqqcakaww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620750": [
        {
            "ioc_value": "uauykeyuaaqogkcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620751": [
        {
            "ioc_value": "ckoyqwkoegoocsey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620752": [
        {
            "ioc_value": "oiskiicgaouseooi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620753": [
        {
            "ioc_value": "easwkqkgouwoqswi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620754": [
        {
            "ioc_value": "uoqkqekiekagsqck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620755": [
        {
            "ioc_value": "ywuokkqumwwssekm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620756": [
        {
            "ioc_value": "geguqagywumogaww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620719": [
        {
            "ioc_value": "sqimiuwigywkqykm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620720": [
        {
            "ioc_value": "kaoaousckeouiecc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620721": [
        {
            "ioc_value": "asimsskquyyuqwys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620722": [
        {
            "ioc_value": "skoyesmcseaqiseo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620723": [
        {
            "ioc_value": "mymukieyagewmsiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620724": [
        {
            "ioc_value": "scoeiqqyqsgguwge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620725": [
        {
            "ioc_value": "sweqcuaomkckosom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620726": [
        {
            "ioc_value": "wemcygowigwmckym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620727": [
        {
            "ioc_value": "ugyieqgaocmkmcow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620728": [
        {
            "ioc_value": "cwkmmkssosukaqqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620729": [
        {
            "ioc_value": "meccgoquowmsaqss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620730": [
        {
            "ioc_value": "kuqakmikggkccsey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620731": [
        {
            "ioc_value": "ocwocmogyucaamcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620732": [
        {
            "ioc_value": "gsmycaoiukqoceqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620733": [
        {
            "ioc_value": "kgwsmqkokuouqoek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620734": [
        {
            "ioc_value": "euacesqqciceokek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620735": [
        {
            "ioc_value": "agqieuiucywigquk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620736": [
        {
            "ioc_value": "qmwgsskmgeiuoaey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620737": [
        {
            "ioc_value": "gesiiwgwqamkegmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620701": [
        {
            "ioc_value": "weiiokasaoykcaku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620702": [
        {
            "ioc_value": "eugygwykyawomckc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620703": [
        {
            "ioc_value": "wyogieyyoqyquigs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620704": [
        {
            "ioc_value": "ckmaamaqyayqegey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620705": [
        {
            "ioc_value": "ouioswsgymsaqkwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620706": [
        {
            "ioc_value": "eiisescwwwemwkya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620707": [
        {
            "ioc_value": "qgsygqikqkwyasii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620708": [
        {
            "ioc_value": "gekuqmcogmmqmmim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620709": [
        {
            "ioc_value": "cqeuuemwmgyekmus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620710": [
        {
            "ioc_value": "icssicmcaeiyoica.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620711": [
        {
            "ioc_value": "ouossukcosaeggwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620712": [
        {
            "ioc_value": "ouqaymikkkywcomg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620713": [
        {
            "ioc_value": "eosyssecuwycucue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620714": [
        {
            "ioc_value": "gmegcoyeyeuioqsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620715": [
        {
            "ioc_value": "myiwecycgyksgeyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620716": [
        {
            "ioc_value": "kaguyoeaoaiowwgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620717": [
        {
            "ioc_value": "yikyguwqoackoyie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620718": [
        {
            "ioc_value": "qsmwieiiawsmoykw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620682": [
        {
            "ioc_value": "gmgmseauqwkoquge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620683": [
        {
            "ioc_value": "ywaoumyicuwmyuiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620684": [
        {
            "ioc_value": "agueskgoiiceoueu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620685": [
        {
            "ioc_value": "gycyyweaqyeayeuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620686": [
        {
            "ioc_value": "amsosemiimmgiywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620687": [
        {
            "ioc_value": "ycsyocmuammygyia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620688": [
        {
            "ioc_value": "sqoeiwuewsaamkcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620689": [
        {
            "ioc_value": "iikymuymygqqsiiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620690": [
        {
            "ioc_value": "eieckwkimaaigwei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620691": [
        {
            "ioc_value": "qgwoykmukqsegqem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620692": [
        {
            "ioc_value": "ugkwqkkcckmiaswy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620693": [
        {
            "ioc_value": "swuuewqcmugckwyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620694": [
        {
            "ioc_value": "qsuiwkwmyucgquww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620695": [
        {
            "ioc_value": "cwagwoieqagsgowy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620696": [
        {
            "ioc_value": "scymcgsckogwkoyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620697": [
        {
            "ioc_value": "gsgioauoququiqym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620698": [
        {
            "ioc_value": "eiiiccuimuymagas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620699": [
        {
            "ioc_value": "uomssggucuyamcsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620700": [
        {
            "ioc_value": "uucqugemcgakcmsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620663": [
        {
            "ioc_value": "ugoyscoigwwkmkkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620664": [
        {
            "ioc_value": "asqmksokseyqiyqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620665": [
        {
            "ioc_value": "oiusiuqoaqekgwmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620666": [
        {
            "ioc_value": "qgiayaiaycseceok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620667": [
        {
            "ioc_value": "uoikismocqqaqgwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620668": [
        {
            "ioc_value": "agaauggycaggqcim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620669": [
        {
            "ioc_value": "gygkuaemoigqkuoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620670": [
        {
            "ioc_value": "kgicsyqssygcogac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620671": [
        {
            "ioc_value": "gsaiwkskiyqgeayi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620672": [
        {
            "ioc_value": "uumieaqmmwwksgic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620673": [
        {
            "ioc_value": "asecqqegwswwieio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620674": [
        {
            "ioc_value": "wsoaciqeouwiauik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620675": [
        {
            "ioc_value": "cegeasoycqoyaiim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620676": [
        {
            "ioc_value": "qyagmiimgksqoccs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620677": [
        {
            "ioc_value": "icqwouiyguyqswio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620678": [
        {
            "ioc_value": "weseqosqaggqieia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620679": [
        {
            "ioc_value": "uguaaeccegaacysa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620680": [
        {
            "ioc_value": "geksyamukgkeoyco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620681": [
        {
            "ioc_value": "wygquswumaceuqsu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620642": [
        {
            "ioc_value": "gmcsmewkskecwigg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620643": [
        {
            "ioc_value": "wsyosoysyeiekyyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620644": [
        {
            "ioc_value": "ugmiogkmmmqkqeis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620645": [
        {
            "ioc_value": "amqeoceuwmkeyaiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620646": [
        {
            "ioc_value": "swquusmmemuqecik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620647": [
        {
            "ioc_value": "yosykummasicmiyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620648": [
        {
            "ioc_value": "iimqyacqaeiycoki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620649": [
        {
            "ioc_value": "iwyokuseawiqoequ.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620650": [
        {
            "ioc_value": "ocqceweeqwckuuwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620651": [
        {
            "ioc_value": "iqokyacwmigeesum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620652": [
        {
            "ioc_value": "iwgoqwooeekmekia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620653": [
        {
            "ioc_value": "kgygiiukaygiwmkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620654": [
        {
            "ioc_value": "uayoukessuwoceuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620655": [
        {
            "ioc_value": "gsmcgysswegaiwcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620656": [
        {
            "ioc_value": "qmaseqmiuucgmcam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620657": [
        {
            "ioc_value": "iigeckmqaskcyqsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620658": [
        {
            "ioc_value": "skosmqiaaemyoamo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620659": [
        {
            "ioc_value": "uogwiqsasokyiiyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620660": [
        {
            "ioc_value": "assywyquyoecemak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620661": [
        {
            "ioc_value": "ooecewqsygiyiciu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620662": [
        {
            "ioc_value": "kgogkqieaoccuigi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620620": [
        {
            "ioc_value": "ycuygwueaagoeime.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620621": [
        {
            "ioc_value": "swayyaoawcmokemo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620622": [
        {
            "ioc_value": "cqemaymgewuuaiie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620623": [
        {
            "ioc_value": "gskocqqaqggaicqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620624": [
        {
            "ioc_value": "sqeekssoaeguyiuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620625": [
        {
            "ioc_value": "ouemogimkaoqssik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620626": [
        {
            "ioc_value": "myyqqaaqoiamcoqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620627": [
        {
            "ioc_value": "aaammiosoawuoaws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620628": [
        {
            "ioc_value": "cwukioyoeoqcumuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620629": [
        {
            "ioc_value": "icukykewcqsesqcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620630": [
        {
            "ioc_value": "amsmucseqwueoysw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620631": [
        {
            "ioc_value": "qywuqmmsgaimmsgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620632": [
        {
            "ioc_value": "asmeaoecqoooiewe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620633": [
        {
            "ioc_value": "ckeqewcaoagayaii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620634": [
        {
            "ioc_value": "cekkyaswucgwcayk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620635": [
        {
            "ioc_value": "uosqysosaoigwsim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620636": [
        {
            "ioc_value": "wyoimqccmaoyymwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620637": [
        {
            "ioc_value": "kgmgwqecmakuiqkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620638": [
        {
            "ioc_value": "mkckuiccoyuweuii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620639": [
        {
            "ioc_value": "yciucmoueywseoca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620640": [
        {
            "ioc_value": "wykiiaogmcykosmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620641": [
        {
            "ioc_value": "asigeoqkqwewcceu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620597": [
        {
            "ioc_value": "gyiokwgugameugyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620598": [
        {
            "ioc_value": "weeacsaemsmocogm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620599": [
        {
            "ioc_value": "cwkkoouicwsiasgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620600": [
        {
            "ioc_value": "eameowquwcemeeig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620601": [
        {
            "ioc_value": "sqakcammswskumky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620602": [
        {
            "ioc_value": "gmgqkosciesmksma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620603": [
        {
            "ioc_value": "skcmmkamcyoqqqcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620604": [
        {
            "ioc_value": "iwiyeswaeksecoig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620605": [
        {
            "ioc_value": "euymomeccoswaesy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620606": [
        {
            "ioc_value": "wegiiewygoccgkmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620607": [
        {
            "ioc_value": "kaowiuyouaksoska.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620608": [
        {
            "ioc_value": "oisougmoioqyaacw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620609": [
        {
            "ioc_value": "asemkoioyksoyakm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620610": [
        {
            "ioc_value": "kueomqqkicaseeem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620611": [
        {
            "ioc_value": "iqukqkwemyouayek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620612": [
        {
            "ioc_value": "yomyymekcgmsymcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620613": [
        {
            "ioc_value": "mkqscuosaqacyuio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620614": [
        {
            "ioc_value": "amowiqygmmuyymoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620615": [
        {
            "ioc_value": "eackcaymyowgeaiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620616": [
        {
            "ioc_value": "cwmyusygqawsieso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620617": [
        {
            "ioc_value": "oiwqeycwkcamyccu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620618": [
        {
            "ioc_value": "gmqeuqqowakuagqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620619": [
        {
            "ioc_value": "ockeuuksyuswwayw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620575": [
        {
            "ioc_value": "uuoiaessyacsiwek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620576": [
        {
            "ioc_value": "aggsouecosccsgyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620577": [
        {
            "ioc_value": "iieuykqqmqgwiugm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620578": [
        {
            "ioc_value": "aacykyimqegumeum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620579": [
        {
            "ioc_value": "kumcacmmkmkimkiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620580": [
        {
            "ioc_value": "geswkimaceskwgus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620581": [
        {
            "ioc_value": "yimmiimicaeeucsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620582": [
        {
            "ioc_value": "euckegwikkaycqeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620583": [
        {
            "ioc_value": "ugsueayageasigmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620584": [
        {
            "ioc_value": "iisywomycqkmcswe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620585": [
        {
            "ioc_value": "qmesuyeueacwisaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620586": [
        {
            "ioc_value": "ywciikiseaeuaowe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620587": [
        {
            "ioc_value": "uoweeaquggukmusa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620588": [
        {
            "ioc_value": "gskqgsmymciisege.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620589": [
        {
            "ioc_value": "sweuewkgumqccqoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620590": [
        {
            "ioc_value": "icwyioooesoeomwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620591": [
        {
            "ioc_value": "uuseowmysyayocys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620592": [
        {
            "ioc_value": "oimsqqqiuiygcokm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620593": [
        {
            "ioc_value": "asgyuskacueomkku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620594": [
        {
            "ioc_value": "iqmymmsusaaeauqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620595": [
        {
            "ioc_value": "iqsgqokyyimsmuce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620596": [
        {
            "ioc_value": "yowgiigkqcacuksa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620554": [
        {
            "ioc_value": "qgucigcuamkegcea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620555": [
        {
            "ioc_value": "aamesagqeyiseucs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620556": [
        {
            "ioc_value": "sqmummgwkgmceogm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620557": [
        {
            "ioc_value": "kgymocoeqywawwwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620558": [
        {
            "ioc_value": "kgyccmyguugyawwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620559": [
        {
            "ioc_value": "sqiegigiqisywseq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620560": [
        {
            "ioc_value": "yciswacqqukoasaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620561": [
        {
            "ioc_value": "mqgeooaecigcmcqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620562": [
        {
            "ioc_value": "kuimaiyaeeaogouu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620563": [
        {
            "ioc_value": "wswkcsmoikqcousy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620564": [
        {
            "ioc_value": "geysooywggeeemug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620565": [
        {
            "ioc_value": "mkmkyigcqcigwkgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620566": [
        {
            "ioc_value": "oogcusiieyaigcyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620567": [
        {
            "ioc_value": "qyuwayieyawwaows.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620568": [
        {
            "ioc_value": "yocyywogoweeiage.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620569": [
        {
            "ioc_value": "qmsgccagiaysgosc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620570": [
        {
            "ioc_value": "gmmueaoikigykamo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620571": [
        {
            "ioc_value": "mygymmesqwmseyey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620572": [
        {
            "ioc_value": "iwegouiwwwgaomuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620573": [
        {
            "ioc_value": "swqioyyskkaewmqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620574": [
        {
            "ioc_value": "cqyqusyuqesyuumc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620532": [
        {
            "ioc_value": "oueowyycyywigmei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620533": [
        {
            "ioc_value": "euoaeigyskkcuiiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620534": [
        {
            "ioc_value": "kgckiiqgwomiwgok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620535": [
        {
            "ioc_value": "cwqoucmyqwieaoqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620536": [
        {
            "ioc_value": "sceukqucykmawwgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620537": [
        {
            "ioc_value": "kaawmqskmwqokuqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620538": [
        {
            "ioc_value": "kuiuecuygamkiaku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620539": [
        {
            "ioc_value": "iqomaaauiaisukeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620540": [
        {
            "ioc_value": "iwiwwwoeqwcgqgwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620541": [
        {
            "ioc_value": "yikqcakwwosickqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620542": [
        {
            "ioc_value": "euaeayqcaoycogog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620543": [
        {
            "ioc_value": "gsyceaioguamacog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620544": [
        {
            "ioc_value": "wysmqiywcogkscig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620545": [
        {
            "ioc_value": "sceykoqywuessiuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620546": [
        {
            "ioc_value": "ywcwwugqaesegiwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620547": [
        {
            "ioc_value": "skiygaegsuisaiyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620548": [
        {
            "ioc_value": "cwyocigissyukoyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620549": [
        {
            "ioc_value": "amqogskyecwycgai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620550": [
        {
            "ioc_value": "ooyqascueqikosky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620551": [
        {
            "ioc_value": "mqgcgukicugeaacs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620552": [
        {
            "ioc_value": "yoawkokksoaoqgay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620553": [
        {
            "ioc_value": "gsyeceyqegyycoia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620510": [
        {
            "ioc_value": "cqkmquauykwoocei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620511": [
        {
            "ioc_value": "uuusoesuugqookyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620512": [
        {
            "ioc_value": "gsmciwumoeckcmcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620513": [
        {
            "ioc_value": "scigqioccwawiouu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620514": [
        {
            "ioc_value": "myyemuuguymuowci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620515": [
        {
            "ioc_value": "ywsceiqqmockmwye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620516": [
        {
            "ioc_value": "kmmocugusmcyeyyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620517": [
        {
            "ioc_value": "cqwuqigoeickycea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620518": [
        {
            "ioc_value": "kgmeiqossesococo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620519": [
        {
            "ioc_value": "scciymkmgaqewoqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620520": [
        {
            "ioc_value": "ugewyyagagsmoeug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620521": [
        {
            "ioc_value": "ckykckkamomoksqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620522": [
        {
            "ioc_value": "iqaywkymqwycqauu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620523": [
        {
            "ioc_value": "uoogyuyskmsyooim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620524": [
        {
            "ioc_value": "eoiiwqykwakqeaiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620525": [
        {
            "ioc_value": "uaemwmeiseiygewg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620526": [
        {
            "ioc_value": "uagmyuqceicaioai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620527": [
        {
            "ioc_value": "qmsiwkqkmgkouqcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620528": [
        {
            "ioc_value": "gsesyiwmqoyiwqao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620529": [
        {
            "ioc_value": "iiqqkggiauyeeyoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620530": [
        {
            "ioc_value": "kusgmwemwoccuyiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620531": [
        {
            "ioc_value": "kuuokkcoeeaquoaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620489": [
        {
            "ioc_value": "qmiomyikeeeceiwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620490": [
        {
            "ioc_value": "gmuwuuciuauukyae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620491": [
        {
            "ioc_value": "kuoimwmyaeiwiyeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620492": [
        {
            "ioc_value": "ycegsumukmouoicq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620493": [
        {
            "ioc_value": "cqmwwskcmaeqoiim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620494": [
        {
            "ioc_value": "cqakmkuwqkaggook.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620495": [
        {
            "ioc_value": "eomwqmcwoccqwasy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620496": [
        {
            "ioc_value": "agycemgkygyuugqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620497": [
        {
            "ioc_value": "ouqoqsqqyccaamwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620498": [
        {
            "ioc_value": "mymuqgoqwiskwkqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620499": [
        {
            "ioc_value": "ywqoeqmscgisecue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620500": [
        {
            "ioc_value": "wkyskskeeeacwuky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620501": [
        {
            "ioc_value": "yiyyuyusykeqikgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620502": [
        {
            "ioc_value": "mkgqkkigigqaames.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620503": [
        {
            "ioc_value": "geoyaokqyywacyqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620504": [
        {
            "ioc_value": "kmkqgckggygumcqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620505": [
        {
            "ioc_value": "kaioqsmwuiomqqmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620506": [
        {
            "ioc_value": "wskkygymiamwqukg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620507": [
        {
            "ioc_value": "kuamacaqwysuicaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620508": [
        {
            "ioc_value": "qmoeekqiwceamoua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620509": [
        {
            "ioc_value": "yiqeoggukummmskw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620469": [
        {
            "ioc_value": "amqoeeeakqsoegmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620470": [
        {
            "ioc_value": "oosqsweokumeyogs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620471": [
        {
            "ioc_value": "kmgscqaookcqysgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620472": [
        {
            "ioc_value": "mqgoqqsqugiweaig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620473": [
        {
            "ioc_value": "qmugayumsgkiggwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620474": [
        {
            "ioc_value": "gmukkmgaqeciieky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620475": [
        {
            "ioc_value": "ceuacukeomcecmqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620476": [
        {
            "ioc_value": "meieqowqqykakswu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620477": [
        {
            "ioc_value": "ooascaekuusumywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620478": [
        {
            "ioc_value": "euwgycsackwioqoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620479": [
        {
            "ioc_value": "ckymwmqyiyyyoaic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620480": [
        {
            "ioc_value": "qmqcseaskciyikua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620481": [
        {
            "ioc_value": "geeyuiuqkiuymsug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620482": [
        {
            "ioc_value": "iqmsymcscgyyueqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620483": [
        {
            "ioc_value": "ywqoosgumkoagmwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620484": [
        {
            "ioc_value": "qyusqkasmkagikwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620485": [
        {
            "ioc_value": "yiyeusquyeoqosgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620486": [
        {
            "ioc_value": "eummsgugwgagmqsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620487": [
        {
            "ioc_value": "kmoiswgimeyqwccy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620488": [
        {
            "ioc_value": "kmgamokagsgskeqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620448": [
        {
            "ioc_value": "uucgmgaswmqqaswy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620449": [
        {
            "ioc_value": "eakgkmgauwuwakge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620450": [
        {
            "ioc_value": "ceccguieyiocgmom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620451": [
        {
            "ioc_value": "aaisgukqmayweqes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620452": [
        {
            "ioc_value": "oukgeksciucqiucq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620453": [
        {
            "ioc_value": "uaiaqiwukyeuyqsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620454": [
        {
            "ioc_value": "weqyokqyaemomceu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620455": [
        {
            "ioc_value": "eagaegaqqkymwqaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620456": [
        {
            "ioc_value": "oumwsaoeyyqisgic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620457": [
        {
            "ioc_value": "oimoowieqeegoigm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620458": [
        {
            "ioc_value": "mygcasoaosqcwewe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620459": [
        {
            "ioc_value": "wsaekgusumqaasii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620460": [
        {
            "ioc_value": "ycsmgsgcyegwsseq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620461": [
        {
            "ioc_value": "qsgyieeskwcqwygm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620462": [
        {
            "ioc_value": "ickcymyweaocwcsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620463": [
        {
            "ioc_value": "ckgskqykeqqqmqki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620464": [
        {
            "ioc_value": "memmyckswacqswws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620465": [
        {
            "ioc_value": "qyecwagusieyyyou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620466": [
        {
            "ioc_value": "skogsikouwqkqeqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620467": [
        {
            "ioc_value": "wskmiewoeuokeems.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620468": [
        {
            "ioc_value": "eaoigqcuwouuicqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620428": [
        {
            "ioc_value": "gssaaeieooyyimmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620429": [
        {
            "ioc_value": "yieyekmciyagymca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620430": [
        {
            "ioc_value": "icmweeaykuiweucm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620431": [
        {
            "ioc_value": "qmosgagckqkaymei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620432": [
        {
            "ioc_value": "kaeuwmmisigykisi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620433": [
        {
            "ioc_value": "eaiseciamgckeyem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620434": [
        {
            "ioc_value": "gmieiiqcmuksuoya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620435": [
        {
            "ioc_value": "qgquakoeqyueiyey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620436": [
        {
            "ioc_value": "oukcgywqauuaqkqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620437": [
        {
            "ioc_value": "gysgyykqwimaoasi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620438": [
        {
            "ioc_value": "uaseceqcmaiqaacs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620439": [
        {
            "ioc_value": "yoauuwasswkgaewk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620440": [
        {
            "ioc_value": "qycqqeweeeamgsog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620441": [
        {
            "ioc_value": "ycqymeiyciakyugc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620442": [
        {
            "ioc_value": "oceuquecykciuccm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620443": [
        {
            "ioc_value": "skeuccugwieowmiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620444": [
        {
            "ioc_value": "iwuesiuieiquakci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620445": [
        {
            "ioc_value": "amayaacoqkgggqqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620446": [
        {
            "ioc_value": "amemyeewkwcumaog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620447": [
        {
            "ioc_value": "wysakwmgscqukmce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620407": [
        {
            "ioc_value": "wkcaqyacamcgkemg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620408": [
        {
            "ioc_value": "ouqgykeuasewkouo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620409": [
        {
            "ioc_value": "gsoiyywcakyoeake.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620410": [
        {
            "ioc_value": "ceayomguooiusiqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620411": [
        {
            "ioc_value": "eieykywaomcsgeak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620412": [
        {
            "ioc_value": "squauoguwmsisquk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620413": [
        {
            "ioc_value": "gyksueemwseaykqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620414": [
        {
            "ioc_value": "amssiyykciuuwgyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620415": [
        {
            "ioc_value": "eokoykqkmmimmssw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620416": [
        {
            "ioc_value": "yceciokkwwmouicw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620417": [
        {
            "ioc_value": "cwgkesugggmeeauw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620418": [
        {
            "ioc_value": "wsqiwuagewokyssm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620419": [
        {
            "ioc_value": "ocmyukucwsewwuma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620420": [
        {
            "ioc_value": "geikkucogyiqgmee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620421": [
        {
            "ioc_value": "iciyaaskoigeiwoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620422": [
        {
            "ioc_value": "oocyosgocewioqwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620423": [
        {
            "ioc_value": "uggwmgcmycyqyguq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620424": [
        {
            "ioc_value": "wkuswqgieyisgsiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620425": [
        {
            "ioc_value": "oikcieuigqewiumw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620426": [
        {
            "ioc_value": "kuuyaggmemqaeism.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620427": [
        {
            "ioc_value": "eisqiykwskwksgos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620384": [
        {
            "ioc_value": "ycoacmcwooamioai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620385": [
        {
            "ioc_value": "cwcmuqoassqweygs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620386": [
        {
            "ioc_value": "wsimuscaoqouiimo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620387": [
        {
            "ioc_value": "wsmacwsskgeiykay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620388": [
        {
            "ioc_value": "eawuaukiigckiaqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620389": [
        {
            "ioc_value": "swacsawqwyemqmek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620390": [
        {
            "ioc_value": "eucgueccummcqosw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620391": [
        {
            "ioc_value": "cwuaosqqgyukquyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620392": [
        {
            "ioc_value": "iiugeewsigmcmkae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620393": [
        {
            "ioc_value": "uuekaawcqqscyycc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620394": [
        {
            "ioc_value": "ywmesyucysscsyoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620395": [
        {
            "ioc_value": "skuweswccimouekw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620396": [
        {
            "ioc_value": "eommceuuecauiika.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620397": [
        {
            "ioc_value": "weieiuesamecsqcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620398": [
        {
            "ioc_value": "ooguaasswggwoqqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620399": [
        {
            "ioc_value": "gscwsiekwocasuss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620400": [
        {
            "ioc_value": "ckqoakeyykacaqim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620401": [
        {
            "ioc_value": "iiayaekqaccmkask.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620402": [
        {
            "ioc_value": "ocagokooekgsyqwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620403": [
        {
            "ioc_value": "gmgmyuguyussqemc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620404": [
        {
            "ioc_value": "cwwyoiquciwsmkik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620405": [
        {
            "ioc_value": "qsscykwaskeuoyie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620406": [
        {
            "ioc_value": "yiikakwgmocgyuum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620363": [
        {
            "ioc_value": "myoyqoaawyqsywco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620364": [
        {
            "ioc_value": "ycyciaueowecmuom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620365": [
        {
            "ioc_value": "kgeymoeoyscmoyuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620366": [
        {
            "ioc_value": "cqoeuwiemmyiiswy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620367": [
        {
            "ioc_value": "oimkaacmiqyewwwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620368": [
        {
            "ioc_value": "iwuacisqyuaacwkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620369": [
        {
            "ioc_value": "scumakisqogaeiqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620370": [
        {
            "ioc_value": "ocysgsiuiekegwuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620371": [
        {
            "ioc_value": "wssaacsciikoyeyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620372": [
        {
            "ioc_value": "wkoiowwoseuoccsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620373": [
        {
            "ioc_value": "amsuqocokguskkee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620374": [
        {
            "ioc_value": "euwukiausmmecscu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620375": [
        {
            "ioc_value": "mqueikwmkeigwsgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620376": [
        {
            "ioc_value": "cwykkgauyyscwykm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620377": [
        {
            "ioc_value": "qmuewaiqcymqcskw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620378": [
        {
            "ioc_value": "myooqsaokwgyyswm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620379": [
        {
            "ioc_value": "gmmimsikgykqgosg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620380": [
        {
            "ioc_value": "kaqyomqwqomwawqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620381": [
        {
            "ioc_value": "weaoewmacycqwuii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620382": [
        {
            "ioc_value": "gyuycqyeomckqsoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620383": [
        {
            "ioc_value": "iwsuwkyssuuoqmms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620340": [
        {
            "ioc_value": "geissameekksaues.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620341": [
        {
            "ioc_value": "eumiqiaaessyguqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620342": [
        {
            "ioc_value": "yigwsoiesoiiicsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620343": [
        {
            "ioc_value": "wksaiguwcmaqomee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620344": [
        {
            "ioc_value": "scqawmwoiosccugs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620345": [
        {
            "ioc_value": "oigqaaigmkecikye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620346": [
        {
            "ioc_value": "skkakisqsqmiomyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620347": [
        {
            "ioc_value": "kumkysyiucygscaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620348": [
        {
            "ioc_value": "iwoaiwecmqucocmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620349": [
        {
            "ioc_value": "swwkucywwwcswaas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620350": [
        {
            "ioc_value": "swsqeyeqssymswsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620351": [
        {
            "ioc_value": "oiueowymiumcmass.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620352": [
        {
            "ioc_value": "qmcgoskicamyaqwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620353": [
        {
            "ioc_value": "yoicsaqauyascquk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620354": [
        {
            "ioc_value": "eiumwqssikmwkaym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620355": [
        {
            "ioc_value": "wsemswaakkuaggcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620356": [
        {
            "ioc_value": "geygswwiwqwsmwkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620357": [
        {
            "ioc_value": "mkcakossmumwayqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620358": [
        {
            "ioc_value": "qsaeqwucoayqmyma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620359": [
        {
            "ioc_value": "ugsacwukqwcwiagu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620360": [
        {
            "ioc_value": "wkaykusuocqquyma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620361": [
        {
            "ioc_value": "iwoeuscewukkekui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620362": [
        {
            "ioc_value": "kuyusmoqekwcquks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620319": [
        {
            "ioc_value": "oiieyeiuogaoqkaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620320": [
        {
            "ioc_value": "gsuuyeqgqyimisyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620321": [
        {
            "ioc_value": "iikyasuecwswuica.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620322": [
        {
            "ioc_value": "skkamwgsawiycamu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620323": [
        {
            "ioc_value": "ocqiuuoegekeemis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620324": [
        {
            "ioc_value": "scieoccwyccyuqsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620325": [
        {
            "ioc_value": "swouwecmyowkeimw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620326": [
        {
            "ioc_value": "euwkuasieesgkyqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620327": [
        {
            "ioc_value": "mqkqsqsyaymsoqmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620328": [
        {
            "ioc_value": "geeiamqwikoagqke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620329": [
        {
            "ioc_value": "gswmecqcgaumuowu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620330": [
        {
            "ioc_value": "ywmsqukwouuusywq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620331": [
        {
            "ioc_value": "ywmiymwegwgoscce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620332": [
        {
            "ioc_value": "gsiueceiawoemmmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620333": [
        {
            "ioc_value": "oouicaaaqmguwuoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620334": [
        {
            "ioc_value": "amowucaugqqkuqqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620335": [
        {
            "ioc_value": "sqimceqacisyuqca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620336": [
        {
            "ioc_value": "ycayqgcqommmyyiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620337": [
        {
            "ioc_value": "yoqswoaqygigwuuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620338": [
        {
            "ioc_value": "aasmukowckmwcsii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620339": [
        {
            "ioc_value": "kueyaaqawkgacgck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620298": [
        {
            "ioc_value": "aaqycawckmeeegqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620299": [
        {
            "ioc_value": "eismqoaymucceggc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620300": [
        {
            "ioc_value": "mecqaiiwegkywmwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620301": [
        {
            "ioc_value": "icqsweeekmesckqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620302": [
        {
            "ioc_value": "weoyqioiwkgkmoum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620303": [
        {
            "ioc_value": "wyigewmyueswuqwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620304": [
        {
            "ioc_value": "oiqiwkgeyysukyqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620305": [
        {
            "ioc_value": "ugqmaoqkcssusiww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620306": [
        {
            "ioc_value": "ocwqmoqiwsgaomwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620307": [
        {
            "ioc_value": "kukaqiuyumsumsmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620308": [
        {
            "ioc_value": "iikyiyioekkoysya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620309": [
        {
            "ioc_value": "oowcqysqsoqakykg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620310": [
        {
            "ioc_value": "sweookmcyyscocgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620311": [
        {
            "ioc_value": "wkyocwqiqugcagmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620312": [
        {
            "ioc_value": "wkaoyyemmuqoysqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620313": [
        {
            "ioc_value": "mewqycauwgwigsuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620314": [
        {
            "ioc_value": "aauwkqmkggkqaeuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620315": [
        {
            "ioc_value": "ywckiyisqqyuoiww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620316": [
        {
            "ioc_value": "ckmkkkkyqigumaye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620317": [
        {
            "ioc_value": "kgoqukacqeikwmqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620318": [
        {
            "ioc_value": "swsqwcyscsoeseom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620275": [
        {
            "ioc_value": "cesygckucumeumos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620276": [
        {
            "ioc_value": "eaisgauaeoauqqsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620277": [
        {
            "ioc_value": "uasagesswiqqmyak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620278": [
        {
            "ioc_value": "gyammygqugcycouw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620279": [
        {
            "ioc_value": "kmoqkwyguqiesgiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620280": [
        {
            "ioc_value": "ugcmuymusicqsiia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620281": [
        {
            "ioc_value": "qmegosaoaamoouge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620282": [
        {
            "ioc_value": "eiawaemqkawqcaia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620283": [
        {
            "ioc_value": "qgcgyayeicikamyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620284": [
        {
            "ioc_value": "gsmsawcuewkgmgyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620285": [
        {
            "ioc_value": "swukkcqqcsoyoqaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620286": [
        {
            "ioc_value": "wesgegocaggygeea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620287": [
        {
            "ioc_value": "uueqesyusyswoekq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620288": [
        {
            "ioc_value": "oiiswegoiqakgaua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620289": [
        {
            "ioc_value": "askueqcyiwmymcoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620290": [
        {
            "ioc_value": "skgwcseawkaiqoou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620291": [
        {
            "ioc_value": "ywoaeaiysigqimie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620292": [
        {
            "ioc_value": "kmkqemisagyauqgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620293": [
        {
            "ioc_value": "yismmayeqswqkgmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620294": [
        {
            "ioc_value": "kgoqkcyeeciwciuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620295": [
        {
            "ioc_value": "qyikwgkaecqskmic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620296": [
        {
            "ioc_value": "cwkiggyoiqimyeck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620297": [
        {
            "ioc_value": "sqyccuemwowmiymi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620252": [
        {
            "ioc_value": "uuyicqoyuqieoyqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620253": [
        {
            "ioc_value": "amwmkgawcoqsqmyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620254": [
        {
            "ioc_value": "eusyiegmaeqmgqys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620255": [
        {
            "ioc_value": "ckcaowuacosugusm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620256": [
        {
            "ioc_value": "kacmeaiquqssykoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620257": [
        {
            "ioc_value": "wkcuaokiewquowyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620258": [
        {
            "ioc_value": "wssoocqscwagewsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620259": [
        {
            "ioc_value": "skiqmueqgkemewis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620260": [
        {
            "ioc_value": "ouimggeeiiceqcoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620261": [
        {
            "ioc_value": "uaisyeyyiymumcqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620262": [
        {
            "ioc_value": "wekmwcisqgcikeuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620263": [
        {
            "ioc_value": "eayiysoqecoqsiok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620264": [
        {
            "ioc_value": "ouksmciiqoymieky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620265": [
        {
            "ioc_value": "oiaswiqiceacocqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620266": [
        {
            "ioc_value": "iqewuuskgoywyeci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620267": [
        {
            "ioc_value": "ywgmwgygyaiwkukk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620268": [
        {
            "ioc_value": "yccouowqkewoscei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620269": [
        {
            "ioc_value": "uaeucmmawiomwooo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620270": [
        {
            "ioc_value": "swmqkgumkqoymesi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620271": [
        {
            "ioc_value": "qmsauaoiowiqwgwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620272": [
        {
            "ioc_value": "kaeymyccigkegsyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620273": [
        {
            "ioc_value": "easwuiwoycakaeag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620274": [
        {
            "ioc_value": "yweicioqiywyyswi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620229": [
        {
            "ioc_value": "icmuqmkymeyeueea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620230": [
        {
            "ioc_value": "amoaeowsyoiagwye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620231": [
        {
            "ioc_value": "eaweqaugmuceqsqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620232": [
        {
            "ioc_value": "qyyesogwagsswwgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620233": [
        {
            "ioc_value": "kayiowekyygqugic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620234": [
        {
            "ioc_value": "ockayakeocewmmsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620235": [
        {
            "ioc_value": "aauauuacmeoycysg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620236": [
        {
            "ioc_value": "uuyqmiawggikmkeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620237": [
        {
            "ioc_value": "qsgmecgcaycmswua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620238": [
        {
            "ioc_value": "uacyagceesomessq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620239": [
        {
            "ioc_value": "agwukemwgqyymeui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620240": [
        {
            "ioc_value": "agayskqogmsusqsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620241": [
        {
            "ioc_value": "qyocsmoyqcaqesuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620242": [
        {
            "ioc_value": "mygeqqkkmyckquww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620243": [
        {
            "ioc_value": "eiqgaaiwmcgwkccs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620244": [
        {
            "ioc_value": "wkggyaqoowcaqyqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620245": [
        {
            "ioc_value": "weckcoqukcyoskwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620246": [
        {
            "ioc_value": "swgcmumqmyckmwuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620247": [
        {
            "ioc_value": "geqiakmoicskieak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620248": [
        {
            "ioc_value": "iiqmouykikieuoss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620249": [
        {
            "ioc_value": "eosyauiqswakmioc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620250": [
        {
            "ioc_value": "skqsoskkcouqguas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620251": [
        {
            "ioc_value": "ywyyskuaooyugmgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620209": [
        {
            "ioc_value": "sciweicgsmiaqwgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620210": [
        {
            "ioc_value": "uoywwiueeuaqgaci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620211": [
        {
            "ioc_value": "aacmmokasaqgkmos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620212": [
        {
            "ioc_value": "wkmmekiiagegyegm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620213": [
        {
            "ioc_value": "qsmeqgqwsuyuiycg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620214": [
        {
            "ioc_value": "mkeummocsggcoyme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620215": [
        {
            "ioc_value": "ugyusweacqwsoqws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620216": [
        {
            "ioc_value": "asocqkywkgqcycue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620217": [
        {
            "ioc_value": "uugokiwsicgeggss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620218": [
        {
            "ioc_value": "qgucaagaccscggac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620219": [
        {
            "ioc_value": "skqwakuquysigyko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620220": [
        {
            "ioc_value": "sqiiiukeksessugq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620221": [
        {
            "ioc_value": "icgisewsaoueiqcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620222": [
        {
            "ioc_value": "kgceygoseoekqsmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620223": [
        {
            "ioc_value": "qmaewkkgsomomwgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620224": [
        {
            "ioc_value": "ckeckmqoogeiqosq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620225": [
        {
            "ioc_value": "eawcgeagqkumwswo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620226": [
        {
            "ioc_value": "eiaiesmckgmwuoqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620227": [
        {
            "ioc_value": "ceeawqiaqcieqwgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620228": [
        {
            "ioc_value": "wkmmwywwukmoikqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620188": [
        {
            "ioc_value": "oiquucqkkmcywqay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620189": [
        {
            "ioc_value": "yiswasacqccmwgmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620190": [
        {
            "ioc_value": "yiowsmwmqoucsyyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620191": [
        {
            "ioc_value": "uuaaeaguysmyoqgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620192": [
        {
            "ioc_value": "meouwkaggygmeiqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620193": [
        {
            "ioc_value": "eagwkkcigiimkkau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620194": [
        {
            "ioc_value": "ococowgyoamouuku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620195": [
        {
            "ioc_value": "gmsqkoukqisagksc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620196": [
        {
            "ioc_value": "yoemgcwiggswcswm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620197": [
        {
            "ioc_value": "uaegkykucawyyais.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620198": [
        {
            "ioc_value": "weeacceikmsksewy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620199": [
        {
            "ioc_value": "scauwwmogwycsiio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620200": [
        {
            "ioc_value": "cwgkqccwcagwikao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620201": [
        {
            "ioc_value": "sqgmqquwuwooywka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620202": [
        {
            "ioc_value": "kuesiaaowioyasga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620203": [
        {
            "ioc_value": "eiikwguguuuiweem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620204": [
        {
            "ioc_value": "oikeymsoymaygksi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620205": [
        {
            "ioc_value": "amiceqymyiiewwgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620206": [
        {
            "ioc_value": "weycwmyymkewckga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620207": [
        {
            "ioc_value": "uukgcgoweykayqgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620208": [
        {
            "ioc_value": "gsccmskagkekcmai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620167": [
        {
            "ioc_value": "ouykwuegyeoyeqie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620168": [
        {
            "ioc_value": "ugwqouokoygyuogw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620169": [
        {
            "ioc_value": "agocckwekwqsooai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620170": [
        {
            "ioc_value": "kugmwoewwgoacksu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620171": [
        {
            "ioc_value": "uoaseceyyoayegky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620172": [
        {
            "ioc_value": "oimsakaeeyccmyao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620173": [
        {
            "ioc_value": "yiokkwgywmoymkcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620174": [
        {
            "ioc_value": "euqmokmacsmukwiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620175": [
        {
            "ioc_value": "gskwuoqgmqeecuik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620176": [
        {
            "ioc_value": "iweymocyymqiukcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620177": [
        {
            "ioc_value": "asieiookgucuiike.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620178": [
        {
            "ioc_value": "cewekiemiusqugam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620179": [
        {
            "ioc_value": "wsiqyqyiiceugmas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620180": [
        {
            "ioc_value": "ugioiaukygemusiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620181": [
        {
            "ioc_value": "euygusgqcywycgqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620182": [
        {
            "ioc_value": "swcguegyiuckggka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620183": [
        {
            "ioc_value": "geyeiuoskkwweiec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620184": [
        {
            "ioc_value": "qysccqsosccsgick.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620185": [
        {
            "ioc_value": "sqiumqssqqooycag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620186": [
        {
            "ioc_value": "aaoggqmmuwqowaqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620187": [
        {
            "ioc_value": "mysuggmuesawsuum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620147": [
        {
            "ioc_value": "ceowscecuamccuck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620148": [
        {
            "ioc_value": "qyymgaiwgakmgcms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620149": [
        {
            "ioc_value": "yioyscuccacyeoio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620150": [
        {
            "ioc_value": "kgaeqgwckgeyiccq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620151": [
        {
            "ioc_value": "cwygmiuyiayocqci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620152": [
        {
            "ioc_value": "mqwsoygwmmgywega.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620153": [
        {
            "ioc_value": "oisoemiagmwkcckm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620154": [
        {
            "ioc_value": "gmmawmeuwosacwwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620155": [
        {
            "ioc_value": "ywsqwasokicikoym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620156": [
        {
            "ioc_value": "yckyuaaiaoiqqmmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620157": [
        {
            "ioc_value": "oousgaqcaikgyaus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620158": [
        {
            "ioc_value": "gyiomucukyyoayqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620159": [
        {
            "ioc_value": "gskusyckwkyugkoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620160": [
        {
            "ioc_value": "gswassgscqiwooym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620161": [
        {
            "ioc_value": "geaimaqmayeoiqmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620162": [
        {
            "ioc_value": "wsgqcysggayqysmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620163": [
        {
            "ioc_value": "ceeooueqmcyuccui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620164": [
        {
            "ioc_value": "yooacuygikwggemc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620165": [
        {
            "ioc_value": "cqasciaoewumuewc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620166": [
        {
            "ioc_value": "uawukyaiwcyqgqmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620127": [
        {
            "ioc_value": "agsoymsawyuiigku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620128": [
        {
            "ioc_value": "gsuakociyoocgqow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620129": [
        {
            "ioc_value": "eaogcmuwiyogqqgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620130": [
        {
            "ioc_value": "wsmgwkmigauqcaii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620131": [
        {
            "ioc_value": "ywyeagkkakkakswo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620132": [
        {
            "ioc_value": "scgacamciqaeaeyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620133": [
        {
            "ioc_value": "swquwiqkugyoyowq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620134": [
        {
            "ioc_value": "wekmcaekseiawyse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620135": [
        {
            "ioc_value": "geweksgugkkkiqgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620136": [
        {
            "ioc_value": "iiucikemkkucyusm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620137": [
        {
            "ioc_value": "wysmmkckeckiscsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620138": [
        {
            "ioc_value": "kuggyocmqmyoawey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620139": [
        {
            "ioc_value": "kuikyokcywugceoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620140": [
        {
            "ioc_value": "gsookasmguaqswoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620141": [
        {
            "ioc_value": "iciswssmgewksayy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620142": [
        {
            "ioc_value": "eukuokmsuuigeyai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620143": [
        {
            "ioc_value": "uueiuyyooyaegugg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620144": [
        {
            "ioc_value": "uuswmkwouuisessq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620145": [
        {
            "ioc_value": "kmqaakcqaiueeoms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620146": [
        {
            "ioc_value": "qgskouucyeywuqoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620106": [
        {
            "ioc_value": "aaiaksiycyocaycw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620107": [
        {
            "ioc_value": "kuqeqogkcmkkioga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620108": [
        {
            "ioc_value": "uuicsqymueuwsoys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620109": [
        {
            "ioc_value": "mkqawsyaecmaeaqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620110": [
        {
            "ioc_value": "qsywwciuauuimugg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620111": [
        {
            "ioc_value": "wywagqywiqsucwea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620112": [
        {
            "ioc_value": "iwsmamoyesqoaukk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620113": [
        {
            "ioc_value": "ugekgieuewwwayuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620114": [
        {
            "ioc_value": "aaoywumqaqckoyyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620115": [
        {
            "ioc_value": "ocuamuyyueesewac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620116": [
        {
            "ioc_value": "qysgukqkssuiecqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620117": [
        {
            "ioc_value": "mkwqmmsgueaicayo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620118": [
        {
            "ioc_value": "cqcaaysocmweoccm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620119": [
        {
            "ioc_value": "kmuciqaasmcwgwaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620120": [
        {
            "ioc_value": "cwoygacokemeuicq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620121": [
        {
            "ioc_value": "ckkwuiwcgmmkauge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620122": [
        {
            "ioc_value": "eiaywqgsusiqoeee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620123": [
        {
            "ioc_value": "kueuacowkwmgoaku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620124": [
        {
            "ioc_value": "wymckwyyqiqiqayy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620125": [
        {
            "ioc_value": "uaoaooucwqwygoku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620126": [
        {
            "ioc_value": "mkuemiykymikswgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620087": [
        {
            "ioc_value": "ascmcewwiugscyau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620088": [
        {
            "ioc_value": "scwaqeqwqimkauym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620089": [
        {
            "ioc_value": "gsoowqyqmocyqwsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620090": [
        {
            "ioc_value": "aaycgmmumooakqki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620091": [
        {
            "ioc_value": "myuomikksswaigau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620092": [
        {
            "ioc_value": "eouysmqsswwkgwge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620093": [
        {
            "ioc_value": "gygokmacaimywags.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620094": [
        {
            "ioc_value": "eusgawgiaueygqom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620095": [
        {
            "ioc_value": "eomcagigcikyeuee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620096": [
        {
            "ioc_value": "sqecygausgcucicm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620097": [
        {
            "ioc_value": "qyugwmkqycwucwsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620098": [
        {
            "ioc_value": "eiamaeggqgggocca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620099": [
        {
            "ioc_value": "ceaucweycgmcywee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620100": [
        {
            "ioc_value": "iicgkaueiggeqmwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620101": [
        {
            "ioc_value": "euyusmmkoymyiuak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620102": [
        {
            "ioc_value": "qsmycgoqgmsgmsci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620103": [
        {
            "ioc_value": "qyqmoqymeqswsiok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620104": [
        {
            "ioc_value": "ouqcqqiyimcquegq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620105": [
        {
            "ioc_value": "uusmayeuycqykywc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620066": [
        {
            "ioc_value": "kuwouayawuweimuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620067": [
        {
            "ioc_value": "qguiysucocckykeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620068": [
        {
            "ioc_value": "easuqiskeaswmgok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620069": [
        {
            "ioc_value": "weqiqkuukgaccsyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620070": [
        {
            "ioc_value": "kgesskoygyygamay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620071": [
        {
            "ioc_value": "iiywsmikasguiaek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620072": [
        {
            "ioc_value": "yoyauokaegwimyoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620073": [
        {
            "ioc_value": "qmaciaomygogcouk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620074": [
        {
            "ioc_value": "kuwukasqsuouqyok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620075": [
        {
            "ioc_value": "skksemgumgaumqye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620076": [
        {
            "ioc_value": "kamguscgmomuimcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620077": [
        {
            "ioc_value": "yiomacqoikmkmkya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620078": [
        {
            "ioc_value": "oogqciisugygwyim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620079": [
        {
            "ioc_value": "wyycqqgcykececqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620080": [
        {
            "ioc_value": "ckwioysoegksomgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620081": [
        {
            "ioc_value": "geqiaegqwyawmyki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620082": [
        {
            "ioc_value": "ywywgukekwieqcuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620083": [
        {
            "ioc_value": "aaqqqoqeaqummkis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620084": [
        {
            "ioc_value": "wkouccwekgieswiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620085": [
        {
            "ioc_value": "kgmqiimueuimuyew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620086": [
        {
            "ioc_value": "yiwgygyqgwoyqyee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620047": [
        {
            "ioc_value": "kaawcccoumqyiequ.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620048": [
        {
            "ioc_value": "yciqcayeesmmqeuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620049": [
        {
            "ioc_value": "qyommyayiqakqweu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620050": [
        {
            "ioc_value": "wsqkiwsuwgkiwigs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620051": [
        {
            "ioc_value": "aackycegyswuqqoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620052": [
        {
            "ioc_value": "ouawwmggkiscmsqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620053": [
        {
            "ioc_value": "yiacwsuycyksgiwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620054": [
        {
            "ioc_value": "kgguawmikqawcawk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620055": [
        {
            "ioc_value": "kmeqkymkaosggccq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620056": [
        {
            "ioc_value": "eacaisoakcmccyue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620057": [
        {
            "ioc_value": "meagkgmoekasqiuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620058": [
        {
            "ioc_value": "cewmoosemyymwcca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620059": [
        {
            "ioc_value": "ywkoummmugaeagqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620060": [
        {
            "ioc_value": "uuyeusukeokcasau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620061": [
        {
            "ioc_value": "mkyocmuasimmasic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620062": [
        {
            "ioc_value": "qsyqcuyygaaauiyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620063": [
        {
            "ioc_value": "qmeokygywmgekuoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620064": [
        {
            "ioc_value": "kaeuoguougkmuiek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620065": [
        {
            "ioc_value": "kmasqueowqwgmogk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620029": [
        {
            "ioc_value": "icascwakogoikiqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620030": [
        {
            "ioc_value": "uauuymomoaoouocw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620031": [
        {
            "ioc_value": "ycgwsgwssywascmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620032": [
        {
            "ioc_value": "oiuuwssuuuicguww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620033": [
        {
            "ioc_value": "eacikomckaoaauoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620034": [
        {
            "ioc_value": "skkukeucosswwiwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620035": [
        {
            "ioc_value": "wscgcqaaawgimyca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620036": [
        {
            "ioc_value": "gekyemsqyykceagg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620037": [
        {
            "ioc_value": "yiaggyagoaoywgou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620038": [
        {
            "ioc_value": "amocswykameackgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620039": [
        {
            "ioc_value": "qyogumimwmkieggy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620040": [
        {
            "ioc_value": "yomssueeekommuwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620041": [
        {
            "ioc_value": "meoooowwoeciokuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620042": [
        {
            "ioc_value": "wsewykwcusckwoem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620043": [
        {
            "ioc_value": "aayacmycsiowsiwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620044": [
        {
            "ioc_value": "gswewqowqqwcowku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620045": [
        {
            "ioc_value": "ooieqcueeoceeqkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620046": [
        {
            "ioc_value": "cqwgcggkigucwcsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620008": [
        {
            "ioc_value": "geswcagagyaumway.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620009": [
        {
            "ioc_value": "ycuwaimgygoqiaes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620010": [
        {
            "ioc_value": "qgumuiskkmcemoye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620011": [
        {
            "ioc_value": "ywuiiimqqciaoaec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620012": [
        {
            "ioc_value": "megkgkygoceiiouy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620013": [
        {
            "ioc_value": "eueacsqyqykecumy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620014": [
        {
            "ioc_value": "qswsykuaumsqugmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620015": [
        {
            "ioc_value": "uumsaeyamguoieiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620016": [
        {
            "ioc_value": "gsuacaawuaiqmeaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620017": [
        {
            "ioc_value": "wkquikiwiygeeeys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620018": [
        {
            "ioc_value": "aakmscaewmgsokys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620019": [
        {
            "ioc_value": "skiawsyiuygsousy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620020": [
        {
            "ioc_value": "cwemocmgkeoecumw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620021": [
        {
            "ioc_value": "oocwqcskmiggasse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620022": [
        {
            "ioc_value": "oowmweamaiuskwgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620023": [
        {
            "ioc_value": "iismsmuiaqwcgqie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620024": [
        {
            "ioc_value": "iiucumeawamoqeiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620025": [
        {
            "ioc_value": "oisyiwygesqakacc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620026": [
        {
            "ioc_value": "ywkiesewgiykkmey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620027": [
        {
            "ioc_value": "aacqoikkkouewckm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620028": [
        {
            "ioc_value": "ycoigagqkmieywgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619986": [
        {
            "ioc_value": "ceymomguqwqcukmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619987": [
        {
            "ioc_value": "eiqeomakomyqeoso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619988": [
        {
            "ioc_value": "kmkqiwkyokyuuice.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619989": [
        {
            "ioc_value": "qsymeumqskcasmcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619990": [
        {
            "ioc_value": "ooyuaoukwsoiwkki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619991": [
        {
            "ioc_value": "iiwakkeokkcusekg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619992": [
        {
            "ioc_value": "kmeesssyakeququc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619993": [
        {
            "ioc_value": "kasgwgymwqciqkqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619994": [
        {
            "ioc_value": "ocsekmsaiigosgio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619995": [
        {
            "ioc_value": "myusoiuiysokqwuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619996": [
        {
            "ioc_value": "wyqckkeuuimescgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619997": [
        {
            "ioc_value": "wekiukkiyawseagq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619998": [
        {
            "ioc_value": "gykmuqmuecuseqcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619999": [
        {
            "ioc_value": "ckgeycuugmmeceim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620000": [
        {
            "ioc_value": "ckscmcsewoycqscm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620001": [
        {
            "ioc_value": "eagqamsaowkeuiqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620002": [
        {
            "ioc_value": "qgiscqeiewgecmkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620003": [
        {
            "ioc_value": "gmqyoeugmoqaiewq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620004": [
        {
            "ioc_value": "scyeyioaaeoosqwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620005": [
        {
            "ioc_value": "ooayuyqieqeqiaaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620006": [
        {
            "ioc_value": "ookwyywiymiwgego.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1620007": [
        {
            "ioc_value": "oueuwmgeuusewwyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619967": [
        {
            "ioc_value": "yccmieokysoigqma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619968": [
        {
            "ioc_value": "kaakiqsksgieokeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619969": [
        {
            "ioc_value": "ougqusuyygeoqsqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619970": [
        {
            "ioc_value": "aaekukmomoiqmqcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619971": [
        {
            "ioc_value": "ywkkqiqwwqimakak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619972": [
        {
            "ioc_value": "iiqaiykeaaeuqkwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619973": [
        {
            "ioc_value": "uagyaeccecikcwwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619974": [
        {
            "ioc_value": "cqycmmeugwweycgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619975": [
        {
            "ioc_value": "qyiuoykuyicwogsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619976": [
        {
            "ioc_value": "scusqwmikwcmagaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619977": [
        {
            "ioc_value": "agsameekceumugao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619978": [
        {
            "ioc_value": "iqiqseaieyommkum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619979": [
        {
            "ioc_value": "aayggesimugwskea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619980": [
        {
            "ioc_value": "meaukemwmqeaycoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619981": [
        {
            "ioc_value": "yigkksysawseogiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619982": [
        {
            "ioc_value": "icoygkmgkggcwmce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619983": [
        {
            "ioc_value": "iwocecigmisseqgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619984": [
        {
            "ioc_value": "oigeswwogccmaoqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619985": [
        {
            "ioc_value": "kmkoasaywmsmkwsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619947": [
        {
            "ioc_value": "uocewsuauiegcimc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619948": [
        {
            "ioc_value": "oicuakoawikwuisq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619949": [
        {
            "ioc_value": "yigmmaeqekmoekak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619950": [
        {
            "ioc_value": "kgykegcyuyiegqgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619951": [
        {
            "ioc_value": "uumoaguuyymoakmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619952": [
        {
            "ioc_value": "eogasuscqeocwumq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619953": [
        {
            "ioc_value": "scaaiwwgkumkaacg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619954": [
        {
            "ioc_value": "mywgeakmwggkkmyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619955": [
        {
            "ioc_value": "mygiqewyqqewqiww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619956": [
        {
            "ioc_value": "wkwomcokcmaeiouk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619957": [
        {
            "ioc_value": "swekaosoqwwooowq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619958": [
        {
            "ioc_value": "oogkgqqmmceeuwmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619959": [
        {
            "ioc_value": "wkguuqwueweuogig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619960": [
        {
            "ioc_value": "scsgmocigumeaimc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619961": [
        {
            "ioc_value": "eogimkwmcsyookoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619962": [
        {
            "ioc_value": "kusiyeeiqucwqgeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619963": [
        {
            "ioc_value": "ceiqecuuwkqiysmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619964": [
        {
            "ioc_value": "gsggueawiowqwmwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619965": [
        {
            "ioc_value": "euymesecmgskassm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619966": [
        {
            "ioc_value": "uausguqkmociuggi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619928": [
        {
            "ioc_value": "mqioqwksueeguwqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619929": [
        {
            "ioc_value": "oiqsagmgwaukgiws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619930": [
        {
            "ioc_value": "uoemiwmgsawccicw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619931": [
        {
            "ioc_value": "mykieggwyaogykue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619932": [
        {
            "ioc_value": "eoegameuqoegwiwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619933": [
        {
            "ioc_value": "icqmmwkcwqaagcgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619934": [
        {
            "ioc_value": "gyyikkaagamcyoum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619935": [
        {
            "ioc_value": "eoqsaccaymwwsmsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619936": [
        {
            "ioc_value": "eosawiiiiuqyiosy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619937": [
        {
            "ioc_value": "ouaaywegumgymuec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619938": [
        {
            "ioc_value": "skaseiaqqaasggss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619939": [
        {
            "ioc_value": "qggwocoaeeiqyyoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619940": [
        {
            "ioc_value": "ugsaewkoqysgmesw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619941": [
        {
            "ioc_value": "oossiwckccwacqiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619942": [
        {
            "ioc_value": "icmousmckmuseywk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619943": [
        {
            "ioc_value": "yoyskmyuagkaqcyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619944": [
        {
            "ioc_value": "iiwowsoqmwwosaoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619945": [
        {
            "ioc_value": "wycomwuywicayeaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619946": [
        {
            "ioc_value": "aaiscsqucwuwwsmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619908": [
        {
            "ioc_value": "gekaiwwwumimyegg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619909": [
        {
            "ioc_value": "icskqycywoosgsuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619910": [
        {
            "ioc_value": "gyykiiqyuqeiimmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619911": [
        {
            "ioc_value": "qygsisueiaecamkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619912": [
        {
            "ioc_value": "eagaymwkkeoeucoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619913": [
        {
            "ioc_value": "ckeamsiwegkiiegy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619914": [
        {
            "ioc_value": "aauuaooisowaooek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619915": [
        {
            "ioc_value": "qgecuysegiyyoayc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619916": [
        {
            "ioc_value": "gseeccqskoyywems.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619917": [
        {
            "ioc_value": "cqokkoccymccqasu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619918": [
        {
            "ioc_value": "swqomiqggmyqqgoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619919": [
        {
            "ioc_value": "sqkauqiicssiiike.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619920": [
        {
            "ioc_value": "ckseiawgigaeeuus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619921": [
        {
            "ioc_value": "kmuoyoqciskqwcmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619922": [
        {
            "ioc_value": "wsmwqmkmsuywicke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619923": [
        {
            "ioc_value": "ocomwqkygmeimoqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619924": [
        {
            "ioc_value": "eawoocsoyaqieoko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619925": [
        {
            "ioc_value": "euikcowswomsggoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619926": [
        {
            "ioc_value": "uaoqeowioeimwuya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619927": [
        {
            "ioc_value": "qywgagiqwcwcewkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619890": [
        {
            "ioc_value": "iqyimkoeisoiucms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619891": [
        {
            "ioc_value": "mygggeigcqemkeqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619892": [
        {
            "ioc_value": "qyqkmkeoocusuaam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619893": [
        {
            "ioc_value": "gyauciqeqamqceoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619894": [
        {
            "ioc_value": "qsqkgmewcekyqcuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619895": [
        {
            "ioc_value": "wkskcuammwoiyosk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619896": [
        {
            "ioc_value": "qyagmsmyqumamwea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619897": [
        {
            "ioc_value": "uumqookigemeacgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619898": [
        {
            "ioc_value": "wsqyyygmuuaygsqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619899": [
        {
            "ioc_value": "wskskuqysiogmcsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619900": [
        {
            "ioc_value": "ckcesgcyowmaycyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619901": [
        {
            "ioc_value": "uawoqwksoagqkgki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619902": [
        {
            "ioc_value": "gymkecmkyuyoamim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619903": [
        {
            "ioc_value": "qmucmeauieyssgii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619904": [
        {
            "ioc_value": "oiceokomwweuuyyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619905": [
        {
            "ioc_value": "cwoyicgaioumyiow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619906": [
        {
            "ioc_value": "eiyiqweekmagyeyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619907": [
        {
            "ioc_value": "skwgsqqkyaqkqoeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619869": [
        {
            "ioc_value": "uaomogwqcscoagkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619870": [
        {
            "ioc_value": "qsmgewoeqkwsmkeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619871": [
        {
            "ioc_value": "uuycoqskogsomuqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619872": [
        {
            "ioc_value": "sqkcmmeicooeywok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619873": [
        {
            "ioc_value": "iiwmksmocewkequg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619874": [
        {
            "ioc_value": "ockmyggmkweoyqgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619875": [
        {
            "ioc_value": "uoeuoqqwuysskaww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619876": [
        {
            "ioc_value": "eaagmegauwwosggo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619877": [
        {
            "ioc_value": "amsciyaciwkeyaoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619878": [
        {
            "ioc_value": "weqwkawgouiaokyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619879": [
        {
            "ioc_value": "ugmwisycqgweakye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619880": [
        {
            "ioc_value": "scosmcsgymouiyss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619881": [
        {
            "ioc_value": "mesusqogaqauekwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619882": [
        {
            "ioc_value": "ywqqckukcggikisu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619883": [
        {
            "ioc_value": "gmomgayeoogcimuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619884": [
        {
            "ioc_value": "iwowiqgsciocqkqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619885": [
        {
            "ioc_value": "gyaukcesqqggusoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619886": [
        {
            "ioc_value": "uamgyuikyieqkgei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619887": [
        {
            "ioc_value": "kaswykcgsceaassi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619888": [
        {
            "ioc_value": "meecaouaeuuemusa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619889": [
        {
            "ioc_value": "kmqmyggsmwceeikg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619848": [
        {
            "ioc_value": "scumeegyecggcgqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619849": [
        {
            "ioc_value": "oiuakeeuisccecuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619850": [
        {
            "ioc_value": "cemamgkcioeoccki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619851": [
        {
            "ioc_value": "uoqckiicwuogwwiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619852": [
        {
            "ioc_value": "ycgmmsaoscyuwwku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619853": [
        {
            "ioc_value": "gymcwaismogkqykc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619854": [
        {
            "ioc_value": "icyyqgyycwkueusq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619855": [
        {
            "ioc_value": "agsikcsusmyqaaiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619856": [
        {
            "ioc_value": "uukuuiouwkcommqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619857": [
        {
            "ioc_value": "mqwwwwscswiiosya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619858": [
        {
            "ioc_value": "wsweggkaekwguyku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619859": [
        {
            "ioc_value": "myeaoucuiaoiuwwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619860": [
        {
            "ioc_value": "mqeymkcgwcucwcue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619861": [
        {
            "ioc_value": "ooseuwkwkqseiago.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619862": [
        {
            "ioc_value": "qsoueeeiqkqauwyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619863": [
        {
            "ioc_value": "qyyiumeuesiywcew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619864": [
        {
            "ioc_value": "ugwmcuaoceagwkca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619865": [
        {
            "ioc_value": "agiuocsiqguugcam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619866": [
        {
            "ioc_value": "myqewcuwwgmieeyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619867": [
        {
            "ioc_value": "uouegogwuqwaoqke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619868": [
        {
            "ioc_value": "uucwucsemmcacogc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619830": [
        {
            "ioc_value": "kgumceqiykgoqkgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619831": [
        {
            "ioc_value": "iisskasoaweoimgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619832": [
        {
            "ioc_value": "wkeygqowweuscmao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619833": [
        {
            "ioc_value": "aguqmqmgsqomksyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619834": [
        {
            "ioc_value": "aayeccueuyqiyomk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619835": [
        {
            "ioc_value": "ywqmoceasmgmiwks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619836": [
        {
            "ioc_value": "agiskqqseswkqcou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619837": [
        {
            "ioc_value": "euoccoimsykigeum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619838": [
        {
            "ioc_value": "swosgcuwwkwecmiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619839": [
        {
            "ioc_value": "ckykoiauuoysqqac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619840": [
        {
            "ioc_value": "ckomaquqamaeowqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619841": [
        {
            "ioc_value": "ugqwsyyogigikqyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619842": [
        {
            "ioc_value": "ywqauoioiiwkgooy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619843": [
        {
            "ioc_value": "uocqsayoqmqumkcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619844": [
        {
            "ioc_value": "eaiugciwaasowuca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619845": [
        {
            "ioc_value": "swuqwieisiymgwgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619846": [
        {
            "ioc_value": "mkyoieckoymmocgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619847": [
        {
            "ioc_value": "iieqowqkwiguykky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619811": [
        {
            "ioc_value": "myqaoqaeqaaqmqyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619812": [
        {
            "ioc_value": "iiaoyqiewekkyyay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619813": [
        {
            "ioc_value": "swiikoqgcycqeica.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619814": [
        {
            "ioc_value": "yiuusikcsgqyicom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619815": [
        {
            "ioc_value": "wkcqwsqqmwqugigu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619816": [
        {
            "ioc_value": "qyymcmwkaqwcsagi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619817": [
        {
            "ioc_value": "iwcmgomiycsgwggw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619818": [
        {
            "ioc_value": "oceumymouuwayikm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619819": [
        {
            "ioc_value": "wsmiqquaimagsuye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619820": [
        {
            "ioc_value": "qmguiwqssqkmoqyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619821": [
        {
            "ioc_value": "icagamywcoqwemgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619822": [
        {
            "ioc_value": "cqcmgiigqkioqmei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619823": [
        {
            "ioc_value": "uucqiwsyywcqkeqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619824": [
        {
            "ioc_value": "sqeiuyguumyskygw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619825": [
        {
            "ioc_value": "sckamqqkuamcaegk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619826": [
        {
            "ioc_value": "kusyigigeoqmgsws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619827": [
        {
            "ioc_value": "ocuegqmewioyyyou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619828": [
        {
            "ioc_value": "mqgokqwkksiasioq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619829": [
        {
            "ioc_value": "kggiqkqciseasqks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619793": [
        {
            "ioc_value": "scqoakycgckmwkoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619794": [
        {
            "ioc_value": "gmeqemokmcamcacm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619795": [
        {
            "ioc_value": "ywgseieocwawqkcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619796": [
        {
            "ioc_value": "qycsqoimgygcacay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619797": [
        {
            "ioc_value": "swqyeygiegwqcigq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619798": [
        {
            "ioc_value": "eusacggmgkckomgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619799": [
        {
            "ioc_value": "geagymeqwqemogym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619800": [
        {
            "ioc_value": "eacsyyaeakeseisa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619801": [
        {
            "ioc_value": "eoysiiuugwqmwcuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619802": [
        {
            "ioc_value": "ceaisyiyciiuwiqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619803": [
        {
            "ioc_value": "skkumsiyaqkcwwia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619804": [
        {
            "ioc_value": "wyywogmgqcssykkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619805": [
        {
            "ioc_value": "icwcysyaqgeiyagm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619806": [
        {
            "ioc_value": "weiuwuqyocasaaqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619807": [
        {
            "ioc_value": "wycqmaykamywcgoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619808": [
        {
            "ioc_value": "eoakeuagegqakgwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619809": [
        {
            "ioc_value": "askasouuquuuwake.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619810": [
        {
            "ioc_value": "kukcymokwaqowygg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619773": [
        {
            "ioc_value": "kggueuucasisumso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619774": [
        {
            "ioc_value": "iccqsmymuoceckay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619775": [
        {
            "ioc_value": "oiykcmqqecseuqyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619776": [
        {
            "ioc_value": "oiycocswgkkwewou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619777": [
        {
            "ioc_value": "iiccoocokkkcuuue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619778": [
        {
            "ioc_value": "iqiuaqmyickkmiyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619779": [
        {
            "ioc_value": "eiouwquwcqouaoea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619780": [
        {
            "ioc_value": "geaksqqmuecaimsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619781": [
        {
            "ioc_value": "swqqaummkawqcewm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619782": [
        {
            "ioc_value": "gyuomwcsqcmyamem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619783": [
        {
            "ioc_value": "gewmwwwqkiccseqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619784": [
        {
            "ioc_value": "ugqwkmqqkqqomkew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619785": [
        {
            "ioc_value": "gsyyceowikisouyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619786": [
        {
            "ioc_value": "skqggowcyyamywwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619787": [
        {
            "ioc_value": "uomkemacumoukcuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619788": [
        {
            "ioc_value": "sqqcouqemqaumagk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619789": [
        {
            "ioc_value": "mkasemwqcocaccoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619790": [
        {
            "ioc_value": "kgamyamyuokowqyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619791": [
        {
            "ioc_value": "uuesiqmamiacouaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619792": [
        {
            "ioc_value": "ycsysgqwcecaikkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619755": [
        {
            "ioc_value": "qgeecqgckuyqowog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619756": [
        {
            "ioc_value": "megeukemyocuaiqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619757": [
        {
            "ioc_value": "kgoyuioysmwckskw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619758": [
        {
            "ioc_value": "wemaysuocmociace.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619759": [
        {
            "ioc_value": "kacyqcugomymugco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619760": [
        {
            "ioc_value": "ckcksgssoakgasou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619761": [
        {
            "ioc_value": "eakwekkawsioaaes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619762": [
        {
            "ioc_value": "iqeuemesqgoosgmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619763": [
        {
            "ioc_value": "skquekuyqqaoscso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619764": [
        {
            "ioc_value": "iismmikeogccsomm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619765": [
        {
            "ioc_value": "cqaweugumckgmysy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619766": [
        {
            "ioc_value": "gywgwkmgyikekygo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619767": [
        {
            "ioc_value": "assgimswywyieqee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619768": [
        {
            "ioc_value": "kmsucyusqwssiwye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619769": [
        {
            "ioc_value": "iwgokscymmeggqsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619770": [
        {
            "ioc_value": "wsqsqyiacwqmiomc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619771": [
        {
            "ioc_value": "ywkgiegywgyuqcom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619772": [
        {
            "ioc_value": "iwowqiwewuucwewy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619740": [
        {
            "ioc_value": "wykkqcywmmmuqgku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619741": [
        {
            "ioc_value": "amccykaouieswewu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619742": [
        {
            "ioc_value": "ooeogaasuackogqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619743": [
        {
            "ioc_value": "agumqsykeqakqsui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619744": [
        {
            "ioc_value": "meokecomysqoesww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619745": [
        {
            "ioc_value": "geoocaemamukkwog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619746": [
        {
            "ioc_value": "uoseywkwmusqokmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619747": [
        {
            "ioc_value": "ywukmagsieesckwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619748": [
        {
            "ioc_value": "kmqesqomsgeyauee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619749": [
        {
            "ioc_value": "weaokokcamgemowc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619750": [
        {
            "ioc_value": "yicyaoacyuisiyya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619751": [
        {
            "ioc_value": "eaweasumuecuauac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619752": [
        {
            "ioc_value": "qyumocqmmgqimeke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619753": [
        {
            "ioc_value": "wyakcwkwugkguigy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619754": [
        {
            "ioc_value": "iqkgieseekawgewa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619725": [
        {
            "ioc_value": "wessoccikmcgkekw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619726": [
        {
            "ioc_value": "weycayiukeoaoggw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619727": [
        {
            "ioc_value": "iwqassqmeawygusm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619728": [
        {
            "ioc_value": "ckeqmskweqqscwko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619729": [
        {
            "ioc_value": "oueokegsokkqgaui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619730": [
        {
            "ioc_value": "uocqwwiqyukgcium.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619731": [
        {
            "ioc_value": "skssqokwismcgswe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619732": [
        {
            "ioc_value": "iieogmyiwikoiuko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619733": [
        {
            "ioc_value": "kgwiayugwkucsgmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619734": [
        {
            "ioc_value": "weuqyeemygmiqyoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619735": [
        {
            "ioc_value": "mqciikgmqoquweum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619736": [
        {
            "ioc_value": "scgkiwsceugosoqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619737": [
        {
            "ioc_value": "oigwuckseiiqogmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619738": [
        {
            "ioc_value": "mywmqcaowouieaew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619739": [
        {
            "ioc_value": "ywomosamoykyawme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619716": [
        {
            "ioc_value": "mqqigikysakokeec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619717": [
        {
            "ioc_value": "wewksyqoioccekuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619718": [
        {
            "ioc_value": "oocacoaqoqkicwou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619719": [
        {
            "ioc_value": "geqmeigsaegsggce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619720": [
        {
            "ioc_value": "ouqyckuucsgmqoys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619721": [
        {
            "ioc_value": "kammyygauqcwcukw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619722": [
        {
            "ioc_value": "kugiuaemuocqoyug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619723": [
        {
            "ioc_value": "ywgwkcmmiyeakoau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619724": [
        {
            "ioc_value": "iwciwgccagcwymus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619714": [
        {
            "ioc_value": "kuweaqkqoekiwiaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619715": [
        {
            "ioc_value": "wsicqcyoecgecmea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619693": [
        {
            "ioc_value": "uaqqwayyuaokyksg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619694": [
        {
            "ioc_value": "gycweyeiagegsimk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619695": [
        {
            "ioc_value": "oieuokueuwewyoau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619696": [
        {
            "ioc_value": "memwgwuyuwwcymuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619697": [
        {
            "ioc_value": "qyeyuqgukmwwskum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619698": [
        {
            "ioc_value": "kuwaosiuamsgcyqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619699": [
        {
            "ioc_value": "cewagusaiisyseys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619700": [
        {
            "ioc_value": "mqyyugccswougkyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619701": [
        {
            "ioc_value": "euaiymiugmkiseai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619702": [
        {
            "ioc_value": "qsoqmiousgwyceao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619703": [
        {
            "ioc_value": "eamageyeiiyaikoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619704": [
        {
            "ioc_value": "kmqaicqquueegmsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619705": [
        {
            "ioc_value": "gswoyquyowikqgog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619706": [
        {
            "ioc_value": "aameqgmmaiawuqii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619707": [
        {
            "ioc_value": "skewcqugqsmcmoai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619708": [
        {
            "ioc_value": "eooeucgwomkayiag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619709": [
        {
            "ioc_value": "oocckauogooieswa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619710": [
        {
            "ioc_value": "mkoimewekaiwceom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619711": [
        {
            "ioc_value": "iwggoyckkqmsumoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619712": [
        {
            "ioc_value": "gsgieaisswowmykg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619713": [
        {
            "ioc_value": "cwwcqgeocemiceiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619672": [
        {
            "ioc_value": "eaaueuqimsaguwso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619673": [
        {
            "ioc_value": "kawaqseqimiwoouu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619674": [
        {
            "ioc_value": "eiemeemusmowqaqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619675": [
        {
            "ioc_value": "mymswkkuwkycqkms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619676": [
        {
            "ioc_value": "sqemgckgmqmuyyme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619677": [
        {
            "ioc_value": "icuyueiqkuiugqqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619678": [
        {
            "ioc_value": "yigygacewemkeeay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619679": [
        {
            "ioc_value": "oigsayaikwaagqca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619680": [
        {
            "ioc_value": "ckkuqmoeuacoocyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619681": [
        {
            "ioc_value": "qywmkwuoyioooaay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619682": [
        {
            "ioc_value": "myqyacyoaicecscc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619683": [
        {
            "ioc_value": "aawwgmceyuaiyeiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619684": [
        {
            "ioc_value": "wkseayowkcwkkckc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619685": [
        {
            "ioc_value": "swugcaggwgwemiie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619686": [
        {
            "ioc_value": "yiiiwscwmuswswgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619687": [
        {
            "ioc_value": "ouwaekumusyikigi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619688": [
        {
            "ioc_value": "ouascggwiwukegws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619689": [
        {
            "ioc_value": "eoaysyuscsiycqso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619690": [
        {
            "ioc_value": "uoquemeugoacysug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619691": [
        {
            "ioc_value": "ocwggockwoaemcgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619692": [
        {
            "ioc_value": "ckaasyswmkscecia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619650": [
        {
            "ioc_value": "wsqyukgwoqwmeusa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619651": [
        {
            "ioc_value": "skoeawqyusecusgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619652": [
        {
            "ioc_value": "asmwwswcgegggumi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619653": [
        {
            "ioc_value": "uacowsqiaiguukoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619654": [
        {
            "ioc_value": "mkwmcswoygkeocao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619655": [
        {
            "ioc_value": "ugweiiomkesuimag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619656": [
        {
            "ioc_value": "kmaggcgysomyssos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619657": [
        {
            "ioc_value": "uuwkeomuakiugwuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619658": [
        {
            "ioc_value": "uoayuyqkqaegmeqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619659": [
        {
            "ioc_value": "aaumsmwkyioeqism.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619660": [
        {
            "ioc_value": "iwckiiagwuyuakcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619661": [
        {
            "ioc_value": "kgckweuicoqowigs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619662": [
        {
            "ioc_value": "wecqewmomucocqwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619663": [
        {
            "ioc_value": "kaoksgcwcqgkegqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619664": [
        {
            "ioc_value": "kamwogwqegwiiecy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619665": [
        {
            "ioc_value": "ugigecwgkweyqukk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619666": [
        {
            "ioc_value": "skqgqimgksyioymg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619667": [
        {
            "ioc_value": "iqamwcgqaoagimaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619668": [
        {
            "ioc_value": "iiogmacaciuuaacw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619669": [
        {
            "ioc_value": "wemkosmwwwuuqowc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619670": [
        {
            "ioc_value": "mkkamwsscygcwqsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619671": [
        {
            "ioc_value": "asoiwcqwioemuacc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619628": [
        {
            "ioc_value": "sqsaiqmqaemceogw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619629": [
        {
            "ioc_value": "gyosuymcsesckiie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619630": [
        {
            "ioc_value": "amykmmasoyoqmwsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619631": [
        {
            "ioc_value": "eoyggkmycsoyooao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619632": [
        {
            "ioc_value": "sqiceuicwmgqaiog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619633": [
        {
            "ioc_value": "wkckiaqsmgqmyauc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619634": [
        {
            "ioc_value": "ocuomcwmkgkewsec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619635": [
        {
            "ioc_value": "ywykysmwcqswkkag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619636": [
        {
            "ioc_value": "kmqegwsuymcmmoos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619637": [
        {
            "ioc_value": "cqewsaqasimqsecw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619638": [
        {
            "ioc_value": "yioooieecycigoss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619639": [
        {
            "ioc_value": "oukkqwkuakiwwsse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619640": [
        {
            "ioc_value": "cwiiagouumkcykek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619641": [
        {
            "ioc_value": "sqqcaqoososuyyue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619642": [
        {
            "ioc_value": "sksugwcsoaqmkewe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619643": [
        {
            "ioc_value": "eiocgckawsoywmwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619644": [
        {
            "ioc_value": "ckgqmksewseegqqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619645": [
        {
            "ioc_value": "cqqkioiuqceqysca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619646": [
        {
            "ioc_value": "kgyqyoqeiuasumcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619647": [
        {
            "ioc_value": "ageicmkykyeqcgqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619648": [
        {
            "ioc_value": "wywmsmugkiqwcyia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619649": [
        {
            "ioc_value": "geoysgocsukoomiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619609": [
        {
            "ioc_value": "wyaaoqykoyegcwqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619610": [
        {
            "ioc_value": "qgkqocoiuausqoio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619611": [
        {
            "ioc_value": "gmioycimikigysui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619612": [
        {
            "ioc_value": "agqwsswuwuoussas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619613": [
        {
            "ioc_value": "qsswmigsaiouoigu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619614": [
        {
            "ioc_value": "wewyimmikucaqsgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619615": [
        {
            "ioc_value": "oigcguiycmsqemaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619616": [
        {
            "ioc_value": "gsmaycqcoiuusiui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619617": [
        {
            "ioc_value": "qyicskgmomesusys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619618": [
        {
            "ioc_value": "aaeciewskmykeoge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619619": [
        {
            "ioc_value": "wsaweyqkcogqueuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619620": [
        {
            "ioc_value": "mqagacmcsmmucums.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619621": [
        {
            "ioc_value": "cqqkimwecakecksc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619622": [
        {
            "ioc_value": "amgsgqygggscooeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619623": [
        {
            "ioc_value": "ouykeasagoumugmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619624": [
        {
            "ioc_value": "kmkmsewyguqeoksm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619625": [
        {
            "ioc_value": "oiomqckyooycoscy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619626": [
        {
            "ioc_value": "ywcgsosakwwsysgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619627": [
        {
            "ioc_value": "mycgusyowcackgyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619590": [
        {
            "ioc_value": "euqeuouuesqyeuai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619591": [
        {
            "ioc_value": "iiucaagommcacauk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619592": [
        {
            "ioc_value": "kmuomqqgqwmwqgim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619593": [
        {
            "ioc_value": "ycmkiewumscgooiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619594": [
        {
            "ioc_value": "eiiauqyoeyecegwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619595": [
        {
            "ioc_value": "ceccoqeyomegmkca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619596": [
        {
            "ioc_value": "kaseyckmsakwcmaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619597": [
        {
            "ioc_value": "weyuooakysmaywoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619598": [
        {
            "ioc_value": "oomaawwsoukikawy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619599": [
        {
            "ioc_value": "yceugkiaawuiscwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619600": [
        {
            "ioc_value": "qmuseioqkcwyqyck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619601": [
        {
            "ioc_value": "ouwuawkqimoqessi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619602": [
        {
            "ioc_value": "skokceiiquwouygo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619603": [
        {
            "ioc_value": "skwqwmaqcsoaqoec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619604": [
        {
            "ioc_value": "ouuykiykuoskkksy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619605": [
        {
            "ioc_value": "weqwqoygkwemmieu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619606": [
        {
            "ioc_value": "cqeskuikkkegecys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619607": [
        {
            "ioc_value": "qymmgsgaqqeegeam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619608": [
        {
            "ioc_value": "asqwuqsowkesswig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619569": [
        {
            "ioc_value": "iiwsqeykksgsyiyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619570": [
        {
            "ioc_value": "qgegkkmaouegekeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619571": [
        {
            "ioc_value": "aamicusaiceyguqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619572": [
        {
            "ioc_value": "gewwosmsccaegeyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619573": [
        {
            "ioc_value": "mkwmmiekqwkueayo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619574": [
        {
            "ioc_value": "euakcosuoeyomgyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619575": [
        {
            "ioc_value": "kmuaecoqoaeckeoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619576": [
        {
            "ioc_value": "eawyasmqqcyqmoiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619577": [
        {
            "ioc_value": "gsqkksycswwqqsaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619578": [
        {
            "ioc_value": "iqiycakiimamusqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619579": [
        {
            "ioc_value": "wsskyayoaowsogek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619580": [
        {
            "ioc_value": "wywuemwekwssqaiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619581": [
        {
            "ioc_value": "yiycyyuqkswsomyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619582": [
        {
            "ioc_value": "mkiiqsomqmgygmgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619583": [
        {
            "ioc_value": "mesgeqyaeuqumuqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619584": [
        {
            "ioc_value": "uummwumaayswmmcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619585": [
        {
            "ioc_value": "mqwemeemuemqmsgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619586": [
        {
            "ioc_value": "uokggeauckoikkaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619587": [
        {
            "ioc_value": "ocsqaqsmiqysecka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619588": [
        {
            "ioc_value": "ouuakqikwkakumwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619589": [
        {
            "ioc_value": "qsoqiiesmiwuwscm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619550": [
        {
            "ioc_value": "weeukouqomigmoqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619551": [
        {
            "ioc_value": "wyokwykuigymikua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619552": [
        {
            "ioc_value": "wyckgqcowcyoasqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619553": [
        {
            "ioc_value": "iisqgieqaquiukog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619554": [
        {
            "ioc_value": "gmokcwogoyacwees.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619555": [
        {
            "ioc_value": "eisqoceuoggcawyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619556": [
        {
            "ioc_value": "eaiooygyiaocyuio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619557": [
        {
            "ioc_value": "gysiiayagcecygqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619558": [
        {
            "ioc_value": "uawgaysqegmkyaoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619559": [
        {
            "ioc_value": "eamcgiwoysmssmie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619560": [
        {
            "ioc_value": "sceyueaskcmmaqso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619561": [
        {
            "ioc_value": "uuumsmakomcsswwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619562": [
        {
            "ioc_value": "wseewewqsgyugqcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619563": [
        {
            "ioc_value": "wsikicoaqqayisqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619564": [
        {
            "ioc_value": "wyguouskmomqmsci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619565": [
        {
            "ioc_value": "gyowikyqgyoikoag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619566": [
        {
            "ioc_value": "yimyiwewysmeewiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619567": [
        {
            "ioc_value": "wygyasekmeosscgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619568": [
        {
            "ioc_value": "oigomwkcewwuiimw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619530": [
        {
            "ioc_value": "eiwkasqimoyswiwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619531": [
        {
            "ioc_value": "iqyqqqyuuyiuykmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619532": [
        {
            "ioc_value": "ckiamgeoqkiswwaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619533": [
        {
            "ioc_value": "uaqkeqskakmgscyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619534": [
        {
            "ioc_value": "mkwkuwyygekyqqgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619535": [
        {
            "ioc_value": "oiggkeqkmkwqeqkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619536": [
        {
            "ioc_value": "qmakykmyeeascuoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619537": [
        {
            "ioc_value": "geaiuuoieiogeuuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619538": [
        {
            "ioc_value": "ywweggmiqeeioeqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619539": [
        {
            "ioc_value": "gmikeacksokaqouk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619540": [
        {
            "ioc_value": "wkoqocweseqimecg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619541": [
        {
            "ioc_value": "cqcssgowsuamgcyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619542": [
        {
            "ioc_value": "cqwggmkwueqgewig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619543": [
        {
            "ioc_value": "kmeaaiegaoaaqaqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619544": [
        {
            "ioc_value": "iisiwwaasaemmiac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619545": [
        {
            "ioc_value": "iwyiqqkwuogasoia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619546": [
        {
            "ioc_value": "gmwiygsaiuuomuee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619547": [
        {
            "ioc_value": "qgssqquyeiumeeeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619548": [
        {
            "ioc_value": "iwoeogkuuwksiuks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619549": [
        {
            "ioc_value": "weusoqgauussaeuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619508": [
        {
            "ioc_value": "iiiugywmwokegaes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619509": [
        {
            "ioc_value": "swiwagawekiacmis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619510": [
        {
            "ioc_value": "qsyoekyieoyaaeew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619511": [
        {
            "ioc_value": "ugmwkmeomagagksw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619512": [
        {
            "ioc_value": "cwkyyegckywqycqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619513": [
        {
            "ioc_value": "ycooisicisocumsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619514": [
        {
            "ioc_value": "qgawyaoqcsocsiks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619515": [
        {
            "ioc_value": "skkwewwacsomukii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619516": [
        {
            "ioc_value": "yceaqscysssekoaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619517": [
        {
            "ioc_value": "icimekaaamwkgkui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619518": [
        {
            "ioc_value": "oowycayqiqoakekw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619519": [
        {
            "ioc_value": "iwogseuyyyciismo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619520": [
        {
            "ioc_value": "gsuucysgykmwccuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619521": [
        {
            "ioc_value": "kmkmyokgaagmkyie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619522": [
        {
            "ioc_value": "kukocwgmogocqewa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619523": [
        {
            "ioc_value": "qgywqamiugyyueck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619524": [
        {
            "ioc_value": "eagoimmuykowcgwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619525": [
        {
            "ioc_value": "ickmkwwacykawoaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619526": [
        {
            "ioc_value": "yiqamksmaqaakmmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619527": [
        {
            "ioc_value": "wkymcsagmyeeyica.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619528": [
        {
            "ioc_value": "ousuaewmeusicoaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619529": [
        {
            "ioc_value": "oiuuqkucciaqwaqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619488": [
        {
            "ioc_value": "uuuokwocmawgocce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619489": [
        {
            "ioc_value": "scmcgmmeimikcwue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619490": [
        {
            "ioc_value": "uoyeqewsoouceoyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619491": [
        {
            "ioc_value": "kueguemauqsqcouo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619492": [
        {
            "ioc_value": "asoywwmqaasaqmsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619493": [
        {
            "ioc_value": "kgskwykccoockyea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619494": [
        {
            "ioc_value": "cqecsguiuceooeak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619495": [
        {
            "ioc_value": "cwoqeiwgyamkwkqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619496": [
        {
            "ioc_value": "qysakegiimuqgsuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619497": [
        {
            "ioc_value": "eogeqowgiseywqkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619498": [
        {
            "ioc_value": "ceuwccqyqcqgoees.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619499": [
        {
            "ioc_value": "iqqguwswcicoscku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619500": [
        {
            "ioc_value": "ycyywcwcekyqemgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619501": [
        {
            "ioc_value": "iciyiyugmiumswui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619502": [
        {
            "ioc_value": "uamccwuimmyquskw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619503": [
        {
            "ioc_value": "iwckawucmewogqcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619504": [
        {
            "ioc_value": "agkgaaqkqqqwqykc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619505": [
        {
            "ioc_value": "ouymmqukgsgekeia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619506": [
        {
            "ioc_value": "kuawmiaicoqkaqwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619507": [
        {
            "ioc_value": "ywiwimqgyiiacsis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619467": [
        {
            "ioc_value": "aawewgcqeoscyuci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619468": [
        {
            "ioc_value": "ycwccyoewccuckgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619469": [
        {
            "ioc_value": "oogqecqgqkekkwso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619470": [
        {
            "ioc_value": "qsicmcaymqeiecqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619471": [
        {
            "ioc_value": "qmmkokiacuawucei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619472": [
        {
            "ioc_value": "memqymsacassooqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619473": [
        {
            "ioc_value": "kmkauikseaimiaeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619474": [
        {
            "ioc_value": "qgqecoggqcyuaaeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619475": [
        {
            "ioc_value": "eiieamcukakoqgwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619476": [
        {
            "ioc_value": "wkssomqiwawcgswi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619477": [
        {
            "ioc_value": "oomeuckqugugsoge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619478": [
        {
            "ioc_value": "mkgocaqiwkcigaem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619479": [
        {
            "ioc_value": "scgymmwiiiekcigg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619480": [
        {
            "ioc_value": "wkaiucwiqiqkiioy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619481": [
        {
            "ioc_value": "mewoooiciwseookw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619482": [
        {
            "ioc_value": "gmsoeokgsemmwuqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619483": [
        {
            "ioc_value": "myuymegaeswmiige.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619484": [
        {
            "ioc_value": "wykoyeyucwaookaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619485": [
        {
            "ioc_value": "weqikuewgcgkicqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619486": [
        {
            "ioc_value": "euiqwaeywsgyskuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619487": [
        {
            "ioc_value": "squgsmcigouagwsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619445": [
        {
            "ioc_value": "gyweksksoemcgkks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619446": [
        {
            "ioc_value": "icssyuogwsggyyau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619447": [
        {
            "ioc_value": "gesaeooqgqacymiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619448": [
        {
            "ioc_value": "wkgyiieqikcocuwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619449": [
        {
            "ioc_value": "oiiowkaioumuueyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619450": [
        {
            "ioc_value": "iqigquaskikqmmgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619451": [
        {
            "ioc_value": "skmsoiwqqekyuysi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619452": [
        {
            "ioc_value": "ckuusmoccuicisey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619453": [
        {
            "ioc_value": "eumikwwgkccwoksg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619454": [
        {
            "ioc_value": "uauoksqycuaysqwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619455": [
        {
            "ioc_value": "iwucmecaiwqgiawa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619456": [
        {
            "ioc_value": "iwkqkeagaqmkmisq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619457": [
        {
            "ioc_value": "gewiyaycwssqakqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619458": [
        {
            "ioc_value": "kukekioauaiuokgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619459": [
        {
            "ioc_value": "mywuoamggcewmasy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619460": [
        {
            "ioc_value": "wkyuoyogeocuiikg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619461": [
        {
            "ioc_value": "qsucwuemswwqweqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619462": [
        {
            "ioc_value": "wekiqusmekqweaue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619463": [
        {
            "ioc_value": "ugugoeeyqumqgmyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619464": [
        {
            "ioc_value": "kmqimumgymaaiwsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619465": [
        {
            "ioc_value": "kakssmqsiucqwoww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619466": [
        {
            "ioc_value": "wsaimcwmwaoqwkuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619423": [
        {
            "ioc_value": "qmokgqikwyiyceue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619424": [
        {
            "ioc_value": "uuucmckkueeecuys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619425": [
        {
            "ioc_value": "wkiaewmweaksekqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619426": [
        {
            "ioc_value": "wsgssqmmmseiiemw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619427": [
        {
            "ioc_value": "wsgaukaekciummce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619428": [
        {
            "ioc_value": "oumokooqacqweqcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619429": [
        {
            "ioc_value": "swgckcccyaeyakaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619430": [
        {
            "ioc_value": "ammeakeouawqagyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619431": [
        {
            "ioc_value": "eawqmegmkqguwgey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619432": [
        {
            "ioc_value": "wkwakyocqwyqwcco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619433": [
        {
            "ioc_value": "yckoaweeegguqcso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619434": [
        {
            "ioc_value": "skggcgqweukgciew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619435": [
        {
            "ioc_value": "uowyoskiekgemkkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619436": [
        {
            "ioc_value": "gsiewmismwskaguc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619437": [
        {
            "ioc_value": "ooyqeqskwekkiuig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619438": [
        {
            "ioc_value": "yiqikcuuyqwqesqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619439": [
        {
            "ioc_value": "eoyagoewakyqseym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619440": [
        {
            "ioc_value": "uuoosioqyeksgaou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619441": [
        {
            "ioc_value": "ugsoogesecomuyao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619442": [
        {
            "ioc_value": "kuaeuugykecmwugk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619443": [
        {
            "ioc_value": "iqkwiuwyooeyyuui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619444": [
        {
            "ioc_value": "geoyqykqkqqiyaqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619403": [
        {
            "ioc_value": "wsqowyugiaaiaqag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619404": [
        {
            "ioc_value": "uueuiguyassyieik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619405": [
        {
            "ioc_value": "oomiiuiscyemswmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619406": [
        {
            "ioc_value": "swwqmqkqqoiaqomi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619407": [
        {
            "ioc_value": "kaccskckciewowuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619408": [
        {
            "ioc_value": "qmciaqmcmcigscao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619409": [
        {
            "ioc_value": "eawqmayuecikwaqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619410": [
        {
            "ioc_value": "uoegkesgikaoemys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619411": [
        {
            "ioc_value": "wsosieqoieiascwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619412": [
        {
            "ioc_value": "wkiwogcagyqamqsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619413": [
        {
            "ioc_value": "icioimgggyywamua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619414": [
        {
            "ioc_value": "cqycouuqwgguckui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619415": [
        {
            "ioc_value": "gemgaceauqugkosq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619416": [
        {
            "ioc_value": "kmsogsqoskagmqye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619417": [
        {
            "ioc_value": "oiywwyguegiakequ.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619418": [
        {
            "ioc_value": "mywkgeeukomouguy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619419": [
        {
            "ioc_value": "skycsmykygaeomcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619420": [
        {
            "ioc_value": "oigwskkeegmegcai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619421": [
        {
            "ioc_value": "swsiuumwckecusgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619422": [
        {
            "ioc_value": "amcoygwkyiqkccim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619381": [
        {
            "ioc_value": "ooamummmwmwsuwoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619382": [
        {
            "ioc_value": "oosqgiweiwguwmku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619383": [
        {
            "ioc_value": "iigueuekacuymuwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619384": [
        {
            "ioc_value": "uggakysweskggcgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619385": [
        {
            "ioc_value": "oikgamaikokwgkau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619386": [
        {
            "ioc_value": "wsyaceguqyowmugs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619387": [
        {
            "ioc_value": "gmcugkmmwsccmqqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619388": [
        {
            "ioc_value": "qmseuaycmuowecyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619389": [
        {
            "ioc_value": "amkkoaueyiwmkqeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619390": [
        {
            "ioc_value": "euwiaakiyyimwwgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619391": [
        {
            "ioc_value": "gswgwqikmikwkiqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619392": [
        {
            "ioc_value": "sqcsccgqwqeseiea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619393": [
        {
            "ioc_value": "cwewoemcyukegekc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619394": [
        {
            "ioc_value": "eiwukgwaekeyoiea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619395": [
        {
            "ioc_value": "ceqmmacsyockwoks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619396": [
        {
            "ioc_value": "scgogeioiyaymssw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619397": [
        {
            "ioc_value": "cqomkkksmsscumik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619398": [
        {
            "ioc_value": "ooqqacmosyuukkam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619399": [
        {
            "ioc_value": "yogkygsmmwcycoya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619400": [
        {
            "ioc_value": "eamooeaiekqwukia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619401": [
        {
            "ioc_value": "sqwsgysemwwkcswm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619402": [
        {
            "ioc_value": "uoywwkwegyuakkme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619366": [
        {
            "ioc_value": "kgkyiiqcqeyqwwwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619367": [
        {
            "ioc_value": "aswokykkaqaekwee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619368": [
        {
            "ioc_value": "kmauyecwmwsqkaoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619369": [
        {
            "ioc_value": "qmmmigymcauawoyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619370": [
        {
            "ioc_value": "kueaiikiymwsmqoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619371": [
        {
            "ioc_value": "myqawkyesckmcwsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619372": [
        {
            "ioc_value": "agkiigmegcouaiku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619373": [
        {
            "ioc_value": "cqmmawquiemkogyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619374": [
        {
            "ioc_value": "oowiweukyoqqciae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619375": [
        {
            "ioc_value": "kagiyomksikwyugy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619376": [
        {
            "ioc_value": "iwegqeswyycumueg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619377": [
        {
            "ioc_value": "ugagiogekywwascc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619378": [
        {
            "ioc_value": "cesiaegmmskowuey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619379": [
        {
            "ioc_value": "ocmiwuyeagquqsie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619380": [
        {
            "ioc_value": "yoeagimqascoaimk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619345": [
        {
            "ioc_value": "ugwkecookwgqieme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619346": [
        {
            "ioc_value": "qgyeeqoyuwmyscoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619347": [
        {
            "ioc_value": "ceuskoqoayimcqsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619348": [
        {
            "ioc_value": "qyqokasawkeykkuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619349": [
        {
            "ioc_value": "uayqygeqgoeueywa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619350": [
        {
            "ioc_value": "wewkkowiqggeckcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619351": [
        {
            "ioc_value": "eaakocgyaymuuweq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619352": [
        {
            "ioc_value": "oucoyaqwsauiwysu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619353": [
        {
            "ioc_value": "agokmiywugagiciu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619354": [
        {
            "ioc_value": "aaiioqkcoikkqwuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619355": [
        {
            "ioc_value": "sksmaiqaesqyigss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619356": [
        {
            "ioc_value": "iwieuueucuusmymm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619357": [
        {
            "ioc_value": "kguwwsgkossqmcii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619358": [
        {
            "ioc_value": "mkyqommakgmsesoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619359": [
        {
            "ioc_value": "qmasgkeqwgwmwkam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619360": [
        {
            "ioc_value": "uuciyeqoykeikcko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619361": [
        {
            "ioc_value": "cwyayuoeagmaqims.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619362": [
        {
            "ioc_value": "ywsiemgaaeuqkeog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619363": [
        {
            "ioc_value": "kummymcucugqomyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619364": [
        {
            "ioc_value": "ascgckwokesqiiui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619365": [
        {
            "ioc_value": "weqsgkyqqgmmuigg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619325": [
        {
            "ioc_value": "eusmcywccyigwguw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619326": [
        {
            "ioc_value": "yiiyoamqoycausas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619327": [
        {
            "ioc_value": "meykaquukwkugcoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619328": [
        {
            "ioc_value": "ckaiqskoswkayoaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619329": [
        {
            "ioc_value": "youmciseucoogksk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619330": [
        {
            "ioc_value": "gmuguqamgcmqwauo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619331": [
        {
            "ioc_value": "cekysamoyggsuioy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619332": [
        {
            "ioc_value": "eauikymkckgqeaea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619333": [
        {
            "ioc_value": "sweukaimaeyioimo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619334": [
        {
            "ioc_value": "icomseecimimumww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619335": [
        {
            "ioc_value": "wkcqoeqawscaawka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619336": [
        {
            "ioc_value": "geaekoeoyisgeaco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619337": [
        {
            "ioc_value": "qmgemwmigicomcqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619338": [
        {
            "ioc_value": "myekegaasuyyqqwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619339": [
        {
            "ioc_value": "eiekcmkukgooymco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619340": [
        {
            "ioc_value": "ckwgwwacqcoymkey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619341": [
        {
            "ioc_value": "ooksoceoicyqacoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619342": [
        {
            "ioc_value": "uamomomoyaiuiasi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619343": [
        {
            "ioc_value": "eoggeuyiwgisewmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619344": [
        {
            "ioc_value": "iwewugawogkeyoow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619304": [
        {
            "ioc_value": "eacsmakiwuiaoiyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619305": [
        {
            "ioc_value": "gsskieewwquakemg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619306": [
        {
            "ioc_value": "gmqwimqocoggmsyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619307": [
        {
            "ioc_value": "qgmmewimesasuiwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619308": [
        {
            "ioc_value": "eocgeccywkcmkcei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619309": [
        {
            "ioc_value": "cqymkcyoquouoysq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619310": [
        {
            "ioc_value": "qsmasiwagwewmums.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619311": [
        {
            "ioc_value": "oieqqaeamiyemyuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619312": [
        {
            "ioc_value": "gsqqseguucoikaqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619313": [
        {
            "ioc_value": "wkewsuyuwoiigeka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619314": [
        {
            "ioc_value": "ceeyecuswssggyic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619315": [
        {
            "ioc_value": "wswuwuioikeeaocs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619316": [
        {
            "ioc_value": "ouoiawgomasiigua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619317": [
        {
            "ioc_value": "euqcyoeiweeiqkao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619318": [
        {
            "ioc_value": "ooycuegkgeysgwuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619319": [
        {
            "ioc_value": "geksocumyweuiuci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619320": [
        {
            "ioc_value": "scquoacwkguogyau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619321": [
        {
            "ioc_value": "uugywgoaymcyagyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619322": [
        {
            "ioc_value": "mycusgcwmaoysekg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619323": [
        {
            "ioc_value": "wssccieckmgkgweq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619324": [
        {
            "ioc_value": "agqoseecgyqmowwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619284": [
        {
            "ioc_value": "uggmgeiiaoaqgwce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619285": [
        {
            "ioc_value": "eumwsewgcmcusoya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619286": [
        {
            "ioc_value": "kgeeggauqkaycmsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619287": [
        {
            "ioc_value": "geaqwckawiamiiwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619288": [
        {
            "ioc_value": "qyquiacaasioamei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619289": [
        {
            "ioc_value": "oioyayomqwiwqgqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619290": [
        {
            "ioc_value": "iquucuqqscmgyyyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619291": [
        {
            "ioc_value": "aaiikeqmqowmykwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619292": [
        {
            "ioc_value": "wyumeousykqokymy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619293": [
        {
            "ioc_value": "cqweysikwmccoqgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619294": [
        {
            "ioc_value": "yiwoawmyuqakqewa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619295": [
        {
            "ioc_value": "oimyuyaqsismyaoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619296": [
        {
            "ioc_value": "wyogsiiwmyiagaoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619297": [
        {
            "ioc_value": "kmyeicayagwqykme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619298": [
        {
            "ioc_value": "uoeikskaiomwmewc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619299": [
        {
            "ioc_value": "qgsgcmksmukeeuik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619300": [
        {
            "ioc_value": "cwogswysceysqwag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619301": [
        {
            "ioc_value": "kguckiieqigaqqsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619302": [
        {
            "ioc_value": "wessqmaiseqgoaak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619303": [
        {
            "ioc_value": "mqwuwaskgugiuqsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619265": [
        {
            "ioc_value": "eaccacsimmqqaoqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619266": [
        {
            "ioc_value": "uokwesskeueqaqkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619267": [
        {
            "ioc_value": "skemiqiyiekkiqge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619268": [
        {
            "ioc_value": "yomegckymeegscai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619269": [
        {
            "ioc_value": "gyywcuksuoouqksm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619270": [
        {
            "ioc_value": "oomykoimcqiwkccu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619271": [
        {
            "ioc_value": "oueagqmsqoouuuks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619272": [
        {
            "ioc_value": "ugauqomsegswmism.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619273": [
        {
            "ioc_value": "kauqiwyywqcucccu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619274": [
        {
            "ioc_value": "wsqoggyscgecwqia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619275": [
        {
            "ioc_value": "ywkoueckimmaqmes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619276": [
        {
            "ioc_value": "agucmqkkcakaoamg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619277": [
        {
            "ioc_value": "amuomscegwugswww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619278": [
        {
            "ioc_value": "yimuuckyyaiuossk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619279": [
        {
            "ioc_value": "ckmagiouyquwiucw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619280": [
        {
            "ioc_value": "uuiqmamksicgassy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619281": [
        {
            "ioc_value": "kmmeykqugcgoqwck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619282": [
        {
            "ioc_value": "ocisyceacqkogqme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619283": [
        {
            "ioc_value": "aauwugosacauqgsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619245": [
        {
            "ioc_value": "uagcmwqwyauqayii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619246": [
        {
            "ioc_value": "eueusccaeaosiwok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619247": [
        {
            "ioc_value": "kamwscwqsyakicqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619248": [
        {
            "ioc_value": "uuwuscwkokkaeecs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619249": [
        {
            "ioc_value": "kmogiusgeasueoew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619250": [
        {
            "ioc_value": "wsiuoaomeswummeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619251": [
        {
            "ioc_value": "kumysowqeoimomqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619252": [
        {
            "ioc_value": "qyoyuyykqmweaacw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619253": [
        {
            "ioc_value": "weomksaaskuwayog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619254": [
        {
            "ioc_value": "ooyiegwmgugisgqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619255": [
        {
            "ioc_value": "ouyemyacqwwyummy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619256": [
        {
            "ioc_value": "ouckwmgmsoickgim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619257": [
        {
            "ioc_value": "ckgqeeawomogygao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619258": [
        {
            "ioc_value": "ywggqqcmeqceeisq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619259": [
        {
            "ioc_value": "skmakioaqwquugqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619260": [
        {
            "ioc_value": "agwaiikwmoaiiaew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619261": [
        {
            "ioc_value": "kgyogcguioeqckoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619262": [
        {
            "ioc_value": "icuougqgmmiwwimu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619263": [
        {
            "ioc_value": "ycomygyukmyiwquu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619264": [
        {
            "ioc_value": "mewmoqkkwqysiyuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619224": [
        {
            "ioc_value": "yogysuwiqqiwoiay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619225": [
        {
            "ioc_value": "kauwqekaeikmgswq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619226": [
        {
            "ioc_value": "mygmiiymyqagekoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619227": [
        {
            "ioc_value": "ywomgkaoqeeomuag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619228": [
        {
            "ioc_value": "cksgwueimygoaaso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619229": [
        {
            "ioc_value": "swgquwmyiaucoosk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619230": [
        {
            "ioc_value": "eucgqsuuomcokkyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619231": [
        {
            "ioc_value": "oimwqeisgyeiceie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619232": [
        {
            "ioc_value": "memwcsucsacsqkco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619233": [
        {
            "ioc_value": "kmuguimqsagcyego.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619234": [
        {
            "ioc_value": "iqkwqyegoeskcmei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619235": [
        {
            "ioc_value": "uokeyqcmkocwkyio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619236": [
        {
            "ioc_value": "ouekskiweicmqyiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619237": [
        {
            "ioc_value": "gyquqmuwmwowwmao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619238": [
        {
            "ioc_value": "icksqwacusicowww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619239": [
        {
            "ioc_value": "eammoaoewiisoqoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619240": [
        {
            "ioc_value": "askumgscmuaeyieo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619241": [
        {
            "ioc_value": "wyescwiakgmkgqmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619242": [
        {
            "ioc_value": "skmkioyecsyyukyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619243": [
        {
            "ioc_value": "myguaaayoacyqkmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619244": [
        {
            "ioc_value": "eocoawqcogyyikow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619206": [
        {
            "ioc_value": "swkwqkquwywoumuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619207": [
        {
            "ioc_value": "ougoswwkcusckauc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619208": [
        {
            "ioc_value": "scemmiwwceqgakyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619209": [
        {
            "ioc_value": "gsmeqcawyciasmki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619210": [
        {
            "ioc_value": "myoauyaskecgwcoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619211": [
        {
            "ioc_value": "iqmqoigkqgmeqqkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619212": [
        {
            "ioc_value": "qmsyikoyygkyaugy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619213": [
        {
            "ioc_value": "kgswwyqqwwkmmmse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619214": [
        {
            "ioc_value": "yiawwgwmiiiiaumq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619215": [
        {
            "ioc_value": "qmcegwkkkqasqsyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619216": [
        {
            "ioc_value": "ycowecqkeaoysimk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619217": [
        {
            "ioc_value": "cwquacwmyaossmew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619218": [
        {
            "ioc_value": "kuesykseuiwaomso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619219": [
        {
            "ioc_value": "oceqyccsoaukqgsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619220": [
        {
            "ioc_value": "iicksoqgoaiacwgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619221": [
        {
            "ioc_value": "mkswcaeogcuisyme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619222": [
        {
            "ioc_value": "wekguqogiwckkiym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619223": [
        {
            "ioc_value": "mqawmaskiagoysmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619187": [
        {
            "ioc_value": "cewqmgiseacmgagg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619188": [
        {
            "ioc_value": "kmeeaooakesqiicy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619189": [
        {
            "ioc_value": "wewceeuyiuiaigmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619190": [
        {
            "ioc_value": "swossiogkwsoecca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619191": [
        {
            "ioc_value": "wkkckgokqmeiaogw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619192": [
        {
            "ioc_value": "ugiqwoccwiqwkcey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619193": [
        {
            "ioc_value": "agucaiuugcuiagec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619194": [
        {
            "ioc_value": "eiyaquiqkaowoace.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619195": [
        {
            "ioc_value": "wsuiuukmikiwceay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619196": [
        {
            "ioc_value": "oiweomomwgaqawim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619197": [
        {
            "ioc_value": "amyksaocayigeoog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619198": [
        {
            "ioc_value": "cqoyuygqiyakycie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619199": [
        {
            "ioc_value": "oikeqaoamowakyow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619200": [
        {
            "ioc_value": "gsiaegaqawwgeiuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619201": [
        {
            "ioc_value": "sccmiuumowqecgsu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619202": [
        {
            "ioc_value": "kueoksasussaayok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619203": [
        {
            "ioc_value": "eiamgeuiugmywkmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619204": [
        {
            "ioc_value": "qyikoayugyaeqsgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619205": [
        {
            "ioc_value": "mkwaaacokaamoqci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619169": [
        {
            "ioc_value": "eaieegwqsoqciguo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619170": [
        {
            "ioc_value": "qgyoqqmuesemmkkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619171": [
        {
            "ioc_value": "qgasaeggyqqeuukk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619172": [
        {
            "ioc_value": "kmimmkcseioaeciq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619173": [
        {
            "ioc_value": "yiqeucmykaomamsu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619174": [
        {
            "ioc_value": "weuueukkucgoeogq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619175": [
        {
            "ioc_value": "oueukaagsmyyoaaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619176": [
        {
            "ioc_value": "eaaumukmygakoeeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619177": [
        {
            "ioc_value": "sqqseykgssucosui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619178": [
        {
            "ioc_value": "skoaamcagcukgkyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619179": [
        {
            "ioc_value": "qguessauogugayoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619180": [
        {
            "ioc_value": "sqosueqqauaaqeas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619181": [
        {
            "ioc_value": "euaiqcewqmasekca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619182": [
        {
            "ioc_value": "swoysogkuuekqcmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619183": [
        {
            "ioc_value": "qmgqyugiywsyouai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619184": [
        {
            "ioc_value": "wyyeyckyqccccskg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619185": [
        {
            "ioc_value": "uguqasyumamkwmqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619186": [
        {
            "ioc_value": "qgicuigeqcaskkem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619148": [
        {
            "ioc_value": "ckwaakgsqwemeiaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619149": [
        {
            "ioc_value": "uayumyaocqcwmcsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619150": [
        {
            "ioc_value": "swqysuwkqqwiwgeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619151": [
        {
            "ioc_value": "agwoycwcuagaecaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619152": [
        {
            "ioc_value": "qmywecieaeeucwoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619153": [
        {
            "ioc_value": "iiiqqwawmmwkqeeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619154": [
        {
            "ioc_value": "eiiciwewecouamyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619155": [
        {
            "ioc_value": "ywcywokumcwcoaqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619156": [
        {
            "ioc_value": "asuqqawgqyikseak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619157": [
        {
            "ioc_value": "qsueygiueksycqay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619158": [
        {
            "ioc_value": "ooqiiwcgsgcmocao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619159": [
        {
            "ioc_value": "qykaygkgigqisego.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619160": [
        {
            "ioc_value": "easssiuisgmogouu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619161": [
        {
            "ioc_value": "ycwsiqqggmmmgiuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619162": [
        {
            "ioc_value": "ocsciwiaymsweuws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619163": [
        {
            "ioc_value": "iqmoseoeqeeiweuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619164": [
        {
            "ioc_value": "ycgoauiyaswcmcyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619165": [
        {
            "ioc_value": "cqyaqcywswwguoew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619166": [
        {
            "ioc_value": "qsqaicwqsaaouwae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619167": [
        {
            "ioc_value": "eoouqguqaaysysms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619168": [
        {
            "ioc_value": "squwsymqesuokqcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619129": [
        {
            "ioc_value": "sqwqyacauquqcyiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619130": [
        {
            "ioc_value": "ywqawucgcoewsmam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619131": [
        {
            "ioc_value": "gmwaueikgygmumua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619132": [
        {
            "ioc_value": "meiacmggcccgamqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619133": [
        {
            "ioc_value": "mkkoucgyugmqqckw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619134": [
        {
            "ioc_value": "uawwmuucwwgmwqcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619135": [
        {
            "ioc_value": "kaaauyegyuieueek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619136": [
        {
            "ioc_value": "eomaqosamauywyqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619137": [
        {
            "ioc_value": "ugyqmuuykweuiquc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619138": [
        {
            "ioc_value": "ocgmimyqkcygkyoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619139": [
        {
            "ioc_value": "ocmuqikogqcayecc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619140": [
        {
            "ioc_value": "mqyokyewswieyiyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619141": [
        {
            "ioc_value": "yieegaekkeiwsuwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619142": [
        {
            "ioc_value": "swocsomiekymocuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619143": [
        {
            "ioc_value": "cwooeaqeoiwckkcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619144": [
        {
            "ioc_value": "geaycqkkmsgoemac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619145": [
        {
            "ioc_value": "iwwyawegeqooacky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619146": [
        {
            "ioc_value": "skaoqugqcweosumg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619147": [
        {
            "ioc_value": "iqwuywcmgaemgkgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619110": [
        {
            "ioc_value": "qsmkukuqmesuqggu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619111": [
        {
            "ioc_value": "ouqeymqugksgwcmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619112": [
        {
            "ioc_value": "cwaqcosssmwcqqiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619113": [
        {
            "ioc_value": "uuyoawccaqqkgyey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619114": [
        {
            "ioc_value": "eimcsuamwqkgoyeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619115": [
        {
            "ioc_value": "qgosiymscgggimom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619116": [
        {
            "ioc_value": "cksmawekmamicqwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619117": [
        {
            "ioc_value": "qsewsimwiiaucosg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619118": [
        {
            "ioc_value": "kgqocsggyueamcca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619119": [
        {
            "ioc_value": "kamyiiamuqciaqmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619120": [
        {
            "ioc_value": "kawssqyaacicewou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619121": [
        {
            "ioc_value": "kmyqcywsmiumwcus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619122": [
        {
            "ioc_value": "ywagmaiskoakcmaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619123": [
        {
            "ioc_value": "aaqgaswksesmswge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619124": [
        {
            "ioc_value": "ouygoqigiomqmgsq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619125": [
        {
            "ioc_value": "amyyquekeugmyquo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619126": [
        {
            "ioc_value": "swkgmkuiwegoiewk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619127": [
        {
            "ioc_value": "cwwicamguqcwyywk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619128": [
        {
            "ioc_value": "sceamsuaaskkeyqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619092": [
        {
            "ioc_value": "cweukaosocqiycky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619093": [
        {
            "ioc_value": "icsiqcuokgkquswk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619094": [
        {
            "ioc_value": "amowymeaigkswmqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619095": [
        {
            "ioc_value": "scykwmwqgmqugmmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619096": [
        {
            "ioc_value": "mqkimskoogyscuwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619097": [
        {
            "ioc_value": "iwmiswegyyowqyia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619098": [
        {
            "ioc_value": "qgewicoeugiusmum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619099": [
        {
            "ioc_value": "iqqymuukqgeokgim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619100": [
        {
            "ioc_value": "oicaoyigoykccggq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619101": [
        {
            "ioc_value": "amuausesqkguwgyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619102": [
        {
            "ioc_value": "swyuiksmqssawaui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619103": [
        {
            "ioc_value": "oiemkowwywaeekuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619104": [
        {
            "ioc_value": "uueeeuaieocieoyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619105": [
        {
            "ioc_value": "wkegmaikogioymug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619106": [
        {
            "ioc_value": "aaccwkakyqecmgaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619107": [
        {
            "ioc_value": "ceameocmoimiqccw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619108": [
        {
            "ioc_value": "scagqkaqswwkickg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619109": [
        {
            "ioc_value": "yimqscgaswmcyikm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619071": [
        {
            "ioc_value": "iwguqaewoqumegcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619072": [
        {
            "ioc_value": "kacamouukygekacw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619073": [
        {
            "ioc_value": "asoysagmicagegse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619074": [
        {
            "ioc_value": "aamgwqysgwykegmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619075": [
        {
            "ioc_value": "ocaoqekuuyygiwee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619076": [
        {
            "ioc_value": "wkkamueomkocywss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619077": [
        {
            "ioc_value": "uaaaeeougquukwgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619078": [
        {
            "ioc_value": "cqmcuaywskqyiuym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619079": [
        {
            "ioc_value": "geiscsgmwqoeiysi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619080": [
        {
            "ioc_value": "iikaccicogwqyoku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619081": [
        {
            "ioc_value": "wyyicgkimuogimuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619082": [
        {
            "ioc_value": "ywekayygigcumsks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619083": [
        {
            "ioc_value": "skuoemoykscscksk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619084": [
        {
            "ioc_value": "uuckgugoeugiisya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619085": [
        {
            "ioc_value": "qsagwsigacqcyaac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619086": [
        {
            "ioc_value": "mkgkyekioocyagge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619087": [
        {
            "ioc_value": "ckisocwwkksqkcuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619088": [
        {
            "ioc_value": "sqqyyqwcgoyckqgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619089": [
        {
            "ioc_value": "yoeewqkwwacogmqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619090": [
        {
            "ioc_value": "cesekckqwwmaeoow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619091": [
        {
            "ioc_value": "uoogoauaiqsyaawy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619049": [
        {
            "ioc_value": "ycywecemwuccqciy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619050": [
        {
            "ioc_value": "iqeoowwwmogkkuua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619051": [
        {
            "ioc_value": "aaamocsikowqkqsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619052": [
        {
            "ioc_value": "mekyamgeuyyuyqsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619053": [
        {
            "ioc_value": "cqwqamyyyimgymem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619054": [
        {
            "ioc_value": "yiqcuykgkkimsomo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619055": [
        {
            "ioc_value": "qmgkssceceauugqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619056": [
        {
            "ioc_value": "iwismmyuuguewukc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619057": [
        {
            "ioc_value": "eaqkggicegkomisu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619058": [
        {
            "ioc_value": "skiqwomwagmgeqmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619059": [
        {
            "ioc_value": "myimmaqeqeyekgqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619060": [
        {
            "ioc_value": "mqyoockiqicukuyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619061": [
        {
            "ioc_value": "qsgaigksqqsuuewu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619062": [
        {
            "ioc_value": "yisaucumyiuqieym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619063": [
        {
            "ioc_value": "eaugsgwaomaeqaog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619064": [
        {
            "ioc_value": "iigyggcgaogqyymi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619065": [
        {
            "ioc_value": "qmyksukekmuoaocu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619066": [
        {
            "ioc_value": "ywueomuuoeekesog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619067": [
        {
            "ioc_value": "aaqoyymoyycquqio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619068": [
        {
            "ioc_value": "qmqikmosmcegecye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619069": [
        {
            "ioc_value": "mkwqkkuymmkiwowo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619070": [
        {
            "ioc_value": "euwmiakewuymugue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619028": [
        {
            "ioc_value": "geycyuiiawkugewc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619029": [
        {
            "ioc_value": "ooayaoiwqwyiuscy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619030": [
        {
            "ioc_value": "cqgkaisssooyuseq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619031": [
        {
            "ioc_value": "iicmgyiuguykioqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619032": [
        {
            "ioc_value": "ugygmyqmggyeeyak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619033": [
        {
            "ioc_value": "wygsqmesggqskkam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619034": [
        {
            "ioc_value": "kucsmoiqgumkcewa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619035": [
        {
            "ioc_value": "cesyyweusmswiyia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619036": [
        {
            "ioc_value": "sqgaiksysgewqoga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619037": [
        {
            "ioc_value": "cqweisqkcykgkgec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619038": [
        {
            "ioc_value": "swmuiwyuussssigk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619039": [
        {
            "ioc_value": "meqseyiwmqiqceii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619040": [
        {
            "ioc_value": "qmuysegeiwcskqcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619041": [
        {
            "ioc_value": "kmaocmweoisceokm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619042": [
        {
            "ioc_value": "gmegeuiqemqqmmag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619043": [
        {
            "ioc_value": "iqmkgwisiugeucmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619044": [
        {
            "ioc_value": "ousqgcqwmuoyysqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619045": [
        {
            "ioc_value": "kgcyegumkyuscysg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619046": [
        {
            "ioc_value": "sweakiogayswayay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619047": [
        {
            "ioc_value": "ouigkseaukiqkyos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619048": [
        {
            "ioc_value": "asgwueyisogemysa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619007": [
        {
            "ioc_value": "wyiwqciwyeywqgmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619008": [
        {
            "ioc_value": "wycwkcyuqisygaoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619009": [
        {
            "ioc_value": "iiuqwcukqwkmcaks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619010": [
        {
            "ioc_value": "wssaumokuiouucku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619011": [
        {
            "ioc_value": "uossiesoaukeiqmi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619012": [
        {
            "ioc_value": "kmyoiikquymieqaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619013": [
        {
            "ioc_value": "uaucmomoamysakig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619014": [
        {
            "ioc_value": "gyiekyqwyigkeags.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619015": [
        {
            "ioc_value": "ouqsksmyuakmkwui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619016": [
        {
            "ioc_value": "eayacgegyoysuyka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619017": [
        {
            "ioc_value": "ycmekomyegcogoas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619018": [
        {
            "ioc_value": "myogwksmqisoaeko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619019": [
        {
            "ioc_value": "iqwayaeoigwkqcka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619020": [
        {
            "ioc_value": "kauuqagcgqcagyoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619021": [
        {
            "ioc_value": "swyekmiqmcawcqoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619022": [
        {
            "ioc_value": "swaiwqoiyogomwoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619023": [
        {
            "ioc_value": "uuaiuwokuguqceaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619024": [
        {
            "ioc_value": "megoiiueoyesqkkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619025": [
        {
            "ioc_value": "kmkucammwgoecsyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619026": [
        {
            "ioc_value": "skaoeqqeoywaacka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619027": [
        {
            "ioc_value": "myiycyaecgaeqeyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618986": [
        {
            "ioc_value": "aamiqkgwoyocmmok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618987": [
        {
            "ioc_value": "kuuacwiuuqeeyeio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618988": [
        {
            "ioc_value": "yccascooiicaeuyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618989": [
        {
            "ioc_value": "cqsegoyucgewsikg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618990": [
        {
            "ioc_value": "cqqccgeewoegqime.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618991": [
        {
            "ioc_value": "ycmgcywwmgeuquco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618992": [
        {
            "ioc_value": "meoewckyueeyiusk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618993": [
        {
            "ioc_value": "qyccwoogoiacukku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618994": [
        {
            "ioc_value": "myuqamoouoqqqmyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618995": [
        {
            "ioc_value": "ocskcqkwqieksoeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618996": [
        {
            "ioc_value": "yookqekcykkkskkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618997": [
        {
            "ioc_value": "amaougqqqycgcooy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618998": [
        {
            "ioc_value": "swqokeoyqmcwwmkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618999": [
        {
            "ioc_value": "ugciiomcgwqgccaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619000": [
        {
            "ioc_value": "wkqsiyqwuuwmyqwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619001": [
        {
            "ioc_value": "ckmwwiicaogmsacu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619002": [
        {
            "ioc_value": "mysgcakgeuoyqcue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619003": [
        {
            "ioc_value": "iqewysisucsqoseo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619004": [
        {
            "ioc_value": "gscqeoueeoueimuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619005": [
        {
            "ioc_value": "mkyqmcsuasikskya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1619006": [
        {
            "ioc_value": "amawyakygywsqcsu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618976": [
        {
            "ioc_value": "mekosgmyekugmoou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618977": [
        {
            "ioc_value": "cwasqeosyqeyuosk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618978": [
        {
            "ioc_value": "ywsyeqmigakwqikg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618979": [
        {
            "ioc_value": "ocikysqioookkokq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618980": [
        {
            "ioc_value": "asagoscauwquuyuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618981": [
        {
            "ioc_value": "icggkcyauugggase.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618982": [
        {
            "ioc_value": "icckiwqumqckuege.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618983": [
        {
            "ioc_value": "iiywcmieqcoyausq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618984": [
        {
            "ioc_value": "gecccewqeeckussi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618985": [
        {
            "ioc_value": "kaysgekqskggmcmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-10-21 06:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c93927732655537fdb51a19ca7fe42f97bbe1adc9b4ce9e84d829d154d03358d/",
            "tags": "dga-seed-279,MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618975": [
        {
            "ioc_value": "t5y0.9z2503.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 06:16:48",
            "last_seen_utc": "2025-10-21 06:24:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618974": [
        {
            "ioc_value": "bring05.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 06:16:01",
            "last_seen_utc": "2025-10-21 06:24:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618972": [
        {
            "ioc_value": "forty.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 06:07:44",
            "last_seen_utc": "2025-10-21 06:16:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618967": [
        {
            "ioc_value": "goe.swpriest.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-21 06:02:08",
            "last_seen_utc": "2025-10-22 12:44:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/251021-genf2a1phk",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618966": [
        {
            "ioc_value": "bip.priestsw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-21 06:02:07",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251021-genf2a1phk",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618965": [
        {
            "ioc_value": "ideai55.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 05:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618964": [
        {
            "ioc_value": "grand.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 05:48:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618962": [
        {
            "ioc_value": "petcasalove.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.koadic",
            "malware_alias": null,
            "malware_printable": "Koadic",
            "first_seen_utc": "2025-10-21 05:44:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/a7457af49c136f70eeeb5c3e271ce2278d4eef71153643b9e41a83f7093ebd80/",
            "tags": "Koadic",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618959": [
        {
            "ioc_value": "clock6.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 05:38:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618957": [
        {
            "ioc_value": "jacket.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 05:28:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618953": [
        {
            "ioc_value": "fogants.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 05:21:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618954": [
        {
            "ioc_value": "fogbed.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 05:21:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618955": [
        {
            "ioc_value": "w2.nitrobuda.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 05:21:57",
            "last_seen_utc": "2025-10-21 05:21:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618956": [
        {
            "ioc_value": "brickcloth.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-21 05:21:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618952": [
        {
            "ioc_value": "lvory7.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 05:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618951": [
        {
            "ioc_value": "brpt.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-21 05:15:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618950": [
        {
            "ioc_value": "faith47.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 05:08:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618949": [
        {
            "ioc_value": "southprovesolutions.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:02:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "c2,MAYBEROBOT",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618948": [
        {
            "ioc_value": "system-healthadv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "c2,YESROBOT",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618946": [
        {
            "ioc_value": "inspectguarantee.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "NOROBOT",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618947": [
        {
            "ioc_value": "captchanom.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "NOROBOT",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618940": [
        {
            "ioc_value": "onstorageline.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "COLDCOPY",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618941": [
        {
            "ioc_value": "applicationformsubmit.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "COLDCOPY",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618942": [
        {
            "ioc_value": "oxwoocat.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "COLDCOPY",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618943": [
        {
            "ioc_value": "ned-granting-opportunities.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "COLDCOPY",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618944": [
        {
            "ioc_value": "blintepeeste.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "COLDCOPY",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618945": [
        {
            "ioc_value": "preentootmist.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "COLDCOPY",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618937": [
        {
            "ioc_value": "viewerdoconline.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "COLDCOPY",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618938": [
        {
            "ioc_value": "documentsec.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "COLDCOPY",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618939": [
        {
            "ioc_value": "documentsec.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 05:01:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/?hl=en",
            "tags": "COLDCOPY",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618927": [
        {
            "ioc_value": "dream3.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 04:57:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618503": [
        {
            "ioc_value": "chamjs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-21 04:54:51",
            "last_seen_utc": "2025-10-20 15:43:28",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115407256331285013",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1618507": [
        {
            "ioc_value": "www.siegelpigeons.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-21 04:54:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115407256331285013",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1618565": [
        {
            "ioc_value": "osinfo.free.beeceptor.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 04:54:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-x1jmzaxmbl/behavioral1",
            "tags": "osinfo,powershell",
            "anonymous": "0",
            "reporter": "malwareanalayser"
        }
    ],
    "1618926": [
        {
            "ioc_value": "c0u1d8.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 04:47:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618925": [
        {
            "ioc_value": "focu546.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 04:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618924": [
        {
            "ioc_value": "being.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 04:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618923": [
        {
            "ioc_value": "drain8.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 04:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618921": [
        {
            "ioc_value": "arise.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 04:07:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618897": [
        {
            "ioc_value": "riotgames-abuse.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 04:01:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/137.74.43.218+riotgames-abuse.com",
            "tags": "AS16276,C2,censys,Mythic,OVH",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1618898": [
        {
            "ioc_value": "research.fusenode.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 04:01:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/100.16.199.221+research.fusenode.net",
            "tags": "AS701,C2,censys,Mythic,UUNET",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1618892": [
        {
            "ioc_value": "f1oor.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 03:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618891": [
        {
            "ioc_value": "lmage.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 03:48:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618890": [
        {
            "ioc_value": "q8z1.7i091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 03:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618889": [
        {
            "ioc_value": "drunk.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 03:37:54",
            "last_seen_utc": "2025-10-21 03:44:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618888": [
        {
            "ioc_value": "v2.7i091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 03:33:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618887": [
        {
            "ioc_value": "buyer.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 03:27:37",
            "last_seen_utc": "2025-10-21 03:33:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618886": [
        {
            "ioc_value": "l0wer.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 03:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618885": [
        {
            "ioc_value": "heavy.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 03:07:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618884": [
        {
            "ioc_value": "yh3a.7i091.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 03:05:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618881": [
        {
            "ioc_value": "coast.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 02:57:14",
            "last_seen_utc": "2025-10-21 03:05:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618876": [
        {
            "ioc_value": "www.salesf0rce.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-21 02:49:37",
            "last_seen_utc": "2025-12-14 11:48:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618875": [
        {
            "ioc_value": "cause.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 02:47:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618874": [
        {
            "ioc_value": "c3k9.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 02:46:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618873": [
        {
            "ioc_value": "easy57.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 02:38:11",
            "last_seen_utc": "2025-10-21 02:46:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618871": [
        {
            "ioc_value": "carve.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 02:27:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618870": [
        {
            "ioc_value": "actor6.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 02:18:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618869": [
        {
            "ioc_value": "r8.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 02:18:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618868": [
        {
            "ioc_value": "jumpy.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 02:07:48",
            "last_seen_utc": "2025-10-21 02:18:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618867": [
        {
            "ioc_value": "m01a.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 01:59:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618866": [
        {
            "ioc_value": "eager.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 01:57:32",
            "last_seen_utc": "2025-10-21 01:59:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618865": [
        {
            "ioc_value": "bas1c36.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 01:47:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618864": [
        {
            "ioc_value": "biame.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 01:38:36",
            "last_seen_utc": "2025-10-21 01:38:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618863": [
        {
            "ioc_value": "tz6.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 01:38:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618862": [
        {
            "ioc_value": "earth.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 01:27:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618860": [
        {
            "ioc_value": "draw1.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 01:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618859": [
        {
            "ioc_value": "ex1st.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 01:07:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618857": [
        {
            "ioc_value": "b7q.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 01:04:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618856": [
        {
            "ioc_value": "board73.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 00:58:17",
            "last_seen_utc": "2025-10-21 01:04:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618855": [
        {
            "ioc_value": "n4y2.4y328.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 00:53:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618854": [
        {
            "ioc_value": "essay8.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 00:48:00",
            "last_seen_utc": "2025-10-21 00:53:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618853": [
        {
            "ioc_value": "x7.9e466.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 00:39:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618852": [
        {
            "ioc_value": "a5ide.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 00:37:44",
            "last_seen_utc": "2025-10-21 00:39:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618851": [
        {
            "ioc_value": "broad.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 00:27:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618850": [
        {
            "ioc_value": "chest.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 00:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618849": [
        {
            "ioc_value": "heavy40.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 00:07:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618846": [
        {
            "ioc_value": "p9t.9e466.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-21 00:03:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618845": [
        {
            "ioc_value": "rds1.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-21 00:03:00",
            "last_seen_utc": "2025-10-21 04:01:52",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+rds1.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618832": [
        {
            "ioc_value": "enjoy.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 23:57:36",
            "last_seen_utc": "2025-10-21 00:03:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618829": [
        {
            "ioc_value": "k3v7.9e466.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 23:50:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618828": [
        {
            "ioc_value": "album.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 23:47:18",
            "last_seen_utc": "2025-10-20 23:50:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618827": [
        {
            "ioc_value": "elite.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 23:36:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618619": [
        {
            "ioc_value": "digit37.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 23:28:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618618": [
        {
            "ioc_value": "chain7.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 23:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618617": [
        {
            "ioc_value": "alone9.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 23:08:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618616": [
        {
            "ioc_value": "ab0ve.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 22:57:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618615": [
        {
            "ioc_value": "being.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 22:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618614": [
        {
            "ioc_value": "haven.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 22:37:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618613": [
        {
            "ioc_value": "driil93.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 22:27:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618612": [
        {
            "ioc_value": "cheap8.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 22:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618611": [
        {
            "ioc_value": "greet09.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 22:08:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618610": [
        {
            "ioc_value": "cl0ck7.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 21:57:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618609": [
        {
            "ioc_value": "elder77.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 21:47:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618608": [
        {
            "ioc_value": "gr1nd.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 21:37:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618602": [
        {
            "ioc_value": "endzed.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-20 21:28:56",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618603": [
        {
            "ioc_value": "hangxdl.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-20 21:28:56",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618604": [
        {
            "ioc_value": "niqateu.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-20 21:28:56",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618605": [
        {
            "ioc_value": "vestbat.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-20 21:28:56",
            "last_seen_utc": "2025-11-13 09:52:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618606": [
        {
            "ioc_value": "sixaupk.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-20 21:28:56",
            "last_seen_utc": "2025-11-13 09:52:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618601": [
        {
            "ioc_value": "a1over.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 21:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618600": [
        {
            "ioc_value": "chair.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 21:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618599": [
        {
            "ioc_value": "blo0d.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 21:08:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618598": [
        {
            "ioc_value": "e5say.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 20:57:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618592": [
        {
            "ioc_value": "cloudflare.028bxgg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-20 20:48:32",
            "last_seen_utc": "2025-11-28 09:50:55",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618593": [
        {
            "ioc_value": "cloudflare.12aim.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-20 20:48:32",
            "last_seen_utc": "2025-11-28 09:50:56",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618594": [
        {
            "ioc_value": "cloudflare.bchedu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-20 20:48:32",
            "last_seen_utc": "2025-11-28 09:50:57",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618595": [
        {
            "ioc_value": "cloudflare.wzznswlxs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-20 20:48:32",
            "last_seen_utc": "2025-11-28 09:50:58",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618596": [
        {
            "ioc_value": "cloudflare.xibutc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-20 20:48:32",
            "last_seen_utc": "2025-11-28 09:50:58",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618591": [
        {
            "ioc_value": "keenly0.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 20:48:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618590": [
        {
            "ioc_value": "fight.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 20:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618588": [
        {
            "ioc_value": "begin7.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 20:28:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618587": [
        {
            "ioc_value": "q2x8.4a8u6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 20:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618586": [
        {
            "ioc_value": "anger.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 20:18:46",
            "last_seen_utc": "2025-10-20 20:19:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618585": [
        {
            "ioc_value": "lega1.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 20:08:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618570": [
        {
            "ioc_value": "map1e.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 19:57:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618569": [
        {
            "ioc_value": "7m1a.4a8u6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 19:48:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618568": [
        {
            "ioc_value": "brown6.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 19:40:47",
            "last_seen_utc": "2025-10-20 19:48:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618567": [
        {
            "ioc_value": "front95.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 19:27:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618566": [
        {
            "ioc_value": "z9kq.4a8u6.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 19:22:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618564": [
        {
            "ioc_value": "fairy.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 19:17:10",
            "last_seen_utc": "2025-10-20 19:22:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618563": [
        {
            "ioc_value": "angle.hop-g-3.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 19:14:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618562": [
        {
            "ioc_value": "event53.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 19:08:24",
            "last_seen_utc": "2025-10-20 19:14:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618561": [
        {
            "ioc_value": "clock.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 18:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618559": [
        {
            "ioc_value": "amber3.run-c-you.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 18:50:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618557": [
        {
            "ioc_value": "begun.7-nenop-38-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 18:48:11",
            "last_seen_utc": "2025-10-20 18:50:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618555": [
        {
            "ioc_value": "oxy7.joy-2-way.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 18:39:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618554": [
        {
            "ioc_value": "cross.xiqek-40-ye-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 18:37:54",
            "last_seen_utc": "2025-10-20 18:39:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618553": [
        {
            "ioc_value": "coast0.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 18:28:11",
            "last_seen_utc": "2025-10-20 18:31:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618552": [
        {
            "ioc_value": "ox.fix-fg.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 18:27:27",
            "last_seen_utc": "2025-10-20 18:31:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618551": [
        {
            "ioc_value": "delay.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 18:07:37",
            "last_seen_utc": "2025-10-20 18:27:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618545": [
        {
            "ioc_value": "start-broker.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-20 18:02:31",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-trg61ack2t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618544": [
        {
            "ioc_value": "micoservices.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-20 18:02:19",
            "last_seen_utc": "2025-10-22 12:44:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-vyj5lsymay",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618543": [
        {
            "ioc_value": "microservices.webredirect.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-20 18:02:18",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-vyj5lsymay",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618542": [
        {
            "ioc_value": "babylongrace1010.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-20 18:02:08",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-qbqxeswjds",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618540": [
        {
            "ioc_value": "pa-character.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-20 18:01:58",
            "last_seen_utc": "2025-10-22 12:44:07",
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-tndz6syjgy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618539": [
        {
            "ioc_value": "enjoy.5-kafaq-7-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 17:58:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618538": [
        {
            "ioc_value": "br1ng0.5-milod-931-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 17:47:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618537": [
        {
            "ioc_value": "check.2-wafij-3-ue.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 17:38:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618536": [
        {
            "ioc_value": "hel1o.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 17:27:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618535": [
        {
            "ioc_value": "anger35.5-ninet-1-ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 17:18:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618532": [
        {
            "ioc_value": "canada-vb.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-20 17:11:43",
            "last_seen_utc": "2025-12-01 07:09:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618533": [
        {
            "ioc_value": "xclaim-62815.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-20 17:11:43",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618529": [
        {
            "ioc_value": "1313global.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-20 17:11:00",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618530": [
        {
            "ioc_value": "americanafood.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-20 17:11:00",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618526": [
        {
            "ioc_value": "event.2-fyzog-201-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 17:08:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618525": [
        {
            "ioc_value": "drown86.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 16:57:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618524": [
        {
            "ioc_value": "eatery.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 16:47:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618522": [
        {
            "ioc_value": "drili61.2-pukeg-36-oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 16:37:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618521": [
        {
            "ioc_value": "empty4.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 16:27:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618520": [
        {
            "ioc_value": "badiy.4-pytim-30-ua.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 16:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618519": [
        {
            "ioc_value": "earth48.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 16:07:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618515": [
        {
            "ioc_value": "login.viewmyinvoice.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-20 16:04:51",
            "last_seen_utc": "2025-10-21 04:01:53",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/141.11.213.239+login.viewmyinvoice.dpdns.org",
            "tags": "AS212477,censys,EvilGinx,panel,Phishing,ROYALE-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618510": [
        {
            "ioc_value": "depth8.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 15:58:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618508": [
        {
            "ioc_value": "laser1.0-we-fid-707-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 15:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618501": [
        {
            "ioc_value": "adopt.1-mafus-044-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 15:38:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618500": [
        {
            "ioc_value": "bru5h.5-juzeb-0-io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 15:27:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618499": [
        {
            "ioc_value": "human98.0-rohyp-5-yu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 15:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618498": [
        {
            "ioc_value": "dawn3.syc0aq8uy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 15:11:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618497": [
        {
            "ioc_value": "actor.1-byhih-05-ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 15:07:33",
            "last_seen_utc": "2025-10-20 15:11:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618496": [
        {
            "ioc_value": "shine0.syc0aq8uy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 15:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618495": [
        {
            "ioc_value": "focus.7-doxok-46-eu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 14:57:44",
            "last_seen_utc": "2025-10-20 15:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618494": [
        {
            "ioc_value": "wi1low.syc0aq8uy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 14:49:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618493": [
        {
            "ioc_value": "began.5-forez-515-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 14:47:18",
            "last_seen_utc": "2025-10-20 14:49:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618492": [
        {
            "ioc_value": "851.rv6324.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 14:39:33",
            "last_seen_utc": "2025-10-20 14:41:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618491": [
        {
            "ioc_value": "061.rv6324.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 14:28:02",
            "last_seen_utc": "2025-10-20 14:28:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618490": [
        {
            "ioc_value": "activitytop.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-20 14:23:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618488": [
        {
            "ioc_value": "incomecondition.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-20 14:21:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618486": [
        {
            "ioc_value": "7436901.rv6324.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 14:17:46",
            "last_seen_utc": "2025-10-20 14:18:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618484": [
        {
            "ioc_value": "160287.rv6324.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 14:07:55",
            "last_seen_utc": "2025-10-20 14:08:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618483": [
        {
            "ioc_value": "93055.rv6324.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 13:58:32",
            "last_seen_utc": "2025-10-20 13:59:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618476": [
        {
            "ioc_value": "4084.rv6324.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 13:47:44",
            "last_seen_utc": "2025-10-20 13:48:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618462": [
        {
            "ioc_value": "219.rv6324.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 13:38:24",
            "last_seen_utc": "2025-10-20 13:40:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618455": [
        {
            "ioc_value": "edclive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-20 13:30:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1618454": [
        {
            "ioc_value": "034d2.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 13:28:08",
            "last_seen_utc": "2025-10-20 13:29:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618452": [
        {
            "ioc_value": "force5.syc0aq8uy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 13:21:30",
            "last_seen_utc": "2025-10-20 13:29:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618451": [
        {
            "ioc_value": "118.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 13:18:21",
            "last_seen_utc": "2025-10-20 13:21:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618450": [
        {
            "ioc_value": "6901420.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 13:08:31",
            "last_seen_utc": "2025-10-20 13:09:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618449": [
        {
            "ioc_value": "spark7.syc0aq8uy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 13:01:03",
            "last_seen_utc": "2025-10-20 13:09:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618448": [
        {
            "ioc_value": "777012.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 12:58:03",
            "last_seen_utc": "2025-10-20 13:01:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618445": [
        {
            "ioc_value": "30951.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 12:47:46",
            "last_seen_utc": "2025-10-20 12:49:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618440": [
        {
            "ioc_value": "gr.e.eonifyit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-20 12:39:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1618441": [
        {
            "ioc_value": "gr.e.khabeir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-20 12:39:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1618437": [
        {
            "ioc_value": "8427.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 12:38:00",
            "last_seen_utc": "2025-10-20 12:44:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618436": [
        {
            "ioc_value": "clearS.syc0aq8uy1.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 12:37:14",
            "last_seen_utc": "2025-10-20 12:44:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1618435": [
        {
            "ioc_value": "501.bl8205.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 12:28:43",
            "last_seen_utc": "2025-10-20 12:37:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618433": [
        {
            "ioc_value": "bhin26.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-20 12:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "20October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1618434": [
        {
            "ioc_value": "xxxyuanko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-20 12:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "20October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1618413": [
        {
            "ioc_value": "windowsupdateeng.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-20 12:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "20October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1618414": [
        {
            "ioc_value": "kicix49607ekuali.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-20 12:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "20October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1618405": [
        {
            "ioc_value": "ptptonuwu.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-20 12:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "20October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1618406": [
        {
            "ioc_value": "formaboyasdfa.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-20 12:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "20October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1618407": [
        {
            "ioc_value": "seal.bravoteam6.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-20 12:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "20October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1618404": [
        {
            "ioc_value": "icryptex007.noip.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-20 12:27:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "20October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1618393": [
        {
            "ioc_value": "581.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 12:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618392": [
        {
            "ioc_value": "0789.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 12:07:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618379": [
        {
            "ioc_value": "www.globallimitedgroups.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-20 12:01:59",
            "last_seen_utc": "2025-10-22 12:44:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-nqkylsfx7h",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618380": [
        {
            "ioc_value": "www.globallimitedgroups.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-20 12:01:59",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-nqkylsfx7h",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618378": [
        {
            "ioc_value": "orgdomin.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-20 12:01:53",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-hmt48agn3y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618376": [
        {
            "ioc_value": "8451203.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 11:57:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618375": [
        {
            "ioc_value": "706391.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 11:48:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618374": [
        {
            "ioc_value": "41002.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 11:38:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618373": [
        {
            "ioc_value": "3135.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 11:27:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618372": [
        {
            "ioc_value": "925.zm6392.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 11:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618371": [
        {
            "ioc_value": "72563.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 11:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618370": [
        {
            "ioc_value": "080.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 10:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618369": [
        {
            "ioc_value": "3998107.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 10:48:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618368": [
        {
            "ioc_value": "links-sponsorship.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-20 10:47:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618367": [
        {
            "ioc_value": "610294.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 10:37:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618366": [
        {
            "ioc_value": "57411.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 10:28:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618365": [
        {
            "ioc_value": "4920.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 10:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618364": [
        {
            "ioc_value": "333.lb3091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 10:08:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618363": [
        {
            "ioc_value": "05b8.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 09:58:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618361": [
        {
            "ioc_value": "964.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 09:47:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618360": [
        {
            "ioc_value": "7123001.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 09:35:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618332": [
        {
            "ioc_value": "v2.xoilaczzzcz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-20 07:20:34",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618333": [
        {
            "ioc_value": "v3.xoilaczzzcz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-20 07:20:34",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618326": [
        {
            "ioc_value": "180264.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 07:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618318": [
        {
            "ioc_value": "77950.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 07:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618315": [
        {
            "ioc_value": "6003.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 06:58:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618314": [
        {
            "ioc_value": "201.8d9691.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 06:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618313": [
        {
            "ioc_value": "913c50.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 06:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618310": [
        {
            "ioc_value": "0482.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 06:27:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618305": [
        {
            "ioc_value": "cdn.myolt.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-20 06:24:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1618306": [
        {
            "ioc_value": "cdn.italian-ips.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-20 06:24:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1618307": [
        {
            "ioc_value": "rtx.anditech.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-20 06:24:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1618298": [
        {
            "ioc_value": "169.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 06:17:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618260": [
        {
            "ioc_value": "admin.mythic.shopify.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-20 06:11:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.128.175.224+admin.mythic.shopify.io",
            "tags": "AS396982,C2,censys,GOOGLE-CLOUD-PLATFORM,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1618254": [
        {
            "ioc_value": "www.jonathanglynnphoto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-20 06:11:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.11.20+www.jonathanglynnphoto.com",
            "tags": "AS42624,C2,censys,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1618253": [
        {
            "ioc_value": "www.studiojordanphoto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-20 06:11:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.11.20+www.studiojordanphoto.com",
            "tags": "AS42624,C2,censys,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1618037": [
        {
            "ioc_value": "rtx.kaizensamawati.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-20 06:10:59",
            "last_seen_utc": "2025-10-20 06:24:11",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/0a0cba03-e2ea-4855-9fa7-57f68e85a43e",
            "tags": "stealer,vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1618297": [
        {
            "ioc_value": "7001845.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 06:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618296": [
        {
            "ioc_value": "toxi-34642.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-20 06:02:32",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251020-ddmass1pgt",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1618295": [
        {
            "ioc_value": "55027.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 06:02:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618294": [
        {
            "ioc_value": "8321.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 05:57:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618293": [
        {
            "ioc_value": "324.5m9081.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 05:48:11",
            "last_seen_utc": "2025-10-20 05:53:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618292": [
        {
            "ioc_value": "4137.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 05:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618291": [
        {
            "ioc_value": "0984.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 05:28:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618290": [
        {
            "ioc_value": "5002201.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 05:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618289": [
        {
            "ioc_value": "620714.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 05:07:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618288": [
        {
            "ioc_value": "45019.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 04:57:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618287": [
        {
            "ioc_value": "1205.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 04:48:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618285": [
        {
            "ioc_value": "777.5h4553.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 04:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618284": [
        {
            "ioc_value": "07a9.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 04:28:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618283": [
        {
            "ioc_value": "34972.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 04:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618282": [
        {
            "ioc_value": "028.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 04:08:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618281": [
        {
            "ioc_value": "7652190.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 04:03:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618252": [
        {
            "ioc_value": "100587.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 03:56:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618251": [
        {
            "ioc_value": "9026.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 03:47:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618250": [
        {
            "ioc_value": "431.7i091.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 03:37:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618249": [
        {
            "ioc_value": "05c8.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 03:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618248": [
        {
            "ioc_value": "035.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 03:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618247": [
        {
            "ioc_value": "9912043.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 03:07:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618246": [
        {
            "ioc_value": "260941.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 02:57:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618244": [
        {
            "ioc_value": "70018.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 02:48:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618243": [
        {
            "ioc_value": "4823.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 02:37:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618242": [
        {
            "ioc_value": "719.4y328.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 02:28:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618241": [
        {
            "ioc_value": "42a5.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 02:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618240": [
        {
            "ioc_value": "0615.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 02:07:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618239": [
        {
            "ioc_value": "9031542.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 01:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618238": [
        {
            "ioc_value": "740182.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 01:48:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618237": [
        {
            "ioc_value": "56039.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 01:35:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618236": [
        {
            "ioc_value": "1207.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 01:27:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618235": [
        {
            "ioc_value": "384.9e466.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 01:13:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618234": [
        {
            "ioc_value": "tip.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 01:07:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618233": [
        {
            "ioc_value": "egg.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 00:57:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618232": [
        {
            "ioc_value": "bay.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 00:47:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618231": [
        {
            "ioc_value": "mud.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 00:36:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618230": [
        {
            "ioc_value": "use.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 00:33:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618229": [
        {
            "ioc_value": "sea.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 00:27:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618228": [
        {
            "ioc_value": "fix.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 00:17:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618227": [
        {
            "ioc_value": "gap.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-20 00:08:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618218": [
        {
            "ioc_value": "ink.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 23:57:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618217": [
        {
            "ioc_value": "of33333.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 23:48:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618216": [
        {
            "ioc_value": "six.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 23:38:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618215": [
        {
            "ioc_value": "day.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 23:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618214": [
        {
            "ioc_value": "lip.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 23:18:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618213": [
        {
            "ioc_value": "shy.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 23:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618212": [
        {
            "ioc_value": "act.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 22:57:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618211": [
        {
            "ioc_value": "tea.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 22:47:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618048": [
        {
            "ioc_value": "pin.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 22:37:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618047": [
        {
            "ioc_value": "mi.limpingbronco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-10-19 22:29:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Amadey",
            "anonymous": "0",
            "reporter": "nickkuechel"
        }
    ],
    "1618046": [
        {
            "ioc_value": "car.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 22:28:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618044": [
        {
            "ioc_value": "dig.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 21:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618043": [
        {
            "ioc_value": "m0ma.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 21:47:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618042": [
        {
            "ioc_value": "big.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 21:34:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618041": [
        {
            "ioc_value": "off.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 21:27:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618040": [
        {
            "ioc_value": "rat.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 21:17:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618036": [
        {
            "ioc_value": "joy.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 21:07:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618035": [
        {
            "ioc_value": "ape.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 20:58:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618034": [
        {
            "ioc_value": "try.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 20:48:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618032": [
        {
            "ioc_value": "gas.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 20:34:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618031": [
        {
            "ioc_value": "us.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 20:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618030": [
        {
            "ioc_value": "rag.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 20:15:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618015": [
        {
            "ioc_value": "sit.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 20:00:36",
            "last_seen_utc": "2025-10-19 20:05:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618014": [
        {
            "ioc_value": "fat.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 19:47:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1618012": [
        {
            "ioc_value": "zahcomputers.pk.modpersonnel.support",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-19 19:39:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "stealthserver",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618013": [
        {
            "ioc_value": "cloudstore.cam",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-19 19:39:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "stealthserver",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1618011": [
        {
            "ioc_value": "herandhis.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 19:38:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617939": [
        {
            "ioc_value": "casadecampoamazonas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-19 19:31:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://securelist.com/maverick-banker-distributing-via-whatsapp/117715/",
            "tags": "c2,Maverick",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617938": [
        {
            "ioc_value": "few.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 19:28:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617937": [
        {
            "ioc_value": "sap.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 19:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617936": [
        {
            "ioc_value": "me.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 19:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617935": [
        {
            "ioc_value": "tab.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 18:54:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617931": [
        {
            "ioc_value": "zehir.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-19 18:03:29",
            "last_seen_utc": "2025-11-07 12:55:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-sye5jsbj7w",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617932": [
        {
            "ioc_value": "hackingrat.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-19 18:03:29",
            "last_seen_utc": "2025-10-19 18:03:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-swwphsbj6t",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617930": [
        {
            "ioc_value": "remmom.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-19 18:01:53",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-r2nqesvqf1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617928": [
        {
            "ioc_value": "come-social.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-19 18:01:49",
            "last_seen_utc": "2025-10-22 12:44:07",
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-tpmzgavpdl",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617927": [
        {
            "ioc_value": "sky7.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 17:31:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617926": [
        {
            "ioc_value": "old.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 17:26:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617925": [
        {
            "ioc_value": "van.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 17:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617924": [
        {
            "ioc_value": "top.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 17:07:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617923": [
        {
            "ioc_value": "sip.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 16:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617922": [
        {
            "ioc_value": "art.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 16:47:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617921": [
        {
            "ioc_value": "odd.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 16:37:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617920": [
        {
            "ioc_value": "sun.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 16:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617919": [
        {
            "ioc_value": "bit.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 16:17:06",
            "last_seen_utc": "2025-10-19 16:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617918": [
        {
            "ioc_value": "gin.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 16:07:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617917": [
        {
            "ioc_value": "sites.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-19 16:03:47",
            "last_seen_utc": "2025-10-20 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+sites.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617915": [
        {
            "ioc_value": "providence.nutorus.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-19 16:03:30",
            "last_seen_utc": "2025-10-20 04:00:35",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/50.92.58.195+providence.nutorus.com",
            "tags": "AS852,C2,censys,Havoc,TELUS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617908": [
        {
            "ioc_value": "giga.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 15:57:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617907": [
        {
            "ioc_value": "cupandhandle.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 15:47:42",
            "last_seen_utc": "2025-10-19 22:07:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617906": [
        {
            "ioc_value": "see.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 15:37:21",
            "last_seen_utc": "2025-10-19 15:38:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617905": [
        {
            "ioc_value": "my.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 15:28:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617904": [
        {
            "ioc_value": "den.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 15:23:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617903": [
        {
            "ioc_value": "no555.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 14:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617902": [
        {
            "ioc_value": "add.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 14:36:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617901": [
        {
            "ioc_value": "kit.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 14:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617900": [
        {
            "ioc_value": "arm.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 14:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617899": [
        {
            "ioc_value": "ask4it.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 14:07:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617896": [
        {
            "ioc_value": "h0p.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 13:57:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617895": [
        {
            "ioc_value": "end.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 13:48:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617894": [
        {
            "ioc_value": "gun4.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 13:37:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617893": [
        {
            "ioc_value": "hen.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 13:24:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617892": [
        {
            "ioc_value": "bad.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 13:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617891": [
        {
            "ioc_value": "tap.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 13:08:05",
            "last_seen_utc": "2025-10-19 13:08:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617890": [
        {
            "ioc_value": "age.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 12:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617888": [
        {
            "ioc_value": "banit.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 12:46:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617887": [
        {
            "ioc_value": "n0w.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 12:37:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617886": [
        {
            "ioc_value": "keyz.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 12:28:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617885": [
        {
            "ioc_value": "bag.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 12:17:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617884": [
        {
            "ioc_value": "be1.ngiz5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 12:07:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617874": [
        {
            "ioc_value": "parsec-47111.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-19 12:01:50",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-nswg5agr7y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617873": [
        {
            "ioc_value": "dad.kpyb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 11:58:45",
            "last_seen_utc": "2025-10-19 11:59:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617872": [
        {
            "ioc_value": "by.kvus7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 11:48:05",
            "last_seen_utc": "2025-10-19 15:08:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617870": [
        {
            "ioc_value": "bee.wtes4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 11:37:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617869": [
        {
            "ioc_value": "mat.cpak0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 11:27:56",
            "last_seen_utc": "2025-10-19 14:48:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617868": [
        {
            "ioc_value": "pad.bkud4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 11:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617867": [
        {
            "ioc_value": "lab.rkuc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 11:07:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617866": [
        {
            "ioc_value": "blackstar.bid5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 10:57:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617865": [
        {
            "ioc_value": "hip.kduk8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 10:57:26",
            "last_seen_utc": "2025-10-19 10:57:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617859": [
        {
            "ioc_value": "dip.hxit8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 10:48:09",
            "last_seen_utc": "2025-10-19 10:49:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617858": [
        {
            "ioc_value": "net.ckon0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 10:37:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617857": [
        {
            "ioc_value": "851.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 10:28:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617856": [
        {
            "ioc_value": "061.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 10:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617855": [
        {
            "ioc_value": "7436901.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 10:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617854": [
        {
            "ioc_value": "lace.bid5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 10:01:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617853": [
        {
            "ioc_value": "160287.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 09:57:42",
            "last_seen_utc": "2025-10-19 10:01:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617852": [
        {
            "ioc_value": "dim.bid5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 09:50:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617851": [
        {
            "ioc_value": "93055.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 09:47:22",
            "last_seen_utc": "2025-10-19 09:50:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617850": [
        {
            "ioc_value": "4084.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 09:37:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617849": [
        {
            "ioc_value": "219.u521483.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 09:27:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617848": [
        {
            "ioc_value": "pond.bid5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 09:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617847": [
        {
            "ioc_value": "nano2025.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-19 09:20:48",
            "last_seen_utc": "2025-10-22 12:44:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617845": [
        {
            "ioc_value": "034d2.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 09:18:29",
            "last_seen_utc": "2025-10-19 09:21:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617844": [
        {
            "ioc_value": "118.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 09:08:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617843": [
        {
            "ioc_value": "6901420.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 08:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617841": [
        {
            "ioc_value": "bossone.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-19 08:48:25",
            "last_seen_utc": "2025-11-19 09:58:40",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617840": [
        {
            "ioc_value": "777012.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 08:47:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617839": [
        {
            "ioc_value": "30951.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 08:37:41",
            "last_seen_utc": "2025-10-19 08:40:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617838": [
        {
            "ioc_value": "spark.bid5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 08:37:26",
            "last_seen_utc": "2025-10-19 08:40:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617837": [
        {
            "ioc_value": "8427.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 08:27:53",
            "last_seen_utc": "2025-10-19 08:37:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617836": [
        {
            "ioc_value": "oak.bid5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 08:22:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617835": [
        {
            "ioc_value": "501.u069653.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 08:17:34",
            "last_seen_utc": "2025-10-19 08:22:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617834": [
        {
            "ioc_value": "brim.bid5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 08:12:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617833": [
        {
            "ioc_value": "581.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 08:08:19",
            "last_seen_utc": "2025-10-19 08:12:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617824": [
        {
            "ioc_value": "0789.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:57:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617823": [
        {
            "ioc_value": "8451203.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:48:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617822": [
        {
            "ioc_value": "nap.wir2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:40:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617821": [
        {
            "ioc_value": "706391.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:38:20",
            "last_seen_utc": "2025-10-19 07:40:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617820": [
        {
            "ioc_value": "41002.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:35:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617819": [
        {
            "ioc_value": "twig.wir2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:30:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617818": [
        {
            "ioc_value": "3135.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:27:56",
            "last_seen_utc": "2025-10-19 07:30:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617817": [
        {
            "ioc_value": "925.y438414.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:17:39",
            "last_seen_utc": "2025-10-19 07:19:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617816": [
        {
            "ioc_value": "curl.wir2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:11:21",
            "last_seen_utc": "2025-10-19 07:19:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617815": [
        {
            "ioc_value": "72563.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 07:07:51",
            "last_seen_utc": "2025-10-19 07:11:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617814": [
        {
            "ioc_value": "080.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 06:57:34",
            "last_seen_utc": "2025-10-19 07:01:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617813": [
        {
            "ioc_value": "beam.wir2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 06:52:27",
            "last_seen_utc": "2025-10-19 07:01:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617812": [
        {
            "ioc_value": "3998107.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 06:48:49",
            "last_seen_utc": "2025-10-19 06:52:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617810": [
        {
            "ioc_value": "e-cross.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-19 06:41:14",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617807": [
        {
            "ioc_value": "redirect.dedicated-coords.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-19 06:39:56",
            "last_seen_utc": "2025-11-07 12:55:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617805": [
        {
            "ioc_value": "v1.subgiare.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-19 06:39:04",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617806": [
        {
            "ioc_value": "v2.subgiare.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-19 06:39:04",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617799": [
        {
            "ioc_value": "gates.subgiare.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-19 06:38:06",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617800": [
        {
            "ioc_value": "jaks.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-19 06:38:06",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617801": [
        {
            "ioc_value": "ze1exlpvm.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-19 06:38:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617794": [
        {
            "ioc_value": "loft.wir2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 06:36:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617789": [
        {
            "ioc_value": "610294.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 06:31:20",
            "last_seen_utc": "2025-10-19 06:36:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617788": [
        {
            "ioc_value": "57411.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 06:28:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617785": [
        {
            "ioc_value": "4920.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 06:17:21",
            "last_seen_utc": "2025-10-19 06:24:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617784": [
        {
            "ioc_value": "gem.wir2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 06:16:37",
            "last_seen_utc": "2025-10-19 06:24:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617783": [
        {
            "ioc_value": "333.i327147.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 06:08:04",
            "last_seen_utc": "2025-10-19 06:16:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617777": [
        {
            "ioc_value": "karmina118.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-19 06:03:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-bhpklsdj9y",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617778": [
        {
            "ioc_value": "karmina119.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-19 06:03:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-bhpklsdj9y",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617779": [
        {
            "ioc_value": "nibiru4.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-19 06:03:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-bhpklsdj9y",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617780": [
        {
            "ioc_value": "nibiru5.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-19 06:03:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-bhpklsdj9y",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617781": [
        {
            "ioc_value": "nibiru6.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-19 06:03:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-bhpklsdj9y",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617776": [
        {
            "ioc_value": "karmina117.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-19 06:03:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-bhpklsdj9y",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617774": [
        {
            "ioc_value": "njkb-24236.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-19 06:02:11",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-bekr9aymgs",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617775": [
        {
            "ioc_value": "slsryatdf.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-19 06:02:11",
            "last_seen_utc": "2025-10-20 17:10:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-aqkqysyka1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617773": [
        {
            "ioc_value": "dc14oct.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-19 06:02:02",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-eak41abv6a",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617772": [
        {
            "ioc_value": "sodfhsiuhdvishvisdhivgh.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-19 06:01:53",
            "last_seen_utc": "2025-10-19 06:41:14",
            "confidence_level": 100,
            "reference": "https://tria.ge/251019-eckk9adp9y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617770": [
        {
            "ioc_value": "05b8.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 05:57:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617769": [
        {
            "ioc_value": "964.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 05:47:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617768": [
        {
            "ioc_value": "7123001.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 05:37:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617766": [
        {
            "ioc_value": "180264.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 05:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617765": [
        {
            "ioc_value": "77950.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 05:17:29",
            "last_seen_utc": "2025-10-19 05:20:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617764": [
        {
            "ioc_value": "6003.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 05:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617762": [
        {
            "ioc_value": "201.i554000.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 04:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617761": [
        {
            "ioc_value": "913c50.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 04:48:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617760": [
        {
            "ioc_value": "0482.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 04:38:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617759": [
        {
            "ioc_value": "169.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 04:27:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617758": [
        {
            "ioc_value": "7001845.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 04:15:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617757": [
        {
            "ioc_value": "55027.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 04:08:32",
            "last_seen_utc": "2025-10-19 04:09:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617728": [
        {
            "ioc_value": "8321.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 03:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617727": [
        {
            "ioc_value": "324.i373582.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 03:47:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617726": [
        {
            "ioc_value": "4137.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 03:33:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617725": [
        {
            "ioc_value": "0984.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 03:27:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617724": [
        {
            "ioc_value": "5002201.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 03:17:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617723": [
        {
            "ioc_value": "620714.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 03:08:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617722": [
        {
            "ioc_value": "45019.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 02:58:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617717": [
        {
            "ioc_value": "juyu1.yifanyi.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-19 02:48:04",
            "last_seen_utc": "2025-12-14 11:48:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617716": [
        {
            "ioc_value": "132541.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-19 02:47:58",
            "last_seen_utc": "2025-12-07 19:48:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617715": [
        {
            "ioc_value": "1205.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 02:43:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617714": [
        {
            "ioc_value": "777.o679975.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 02:37:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617713": [
        {
            "ioc_value": "07a9.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 02:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617712": [
        {
            "ioc_value": "34972.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 02:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617711": [
        {
            "ioc_value": "028.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 02:08:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617710": [
        {
            "ioc_value": "7652190.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 01:54:28",
            "last_seen_utc": "2025-10-19 02:04:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617709": [
        {
            "ioc_value": "100587.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 01:48:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617707": [
        {
            "ioc_value": "9026.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 01:38:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617706": [
        {
            "ioc_value": "431.o303024.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 01:28:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617705": [
        {
            "ioc_value": "05c8.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 01:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617704": [
        {
            "ioc_value": "035.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 01:07:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617702": [
        {
            "ioc_value": "9912043.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 00:51:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617701": [
        {
            "ioc_value": "260941.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 00:47:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617700": [
        {
            "ioc_value": "70018.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 00:37:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617699": [
        {
            "ioc_value": "4823.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 00:27:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617698": [
        {
            "ioc_value": "719.o411213.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 00:17:25",
            "last_seen_utc": "2025-10-19 00:23:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617697": [
        {
            "ioc_value": "42a5.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-19 00:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617693": [
        {
            "ioc_value": "desktop.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-19 00:02:42",
            "last_seen_utc": "2025-10-19 04:00:49",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+desktop.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617694": [
        {
            "ioc_value": "assets.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-19 00:02:42",
            "last_seen_utc": "2025-10-19 04:00:50",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+assets.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617690": [
        {
            "ioc_value": "0615.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 23:57:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617689": [
        {
            "ioc_value": "9031542.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 23:49:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617688": [
        {
            "ioc_value": "740182.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 23:37:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617686": [
        {
            "ioc_value": "56039.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 23:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617685": [
        {
            "ioc_value": "1207.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 23:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617684": [
        {
            "ioc_value": "384.i733643.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 23:07:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617683": [
        {
            "ioc_value": "1m.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 22:57:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617681": [
        {
            "ioc_value": "c8.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 22:41:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617680": [
        {
            "ioc_value": "p0.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 22:31:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617679": [
        {
            "ioc_value": "0zq.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 22:28:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617678": [
        {
            "ioc_value": "v3.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 22:15:36",
            "last_seen_utc": "2025-10-18 22:19:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617677": [
        {
            "ioc_value": "h1.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 22:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617676": [
        {
            "ioc_value": "s.5e8y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 21:58:33",
            "last_seen_utc": "2025-10-18 22:00:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617675": [
        {
            "ioc_value": "arm.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 21:47:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617674": [
        {
            "ioc_value": "rye.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 21:38:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617673": [
        {
            "ioc_value": "vet.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 21:28:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617672": [
        {
            "ioc_value": "gas.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 21:17:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617671": [
        {
            "ioc_value": "gig.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 21:06:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617669": [
        {
            "ioc_value": "fit.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 20:58:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617668": [
        {
            "ioc_value": "sap.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 20:45:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617667": [
        {
            "ioc_value": "ai.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 20:38:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617666": [
        {
            "ioc_value": "eh.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 20:28:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617665": [
        {
            "ioc_value": "yo.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 20:10:37",
            "last_seen_utc": "2025-10-18 20:21:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617664": [
        {
            "ioc_value": "pan.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 20:07:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617651": [
        {
            "ioc_value": "him.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 19:57:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617650": [
        {
            "ioc_value": "far.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 19:48:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617648": [
        {
            "ioc_value": "hi.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 19:39:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617647": [
        {
            "ioc_value": "six.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 19:27:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617646": [
        {
            "ioc_value": "too.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 19:11:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617645": [
        {
            "ioc_value": "gab.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 19:07:38",
            "last_seen_utc": "2025-10-18 19:11:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617644": [
        {
            "ioc_value": "gi.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 18:57:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617643": [
        {
            "ioc_value": "ice.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 18:47:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617641": [
        {
            "ioc_value": "gap.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 18:38:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617640": [
        {
            "ioc_value": "zed.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 18:28:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617639": [
        {
            "ioc_value": "gin.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 18:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617637": [
        {
            "ioc_value": "red.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 18:02:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617629": [
        {
            "ioc_value": "editor-formula.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-18 18:01:57",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251018-s6mjlatkaw",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617626": [
        {
            "ioc_value": "throughout-groundwater.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-18 18:01:45",
            "last_seen_utc": "2025-10-22 12:44:07",
            "confidence_level": 100,
            "reference": "https://tria.ge/251018-vdez6aex9h",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617627": [
        {
            "ioc_value": "maxem228666-55949.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-18 18:01:45",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251018-r8eq4asnay",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617625": [
        {
            "ioc_value": "example-kit.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-18 18:01:44",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251018-v6ng1ahl8t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617624": [
        {
            "ioc_value": "wed.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 17:53:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617623": [
        {
            "ioc_value": "coy.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 17:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617622": [
        {
            "ioc_value": "wet.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 17:08:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617621": [
        {
            "ioc_value": "out.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 16:57:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617620": [
        {
            "ioc_value": "he.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 16:47:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617618": [
        {
            "ioc_value": "fur.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 16:37:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617617": [
        {
            "ioc_value": "rid.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 16:27:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617616": [
        {
            "ioc_value": "tic.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 16:17:39",
            "last_seen_utc": "2025-10-18 16:20:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617614": [
        {
            "ioc_value": "id.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 16:08:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617608": [
        {
            "ioc_value": "www.mona-ads.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-18 16:01:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.86.163.126+www.mona-ads.com",
            "tags": "AS44066,C2,censys,DE-FIRSTCOLO,RAT,SpiceRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617607": [
        {
            "ioc_value": "gag.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 15:56:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617606": [
        {
            "ioc_value": "w1656569g.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 15:40:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617601": [
        {
            "ioc_value": "hid.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 15:37:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617599": [
        {
            "ioc_value": "wok.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 15:24:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617598": [
        {
            "ioc_value": "hag.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 15:15:08",
            "last_seen_utc": "2025-10-18 15:20:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617597": [
        {
            "ioc_value": "age.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 15:07:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617596": [
        {
            "ioc_value": "hay.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 14:58:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617595": [
        {
            "ioc_value": "due.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 14:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617594": [
        {
            "ioc_value": "mist.jix3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 14:39:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617593": [
        {
            "ioc_value": "yap.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 14:37:30",
            "last_seen_utc": "2025-10-18 14:39:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617592": [
        {
            "ioc_value": "fab.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 14:27:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617591": [
        {
            "ioc_value": "fig.jix3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 14:20:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617590": [
        {
            "ioc_value": "ow.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 14:18:26",
            "last_seen_utc": "2025-10-18 14:20:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617589": [
        {
            "ioc_value": "bold.jix3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 14:01:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617588": [
        {
            "ioc_value": "ape.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 14:01:01",
            "last_seen_utc": "2025-10-18 14:01:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617587": [
        {
            "ioc_value": "art.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 13:51:11",
            "last_seen_utc": "2025-10-18 13:51:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617586": [
        {
            "ioc_value": "lot.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 13:48:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617585": [
        {
            "ioc_value": "jet.gyj0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 13:41:18",
            "last_seen_utc": "2025-10-18 13:51:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617584": [
        {
            "ioc_value": "air.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 13:36:43",
            "last_seen_utc": "2025-10-18 13:41:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617583": [
        {
            "ioc_value": "few.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 13:27:50",
            "last_seen_utc": "2025-10-18 17:24:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617582": [
        {
            "ioc_value": "try.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 13:17:31",
            "last_seen_utc": "2025-10-18 13:25:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617581": [
        {
            "ioc_value": "tray.gyj0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 13:16:48",
            "last_seen_utc": "2025-10-18 13:29:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617580": [
        {
            "ioc_value": "nap.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 13:07:44",
            "last_seen_utc": "2025-10-18 13:16:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617579": [
        {
            "ioc_value": "muse.gyj0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 12:59:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617578": [
        {
            "ioc_value": "er.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 12:57:28",
            "last_seen_utc": "2025-10-18 12:59:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617575": [
        {
            "ioc_value": "ban.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 12:45:36",
            "last_seen_utc": "2025-10-18 12:51:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617572": [
        {
            "ioc_value": "tag.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 12:38:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617571": [
        {
            "ioc_value": "bark.gyj0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 12:37:22",
            "last_seen_utc": "2025-10-18 12:51:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617570": [
        {
            "ioc_value": "pat.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 12:28:03",
            "last_seen_utc": "2025-10-18 12:37:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617569": [
        {
            "ioc_value": "ran.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 12:18:15",
            "last_seen_utc": "2025-10-18 12:28:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617568": [
        {
            "ioc_value": "cup.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 12:07:58",
            "last_seen_utc": "2025-10-18 12:11:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617557": [
        {
            "ioc_value": "fin.gyj0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 12:01:49",
            "last_seen_utc": "2025-10-18 12:11:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617556": [
        {
            "ioc_value": "pepes18921.webredirect.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-18 12:01:46",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/251018-lxf7wsek5s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617555": [
        {
            "ioc_value": "late-operates.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-18 12:01:41",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251018-jzka8adr21",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617554": [
        {
            "ioc_value": "can.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:58:04",
            "last_seen_utc": "2025-10-18 12:01:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617553": [
        {
            "ioc_value": "nod.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:47:45",
            "last_seen_utc": "2025-10-18 11:51:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617552": [
        {
            "ioc_value": "dusk.gyj0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:38:24",
            "last_seen_utc": "2025-10-18 11:51:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617551": [
        {
            "ioc_value": "jet.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:35:49",
            "last_seen_utc": "2025-10-18 11:38:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617550": [
        {
            "ioc_value": "bog.qvik5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:27:23",
            "last_seen_utc": "2025-10-18 11:30:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617549": [
        {
            "ioc_value": "fern.luv6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:18:13",
            "last_seen_utc": "2025-10-18 11:30:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617548": [
        {
            "ioc_value": "has.cqom9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:15:32",
            "last_seen_utc": "2025-10-18 11:18:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617547": [
        {
            "ioc_value": "era.mzas7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:10:20",
            "last_seen_utc": "2025-10-18 11:14:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617546": [
        {
            "ioc_value": "clay.luv6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:08:11",
            "last_seen_utc": "2025-10-18 11:14:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617545": [
        {
            "ioc_value": "inn.jrih5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 11:07:10",
            "last_seen_utc": "2025-10-18 11:08:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617544": [
        {
            "ioc_value": "its.npoj2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:58:25",
            "last_seen_utc": "2025-10-18 10:59:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617543": [
        {
            "ioc_value": "pun.wkej2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:52:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617542": [
        {
            "ioc_value": "rim.luv6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:51:12",
            "last_seen_utc": "2025-10-18 10:59:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617540": [
        {
            "ioc_value": "51rteswqa.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-18 10:48:19",
            "last_seen_utc": "2025-11-11 15:48:48",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617539": [
        {
            "ioc_value": "pet.rqyp1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:47:56",
            "last_seen_utc": "2025-10-18 10:51:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617538": [
        {
            "ioc_value": "ski.jsuv0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:38:08",
            "last_seen_utc": "2025-10-18 10:41:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617537": [
        {
            "ioc_value": "bed.sjyj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:27:50",
            "last_seen_utc": "2025-10-18 10:35:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617536": [
        {
            "ioc_value": "nest.luv6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:27:14",
            "last_seen_utc": "2025-10-18 10:41:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617534": [
        {
            "ioc_value": "cat.khoc9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:19:34",
            "last_seen_utc": "2025-10-18 10:27:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617533": [
        {
            "ioc_value": "851.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:15:23",
            "last_seen_utc": "2025-10-18 10:15:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617532": [
        {
            "ioc_value": "glow.luv6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:04:50",
            "last_seen_utc": "2025-10-18 10:15:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617531": [
        {
            "ioc_value": "06d1.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 10:03:32",
            "last_seen_utc": "2025-10-18 10:04:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617530": [
        {
            "ioc_value": "7436901.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 09:57:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617529": [
        {
            "ioc_value": "160287.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 09:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617527": [
        {
            "ioc_value": "93055.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 09:37:14",
            "last_seen_utc": "2025-10-18 09:40:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617526": [
        {
            "ioc_value": "4084.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 09:28:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617525": [
        {
            "ioc_value": "pine.luv6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 09:27:57",
            "last_seen_utc": "2025-10-18 09:40:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617523": [
        {
            "ioc_value": "219.93i197934.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 09:17:51",
            "last_seen_utc": "2025-10-18 09:27:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617521": [
        {
            "ioc_value": "03452.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 09:05:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617520": [
        {
            "ioc_value": "118.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 08:57:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617519": [
        {
            "ioc_value": "dew.wib8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 08:49:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617518": [
        {
            "ioc_value": "6901420.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 08:47:54",
            "last_seen_utc": "2025-10-18 08:49:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617516": [
        {
            "ioc_value": "777012.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 08:37:36",
            "last_seen_utc": "2025-10-18 08:42:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617515": [
        {
            "ioc_value": "sail.wib8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 08:31:32",
            "last_seen_utc": "2025-10-18 08:42:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617514": [
        {
            "ioc_value": "30951.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 08:28:20",
            "last_seen_utc": "2025-10-18 08:31:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617513": [
        {
            "ioc_value": "8427.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 08:18:23",
            "last_seen_utc": "2025-10-18 08:19:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617512": [
        {
            "ioc_value": "501.49o103159.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 08:08:05",
            "last_seen_utc": "2025-10-18 08:11:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617511": [
        {
            "ioc_value": "ray.wib8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 08:04:28",
            "last_seen_utc": "2025-10-18 08:19:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617507": [
        {
            "ioc_value": "581.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 07:58:19",
            "last_seen_utc": "2025-10-18 08:04:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617506": [
        {
            "ioc_value": "forceadvance.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-18 07:53:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "zphp",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617503": [
        {
            "ioc_value": "www.montanaivest.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-18 07:52:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617504": [
        {
            "ioc_value": "www.montanaivest.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-18 07:52:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617505": [
        {
            "ioc_value": "www.montanaivest.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-18 07:52:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617502": [
        {
            "ioc_value": "mirailoversddos.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-18 07:52:36",
            "last_seen_utc": "2025-10-20 12:27:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617501": [
        {
            "ioc_value": "youth-better.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-18 07:52:20",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617499": [
        {
            "ioc_value": "asy8808.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-18 07:52:08",
            "last_seen_utc": "2025-11-20 22:57:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617500": [
        {
            "ioc_value": "autodater.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-18 07:52:08",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617490": [
        {
            "ioc_value": "07c9.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 07:48:01",
            "last_seen_utc": "2025-10-18 07:50:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617478": [
        {
            "ioc_value": "8451203.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 07:37:42",
            "last_seen_utc": "2025-10-18 07:43:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617476": [
        {
            "ioc_value": "mint.wib8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 07:32:56",
            "last_seen_utc": "2025-10-18 07:50:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617475": [
        {
            "ioc_value": "706391.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 07:27:54",
            "last_seen_utc": "2025-10-18 07:32:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617474": [
        {
            "ioc_value": "41002.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 07:18:36",
            "last_seen_utc": "2025-10-18 07:19:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617473": [
        {
            "ioc_value": "3135.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 07:07:37",
            "last_seen_utc": "2025-10-18 07:11:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617472": [
        {
            "ioc_value": "plum.wib8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 07:01:38",
            "last_seen_utc": "2025-10-18 07:19:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617471": [
        {
            "ioc_value": "925.31e854642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 06:58:20",
            "last_seen_utc": "2025-10-18 07:01:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617470": [
        {
            "ioc_value": "72563.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 06:47:20",
            "last_seen_utc": "2025-10-18 06:50:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617469": [
        {
            "ioc_value": "fox.wib8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 06:38:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617468": [
        {
            "ioc_value": "080.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 06:38:02",
            "last_seen_utc": "2025-10-18 06:38:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617467": [
        {
            "ioc_value": "3998107.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 06:28:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617466": [
        {
            "ioc_value": "610294.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 06:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617465": [
        {
            "ioc_value": "57411.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 06:07:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617464": [
        {
            "ioc_value": "4920.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 05:57:38",
            "last_seen_utc": "2025-10-18 05:58:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617463": [
        {
            "ioc_value": "333.37i658094.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 05:47:51",
            "last_seen_utc": "2025-10-18 05:53:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617461": [
        {
            "ioc_value": "964.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 05:40:05",
            "last_seen_utc": "2025-10-18 05:44:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617460": [
        {
            "ioc_value": "05b8.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 05:38:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617459": [
        {
            "ioc_value": "7123001.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 05:30:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617458": [
        {
            "ioc_value": "180264.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 05:27:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617457": [
        {
            "ioc_value": "77950.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 05:17:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617456": [
        {
            "ioc_value": "6003.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 05:08:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617455": [
        {
            "ioc_value": "201.30u241207.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 04:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617454": [
        {
            "ioc_value": "913560.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 04:47:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617453": [
        {
            "ioc_value": "0482.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 04:35:16",
            "last_seen_utc": "2025-10-18 04:40:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617452": [
        {
            "ioc_value": "169.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 04:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617451": [
        {
            "ioc_value": "7001845.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 04:18:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617450": [
        {
            "ioc_value": "55027.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 04:07:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617435": [
        {
            "ioc_value": "homeoffice.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-18 04:01:07",
            "last_seen_utc": "2025-10-18 04:02:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+homeoffice.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1617402": [
        {
            "ioc_value": "tubifly.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-18 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.168.135.13+tubifly.com",
            "tags": "AS54290,C2,censys,HOSTWINDS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1617401": [
        {
            "ioc_value": "8321.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 03:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617400": [
        {
            "ioc_value": "324.54o477354.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 03:47:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617399": [
        {
            "ioc_value": "04137.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 03:38:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617397": [
        {
            "ioc_value": "984.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 03:28:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617396": [
        {
            "ioc_value": "5002201.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 03:17:50",
            "last_seen_utc": "2025-10-18 03:23:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617395": [
        {
            "ioc_value": "620714.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 03:08:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617394": [
        {
            "ioc_value": "45019.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 02:57:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617393": [
        {
            "ioc_value": "1205.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 02:47:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617392": [
        {
            "ioc_value": "777.60e533569.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 02:38:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617391": [
        {
            "ioc_value": "581004.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 02:27:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617390": [
        {
            "ioc_value": "34972.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 02:17:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617389": [
        {
            "ioc_value": "028.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 02:08:03",
            "last_seen_utc": "2025-10-18 02:10:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617388": [
        {
            "ioc_value": "7652190.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 01:58:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617387": [
        {
            "ioc_value": "100587.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 01:47:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617386": [
        {
            "ioc_value": "9023.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 01:37:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617385": [
        {
            "ioc_value": "431.11u812580.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 01:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617384": [
        {
            "ioc_value": "889.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 01:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617383": [
        {
            "ioc_value": "05a9.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 01:07:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617382": [
        {
            "ioc_value": "3007812.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 00:57:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617381": [
        {
            "ioc_value": "918274.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 00:48:14",
            "last_seen_utc": "2025-10-18 00:56:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617380": [
        {
            "ioc_value": "60012.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 00:37:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617379": [
        {
            "ioc_value": "2215.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 00:28:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617378": [
        {
            "ioc_value": "740.08u073852.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 00:17:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617377": [
        {
            "ioc_value": "06342.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-18 00:07:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617370": [
        {
            "ioc_value": "719.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 23:57:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617369": [
        {
            "ioc_value": "3499013.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 23:47:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617368": [
        {
            "ioc_value": "55728.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 23:37:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617367": [
        {
            "ioc_value": "120984.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 23:27:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617366": [
        {
            "ioc_value": "9031.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 23:11:26",
            "last_seen_utc": "2025-10-17 23:12:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617365": [
        {
            "ioc_value": "volt.koq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 23:08:22",
            "last_seen_utc": "2025-10-17 23:12:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617364": [
        {
            "ioc_value": "482.99y401874.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 23:04:39",
            "last_seen_utc": "2025-10-17 23:08:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617362": [
        {
            "ioc_value": "zip.zen-and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617363": [
        {
            "ioc_value": "zip.zen-and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617361": [
        {
            "ioc_value": "slow.koq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:50:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617355": [
        {
            "ioc_value": "sip.run-c-you.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:48:07",
            "last_seen_utc": "2025-10-17 22:50:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617354": [
        {
            "ioc_value": "lamp.koq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:39:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617353": [
        {
            "ioc_value": "pig.fix-fg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:37:49",
            "last_seen_utc": "2025-10-17 22:39:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617352": [
        {
            "ioc_value": "wet.app-6-v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:24:24",
            "last_seen_utc": "2025-10-17 22:30:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617351": [
        {
            "ioc_value": "chat.koq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:22:16",
            "last_seen_utc": "2025-10-17 22:30:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617350": [
        {
            "ioc_value": "dip.net-0-prosa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:17:39",
            "last_seen_utc": "2025-10-17 22:22:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617349": [
        {
            "ioc_value": "rig.bit-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:10:22",
            "last_seen_utc": "2025-10-17 22:14:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617348": [
        {
            "ioc_value": "cop.joy-2-way.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:07:13",
            "last_seen_utc": "2025-10-17 22:09:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617347": [
        {
            "ioc_value": "soar.koq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 22:02:39",
            "last_seen_utc": "2025-10-17 22:14:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617346": [
        {
            "ioc_value": "er.hop-g-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 21:51:12",
            "last_seen_utc": "2025-10-17 22:02:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617345": [
        {
            "ioc_value": "cup.tag-b-s3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 21:48:25",
            "last_seen_utc": "2025-10-17 21:50:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617340": [
        {
            "ioc_value": "hum.hop-g3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 21:38:06",
            "last_seen_utc": "2025-10-17 21:41:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617339": [
        {
            "ioc_value": "the-encyclopedia-of-digital-entrepreneurship-and-innovation.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-17 21:35:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1797237/0/iochtml",
            "tags": "c2,domain,joesandbox,Rhadamanthys",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617337": [
        {
            "ioc_value": "year.koq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 21:33:39",
            "last_seen_utc": "2025-10-17 21:41:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617334": [
        {
            "ioc_value": "ash.web-d-n-45.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 21:27:49",
            "last_seen_utc": "2025-10-17 21:33:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617333": [
        {
            "ioc_value": "jar.zen-and.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 21:18:01",
            "last_seen_utc": "2025-10-17 21:23:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617332": [
        {
            "ioc_value": "case.pot5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 21:12:43",
            "last_seen_utc": "2025-10-17 21:23:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617331": [
        {
            "ioc_value": "axe.run-c-you.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 21:07:41",
            "last_seen_utc": "2025-10-17 21:12:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617330": [
        {
            "ioc_value": "raw.fix-fg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 20:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617329": [
        {
            "ioc_value": "must.pot5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 20:49:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617328": [
        {
            "ioc_value": "no.net-0-prosa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 20:47:35",
            "last_seen_utc": "2025-10-17 20:49:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617327": [
        {
            "ioc_value": "tune.pot5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 20:37:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617326": [
        {
            "ioc_value": "paw.bit-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 20:33:14",
            "last_seen_utc": "2025-10-17 20:37:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617325": [
        {
            "ioc_value": "w8y3n2d.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 20:23:45",
            "last_seen_utc": "2025-10-17 20:29:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617315": [
        {
            "ioc_value": "vaxlet.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-17 18:30:59",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5e532dc348cea226907ee286cc623670b87c8f642262ea771b226b7b684fc7d9/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617314": [
        {
            "ioc_value": "ndocpw5ek.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-17 18:02:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-pfqxjs1qv8",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617313": [
        {
            "ioc_value": "emblemfurniture.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 18:02:05",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-r515xsfk3t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617311": [
        {
            "ioc_value": "ALIMMKALO-37356.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-17 18:01:45",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-ta7qbsfn5s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617312": [
        {
            "ioc_value": "increase-breath.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-17 18:01:45",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-slxh3a1jdr",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617310": [
        {
            "ioc_value": "idkvmbox-62519.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-17 18:01:44",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-wd5fgsgk8x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617307": [
        {
            "ioc_value": "login.protect-instagram.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 16:02:33",
            "last_seen_utc": "2025-10-18 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/89.115.156.16+login.protect-instagram.com",
            "tags": "AS12353,censys,EvilGinx,panel,Phishing,VODAFONE-PT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617308": [
        {
            "ioc_value": "aadcdn.protect-instagram.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 16:02:33",
            "last_seen_utc": "2025-10-18 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/89.115.156.16+aadcdn.protect-instagram.com",
            "tags": "AS12353,censys,EvilGinx,panel,Phishing,VODAFONE-PT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617296": [
        {
            "ioc_value": "s.k.myolt.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-17 12:57:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1617297": [
        {
            "ioc_value": "s.k.glinkeg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-17 12:57:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1617287": [
        {
            "ioc_value": "www.blessingsz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 12:02:21",
            "last_seen_utc": "2025-10-22 12:44:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-jgrbtaypt6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617288": [
        {
            "ioc_value": "www.chemeclo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 12:02:21",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-jgrbtaypt6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617289": [
        {
            "ioc_value": "www.foodchenn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 12:02:21",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-jgrbtaypt6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617286": [
        {
            "ioc_value": "thursdayyyyyremmmmxxxxx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 12:02:20",
            "last_seen_utc": "2025-10-22 12:44:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-jqhq2ayqt7",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617283": [
        {
            "ioc_value": "reason-children.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-17 12:02:10",
            "last_seen_utc": "2025-10-22 12:44:07",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-kxjscazm19",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1617274": [
        {
            "ioc_value": "arch.pot5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 11:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617273": [
        {
            "ioc_value": "p7w2c9.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 11:07:19",
            "last_seen_utc": "2025-10-17 11:55:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617272": [
        {
            "ioc_value": "z1q8m.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 10:55:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617255": [
        {
            "ioc_value": "quit.pot5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 10:20:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617248": [
        {
            "ioc_value": "k4nz.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 10:08:24",
            "last_seen_utc": "2025-10-17 10:20:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617247": [
        {
            "ioc_value": "y0n3qv2.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 09:59:24",
            "last_seen_utc": "2025-11-29 09:59:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617244": [
        {
            "ioc_value": "beef.pot5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 09:50:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1617237": [
        {
            "ioc_value": "coxverifica.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-17 09:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1978938247746146761",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617238": [
        {
            "ioc_value": "coxverification.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-17 09:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1978938247746146761",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617239": [
        {
            "ioc_value": "coxverific.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-17 09:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1978938247746146761",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617240": [
        {
            "ioc_value": "downloadjako.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-17 09:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1978938247746146761",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617241": [
        {
            "ioc_value": "helwan.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-17 09:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1978938247746146761",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617242": [
        {
            "ioc_value": "jakodns.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-17 09:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1978938247746146761",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617243": [
        {
            "ioc_value": "swisscomaler.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-17 09:35:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1978938247746146761",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617231": [
        {
            "ioc_value": "ns.acrobe-dev.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 09:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1978919438964420841",
            "tags": "APT,jewelbug,ref7707",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617232": [
        {
            "ioc_value": "ns.fiberlux.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 09:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1978919438964420841",
            "tags": "APT,jewelbug,ref7707",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617233": [
        {
            "ioc_value": "ns.defender-update.services",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 09:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1978919438964420841",
            "tags": "APT,jewelbug,ref7707",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617234": [
        {
            "ioc_value": "ns1.defender-update.services",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 09:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1978919438964420841",
            "tags": "APT,jewelbug,ref7707",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617235": [
        {
            "ioc_value": "update.ubuntu22c3sl-update.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 09:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1978919438964420841",
            "tags": "APT,jewelbug,ref7707",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617236": [
        {
            "ioc_value": "v-proxy.p1ayer.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 09:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1978919438964420841",
            "tags": "APT,jewelbug,ref7707",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617229": [
        {
            "ioc_value": "accounts.mgovcloud.in.departmentofdefence.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 09:31:10",
            "last_seen_utc": "2025-10-17 09:31:10",
            "confidence_level": 100,
            "reference": "https://x.com/Cyberteam008/status/1978823152118407431",
            "tags": "APT,APT36,StealthServer,TransparentTribe",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1617228": [
        {
            "ioc_value": "y0n3qv2.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 09:27:02",
            "last_seen_utc": "2025-10-17 09:50:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617219": [
        {
            "ioc_value": "c1p7mx.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 09:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617218": [
        {
            "ioc_value": "t6z0q8.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 09:08:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617216": [
        {
            "ioc_value": "cloudflarecache.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-17 09:06:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617217": [
        {
            "ioc_value": "bootcdncache.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-17 09:06:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617215": [
        {
            "ioc_value": "manage.veranoresorts.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-17 09:05:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Gholoader,TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617171": [
        {
            "ioc_value": "q9b1v.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 08:57:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1617156": [
        {
            "ioc_value": "toys-officers.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-17 08:53:42",
            "last_seen_utc": "2025-10-22 12:44:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617154": [
        {
            "ioc_value": "rewasay.buynewarexch.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 08:53:14",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617151": [
        {
            "ioc_value": "angelblessedzynovakobothankyougodfeelhap.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 08:53:13",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617152": [
        {
            "ioc_value": "mbremrhnjsggjaklsjgs66yhnsasbtgyujksmjda.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 08:53:13",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617153": [
        {
            "ioc_value": "oobinnnasdfgghjkll.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 08:53:13",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617136": [
        {
            "ioc_value": "www.somapgtserverr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617137": [
        {
            "ioc_value": "www.spops-newsize12.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617138": [
        {
            "ioc_value": "www.tiedbythreads.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617139": [
        {
            "ioc_value": "www.trektogether.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617140": [
        {
            "ioc_value": "www.u3zpp2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617141": [
        {
            "ioc_value": "www.utfjsince.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617142": [
        {
            "ioc_value": "www.vw85.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617143": [
        {
            "ioc_value": "www.welding-machines-27770.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617144": [
        {
            "ioc_value": "www.whygetready.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617145": [
        {
            "ioc_value": "www.wornunder.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617146": [
        {
            "ioc_value": "www.yihengkeji.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617147": [
        {
            "ioc_value": "www.yngbloodbranddeals.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617148": [
        {
            "ioc_value": "www.ys8o6x2kq7mn3j5.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617116": [
        {
            "ioc_value": "www.jrgdbf.com.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617117": [
        {
            "ioc_value": "www.jumpdeep.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617118": [
        {
            "ioc_value": "www.keepitlight.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617119": [
        {
            "ioc_value": "www.klambianyar.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617120": [
        {
            "ioc_value": "www.loudlogicplatform.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617121": [
        {
            "ioc_value": "www.lucky168thh.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617122": [
        {
            "ioc_value": "www.nnhatl.boats",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617123": [
        {
            "ioc_value": "www.noughties.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617124": [
        {
            "ioc_value": "www.oj5nug.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617125": [
        {
            "ioc_value": "www.ome-loan-landers-71214.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617126": [
        {
            "ioc_value": "www.ome-roofing-wjyjof.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617127": [
        {
            "ioc_value": "www.oppkokbadstue.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617128": [
        {
            "ioc_value": "www.prestige-case.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617129": [
        {
            "ioc_value": "www.przyjaciolki.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617130": [
        {
            "ioc_value": "www.quickmderm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617131": [
        {
            "ioc_value": "www.relivu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617132": [
        {
            "ioc_value": "www.repxfitness.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617133": [
        {
            "ioc_value": "www.shohadaonline.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617134": [
        {
            "ioc_value": "www.shopalya.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617135": [
        {
            "ioc_value": "www.sjty100.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617098": [
        {
            "ioc_value": "www.caixasdesom.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617099": [
        {
            "ioc_value": "www.cardinopa.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617100": [
        {
            "ioc_value": "www.ckksweb.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617101": [
        {
            "ioc_value": "www.cus2rel.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617102": [
        {
            "ioc_value": "www.dedo.design",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617103": [
        {
            "ioc_value": "www.dh22804.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617104": [
        {
            "ioc_value": "www.eak5u8.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617105": [
        {
            "ioc_value": "www.easyagentmail.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617106": [
        {
            "ioc_value": "www.energibriq.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617107": [
        {
            "ioc_value": "www.eppwrq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617108": [
        {
            "ioc_value": "www.esvtp.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617109": [
        {
            "ioc_value": "www.financialrhythms.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617110": [
        {
            "ioc_value": "www.gabe.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617111": [
        {
            "ioc_value": "www.gr026.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617112": [
        {
            "ioc_value": "www.hearing-aids-24509.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617113": [
        {
            "ioc_value": "www.ilil.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617114": [
        {
            "ioc_value": "www.investai.chat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617115": [
        {
            "ioc_value": "www.jaguak.casa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617084": [
        {
            "ioc_value": "www.17752.loan",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617085": [
        {
            "ioc_value": "www.245368925.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617086": [
        {
            "ioc_value": "www.315967.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617087": [
        {
            "ioc_value": "www.4si19z.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617088": [
        {
            "ioc_value": "www.5867.pet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617089": [
        {
            "ioc_value": "www.82875.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617090": [
        {
            "ioc_value": "www.94924.town",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617091": [
        {
            "ioc_value": "www.a6tm2kr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617092": [
        {
            "ioc_value": "www.adsf315-12sdfgsfdg.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617093": [
        {
            "ioc_value": "www.alan-jackson-lawyer.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617094": [
        {
            "ioc_value": "www.ambulance1.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617095": [
        {
            "ioc_value": "www.br247821.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617096": [
        {
            "ioc_value": "www.bwitllc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617097": [
        {
            "ioc_value": "www.caijinshuiguolabadianzi.com.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-17 08:52:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617015": [
        {
            "ioc_value": "datesud12.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-17 08:51:41",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617016": [
        {
            "ioc_value": "port-nightlife.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-17 08:51:41",
            "last_seen_utc": "2025-10-22 12:44:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617017": [
        {
            "ioc_value": "send15-10.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-17 08:51:41",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617018": [
        {
            "ioc_value": "vacaa1818.ddnsguru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-17 08:51:41",
            "last_seen_utc": "2025-10-22 12:44:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617014": [
        {
            "ioc_value": "www.premiumsion.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-17 08:51:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617013": [
        {
            "ioc_value": "eladhamas.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-17 08:51:09",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1617008": [
        {
            "ioc_value": "m4rj.tape-5-x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 08:42:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616705": [
        {
            "ioc_value": "nova-shadow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-17 07:13:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://hybrid-analysis.com/sample/1a19a5c6ffb9e34367e8f6cebc6673468a0c75250fc902d9b544fdae32b98e1d/68f144437e66a2f09c0eb516#dns-requests",
            "tags": "NovaSentinel,NovaShadow,RAT",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1616994": [
        {
            "ioc_value": "x.f.glinkeg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-17 06:22:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1616991": [
        {
            "ioc_value": "p.x.myolt.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-17 06:22:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1616992": [
        {
            "ioc_value": "p.x.compuegypt.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-17 06:22:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1616993": [
        {
            "ioc_value": "x.f.myolt.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-17 06:22:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1616984": [
        {
            "ioc_value": "remcos.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-17 06:01:44",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251017-da7gkawpz2",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616977": [
        {
            "ioc_value": "z7f1q0h.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 05:07:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616976": [
        {
            "ioc_value": "r2q6vm.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 04:57:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616974": [
        {
            "ioc_value": "w9t3z8.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 04:46:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616973": [
        {
            "ioc_value": "k1m7c.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 04:42:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616972": [
        {
            "ioc_value": "p5yx.sun-7-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 04:37:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616970": [
        {
            "ioc_value": "n1s8y0w.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 04:27:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616969": [
        {
            "ioc_value": "h4ptx9.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 04:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616968": [
        {
            "ioc_value": "q0w9e3.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 04:07:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616945": [
        {
            "ioc_value": "v6m2a.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 03:57:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616944": [
        {
            "ioc_value": "b7qk.sip-9ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 03:47:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616943": [
        {
            "ioc_value": "z9u4qm1.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 03:41:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616942": [
        {
            "ioc_value": "p3hkv8.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 03:37:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616941": [
        {
            "ioc_value": "w7c5n2.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 03:28:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616940": [
        {
            "ioc_value": "tq1ze.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 03:18:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616939": [
        {
            "ioc_value": "m8d4.sip-9-ta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 03:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616937": [
        {
            "ioc_value": "k2w9e7a.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 02:58:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616936": [
        {
            "ioc_value": "r8qv1m.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 02:47:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616935": [
        {
            "ioc_value": "z3n7c4.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 02:37:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616934": [
        {
            "ioc_value": "y0mkq.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 02:27:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616933": [
        {
            "ioc_value": "f5rp.pitsburg-2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 02:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616932": [
        {
            "ioc_value": "t6e1x9a.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 02:07:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616931": [
        {
            "ioc_value": "m7yq2p.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 01:58:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616930": [
        {
            "ioc_value": "c40znm.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 01:48:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616929": [
        {
            "ioc_value": "w9t7k.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 01:38:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616928": [
        {
            "ioc_value": "h2qf.pits-burg-2-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 01:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616927": [
        {
            "ioc_value": "z0rfu3s.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 01:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616926": [
        {
            "ioc_value": "m1qv9p.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 01:12:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616925": [
        {
            "ioc_value": "kz6t3.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 01:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616924": [
        {
            "ioc_value": "p7e2x.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 00:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616923": [
        {
            "ioc_value": "b4yn.mape-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 00:48:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616922": [
        {
            "ioc_value": "wq3b0k7.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 00:38:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616921": [
        {
            "ioc_value": "c8y4d.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 00:27:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616920": [
        {
            "ioc_value": "t1mze9.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 00:17:05",
            "last_seen_utc": "2025-10-17 00:19:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616918": [
        {
            "ioc_value": "rka7q.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-17 00:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616914": [
        {
            "ioc_value": "imap.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 00:03:51",
            "last_seen_utc": "2025-10-17 04:01:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+imap.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616915": [
        {
            "ioc_value": "rdweb.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-17 00:03:51",
            "last_seen_utc": "2025-10-17 04:01:25",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+rdweb.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616899": [
        {
            "ioc_value": "n5h2.fox-ab.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 23:58:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616898": [
        {
            "ioc_value": "u7wq0c9.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 23:47:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616897": [
        {
            "ioc_value": "g2p4n8.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 23:37:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616896": [
        {
            "ioc_value": "xb19f.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 23:28:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616733": [
        {
            "ioc_value": "d7mta.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 23:22:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616732": [
        {
            "ioc_value": "q3kz.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 23:15:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616731": [
        {
            "ioc_value": "hill.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 23:08:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616730": [
        {
            "ioc_value": "cat.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 22:57:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616728": [
        {
            "ioc_value": "ns1.gygiuh.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-16 22:49:04",
            "last_seen_utc": "2025-12-14 11:48:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616727": [
        {
            "ioc_value": "tree.4y3e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 22:47:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616726": [
        {
            "ioc_value": "13586721moon.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 22:37:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616725": [
        {
            "ioc_value": "quee54949646642n.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 22:27:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616724": [
        {
            "ioc_value": "ro4646623165ck.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 22:18:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616722": [
        {
            "ioc_value": "e79sx2bnqwew6.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-16 20:52:48",
            "last_seen_utc": "2025-11-16 07:49:22",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616721": [
        {
            "ioc_value": "rice.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 20:39:01",
            "last_seen_utc": "2025-10-16 20:46:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616720": [
        {
            "ioc_value": "g46dfgdf65h.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 20:28:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616719": [
        {
            "ioc_value": "6416516876.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 20:14:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616708": [
        {
            "ioc_value": "ice.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 19:48:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616707": [
        {
            "ioc_value": "star.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 19:37:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616706": [
        {
            "ioc_value": "book.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 19:28:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616703": [
        {
            "ioc_value": "bear.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 19:10:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616702": [
        {
            "ioc_value": "fire.4y3e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 19:08:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616701": [
        {
            "ioc_value": "sea.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 18:57:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616699": [
        {
            "ioc_value": "hill.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 18:47:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616697": [
        {
            "ioc_value": "wave.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 18:39:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616681": [
        {
            "ioc_value": "wolf.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 18:35:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616680": [
        {
            "ioc_value": "star.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 18:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616679": [
        {
            "ioc_value": "apple.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 18:23:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616676": [
        {
            "ioc_value": "akuruonka.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-16 18:01:40",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-pkep3sfs3c",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616671": [
        {
            "ioc_value": "rice.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 16:47:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616670": [
        {
            "ioc_value": "g0qm.ko0um.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 16:40:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616668": [
        {
            "ioc_value": "light.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 16:38:02",
            "last_seen_utc": "2025-10-16 16:40:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616667": [
        {
            "ioc_value": "boat.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 16:27:43",
            "last_seen_utc": "2025-10-16 16:32:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616666": [
        {
            "ioc_value": "r2vy.ko0um.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 16:22:22",
            "last_seen_utc": "2025-10-16 16:32:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616665": [
        {
            "ioc_value": "cloud.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 16:17:24",
            "last_seen_utc": "2025-10-16 16:22:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616664": [
        {
            "ioc_value": "wave.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 16:07:37",
            "last_seen_utc": "2025-10-16 16:12:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616656": [
        {
            "ioc_value": "lt7d.ko0um.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 16:01:32",
            "last_seen_utc": "2025-10-16 16:12:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616654": [
        {
            "ioc_value": "stone.ndoq-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 15:57:17",
            "last_seen_utc": "2025-10-16 16:01:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616653": [
        {
            "ioc_value": "stone.vbep-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 15:47:29",
            "last_seen_utc": "2025-10-16 15:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616652": [
        {
            "ioc_value": "w9pl.ko0um.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 15:43:47",
            "last_seen_utc": "2025-10-16 15:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616651": [
        {
            "ioc_value": "fire.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 15:38:06",
            "last_seen_utc": "2025-10-16 15:43:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616649": [
        {
            "ioc_value": "leaf.8y7o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 15:25:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616648": [
        {
            "ioc_value": "book.1a2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 15:13:56",
            "last_seen_utc": "2025-10-16 15:18:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616647": [
        {
            "ioc_value": "f6rx.ko0um.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 15:11:05",
            "last_seen_utc": "2025-10-16 15:18:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616646": [
        {
            "ioc_value": "mv.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 15:07:44",
            "last_seen_utc": "2025-10-16 15:11:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616644": [
        {
            "ioc_value": "y1dk.fi7em.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 15:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616642": [
        {
            "ioc_value": "932.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 14:57:54",
            "last_seen_utc": "2025-10-16 15:00:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616641": [
        {
            "ioc_value": "t9k.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 14:47:36",
            "last_seen_utc": "2025-10-16 14:56:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616640": [
        {
            "ioc_value": "zn8c.fi7em.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 14:45:19",
            "last_seen_utc": "2025-10-16 14:56:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616630": [
        {
            "ioc_value": "modgovindia.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:38:27",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616631": [
        {
            "ioc_value": "modindia.serveminecraft.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:37:56",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616632": [
        {
            "ioc_value": "seemysitelive.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:38:27",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616633": [
        {
            "ioc_value": "solarwindturbine.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:38:27",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616634": [
        {
            "ioc_value": "sinjita.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:38:27",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616635": [
        {
            "ioc_value": "sinjita.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:38:27",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616636": [
        {
            "ioc_value": "seeconnectionalive.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:39:04",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616637": [
        {
            "ioc_value": "windturbine.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:39:04",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616638": [
        {
            "ioc_value": "kavach.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:39:04",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616639": [
        {
            "ioc_value": "discoverlive.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:38:57",
            "last_seen_utc": "2025-10-19 19:39:04",
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616629": [
        {
            "ioc_value": "u7j.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 14:37:17",
            "last_seen_utc": "2025-10-16 14:45:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616628": [
        {
            "ioc_value": "9t4.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 14:28:31",
            "last_seen_utc": "2025-10-16 14:32:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616627": [
        {
            "ioc_value": "securestore.cv",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:28:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616626": [
        {
            "ioc_value": "filestore.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 14:25:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://blog.xlab.qianxin.com/apt-stealthserver-en/",
            "tags": "APT,StealthServer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616625": [
        {
            "ioc_value": "p3za.fi7em.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 14:25:27",
            "last_seen_utc": "2025-10-16 14:32:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616624": [
        {
            "ioc_value": "3r.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 14:18:13",
            "last_seen_utc": "2025-10-16 14:25:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616623": [
        {
            "ioc_value": "w8v.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 14:08:24",
            "last_seen_utc": "2025-10-16 14:09:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616622": [
        {
            "ioc_value": "b5uk.fi7em.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:59:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616621": [
        {
            "ioc_value": "z2.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:58:05",
            "last_seen_utc": "2025-10-16 13:59:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616620": [
        {
            "ioc_value": "xq74.fi7em.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:42:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616619": [
        {
            "ioc_value": "tree.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:40:38",
            "last_seen_utc": "2025-10-16 13:42:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616618": [
        {
            "ioc_value": "apple.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:31:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616596": [
        {
            "ioc_value": "dow.895628.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-16 13:29:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1616606": [
        {
            "ioc_value": "pcdcinc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-16 13:29:22",
            "last_seen_utc": "2025-10-16 13:18:02",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115384036759487109",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1616608": [
        {
            "ioc_value": "app.futurarealestate.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-16 13:29:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1616609": [
        {
            "ioc_value": "community.veranobuilders.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-16 13:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1616610": [
        {
            "ioc_value": "devel.prtaxheaven.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-16 13:29:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1616611": [
        {
            "ioc_value": "kuber.futurarealestate.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-16 13:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1616612": [
        {
            "ioc_value": "plesk.puertoricolsla.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-16 13:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1616613": [
        {
            "ioc_value": "secure.destinationgallery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-16 13:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1616614": [
        {
            "ioc_value": "stream.escapesvacationclub.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-16 13:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1616615": [
        {
            "ioc_value": "support.prtaxheaven.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-16 13:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1616617": [
        {
            "ioc_value": "hd3n.fi7em.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:28:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616616": [
        {
            "ioc_value": "forest.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:26:37",
            "last_seen_utc": "2025-10-16 13:28:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616604": [
        {
            "ioc_value": "apple.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616603": [
        {
            "ioc_value": "sun.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:08:26",
            "last_seen_utc": "2025-10-16 13:12:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616602": [
        {
            "ioc_value": "q4xn.te7ap.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 13:00:53",
            "last_seen_utc": "2025-10-16 13:12:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616601": [
        {
            "ioc_value": "cloud.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 12:58:10",
            "last_seen_utc": "2025-10-16 13:00:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616597": [
        {
            "ioc_value": "forest.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 12:48:19",
            "last_seen_utc": "2025-10-16 12:51:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616595": [
        {
            "ioc_value": "c7qv.te7ap.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 12:43:22",
            "last_seen_utc": "2025-10-16 12:51:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616594": [
        {
            "ioc_value": "storm.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 12:38:03",
            "last_seen_utc": "2025-10-16 12:43:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616592": [
        {
            "ioc_value": "stone.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 12:28:15",
            "last_seen_utc": "2025-10-16 12:30:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616590": [
        {
            "ioc_value": "m0yl.te7ap.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 12:22:17",
            "last_seen_utc": "2025-10-16 12:30:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616588": [
        {
            "ioc_value": "wolf.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 12:15:54",
            "last_seen_utc": "2025-10-16 12:22:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616587": [
        {
            "ioc_value": "leaf.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 12:07:40",
            "last_seen_utc": "2025-10-16 12:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616585": [
        {
            "ioc_value": "wargvan.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-16 12:03:47",
            "last_seen_utc": "2025-11-07 12:55:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-nnezksyxf1",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616584": [
        {
            "ioc_value": "12.895628.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-16 12:03:04",
            "last_seen_utc": "2025-10-16 12:45:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-k8cs6swky5",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616581": [
        {
            "ioc_value": "late-lil.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-16 12:02:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-lxpt2axjx7",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616574": [
        {
            "ioc_value": "design-plasma.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-16 12:01:56",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-htryfaat4g",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616573": [
        {
            "ioc_value": "kids-peer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-16 12:01:55",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-m3y6bsev3a",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616571": [
        {
            "ioc_value": "view-creates.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-16 12:01:45",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-msjynayvgw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616570": [
        {
            "ioc_value": "agulo22.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-16 12:01:38",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-mr3pdahk9y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616568": [
        {
            "ioc_value": "return-carol.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-16 12:01:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-l1jgesdw7a",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616569": [
        {
            "ioc_value": "thursday-cabinet.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-16 12:01:32",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-k8f6law1bv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616567": [
        {
            "ioc_value": "vr4x.te7ap.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 12:00:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616566": [
        {
            "ioc_value": "rain.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 11:59:51",
            "last_seen_utc": "2025-10-16 12:00:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616565": [
        {
            "ioc_value": "stevenfromcoinbase.fk3.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.aisuru",
            "malware_alias": null,
            "malware_printable": "Aisuru",
            "first_seen_utc": "2025-10-16 11:48:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/35bbf0234535438e8cbc25031e6501e259c847270467d45bc18af065d03fc537/",
            "tags": "Aisuru",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616564": [
        {
            "ioc_value": "water.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 11:47:31",
            "last_seen_utc": "2025-10-16 11:50:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616563": [
        {
            "ioc_value": "t1qh.te7ap.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 11:47:00",
            "last_seen_utc": "2025-10-16 11:50:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616562": [
        {
            "ioc_value": "fire.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 11:37:44",
            "last_seen_utc": "2025-10-16 11:47:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616561": [
        {
            "ioc_value": "kz8m.te7ap.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 11:34:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616560": [
        {
            "ioc_value": "path.4i1e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 11:29:24",
            "last_seen_utc": "2025-10-16 11:34:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616559": [
        {
            "ioc_value": "bridge.8u2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 11:18:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616558": [
        {
            "ioc_value": "cloud.bvuf-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 11:08:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616557": [
        {
            "ioc_value": "qd.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 10:58:01",
            "last_seen_utc": "2025-10-16 11:06:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616556": [
        {
            "ioc_value": "kimono.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 10:47:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616555": [
        {
            "ioc_value": "risk.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 10:37:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616554": [
        {
            "ioc_value": "money.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 10:27:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616553": [
        {
            "ioc_value": "gold.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 10:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616552": [
        {
            "ioc_value": "white.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 10:08:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616551": [
        {
            "ioc_value": "heaven.nqyf-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 09:58:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616548": [
        {
            "ioc_value": "black.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 09:49:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616547": [
        {
            "ioc_value": "four.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 09:37:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616546": [
        {
            "ioc_value": "ultimate.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 09:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616544": [
        {
            "ioc_value": "war.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 09:18:23",
            "last_seen_utc": "2025-10-16 09:22:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616543": [
        {
            "ioc_value": "glue.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 09:07:34",
            "last_seen_utc": "2025-10-16 09:16:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616542": [
        {
            "ioc_value": "forward.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 08:58:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616541": [
        {
            "ioc_value": "fast.rjuq-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 08:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616535": [
        {
            "ioc_value": "dog.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 08:38:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616534": [
        {
            "ioc_value": "slash.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 08:27:01",
            "last_seen_utc": "2025-10-16 08:28:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616533": [
        {
            "ioc_value": "dock.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 08:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616532": [
        {
            "ioc_value": "twelve.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 08:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616527": [
        {
            "ioc_value": "back.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 07:58:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616526": [
        {
            "ioc_value": "car.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 07:47:53",
            "last_seen_utc": "2025-10-16 07:52:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616525": [
        {
            "ioc_value": "one.gdyl-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 07:37:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616523": [
        {
            "ioc_value": "azure.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 07:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616522": [
        {
            "ioc_value": "yonder.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 07:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616518": [
        {
            "ioc_value": "bral.grupovargas.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 07:11:39",
            "last_seen_utc": "2025-10-16 07:11:39",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616519": [
        {
            "ioc_value": "md.grupflixca.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 07:11:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616520": [
        {
            "ioc_value": "cont.appsalve.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 07:11:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616521": [
        {
            "ioc_value": "cfg.brasilinst.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-16 07:11:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616517": [
        {
            "ioc_value": "zephyr.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 07:09:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616516": [
        {
            "ioc_value": "verge.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 06:57:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616515": [
        {
            "ioc_value": "ultra.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 06:48:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616512": [
        {
            "ioc_value": "bookgiants.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-16 06:45:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616513": [
        {
            "ioc_value": "eggscoach.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-16 06:45:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616514": [
        {
            "ioc_value": "cubmilk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-16 06:45:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616509": [
        {
            "ioc_value": "p.d.myolt.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-16 06:40:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1616510": [
        {
            "ioc_value": "p.d.compuegypt.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-16 06:40:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1616506": [
        {
            "ioc_value": "topaz.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 06:38:06",
            "last_seen_utc": "2025-10-16 06:46:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616505": [
        {
            "ioc_value": "sable.mcej-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 06:29:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616504": [
        {
            "ioc_value": "jungle.bqet-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 06:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616503": [
        {
            "ioc_value": "ivory.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616499": [
        {
            "ioc_value": "angelkingsdidthebestfeelingforhislifetog.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-16 06:11:58",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1616500": [
        {
            "ioc_value": "www.medicoolpart.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-16 06:11:58",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1616501": [
        {
            "ioc_value": "zsew.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-16 06:11:58",
            "last_seen_utc": "2025-11-07 12:55:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1616495": [
        {
            "ioc_value": "coorpfree.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-16 06:11:37",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1616496": [
        {
            "ioc_value": "v1.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-16 06:11:37",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1616497": [
        {
            "ioc_value": "v2.moroccancam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-16 06:11:37",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1616498": [
        {
            "ioc_value": "wowow422421xs.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-16 06:11:37",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1616492": [
        {
            "ioc_value": "breeze.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 06:07:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616491": [
        {
            "ioc_value": "userbot.uswin.com.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-16 06:03:19",
            "last_seen_utc": "2025-10-22 12:44:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-c9fbpatwdz",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616488": [
        {
            "ioc_value": "alemania2059.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-16 06:01:51",
            "last_seen_utc": "2025-10-22 12:44:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-b11qlabl2w",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616486": [
        {
            "ioc_value": "adigo.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-16 06:01:32",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-gdd6zavtbs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616487": [
        {
            "ioc_value": "fteamez7iurs02.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-16 06:01:32",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251016-deb68agw2e",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616485": [
        {
            "ioc_value": "acorn.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 05:57:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616484": [
        {
            "ioc_value": "walnut.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 05:47:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616483": [
        {
            "ioc_value": "saffron.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 05:38:10",
            "last_seen_utc": "2025-10-16 05:42:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616482": [
        {
            "ioc_value": "ginger.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 05:28:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616481": [
        {
            "ioc_value": "pepper.wtok-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 05:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616480": [
        {
            "ioc_value": "sprout.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 05:08:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616478": [
        {
            "ioc_value": "plume.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 04:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616477": [
        {
            "ioc_value": "onyx.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 04:47:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616476": [
        {
            "ioc_value": "maple.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 04:38:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616475": [
        {
            "ioc_value": "raven.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 04:28:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616474": [
        {
            "ioc_value": "cobalt.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 04:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616473": [
        {
            "ioc_value": "meadow.wduh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 04:08:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616439": [
        {
            "ioc_value": "flint.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 03:50:19",
            "last_seen_utc": "2025-10-16 03:58:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616438": [
        {
            "ioc_value": "hazel.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 03:36:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616437": [
        {
            "ioc_value": "quartz.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 03:27:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616436": [
        {
            "ioc_value": "willow.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 03:17:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616435": [
        {
            "ioc_value": "brisk.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 03:07:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616434": [
        {
            "ioc_value": "velvet.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 02:58:46",
            "last_seen_utc": "2025-10-16 03:00:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616432": [
        {
            "ioc_value": "ember.wqix-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 02:47:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616431": [
        {
            "ioc_value": "x8n.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 02:38:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616430": [
        {
            "ioc_value": "h9.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 02:28:13",
            "last_seen_utc": "2025-10-16 02:36:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616429": [
        {
            "ioc_value": "tq.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 02:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616428": [
        {
            "ioc_value": "z1.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 02:08:09",
            "last_seen_utc": "2025-10-16 02:13:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616427": [
        {
            "ioc_value": "bd.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 01:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616426": [
        {
            "ioc_value": "q4.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 01:47:35",
            "last_seen_utc": "2025-10-16 01:54:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616425": [
        {
            "ioc_value": "g.5e7i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 01:37:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616424": [
        {
            "ioc_value": "p9.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 01:27:28",
            "last_seen_utc": "2025-10-16 01:36:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616423": [
        {
            "ioc_value": "h7.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 01:17:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616422": [
        {
            "ioc_value": "x.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 01:07:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616420": [
        {
            "ioc_value": "t1.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 00:57:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616419": [
        {
            "ioc_value": "zc.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 00:48:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616417": [
        {
            "ioc_value": "n3.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 00:37:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616416": [
        {
            "ioc_value": "a.1o6y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 00:28:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616415": [
        {
            "ioc_value": "q1n.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 00:17:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616414": [
        {
            "ioc_value": "b.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-16 00:07:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616406": [
        {
            "ioc_value": "www.slickwebads.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-16 00:01:46",
            "last_seen_utc": "2025-10-18 20:02:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.86.163.126+www.slickwebads.com",
            "tags": "AS44066,C2,censys,DE-FIRSTCOLO,RAT,SpiceRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616403": [
        {
            "ioc_value": "r7.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 23:57:47",
            "last_seen_utc": "2025-10-16 00:07:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616402": [
        {
            "ioc_value": "x.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 23:48:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616400": [
        {
            "ioc_value": "vk.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 23:38:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616399": [
        {
            "ioc_value": "m8.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 23:28:20",
            "last_seen_utc": "2025-10-15 23:32:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616398": [
        {
            "ioc_value": "s.4y2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 23:19:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616243": [
        {
            "ioc_value": "h7.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 23:07:46",
            "last_seen_utc": "2025-10-15 23:09:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616192": [
        {
            "ioc_value": "q9.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 22:57:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616191": [
        {
            "ioc_value": "x.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 22:47:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616190": [
        {
            "ioc_value": "pt.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 22:33:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616189": [
        {
            "ioc_value": "fyh-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 22:27:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616188": [
        {
            "ioc_value": "bas-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 22:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616187": [
        {
            "ioc_value": "zit-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 22:07:35",
            "last_seen_utc": "2025-10-15 22:08:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616186": [
        {
            "ioc_value": "jix-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 21:57:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616185": [
        {
            "ioc_value": "luv-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 21:47:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616183": [
        {
            "ioc_value": "koq-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 21:36:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616181": [
        {
            "ioc_value": "mioasiosumslauyoks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-15 21:05:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.55.44",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616179": [
        {
            "ioc_value": "jquery.min-js.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-15 20:49:26",
            "last_seen_utc": "2025-12-01 11:50:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1616178": [
        {
            "ioc_value": "z1.4a8u6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 20:39:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616177": [
        {
            "ioc_value": "b21.wib-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 20:29:32",
            "last_seen_utc": "2025-10-15 20:44:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616176": [
        {
            "ioc_value": "k32.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 20:27:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616175": [
        {
            "ioc_value": "sj.wir-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 20:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616174": [
        {
            "ioc_value": "ni5.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 20:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616173": [
        {
            "ioc_value": "7d.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 20:08:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616166": [
        {
            "ioc_value": "slickweb-ads.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-15 20:01:50",
            "last_seen_utc": "2025-10-24 16:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.86.163.126+slickweb-ads.com",
            "tags": "AS44066,C2,censys,DE-FIRSTCOLO,RAT,SpiceRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616158": [
        {
            "ioc_value": "v5.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616157": [
        {
            "ioc_value": "8m.bid-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:51:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616156": [
        {
            "ioc_value": "yc.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:48:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616155": [
        {
            "ioc_value": "13.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:38:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616154": [
        {
            "ioc_value": "t2jw.kynh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:31:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616153": [
        {
            "ioc_value": "1n.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:30:20",
            "last_seen_utc": "2025-10-15 19:31:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616151": [
        {
            "ioc_value": "b7yg.kynh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:21:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616150": [
        {
            "ioc_value": "wu.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:18:44",
            "last_seen_utc": "2025-10-15 19:21:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616148": [
        {
            "ioc_value": "x3rn.kynh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:11:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616147": [
        {
            "ioc_value": "pt.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 19:07:25",
            "last_seen_utc": "2025-10-15 19:11:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616146": [
        {
            "ioc_value": "k6oz.kynh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616145": [
        {
            "ioc_value": "chp.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:58:39",
            "last_seen_utc": "2025-10-15 18:59:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616144": [
        {
            "ioc_value": "n1sb.kynh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:50:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616143": [
        {
            "ioc_value": "fe.gyj-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:48:21",
            "last_seen_utc": "2025-10-15 18:50:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616138": [
        {
            "ioc_value": "ov6.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:38:02",
            "last_seen_utc": "2025-10-15 18:39:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616137": [
        {
            "ioc_value": "q8dh.kynh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:30:19",
            "last_seen_utc": "2025-10-15 18:39:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616136": [
        {
            "ioc_value": "65o.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:28:15",
            "last_seen_utc": "2025-10-15 18:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616135": [
        {
            "ioc_value": "m6hk.nyqb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616134": [
        {
            "ioc_value": "e6.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:17:56",
            "last_seen_utc": "2025-10-15 18:18:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616133": [
        {
            "ioc_value": "j9pf.nyqb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:09:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616132": [
        {
            "ioc_value": "baj.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 18:08:41",
            "last_seen_utc": "2025-10-15 18:09:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616130": [
        {
            "ioc_value": "mikloesee.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-15 18:02:28",
            "last_seen_utc": "2025-11-07 12:55:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251015-rxe8gsdk2z",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616128": [
        {
            "ioc_value": "suprakini3-53700.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-15 18:02:27",
            "last_seen_utc": "2025-10-20 12:27:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251015-sehfka1wds",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616129": [
        {
            "ioc_value": "miklo2600.chickenkiller.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-15 18:02:27",
            "last_seen_utc": "2025-11-07 12:55:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251015-rxe8gsdk2z",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616126": [
        {
            "ioc_value": "mr1.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:57:52",
            "last_seen_utc": "2025-10-15 18:04:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616125": [
        {
            "ioc_value": "y0wg.nyqb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:52:05",
            "last_seen_utc": "2025-10-15 18:04:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616124": [
        {
            "ioc_value": "inr.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:48:54",
            "last_seen_utc": "2025-10-15 17:52:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616123": [
        {
            "ioc_value": "lmg.pot-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:38:34",
            "last_seen_utc": "2025-10-15 17:46:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616122": [
        {
            "ioc_value": "z5kc.nyqb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:31:50",
            "last_seen_utc": "2025-10-15 17:46:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616121": [
        {
            "ioc_value": "oy.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:28:45",
            "last_seen_utc": "2025-10-15 17:31:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616120": [
        {
            "ioc_value": "c4tt.nyqb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616119": [
        {
            "ioc_value": "c9.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:18:24",
            "last_seen_utc": "2025-10-15 17:20:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616118": [
        {
            "ioc_value": "hpc.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:08:05",
            "last_seen_utc": "2025-10-15 17:09:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616117": [
        {
            "ioc_value": "r7nd.nyqb0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 17:01:25",
            "last_seen_utc": "2025-10-15 17:09:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616116": [
        {
            "ioc_value": "u7.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 16:56:17",
            "last_seen_utc": "2025-10-15 17:01:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616114": [
        {
            "ioc_value": "1b.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 16:47:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616113": [
        {
            "ioc_value": "h2ds.moxt5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 16:39:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616112": [
        {
            "ioc_value": "6dx.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 16:39:05",
            "last_seen_utc": "2025-10-15 16:39:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616111": [
        {
            "ioc_value": "4a.cfob-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 16:29:17",
            "last_seen_utc": "2025-10-15 16:35:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616110": [
        {
            "ioc_value": "e1my.moxt5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 16:22:52",
            "last_seen_utc": "2025-10-15 16:35:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616109": [
        {
            "ioc_value": "3k.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 16:16:26",
            "last_seen_utc": "2025-10-15 16:22:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616108": [
        {
            "ioc_value": "l8qh.moxt5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 16:09:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616107": [
        {
            "ioc_value": "3x1.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 16:08:42",
            "last_seen_utc": "2025-10-15 16:09:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616098": [
        {
            "ioc_value": "t3wn.moxt5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 15:58:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616097": [
        {
            "ioc_value": "bb.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 15:58:14",
            "last_seen_utc": "2025-10-15 15:58:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616096": [
        {
            "ioc_value": "l5.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 15:48:27",
            "last_seen_utc": "2025-10-15 15:51:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616078": [
        {
            "ioc_value": "signaturepl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-15 15:43:21",
            "last_seen_utc": "2025-10-15 14:21:31",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115378623999530406",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1616094": [
        {
            "ioc_value": "p9au.moxt5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 15:39:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616093": [
        {
            "ioc_value": "cyc.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 15:38:10",
            "last_seen_utc": "2025-10-15 15:39:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616092": [
        {
            "ioc_value": "ov.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 15:28:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616090": [
        {
            "ioc_value": "v7b.rxir-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 15:16:21",
            "last_seen_utc": "2025-10-15 15:21:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616089": [
        {
            "ioc_value": "v6yv.moxt5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 15:13:47",
            "last_seen_utc": "2025-10-15 15:21:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616088": [
        {
            "ioc_value": "y7.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 15:10:10",
            "last_seen_utc": "2025-10-15 15:13:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616085": [
        {
            "ioc_value": "e9u.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 14:57:47",
            "last_seen_utc": "2025-10-15 15:02:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616084": [
        {
            "ioc_value": "q0rd.jobt9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 14:50:39",
            "last_seen_utc": "2025-10-15 15:02:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616083": [
        {
            "ioc_value": "5c.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 14:48:31",
            "last_seen_utc": "2025-10-15 14:50:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616082": [
        {
            "ioc_value": "auf.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 14:36:43",
            "last_seen_utc": "2025-10-15 14:46:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616081": [
        {
            "ioc_value": "sx89.jobt9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 14:30:32",
            "last_seen_utc": "2025-10-15 14:46:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616080": [
        {
            "ioc_value": "r2.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 14:28:26",
            "last_seen_utc": "2025-10-15 14:30:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616076": [
        {
            "ioc_value": "77.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 14:15:35",
            "last_seen_utc": "2025-10-15 14:17:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616075": [
        {
            "ioc_value": "n0.blyp-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 14:08:17",
            "last_seen_utc": "2025-10-15 14:11:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616074": [
        {
            "ioc_value": "f4zi.jobt9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 14:02:16",
            "last_seen_utc": "2025-10-15 14:17:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616073": [
        {
            "ioc_value": "ar.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:57:59",
            "last_seen_utc": "2025-10-15 14:02:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616071": [
        {
            "ioc_value": "av.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:48:11",
            "last_seen_utc": "2025-10-15 13:54:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616070": [
        {
            "ioc_value": "w12r.jobt9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:45:33",
            "last_seen_utc": "2025-10-15 13:54:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616068": [
        {
            "ioc_value": "tx8.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:37:51",
            "last_seen_utc": "2025-10-15 13:45:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616067": [
        {
            "ioc_value": "bgu.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:28:50",
            "last_seen_utc": "2025-10-15 13:34:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616066": [
        {
            "ioc_value": "k9ux.jobt9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:24:54",
            "last_seen_utc": "2025-10-15 13:34:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616064": [
        {
            "ioc_value": "pd.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:18:23",
            "last_seen_utc": "2025-10-15 13:24:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616063": [
        {
            "ioc_value": "hristomasitomasdf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-15 13:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.52.144",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616061": [
        {
            "ioc_value": "krivomadogolyhp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-15 13:16:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.52.145",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616059": [
        {
            "ioc_value": "justriojadiokliobass.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-15 13:15:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.55.24",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616057": [
        {
            "ioc_value": "novakremokasdogiosan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-15 13:13:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.55.33",
            "tags": "c2,censys,domain,latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616055": [
        {
            "ioc_value": "krlopskhfutroplsa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-15 13:11:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.55.46",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616052": [
        {
            "ioc_value": "krisaldasliodsahj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-15 13:10:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.55.18",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616051": [
        {
            "ioc_value": "m3qh.jobt9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:09:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616049": [
        {
            "ioc_value": "havalkilofilojast.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-15 13:08:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.55.30",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616048": [
        {
            "ioc_value": "hv.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:08:05",
            "last_seen_utc": "2025-10-15 13:09:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616047": [
        {
            "ioc_value": "t5vq.qihs8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 13:00:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616045": [
        {
            "ioc_value": "t9f.qcet-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 12:58:16",
            "last_seen_utc": "2025-10-15 13:00:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616044": [
        {
            "ioc_value": "qiokbrohaschosdikolane.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-15 12:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.16.55.39",
            "tags": "c2,censys,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616043": [
        {
            "ioc_value": "d7qz.qihs8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 12:50:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616042": [
        {
            "ioc_value": "pau.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 12:48:28",
            "last_seen_utc": "2025-10-15 12:50:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616041": [
        {
            "ioc_value": "y1me.qihs8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 12:38:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616040": [
        {
            "ioc_value": "nr1.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 12:37:58",
            "last_seen_utc": "2025-10-15 12:38:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616039": [
        {
            "ioc_value": "lx6.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 12:26:38",
            "last_seen_utc": "2025-10-15 12:30:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616038": [
        {
            "ioc_value": "rb56.qihs8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 12:17:57",
            "last_seen_utc": "2025-10-15 12:30:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616037": [
        {
            "ioc_value": "rq8.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 12:13:48",
            "last_seen_utc": "2025-10-15 12:17:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616036": [
        {
            "ioc_value": "428.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 12:07:35",
            "last_seen_utc": "2025-10-15 12:08:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616035": [
        {
            "ioc_value": "akea-24794.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-15 12:02:30",
            "last_seen_utc": "2025-11-07 12:55:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251015-jw4wfsan6v",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616025": [
        {
            "ioc_value": "11733wednesdayyyyyyyfileeemanagerxxxx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-15 12:01:28",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/251015-m3ndtsslw8",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1616022": [
        {
            "ioc_value": "oo.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 11:54:44",
            "last_seen_utc": "2025-10-15 11:57:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616021": [
        {
            "ioc_value": "kt.ckyq-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 11:47:25",
            "last_seen_utc": "2025-10-15 11:51:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616019": [
        {
            "ioc_value": "g6tc.qihs8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 11:40:32",
            "last_seen_utc": "2025-10-15 11:51:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616017": [
        {
            "ioc_value": "7l.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 11:37:09",
            "last_seen_utc": "2025-10-15 11:40:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616016": [
        {
            "ioc_value": "65y.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 11:28:13",
            "last_seen_utc": "2025-10-15 11:36:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616014": [
        {
            "ioc_value": "n8yt.qihs8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 11:21:26",
            "last_seen_utc": "2025-10-15 11:57:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616013": [
        {
            "ioc_value": "mje.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 11:17:55",
            "last_seen_utc": "2025-10-15 11:21:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616012": [
        {
            "ioc_value": "fs.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 11:08:09",
            "last_seen_utc": "2025-10-15 11:11:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616011": [
        {
            "ioc_value": "c3fs.vorn5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 11:05:59",
            "last_seen_utc": "2025-10-15 11:11:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616008": [
        {
            "ioc_value": "njv.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 10:57:51",
            "last_seen_utc": "2025-10-15 11:05:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616007": [
        {
            "ioc_value": "zz1c.vorn5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 10:49:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616006": [
        {
            "ioc_value": "08.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 10:47:32",
            "last_seen_utc": "2025-10-15 10:51:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616005": [
        {
            "ioc_value": "ax75.vorn5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 10:39:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1616004": [
        {
            "ioc_value": "v8.ckar-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 10:37:45",
            "last_seen_utc": "2025-10-15 10:39:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616003": [
        {
            "ioc_value": "lz.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 10:27:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616002": [
        {
            "ioc_value": "g1s.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 10:18:41",
            "last_seen_utc": "2025-10-15 10:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1616000": [
        {
            "ioc_value": "p0qh.vorn5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 10:11:45",
            "last_seen_utc": "2025-10-15 10:20:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615999": [
        {
            "ioc_value": "gi.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 10:08:15",
            "last_seen_utc": "2025-10-15 10:11:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615998": [
        {
            "ioc_value": "mhk.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 09:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615997": [
        {
            "ioc_value": "biz.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 09:48:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615996": [
        {
            "ioc_value": "oe.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 09:38:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615995": [
        {
            "ioc_value": "hs7.obvp-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 09:27:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615994": [
        {
            "ioc_value": "xw.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 09:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615975": [
        {
            "ioc_value": "angelcamefromtheskypeforsaveyoublessinga.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-15 07:43:56",
            "last_seen_utc": "2025-10-22 12:44:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1615974": [
        {
            "ioc_value": "exec.windyy.qzz.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-15 07:43:40",
            "last_seen_utc": "2025-12-12 18:40:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1615972": [
        {
            "ioc_value": "bruselas1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-15 07:42:59",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1615971": [
        {
            "ioc_value": "prakashjadhav.dynu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-15 07:42:47",
            "last_seen_utc": "2025-10-22 12:44:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1615656": [
        {
            "ioc_value": "prixmatech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-15 06:12:19",
            "last_seen_utc": "2025-10-15 02:19:06",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115373209472581953",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1615703": [
        {
            "ioc_value": "fsafasjasgia.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-10-15 06:12:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/97dbe490-197c-493b-9283-4a1f2ae42b12",
            "tags": "infostealer,SalatStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1615704": [
        {
            "ioc_value": "196dot247dot163dot8.webrat.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-10-15 06:12:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/97dbe490-197c-493b-9283-4a1f2ae42b12",
            "tags": "infostealer,SalatStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1615780": [
        {
            "ioc_value": "store.alignfrisco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-15 06:12:11",
            "last_seen_utc": "2025-10-21 02:31:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1615962": [
        {
            "ioc_value": "address-buffer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-10-15 06:02:51",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251015-e3hjkswygx",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615936": [
        {
            "ioc_value": "ss.cybiz.ggff.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-15 04:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/48.210.223.56+ss.cybiz.ggff.net",
            "tags": "AS8075,C2,censys,MICROSOFT-CORP-MSN-AS-BLOCK,Supershell",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1615933": [
        {
            "ioc_value": "www.6119.com.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-15 02:49:10",
            "last_seen_utc": "2025-12-14 11:48:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1615932": [
        {
            "ioc_value": "h7lp.vorn5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 01:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615931": [
        {
            "ioc_value": "pox.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-15 00:08:32",
            "last_seen_utc": "2025-10-15 00:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615916": [
        {
            "ioc_value": "n6r.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 23:57:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615915": [
        {
            "ioc_value": "vd3k.nowc8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 23:49:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615914": [
        {
            "ioc_value": "uhf.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 23:47:27",
            "last_seen_utc": "2025-10-15 01:59:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615913": [
        {
            "ioc_value": "mt07.nowc8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 23:38:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615912": [
        {
            "ioc_value": "6mm.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 23:38:12",
            "last_seen_utc": "2025-10-14 23:38:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615911": [
        {
            "ioc_value": "u6.ibzr-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 23:27:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615817": [
        {
            "ioc_value": "ppd.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 23:18:08",
            "last_seen_utc": "2025-10-14 23:25:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615816": [
        {
            "ioc_value": "q9py.nowc8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 23:11:06",
            "last_seen_utc": "2025-10-14 23:25:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615815": [
        {
            "ioc_value": "wp.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 23:09:22",
            "last_seen_utc": "2025-10-14 23:11:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615814": [
        {
            "ioc_value": "e2rx.nowc8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:59:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615813": [
        {
            "ioc_value": "3q6.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:57:32",
            "last_seen_utc": "2025-10-14 22:59:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615812": [
        {
            "ioc_value": "ka86.nowc8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:49:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615811": [
        {
            "ioc_value": "5v.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:47:43",
            "last_seen_utc": "2025-10-14 22:49:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615810": [
        {
            "ioc_value": "s1od.nowc8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:39:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615809": [
        {
            "ioc_value": "t5.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:37:27",
            "last_seen_utc": "2025-10-14 22:39:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615808": [
        {
            "ioc_value": "cmv.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:28:10",
            "last_seen_utc": "2025-10-14 22:28:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615807": [
        {
            "ioc_value": "jm5a.desj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:20:51",
            "last_seen_utc": "2025-10-14 22:28:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615806": [
        {
            "ioc_value": "ghc.ithc-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:17:19",
            "last_seen_utc": "2025-10-14 22:20:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615805": [
        {
            "ioc_value": "g0nq.desj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:08:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615804": [
        {
            "ioc_value": "q2.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 22:08:03",
            "last_seen_utc": "2025-10-14 22:08:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615803": [
        {
            "ioc_value": "l0.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:58:16",
            "last_seen_utc": "2025-10-14 22:02:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615802": [
        {
            "ioc_value": "r2cx.desj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:53:05",
            "last_seen_utc": "2025-10-14 22:02:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615800": [
        {
            "ioc_value": "nve.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:47:59",
            "last_seen_utc": "2025-10-14 21:53:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615799": [
        {
            "ioc_value": "t80.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:37:40",
            "last_seen_utc": "2025-10-14 21:40:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615798": [
        {
            "ioc_value": "lt3d.desj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:35:36",
            "last_seen_utc": "2025-10-14 21:40:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615797": [
        {
            "ioc_value": "4u.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:27:52",
            "last_seen_utc": "2025-10-14 21:35:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615796": [
        {
            "ioc_value": "w9qm.desj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615795": [
        {
            "ioc_value": "2hu.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:17:36",
            "last_seen_utc": "2025-10-14 21:18:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615794": [
        {
            "ioc_value": "vr.ozxg-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:09:20",
            "last_seen_utc": "2025-10-14 21:12:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615792": [
        {
            "ioc_value": "f6ua.desj1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 21:02:12",
            "last_seen_utc": "2025-10-14 21:12:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615790": [
        {
            "ioc_value": "4i1.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:58:32",
            "last_seen_utc": "2025-10-14 21:02:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615789": [
        {
            "ioc_value": "r5.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:48:15",
            "last_seen_utc": "2025-10-14 20:50:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615788": [
        {
            "ioc_value": "y3ag.vukm9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:41:02",
            "last_seen_utc": "2025-10-14 20:50:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615787": [
        {
            "ioc_value": "kc.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:37:55",
            "last_seen_utc": "2025-10-14 20:41:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615784": [
        {
            "ioc_value": "zn5r.vukm9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615783": [
        {
            "ioc_value": "yt6.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:28:02",
            "last_seen_utc": "2025-10-14 20:35:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615782": [
        {
            "ioc_value": "p8kw.vukm9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615781": [
        {
            "ioc_value": "fih.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:17:44",
            "last_seen_utc": "2025-10-14 20:19:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615779": [
        {
            "ioc_value": "b2vf.vukm9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:10:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615778": [
        {
            "ioc_value": "y0.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 20:07:58",
            "last_seen_utc": "2025-10-14 20:10:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615773": [
        {
            "ioc_value": "financeiro1412.melhorescoisa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-14 20:03:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/216.9.227.203+financeiro1412.melhorescoisa.com",
            "tags": "AS44382,C2,censys,Gafgyt,open-dir,WHITELABEL",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615771": [
        {
            "ioc_value": "bdo.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 20:03:00",
            "last_seen_utc": "2025-10-15 04:02:00",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+bdo.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615768": [
        {
            "ioc_value": "apps.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 20:02:59",
            "last_seen_utc": "2025-10-15 04:01:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+apps.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615769": [
        {
            "ioc_value": "sharepoint.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 20:02:59",
            "last_seen_utc": "2025-10-15 04:01:58",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+sharepoint.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615770": [
        {
            "ioc_value": "mail.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 20:02:59",
            "last_seen_utc": "2025-10-16 04:00:56",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+mail.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615765": [
        {
            "ioc_value": "rdg.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 20:02:58",
            "last_seen_utc": "2025-10-15 04:01:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+rdg.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615766": [
        {
            "ioc_value": "oma.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 20:02:58",
            "last_seen_utc": "2025-10-15 04:01:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+oma.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615767": [
        {
            "ioc_value": "remote.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 20:02:58",
            "last_seen_utc": "2025-10-15 04:01:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+remote.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615764": [
        {
            "ioc_value": "ts.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 20:02:57",
            "last_seen_utc": "2025-10-15 04:01:58",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+ts.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615751": [
        {
            "ioc_value": "xq97.vukm9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615750": [
        {
            "ioc_value": "49i.ussn-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:57:40",
            "last_seen_utc": "2025-10-14 19:58:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615749": [
        {
            "ioc_value": "8lo.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:47:51",
            "last_seen_utc": "2025-10-14 19:49:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615748": [
        {
            "ioc_value": "hd6p.vukm9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:40:52",
            "last_seen_utc": "2025-10-14 19:49:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615747": [
        {
            "ioc_value": "dei.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:37:30",
            "last_seen_utc": "2025-10-14 19:40:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615735": [
        {
            "ioc_value": "q9ne.pohv3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:30:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615734": [
        {
            "ioc_value": "kyf.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:28:15",
            "last_seen_utc": "2025-10-14 19:30:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615733": [
        {
            "ioc_value": "7r.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:18:27",
            "last_seen_utc": "2025-10-14 19:19:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615732": [
        {
            "ioc_value": "814.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:07:58",
            "last_seen_utc": "2025-10-14 19:12:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615731": [
        {
            "ioc_value": "c7uo.pohv3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 19:00:55",
            "last_seen_utc": "2025-10-14 19:19:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615730": [
        {
            "ioc_value": "36.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 18:58:13",
            "last_seen_utc": "2025-10-14 19:00:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615724": [
        {
            "ioc_value": "uptowrw.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-14 18:54:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615725": [
        {
            "ioc_value": "countiw.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-14 18:54:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615726": [
        {
            "ioc_value": "loamcpps.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-14 18:54:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615727": [
        {
            "ioc_value": "speckhu.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-14 18:54:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615728": [
        {
            "ioc_value": "quiverwr.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-14 18:54:25",
            "last_seen_utc": "2025-10-20 09:12:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615729": [
        {
            "ioc_value": "histasup.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-14 18:54:25",
            "last_seen_utc": "2025-10-20 09:12:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615723": [
        {
            "ioc_value": "celiawjy.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-14 18:54:24",
            "last_seen_utc": "2025-10-20 09:12:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615721": [
        {
            "ioc_value": "r58.ynmh-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 18:47:55",
            "last_seen_utc": "2025-10-14 18:48:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615718": [
        {
            "ioc_value": "y1bd.pohv3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 18:39:49",
            "last_seen_utc": "2025-10-14 18:48:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615717": [
        {
            "ioc_value": "78y.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 18:37:38",
            "last_seen_utc": "2025-10-14 18:39:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615716": [
        {
            "ioc_value": "927.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 18:27:50",
            "last_seen_utc": "2025-10-14 18:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615715": [
        {
            "ioc_value": "tk2v.pohv3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 18:20:54",
            "last_seen_utc": "2025-10-14 18:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615713": [
        {
            "ioc_value": "llb.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 18:17:32",
            "last_seen_utc": "2025-10-14 18:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615712": [
        {
            "ioc_value": "xxxmm20250820.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-14 18:09:02",
            "last_seen_utc": "2025-10-20 12:27:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/251014-qelrwazxbs",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615711": [
        {
            "ioc_value": "1w2.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 18:07:15",
            "last_seen_utc": "2025-10-14 18:09:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615709": [
        {
            "ioc_value": "uk2.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-14 18:03:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251014-p7jbsaap2z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615708": [
        {
            "ioc_value": "pr5.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 18:01:32",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251014-sfdtrsbn6y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615707": [
        {
            "ioc_value": "s-repairs.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 18:01:31",
            "last_seen_utc": "2025-10-22 12:44:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/251014-tynmcs1whx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615706": [
        {
            "ioc_value": "m8qa.pohv3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 17:58:32",
            "last_seen_utc": "2025-10-14 18:09:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615705": [
        {
            "ioc_value": "szo.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 17:57:28",
            "last_seen_utc": "2025-10-14 17:58:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615702": [
        {
            "ioc_value": "dw.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 17:47:07",
            "last_seen_utc": "2025-10-14 17:50:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615701": [
        {
            "ioc_value": "7o.ynbr-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 17:38:20",
            "last_seen_utc": "2025-10-14 17:45:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615700": [
        {
            "ioc_value": "r5xz.pohv3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 17:37:58",
            "last_seen_utc": "2025-10-14 17:50:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615699": [
        {
            "ioc_value": "me.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 17:28:03",
            "last_seen_utc": "2025-10-14 17:37:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615697": [
        {
            "ioc_value": "5x.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 17:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615693": [
        {
            "ioc_value": "89.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 17:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615692": [
        {
            "ioc_value": "869.yffl9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 16:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615691": [
        {
            "ioc_value": "61.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 16:57:31",
            "last_seen_utc": "2025-10-14 16:59:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615690": [
        {
            "ioc_value": "jy.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 16:47:45",
            "last_seen_utc": "2025-10-14 16:49:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615689": [
        {
            "ioc_value": "rb.yffl9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 16:38:09",
            "last_seen_utc": "2025-10-14 16:49:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615688": [
        {
            "ioc_value": "8m.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 16:37:28",
            "last_seen_utc": "2025-10-14 16:38:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615687": [
        {
            "ioc_value": "pfm.yffl-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 16:28:31",
            "last_seen_utc": "2025-10-14 16:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615686": [
        {
            "ioc_value": "a8a.yffl9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 16:12:19",
            "last_seen_utc": "2025-10-14 16:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615685": [
        {
            "ioc_value": "sji.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 16:10:22",
            "last_seen_utc": "2025-10-14 16:12:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615682": [
        {
            "ioc_value": "chaos.blowitup.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.chaos",
            "malware_alias": "FakeRyuk,RyukJoke,Yashma",
            "malware_printable": "Chaos",
            "first_seen_utc": "2025-10-14 16:04:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/93.127.160.122+chaos.blowitup.nl",
            "tags": "AS47447,censys,Chaos,panel,TTM",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615681": [
        {
            "ioc_value": "rds.dmg-tech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 16:04:24",
            "last_seen_utc": "2025-10-15 04:01:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.191.251.170+rds.dmg-tech.com",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1615668": [
        {
            "ioc_value": "1w.yffl9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 16:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615667": [
        {
            "ioc_value": "971.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 15:58:01",
            "last_seen_utc": "2025-10-14 16:00:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615663": [
        {
            "ioc_value": "hoi.cozygardenkids.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-14 15:51:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1615662": [
        {
            "ioc_value": "z4k.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 15:47:43",
            "last_seen_utc": "2025-10-14 15:49:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615661": [
        {
            "ioc_value": "ohl.yffl9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 15:39:39",
            "last_seen_utc": "2025-10-14 15:49:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615660": [
        {
            "ioc_value": "6cm.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 15:37:54",
            "last_seen_utc": "2025-10-14 15:39:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615658": [
        {
            "ioc_value": "vm.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 15:27:37",
            "last_seen_utc": "2025-10-14 15:29:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615654": [
        {
            "ioc_value": "uq2.obvp2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 15:20:18",
            "last_seen_utc": "2025-10-14 15:29:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615653": [
        {
            "ioc_value": "69d.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 15:18:20",
            "last_seen_utc": "2025-10-14 15:20:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615651": [
        {
            "ioc_value": "03.obvp2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 15:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615650": [
        {
            "ioc_value": "x2.ykgw-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 15:07:30",
            "last_seen_utc": "2025-10-14 15:08:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615647": [
        {
            "ioc_value": "cr0.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 14:58:14",
            "last_seen_utc": "2025-10-14 14:59:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615646": [
        {
            "ioc_value": "5xw.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 14:47:25",
            "last_seen_utc": "2025-10-14 14:47:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615645": [
        {
            "ioc_value": "8o.obvp2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 14:43:21",
            "last_seen_utc": "2025-10-14 14:59:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615644": [
        {
            "ioc_value": "t1.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 14:38:07",
            "last_seen_utc": "2025-10-14 14:43:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615641": [
        {
            "ioc_value": "capilonapro.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-14 14:34:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615642": [
        {
            "ioc_value": "ej224477.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-14 14:34:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615643": [
        {
            "ioc_value": "email-server.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-14 14:34:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615638": [
        {
            "ioc_value": "amarre26.mysynology.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-14 14:34:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615639": [
        {
            "ioc_value": "messsis.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-14 14:34:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615640": [
        {
            "ioc_value": "rcisgoat.chickenkiller.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-14 14:34:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615626": [
        {
            "ioc_value": "boy-nt.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 14:34:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615627": [
        {
            "ioc_value": "mark-der.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 14:34:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615628": [
        {
            "ioc_value": "legal-sending.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 14:34:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615629": [
        {
            "ioc_value": "responsible-cables.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 14:34:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615630": [
        {
            "ioc_value": "field-tracker.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 14:34:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615631": [
        {
            "ioc_value": "dad9idois-51319.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 14:34:12",
            "last_seen_utc": "2025-10-14 18:01:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615625": [
        {
            "ioc_value": "yttt-34658.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 14:34:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615595": [
        {
            "ioc_value": "envio08-10.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-14 14:34:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615596": [
        {
            "ioc_value": "remproces.casacam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-14 14:34:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615597": [
        {
            "ioc_value": "fiologo.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-14 14:34:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615598": [
        {
            "ioc_value": "online-offices.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-14 14:34:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615599": [
        {
            "ioc_value": "carloslopezsas2025.casacam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-14 14:34:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615592": [
        {
            "ioc_value": "apphost.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-14 14:34:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615593": [
        {
            "ioc_value": "1209forward1209.dns.army",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-14 14:34:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615594": [
        {
            "ioc_value": "case-sa.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-14 14:34:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "14October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1615590": [
        {
            "ioc_value": "ckr.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 14:28:14",
            "last_seen_utc": "2025-10-14 14:29:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615589": [
        {
            "ioc_value": "lz.obvp2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 14:21:00",
            "last_seen_utc": "2025-10-14 14:29:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615588": [
        {
            "ioc_value": "50.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 14:17:57",
            "last_seen_utc": "2025-10-14 14:21:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615587": [
        {
            "ioc_value": "8x4.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 14:07:38",
            "last_seen_utc": "2025-10-14 14:09:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615586": [
        {
            "ioc_value": "qm.obvp2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 14:01:45",
            "last_seen_utc": "2025-10-14 14:09:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615585": [
        {
            "ioc_value": "b5o.aclz-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:57:51",
            "last_seen_utc": "2025-10-14 14:01:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615584": [
        {
            "ioc_value": "manage.veranoresorts.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-14 13:51:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615581": [
        {
            "ioc_value": "i8.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:47:30",
            "last_seen_utc": "2025-10-14 13:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615580": [
        {
            "ioc_value": "maw.ykgw2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:40:56",
            "last_seen_utc": "2025-10-14 13:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615579": [
        {
            "ioc_value": "qm0.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:38:14",
            "last_seen_utc": "2025-10-14 13:40:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615578": [
        {
            "ioc_value": "erv.ykgw2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:29:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615577": [
        {
            "ioc_value": "yl.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:28:26",
            "last_seen_utc": "2025-10-14 13:29:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614830": [
        {
            "ioc_value": "od2nipo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-14 13:27:52",
            "last_seen_utc": "2025-10-14 12:18:00",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115372475969953083",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1614826": [
        {
            "ioc_value": "hoi.sofyartist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-14 13:27:46",
            "last_seen_utc": "2025-10-14 15:51:42",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/d10b6cf2-871b-4d4c-8b41-75790fee1b9d",
            "tags": "stealer,vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1615576": [
        {
            "ioc_value": "4d.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:17:58",
            "last_seen_utc": "2025-10-14 13:18:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615575": [
        {
            "ioc_value": "u4.ykgw2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:09:14",
            "last_seen_utc": "2025-10-14 13:18:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615574": [
        {
            "ioc_value": "hw.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:08:11",
            "last_seen_utc": "2025-10-14 13:09:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615573": [
        {
            "ioc_value": "b5h.ykgw2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 13:00:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615572": [
        {
            "ioc_value": "cuf.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:58:25",
            "last_seen_utc": "2025-10-14 13:00:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1615569": [
        {
            "ioc_value": "gsw.ykgw2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:49:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1615568": [
        {
            "ioc_value": "abd.kdit-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:48:07",
            "last_seen_utc": "2025-10-14 12:49:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614839": [
        {
            "ioc_value": "p7.ykgw2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:39:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614838": [
        {
            "ioc_value": "je.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:37:49",
            "last_seen_utc": "2025-10-14 12:39:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614837": [
        {
            "ioc_value": "9xp.aclz9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:28:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614836": [
        {
            "ioc_value": "hoy.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:27:31",
            "last_seen_utc": "2025-10-14 12:28:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614833": [
        {
            "ioc_value": "b2i.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614832": [
        {
            "ioc_value": "rgu.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614828": [
        {
            "ioc_value": "fp.aclz9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:14:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614825": [
        {
            "ioc_value": "q1h.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 12:08:24",
            "last_seen_utc": "2025-10-14 12:14:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614823": [
        {
            "ioc_value": "caleta.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-14 12:05:23",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/51fe6cfaf0e1072a180b909dba8e7fd9e078f8e6180fea4526730a37b3c03737/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1614824": [
        {
            "ioc_value": "error.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-14 12:05:23",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/51fe6cfaf0e1072a180b909dba8e7fd9e078f8e6180fea4526730a37b3c03737/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1614813": [
        {
            "ioc_value": "11243debestremcox.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-14 12:01:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251014-h1s43sxvfx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614811": [
        {
            "ioc_value": "aku7.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-14 12:01:50",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/251014-kc8wqs1j14",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614808": [
        {
            "ioc_value": "akea-44005.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-14 12:01:34",
            "last_seen_utc": "2025-10-14 14:34:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/251014-l2k2msyths",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614804": [
        {
            "ioc_value": "bwj.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:59:36",
            "last_seen_utc": "2025-10-14 12:01:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614799": [
        {
            "ioc_value": "nws.aclz9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:51:51",
            "last_seen_utc": "2025-10-14 12:01:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614798": [
        {
            "ioc_value": "o29.tvil-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:51:50",
            "last_seen_utc": "2025-10-14 11:55:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614793": [
        {
            "ioc_value": "ananbabanbensen.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-14 11:51:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251014-nlbt5sfz7h",
            "tags": "FixStealer,infostealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1614797": [
        {
            "ioc_value": "fgq.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:48:09",
            "last_seen_utc": "2025-10-14 11:51:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614796": [
        {
            "ioc_value": "tm.aclz9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:42:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614795": [
        {
            "ioc_value": "j5.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:37:52",
            "last_seen_utc": "2025-10-14 11:42:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614792": [
        {
            "ioc_value": "bzf.aclz9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:30:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614791": [
        {
            "ioc_value": "d8i.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:27:47",
            "last_seen_utc": "2025-10-14 11:30:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614790": [
        {
            "ioc_value": "dp.aclz9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:20:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614789": [
        {
            "ioc_value": "yt.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:18:00",
            "last_seen_utc": "2025-10-14 11:20:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614788": [
        {
            "ioc_value": "w9x.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:07:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614787": [
        {
            "ioc_value": "k3.ussn7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 11:03:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614786": [
        {
            "ioc_value": "wxe.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:57:25",
            "last_seen_utc": "2025-10-14 11:03:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614780": [
        {
            "ioc_value": "t0.llim-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:47:37",
            "last_seen_utc": "2025-10-14 10:55:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614779": [
        {
            "ioc_value": "6l.ussn7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:43:06",
            "last_seen_utc": "2025-10-14 10:55:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614778": [
        {
            "ioc_value": "75.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:38:21",
            "last_seen_utc": "2025-10-14 10:43:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614777": [
        {
            "ioc_value": "f6.ce1im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:29:12",
            "last_seen_utc": "2025-10-14 10:49:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614776": [
        {
            "ioc_value": "pz.ussn7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:23:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614775": [
        {
            "ioc_value": "60.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:21:43",
            "last_seen_utc": "2025-10-14 10:29:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614774": [
        {
            "ioc_value": "dr.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:18:01",
            "last_seen_utc": "2025-10-14 10:19:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614772": [
        {
            "ioc_value": "pse.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:08:14",
            "last_seen_utc": "2025-10-14 10:10:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614771": [
        {
            "ioc_value": "3o.ussn7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 10:01:34",
            "last_seen_utc": "2025-10-14 10:19:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614770": [
        {
            "ioc_value": "qph.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:59:49",
            "last_seen_utc": "2025-10-14 10:01:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614769": [
        {
            "ioc_value": "56.fkur-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:57:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614768": [
        {
            "ioc_value": "eq.ussn7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:49:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614767": [
        {
            "ioc_value": "i6.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:47:37",
            "last_seen_utc": "2025-10-14 09:49:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614765": [
        {
            "ioc_value": "8y.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:38:50",
            "last_seen_utc": "2025-10-14 09:40:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614764": [
        {
            "ioc_value": "u1.ussn7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:34:43",
            "last_seen_utc": "2025-10-14 09:40:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614744": [
        {
            "ioc_value": "rampage.myvnc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-14 09:29:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1614746": [
        {
            "ioc_value": "kilimanjaro.run.place",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-14 09:29:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1614745": [
        {
            "ioc_value": "kilimanjaro.cloudns.nz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-14 09:29:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1614747": [
        {
            "ioc_value": "kilimanjaro.theworkpc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-14 09:29:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1614748": [
        {
            "ioc_value": "kilimanjaro.bigmoney.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-14 09:29:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1614749": [
        {
            "ioc_value": "kilimanjaro.crabdance.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-14 09:29:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1614750": [
        {
            "ioc_value": "kilimanjaro.dns.army",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-14 09:29:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1614751": [
        {
            "ioc_value": "kilimanjaro.hopto.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-14 09:29:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1614752": [
        {
            "ioc_value": "burkinafaso.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-14 09:29:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka",
            "tags": null,
            "anonymous": "0",
            "reporter": "Seclemur"
        }
    ],
    "1614763": [
        {
            "ioc_value": "7u.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:27:44",
            "last_seen_utc": "2025-10-14 09:34:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614761": [
        {
            "ioc_value": "j9pd.0-9pr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614760": [
        {
            "ioc_value": "f6.b-18a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614759": [
        {
            "ioc_value": "zo.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:17:55",
            "last_seen_utc": "2025-10-14 09:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614756": [
        {
            "ioc_value": "frameclover.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-14 09:15:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1614757": [
        {
            "ioc_value": "tramporange.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-14 09:15:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1614758": [
        {
            "ioc_value": "wireswim.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-14 09:15:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1614755": [
        {
            "ioc_value": "q8.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:09:08",
            "last_seen_utc": "2025-10-14 09:10:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614754": [
        {
            "ioc_value": "y0wf.0-9pr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 09:04:09",
            "last_seen_utc": "2025-10-14 09:10:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614753": [
        {
            "ioc_value": "5n.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:58:19",
            "last_seen_utc": "2025-10-14 09:04:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614741": [
        {
            "ioc_value": "ff0.kqag-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:48:30",
            "last_seen_utc": "2025-10-14 08:49:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614740": [
        {
            "ioc_value": "z5kb.0-9pr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:45:10",
            "last_seen_utc": "2025-10-14 08:49:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614739": [
        {
            "ioc_value": "alphac2.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-14 08:44:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1614738": [
        {
            "ioc_value": "iot.internalboar.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-14 08:44:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1614736": [
        {
            "ioc_value": "vg.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:38:13",
            "last_seen_utc": "2025-10-14 08:45:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614735": [
        {
            "ioc_value": "c4tz.0-9pr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:30:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614734": [
        {
            "ioc_value": "ok.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:28:34",
            "last_seen_utc": "2025-10-14 08:30:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614733": [
        {
            "ioc_value": "r7nc.0-9pr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614732": [
        {
            "ioc_value": "ig.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:18:09",
            "last_seen_utc": "2025-10-14 08:20:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614731": [
        {
            "ioc_value": "h2dp.7-5xc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:09:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614730": [
        {
            "ioc_value": "wnn.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 08:07:51",
            "last_seen_utc": "2025-10-14 08:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614707": [
        {
            "ioc_value": "q9.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:59:27",
            "last_seen_utc": "2025-10-14 08:01:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614706": [
        {
            "ioc_value": "e1mz.7-5xc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:51:40",
            "last_seen_utc": "2025-10-14 08:01:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614705": [
        {
            "ioc_value": "nc.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:48:31",
            "last_seen_utc": "2025-10-14 07:51:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614704": [
        {
            "ioc_value": "er.plig-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:38:43",
            "last_seen_utc": "2025-10-14 07:42:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614703": [
        {
            "ioc_value": "l8qg.7-5xc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:34:56",
            "last_seen_utc": "2025-10-14 07:42:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614699": [
        {
            "ioc_value": "stbl.shutupkissme.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-14 07:31:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1614700": [
        {
            "ioc_value": "pre.cozygardenkids.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-14 07:31:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1614701": [
        {
            "ioc_value": "stbl.bluewave-shipping.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-14 07:31:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1614698": [
        {
            "ioc_value": "pre.sofyartist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-14 07:31:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1614691": [
        {
            "ioc_value": "s3.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:28:21",
            "last_seen_utc": "2025-10-14 07:34:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614690": [
        {
            "ioc_value": "t3wp.7-5xc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614689": [
        {
            "ioc_value": "8k.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:18:33",
            "last_seen_utc": "2025-10-14 07:19:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614688": [
        {
            "ioc_value": "p9at.7-5xc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:10:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614687": [
        {
            "ioc_value": "9n.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 07:07:57",
            "last_seen_utc": "2025-10-14 07:10:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614686": [
        {
            "ioc_value": "fk8.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:58:02",
            "last_seen_utc": "2025-10-14 06:59:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614685": [
        {
            "ioc_value": "v6yu.7-5xc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:53:48",
            "last_seen_utc": "2025-10-14 06:59:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614684": [
        {
            "ioc_value": "iiu.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:47:37",
            "last_seen_utc": "2025-10-14 06:53:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614683": [
        {
            "ioc_value": "sx88.6-3tm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:43:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614681": [
        {
            "ioc_value": "2h.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:38:49",
            "last_seen_utc": "2025-10-14 06:43:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614680": [
        {
            "ioc_value": "f4zj.6-3tm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:29:49",
            "last_seen_utc": "2025-10-14 06:34:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614679": [
        {
            "ioc_value": "y6w.bvum-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:20:17",
            "last_seen_utc": "2025-10-14 06:34:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614678": [
        {
            "ioc_value": "iro.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614677": [
        {
            "ioc_value": "w12q.6-3tm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:15:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614675": [
        {
            "ioc_value": "624.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 06:08:09",
            "last_seen_utc": "2025-10-14 06:15:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614674": [
        {
            "ioc_value": "5932ec3f-83d8-43b6.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-14 06:01:26",
            "last_seen_utc": "2025-10-14 14:34:15",
            "confidence_level": 100,
            "reference": "https://tria.ge/251014-e4pdhsek6s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614671": [
        {
            "ioc_value": "jv.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:58:22",
            "last_seen_utc": "2025-10-14 06:00:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614670": [
        {
            "ioc_value": "k9uw.6-3tm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:51:10",
            "last_seen_utc": "2025-10-14 06:00:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614669": [
        {
            "ioc_value": "qq7.wqix5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614668": [
        {
            "ioc_value": "1f.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:48:04",
            "last_seen_utc": "2025-10-14 05:51:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614667": [
        {
            "ioc_value": "m3qf.6-3tm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:38:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614666": [
        {
            "ioc_value": "s4f.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:35:15",
            "last_seen_utc": "2025-10-14 05:38:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614665": [
        {
            "ioc_value": "7ue.wqix5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:30:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614664": [
        {
            "ioc_value": "59.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:27:55",
            "last_seen_utc": "2025-10-14 05:30:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614293": [
        {
            "ioc_value": "cansupeker.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-14 05:22:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115367762481149851",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1614366": [
        {
            "ioc_value": "tez-suite.render-app.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 05:22:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "xQeR"
        }
    ],
    "1614367": [
        {
            "ioc_value": "typhondesktop.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 05:22:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "xQeR"
        }
    ],
    "1614368": [
        {
            "ioc_value": "ccleaner.org.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 05:22:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "xQeR"
        }
    ],
    "1614369": [
        {
            "ioc_value": "smplswpp.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 05:22:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "xQeR"
        }
    ],
    "1614370": [
        {
            "ioc_value": "putty.org.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 05:22:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "xQeR"
        }
    ],
    "1614371": [
        {
            "ioc_value": "en-suite-faq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-14 05:22:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "xQeR"
        }
    ],
    "1614663": [
        {
            "ioc_value": "t5vp.0-1gc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:20:29",
            "last_seen_utc": "2025-10-14 05:29:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614662": [
        {
            "ioc_value": "q77.zzax-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:17:55",
            "last_seen_utc": "2025-10-14 05:20:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614661": [
        {
            "ioc_value": "gkh.wqix5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:10:17",
            "last_seen_utc": "2025-10-14 05:18:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614660": [
        {
            "ioc_value": "d7qy.0-1gc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:10:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614659": [
        {
            "ioc_value": "vb.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 05:07:36",
            "last_seen_utc": "2025-10-14 05:10:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614658": [
        {
            "ioc_value": "zb.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:59:47",
            "last_seen_utc": "2025-10-14 05:04:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614656": [
        {
            "ioc_value": "y1md.0-1gc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:52:27",
            "last_seen_utc": "2025-10-14 05:04:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614655": [
        {
            "ioc_value": "t84.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:48:23",
            "last_seen_utc": "2025-10-14 04:55:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614654": [
        {
            "ioc_value": "1rs.wqix5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:47:09",
            "last_seen_utc": "2025-10-14 04:55:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614653": [
        {
            "ioc_value": "vr.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:31:57",
            "last_seen_utc": "2025-10-14 04:47:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614652": [
        {
            "ioc_value": "rb55.0-1gc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:31:11",
            "last_seen_utc": "2025-10-14 04:38:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614651": [
        {
            "ioc_value": "vfn.wqix5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:28:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614650": [
        {
            "ioc_value": "nb.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:28:17",
            "last_seen_utc": "2025-10-14 04:31:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614649": [
        {
            "ioc_value": "g6tb.0-1gc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614648": [
        {
            "ioc_value": "kx.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:18:00",
            "last_seen_utc": "2025-10-14 04:19:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614647": [
        {
            "ioc_value": "n8ys.0-1gc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:09:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614646": [
        {
            "ioc_value": "w2.kpyw-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 04:07:47",
            "last_seen_utc": "2025-10-14 04:09:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614613": [
        {
            "ioc_value": "c3fp.3-2pd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:59:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614612": [
        {
            "ioc_value": "907.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:57:55",
            "last_seen_utc": "2025-10-14 03:59:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614611": [
        {
            "ioc_value": "cq.ckyq9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:52:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614610": [
        {
            "ioc_value": "zz1a.3-2pd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:52:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614609": [
        {
            "ioc_value": "hr5.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:47:38",
            "last_seen_utc": "2025-10-14 03:52:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614608": [
        {
            "ioc_value": "lk.ckyq9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:44:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614607": [
        {
            "ioc_value": "ax74.3-2pd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:39:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614606": [
        {
            "ioc_value": "fd.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:37:49",
            "last_seen_utc": "2025-10-14 03:44:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614605": [
        {
            "ioc_value": "fn.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:27:31",
            "last_seen_utc": "2025-10-14 03:30:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614604": [
        {
            "ioc_value": "p0qf.3-2pd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:26:07",
            "last_seen_utc": "2025-10-14 03:30:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614603": [
        {
            "ioc_value": "19.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:18:16",
            "last_seen_utc": "2025-10-14 03:26:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614602": [
        {
            "ioc_value": "u4xv.3-2pd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:07:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614601": [
        {
            "ioc_value": "dnm.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:07:26",
            "last_seen_utc": "2025-10-14 03:07:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614600": [
        {
            "ioc_value": "h7ln.3-2pd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 03:00:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614599": [
        {
            "ioc_value": "oc6.nmys-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:58:09",
            "last_seen_utc": "2025-10-14 03:00:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614595": [
        {
            "ioc_value": "red.clevercougar.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-14 02:48:45",
            "last_seen_utc": "2025-11-22 07:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1614594": [
        {
            "ioc_value": "p9e.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:47:52",
            "last_seen_utc": "2025-10-14 02:50:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614593": [
        {
            "ioc_value": "vd3j.6-0sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:46:43",
            "last_seen_utc": "2025-10-14 02:50:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614592": [
        {
            "ioc_value": "zok.ckyq9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:39:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614591": [
        {
            "ioc_value": "ye.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:38:05",
            "last_seen_utc": "2025-10-14 02:46:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614590": [
        {
            "ioc_value": "4t.ckyq9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:28:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614589": [
        {
            "ioc_value": "mt06.6-0sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:28:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614588": [
        {
            "ioc_value": "aj.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:27:47",
            "last_seen_utc": "2025-10-14 02:28:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614587": [
        {
            "ioc_value": "q9px.6-0sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:19:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614586": [
        {
            "ioc_value": "hid.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:17:28",
            "last_seen_utc": "2025-10-14 02:19:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614585": [
        {
            "ioc_value": "e2rw.6-0sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:10:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614584": [
        {
            "ioc_value": "xq.ckyq9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:08:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614583": [
        {
            "ioc_value": "nf.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:07:40",
            "last_seen_utc": "2025-10-14 02:10:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614582": [
        {
            "ioc_value": "ka85.6-0sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:01:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614581": [
        {
            "ioc_value": "sf5.ckyq9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 02:00:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614580": [
        {
            "ioc_value": "va.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 01:58:23",
            "last_seen_utc": "2025-10-14 02:01:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614579": [
        {
            "ioc_value": "s1oc.6-0sg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 01:55:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614578": [
        {
            "ioc_value": "py.wqix5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 01:54:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614577": [
        {
            "ioc_value": "72k.hpap-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 01:50:10",
            "last_seen_utc": "2025-10-14 01:55:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614576": [
        {
            "ioc_value": "q14.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 00:47:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614575": [
        {
            "ioc_value": "ch.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 00:37:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614442": [
        {
            "ioc_value": "xkp.rxir9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 00:28:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614441": [
        {
            "ioc_value": "dp.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 00:28:35",
            "last_seen_utc": "2025-10-14 00:28:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614440": [
        {
            "ioc_value": "hwj.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 00:17:36",
            "last_seen_utc": "2025-10-14 00:18:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614439": [
        {
            "ioc_value": "xd5.rxir9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 00:13:50",
            "last_seen_utc": "2025-10-14 00:18:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614438": [
        {
            "ioc_value": "o4k.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-14 00:08:20",
            "last_seen_utc": "2025-10-14 00:13:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614423": [
        {
            "ioc_value": "po4.rxir9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:59:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614422": [
        {
            "ioc_value": "35i.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:58:01",
            "last_seen_utc": "2025-10-13 23:59:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614421": [
        {
            "ioc_value": "jm59.4-5sq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:49:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614420": [
        {
            "ioc_value": "u9.sxuj-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:48:25",
            "last_seen_utc": "2025-10-13 23:49:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614419": [
        {
            "ioc_value": "3x.rxir9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:39:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614418": [
        {
            "ioc_value": "wj.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:36:57",
            "last_seen_utc": "2025-10-13 23:40:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614417": [
        {
            "ioc_value": "g0nz.4-5sq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:32:05",
            "last_seen_utc": "2025-10-13 23:40:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614416": [
        {
            "ioc_value": "ug.rxir9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:28:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614415": [
        {
            "ioc_value": "4c.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:27:38",
            "last_seen_utc": "2025-10-13 23:32:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614414": [
        {
            "ioc_value": "64.rxir9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614413": [
        {
            "ioc_value": "r2cy.4-5sq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614412": [
        {
            "ioc_value": "syl.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:17:50",
            "last_seen_utc": "2025-10-13 23:19:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614411": [
        {
            "ioc_value": "lt3c.4-5sq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:09:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614410": [
        {
            "ioc_value": "pb.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:08:03",
            "last_seen_utc": "2025-10-13 23:10:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614409": [
        {
            "ioc_value": "5q.ckar4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 23:06:31",
            "last_seen_utc": "2025-10-13 23:10:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614408": [
        {
            "ioc_value": "t4.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:57:45",
            "last_seen_utc": "2025-10-13 23:06:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614407": [
        {
            "ioc_value": "w9ql.4-5sq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:50:28",
            "last_seen_utc": "2025-10-13 23:00:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614406": [
        {
            "ioc_value": "hs.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:48:28",
            "last_seen_utc": "2025-10-13 22:50:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614405": [
        {
            "ioc_value": "19s.ckar4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:47:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614404": [
        {
            "ioc_value": "tpa.gtus-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:37:09",
            "last_seen_utc": "2025-10-13 22:47:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614403": [
        {
            "ioc_value": "f6ue.4-5sq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:30:31",
            "last_seen_utc": "2025-10-13 22:41:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614402": [
        {
            "ioc_value": "do.ckar4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614401": [
        {
            "ioc_value": "yz.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:28:22",
            "last_seen_utc": "2025-10-13 22:30:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614400": [
        {
            "ioc_value": "y3ak.7-5wd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614399": [
        {
            "ioc_value": "b9.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:18:04",
            "last_seen_utc": "2025-10-13 22:23:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614398": [
        {
            "ioc_value": "9c.ckar4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:13:10",
            "last_seen_utc": "2025-10-13 22:23:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614397": [
        {
            "ioc_value": "zn5e.7-5wd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:08:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614396": [
        {
            "ioc_value": "3w5.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 22:07:46",
            "last_seen_utc": "2025-10-13 22:13:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614395": [
        {
            "ioc_value": "o5b.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:57:57",
            "last_seen_utc": "2025-10-13 22:00:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614394": [
        {
            "ioc_value": "mn.ckar4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:53:29",
            "last_seen_utc": "2025-10-13 21:59:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614393": [
        {
            "ioc_value": "p8km.7-5wd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:51:11",
            "last_seen_utc": "2025-10-13 22:00:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614392": [
        {
            "ioc_value": "0pv.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:48:09",
            "last_seen_utc": "2025-10-13 21:53:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614391": [
        {
            "ioc_value": "3t6.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:38:49",
            "last_seen_utc": "2025-10-13 21:42:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614390": [
        {
            "ioc_value": "08p.ckar4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:34:54",
            "last_seen_utc": "2025-10-13 21:39:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614389": [
        {
            "ioc_value": "b2vu.7-5wd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:30:29",
            "last_seen_utc": "2025-10-13 21:42:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614388": [
        {
            "ioc_value": "3bm.dlun-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:28:30",
            "last_seen_utc": "2025-10-13 21:34:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614387": [
        {
            "ioc_value": "xq92.7-5wd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614386": [
        {
            "ioc_value": "f0.wduh8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614385": [
        {
            "ioc_value": "ixa.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:16:23",
            "last_seen_utc": "2025-10-13 21:19:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614384": [
        {
            "ioc_value": "fr.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:06:04",
            "last_seen_utc": "2025-10-13 21:06:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614383": [
        {
            "ioc_value": "u1.wduh8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 21:05:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614382": [
        {
            "ioc_value": "hd6r.7-5wd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:59:02",
            "last_seen_utc": "2025-10-13 21:06:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614381": [
        {
            "ioc_value": "bi4.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:57:18",
            "last_seen_utc": "2025-10-13 21:05:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614380": [
        {
            "ioc_value": "q4wt.9-1pv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:49:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614379": [
        {
            "ioc_value": "ocip.clevercougar.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-13 20:48:56",
            "last_seen_utc": "2025-11-22 07:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1614378": [
        {
            "ioc_value": "db.yinyang.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-13 20:48:47",
            "last_seen_utc": "2025-11-20 09:48:59",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1614377": [
        {
            "ioc_value": "zn.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:48:00",
            "last_seen_utc": "2025-10-13 20:49:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614376": [
        {
            "ioc_value": "c7pz.9-1pv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:39:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614375": [
        {
            "ioc_value": "1j9.wduh8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:38:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614374": [
        {
            "ioc_value": "pzi.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:37:44",
            "last_seen_utc": "2025-10-13 20:39:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614373": [
        {
            "ioc_value": "mi.wduh8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:28:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614372": [
        {
            "ioc_value": "e8.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:27:57",
            "last_seen_utc": "2025-10-13 20:29:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614365": [
        {
            "ioc_value": "m3yl.9-1pv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:22:00",
            "last_seen_utc": "2025-10-13 20:29:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614364": [
        {
            "ioc_value": "x7m.wduh8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:19:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614363": [
        {
            "ioc_value": "y4.qzad-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:17:40",
            "last_seen_utc": "2025-10-13 20:22:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614362": [
        {
            "ioc_value": "vk2x.9-1pv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:09:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614361": [
        {
            "ioc_value": "1sw.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 20:07:52",
            "last_seen_utc": "2025-10-13 20:09:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614350": [
        {
            "ioc_value": "tz9q.9-1pv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 19:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614349": [
        {
            "ioc_value": "pu.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 19:57:23",
            "last_seen_utc": "2025-10-13 20:02:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614348": [
        {
            "ioc_value": "tt.wduh8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 19:53:54",
            "last_seen_utc": "2025-10-13 20:02:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614347": [
        {
            "ioc_value": "dns4up.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-13 19:50:49",
            "last_seen_utc": "2025-10-22 12:44:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/4ea9a321958b4d2c43cadbb62e2b037b958ed5f9984033aa3a9d10a5423fd006/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1614346": [
        {
            "ioc_value": "ca.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 19:47:36",
            "last_seen_utc": "2025-10-13 19:53:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614345": [
        {
            "ioc_value": "gx1m.9-1pv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 19:45:41",
            "last_seen_utc": "2025-10-13 19:51:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614343": [
        {
            "ioc_value": "ciy.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 19:32:13",
            "last_seen_utc": "2025-10-13 19:45:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614342": [
        {
            "ioc_value": "wp.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 19:27:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614340": [
        {
            "ioc_value": "p5.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 19:18:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614339": [
        {
            "ioc_value": "j2.stix-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 19:07:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614338": [
        {
            "ioc_value": "280.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 18:57:39",
            "last_seen_utc": "2025-10-13 18:58:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614334": [
        {
            "ioc_value": "eqt.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 18:47:52",
            "last_seen_utc": "2025-10-13 18:49:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614331": [
        {
            "ioc_value": "q7.kdit5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 18:43:56",
            "last_seen_utc": "2025-10-13 18:58:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614330": [
        {
            "ioc_value": "v30.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 18:37:33",
            "last_seen_utc": "2025-10-13 18:43:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614328": [
        {
            "ioc_value": "secarby.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-13 18:33:12",
            "last_seen_utc": "2025-10-20 09:12:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614329": [
        {
            "ioc_value": "whinmap.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-13 18:33:12",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614326": [
        {
            "ioc_value": "7hz.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 18:28:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614325": [
        {
            "ioc_value": "qq.kdit5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 18:13:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614324": [
        {
            "ioc_value": "5k.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 18:13:23",
            "last_seen_utc": "2025-10-13 18:13:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614323": [
        {
            "ioc_value": "takbynano.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-13 18:04:59",
            "last_seen_utc": "2025-10-20 12:27:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-q1j56sfm4z",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614322": [
        {
            "ioc_value": "86w.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 18:03:35",
            "last_seen_utc": "2025-10-13 18:04:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614320": [
        {
            "ioc_value": "azharabdo109.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-13 18:01:42",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-tfleaagj4s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614321": [
        {
            "ioc_value": "doudouh22.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-13 18:01:42",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-r6s6psfp5v",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614318": [
        {
            "ioc_value": "doing-radical.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-13 18:01:17",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-tp63cazqt8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1614317": [
        {
            "ioc_value": "zq.kdit5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:58:33",
            "last_seen_utc": "2025-10-13 18:04:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614316": [
        {
            "ioc_value": "2oy.ldef-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:58:10",
            "last_seen_utc": "2025-10-13 17:58:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614315": [
        {
            "ioc_value": "t2.mcyz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:48:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614314": [
        {
            "ioc_value": "j6b.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:47:51",
            "last_seen_utc": "2025-10-13 17:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614313": [
        {
            "ioc_value": "je.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:38:02",
            "last_seen_utc": "2025-10-13 17:39:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614312": [
        {
            "ioc_value": "wyd.kdit5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:34:58",
            "last_seen_utc": "2025-10-13 17:38:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614311": [
        {
            "ioc_value": "b7ye.mcyz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:29:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614310": [
        {
            "ioc_value": "y4l.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:27:39",
            "last_seen_utc": "2025-10-13 17:34:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614309": [
        {
            "ioc_value": "x32l.mcyz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614308": [
        {
            "ioc_value": "jz.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:18:53",
            "last_seen_utc": "2025-10-13 17:19:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614307": [
        {
            "ioc_value": "k6o.mcyz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:08:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614306": [
        {
            "ioc_value": "f1.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:07:34",
            "last_seen_utc": "2025-10-13 17:09:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614305": [
        {
            "ioc_value": "n9o.kdit5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 17:03:13",
            "last_seen_utc": "2025-10-13 17:09:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614304": [
        {
            "ioc_value": "tgx.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:57:47",
            "last_seen_utc": "2025-10-13 17:03:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614303": [
        {
            "ioc_value": "sv.mcyz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:51:51",
            "last_seen_utc": "2025-10-13 16:58:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614302": [
        {
            "ioc_value": "2l.kdit5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:48:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614301": [
        {
            "ioc_value": "0c.dzem-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:48:22",
            "last_seen_utc": "2025-10-13 16:51:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614300": [
        {
            "ioc_value": "f.mcyz4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:39:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614299": [
        {
            "ioc_value": "dgl.blyp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:38:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614298": [
        {
            "ioc_value": "q5.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:38:28",
            "last_seen_utc": "2025-10-13 16:39:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614297": [
        {
            "ioc_value": "m6hg.bvum6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:29:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614296": [
        {
            "ioc_value": "uk.blyp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:29:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614295": [
        {
            "ioc_value": "iha.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:28:09",
            "last_seen_utc": "2025-10-13 16:29:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614294": [
        {
            "ioc_value": "j9pc.bvum6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:19:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614291": [
        {
            "ioc_value": "yi.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:17:52",
            "last_seen_utc": "2025-10-13 16:19:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614290": [
        {
            "ioc_value": "iz.blyp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:14:23",
            "last_seen_utc": "2025-10-13 16:18:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614289": [
        {
            "ioc_value": "emc.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:08:05",
            "last_seen_utc": "2025-10-13 16:14:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614282": [
        {
            "ioc_value": "y0we.bvum6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 16:01:06",
            "last_seen_utc": "2025-10-13 16:08:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614281": [
        {
            "ioc_value": "n9.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:54:04",
            "last_seen_utc": "2025-10-13 16:01:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614280": [
        {
            "ioc_value": "g5.blyp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:49:15",
            "last_seen_utc": "2025-10-13 15:55:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614279": [
        {
            "ioc_value": "9t.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:48:02",
            "last_seen_utc": "2025-10-13 15:54:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614278": [
        {
            "ioc_value": "z5k.bvum6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:41:01",
            "last_seen_utc": "2025-10-13 15:54:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614277": [
        {
            "ioc_value": "aw.blyp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:39:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614276": [
        {
            "ioc_value": "hv3.wsit-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:38:41",
            "last_seen_utc": "2025-10-13 15:41:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614275": [
        {
            "ioc_value": "rmi.blyp9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:29:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614274": [
        {
            "ioc_value": "1mk.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:24:41",
            "last_seen_utc": "2025-10-13 15:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614273": [
        {
            "ioc_value": "c.bvum6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:22:49",
            "last_seen_utc": "2025-10-13 15:26:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614272": [
        {
            "ioc_value": "vnv.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:18:39",
            "last_seen_utc": "2025-10-13 15:22:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614271": [
        {
            "ioc_value": "7b.bvum6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:08:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614270": [
        {
            "ioc_value": "81s.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:07:11",
            "last_seen_utc": "2025-10-13 15:12:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614269": [
        {
            "ioc_value": "43.tvil0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 15:01:06",
            "last_seen_utc": "2025-10-13 15:12:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614267": [
        {
            "ioc_value": "7e.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:56:22",
            "last_seen_utc": "2025-10-13 15:01:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614266": [
        {
            "ioc_value": "n.fkur8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:42:47",
            "last_seen_utc": "2025-10-13 14:57:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614265": [
        {
            "ioc_value": "14.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:41:00",
            "last_seen_utc": "2025-10-13 14:43:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614264": [
        {
            "ioc_value": "im8.tvil0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:39:04",
            "last_seen_utc": "2025-10-13 14:43:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614263": [
        {
            "ioc_value": "ib.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:34:16",
            "last_seen_utc": "2025-10-13 14:39:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614262": [
        {
            "ioc_value": "uz.vqod-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:27:52",
            "last_seen_utc": "2025-10-13 14:29:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614261": [
        {
            "ioc_value": "oj.tvil0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:22:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614260": [
        {
            "ioc_value": "e1mx.fkur8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:20:47",
            "last_seen_utc": "2025-10-13 14:35:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614259": [
        {
            "ioc_value": "1m.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:18:36",
            "last_seen_utc": "2025-10-13 14:22:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614258": [
        {
            "ioc_value": "c8.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:04:13",
            "last_seen_utc": "2025-10-13 14:06:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1614257": [
        {
            "ioc_value": "57.tvil0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:00:10",
            "last_seen_utc": "2025-10-13 14:06:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614256": [
        {
            "ioc_value": "l8qf.fkur8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 14:00:09",
            "last_seen_utc": "2025-10-13 14:06:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1614255": [
        {
            "ioc_value": "p0.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:58:00",
            "last_seen_utc": "2025-10-13 14:00:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613463": [
        {
            "ioc_value": "lowi1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-13 13:56:38",
            "last_seen_utc": "2025-10-13 13:49:31",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115367172994630073",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1613466": [
        {
            "ioc_value": "lextran.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-13 13:56:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115367172994630073",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1614182": [
        {
            "ioc_value": "youtubeplusandroid.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-13 13:54:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://zimperium.com/blog/clayrat-a-new-android-spyware-targeting-russia",
            "tags": "ClayRat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1614183": [
        {
            "ioc_value": "actedsda.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-13 13:54:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://zimperium.com/blog/clayrat-a-new-android-spyware-targeting-russia",
            "tags": "ClayRat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1614184": [
        {
            "ioc_value": "antiradar.life",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-13 13:54:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://zimperium.com/blog/clayrat-a-new-android-spyware-targeting-russia",
            "tags": "ClayRat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1613467": [
        {
            "ioc_value": "t3wo.fkur8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:49:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613461": [
        {
            "ioc_value": "f4l.tvil0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:49:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613460": [
        {
            "ioc_value": "0zq.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:48:13",
            "last_seen_utc": "2025-10-13 13:49:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613459": [
        {
            "ioc_value": "je.tvil0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:39:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613458": [
        {
            "ioc_value": "p9as.fkur8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:38:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613457": [
        {
            "ioc_value": "v3.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:38:26",
            "last_seen_utc": "2025-10-13 13:39:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613456": [
        {
            "ioc_value": "h1.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:27:09",
            "last_seen_utc": "2025-10-13 13:27:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613455": [
        {
            "ioc_value": "v6yt.fkur8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:20:39",
            "last_seen_utc": "2025-10-13 13:27:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613454": [
        {
            "ioc_value": "pm.stix2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:19:20",
            "last_seen_utc": "2025-10-13 13:27:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613453": [
        {
            "ioc_value": "s.2mq4r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:18:15",
            "last_seen_utc": "2025-10-13 13:20:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613452": [
        {
            "ioc_value": "q0rb.zzax4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:09:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613451": [
        {
            "ioc_value": "t1n.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:07:56",
            "last_seen_utc": "2025-10-13 13:09:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613450": [
        {
            "ioc_value": "fmg.stix2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 13:03:15",
            "last_seen_utc": "2025-10-13 13:09:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613449": [
        {
            "ioc_value": "r9.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:57:40",
            "last_seen_utc": "2025-10-13 13:03:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613448": [
        {
            "ioc_value": "sx87.zzax4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:49:07",
            "last_seen_utc": "2025-10-13 12:59:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613447": [
        {
            "ioc_value": "bq.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:48:17",
            "last_seen_utc": "2025-10-13 12:50:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613442": [
        {
            "ioc_value": "honibest.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-13 12:45:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,REMPROXY",
            "anonymous": "0",
            "reporter": "BlackLotusLabs"
        }
    ],
    "1613446": [
        {
            "ioc_value": "tng.stix2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:38:46",
            "last_seen_utc": "2025-10-13 12:48:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613445": [
        {
            "ioc_value": "x2j.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:37:21",
            "last_seen_utc": "2025-10-13 12:38:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613444": [
        {
            "ioc_value": "f4zh.zzax4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:28:58",
            "last_seen_utc": "2025-10-13 12:38:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613443": [
        {
            "ioc_value": "pc.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:27:35",
            "last_seen_utc": "2025-10-13 12:28:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613441": [
        {
            "ioc_value": "m8.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:16:14",
            "last_seen_utc": "2025-10-13 12:17:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613435": [
        {
            "ioc_value": "o34.stix2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:14:08",
            "last_seen_utc": "2025-10-13 12:28:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613434": [
        {
            "ioc_value": "a.4fg2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:13:05",
            "last_seen_utc": "2025-10-13 12:14:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613433": [
        {
            "ioc_value": "w12p.zzax4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:11:36",
            "last_seen_utc": "2025-10-13 12:17:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613432": [
        {
            "ioc_value": "k0n.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 12:08:23",
            "last_seen_utc": "2025-10-13 12:11:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613430": [
        {
            "ioc_value": "slucasanderson.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-13 12:04:30",
            "last_seen_utc": "2025-11-05 11:05:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-k5xzyaxlt8",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1613431": [
        {
            "ioc_value": "creativegear001.ddnsfree.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-13 12:04:30",
            "last_seen_utc": "2025-10-20 12:27:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-k5xzyaxlt8",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1613422": [
        {
            "ioc_value": "v2.cntm.edu.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-13 12:01:45",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-j7tjvsdj9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1613420": [
        {
            "ioc_value": "v1.cntm.edu.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-13 12:01:43",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-j7tjvsdj9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1613419": [
        {
            "ioc_value": "cntm.edu.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-13 12:01:42",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-j7tjvsdj9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1613416": [
        {
            "ioc_value": "hgamkado.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-13 12:01:21",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-kd88wsdk7s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1613417": [
        {
            "ioc_value": "gehjas.3utilities.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-13 12:01:21",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-kd88wsdk7s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1613415": [
        {
            "ioc_value": "wz.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:58:03",
            "last_seen_utc": "2025-10-13 11:59:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613414": [
        {
            "ioc_value": "k9uv.zzax4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:50:09",
            "last_seen_utc": "2025-10-13 11:59:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613413": [
        {
            "ioc_value": "h2.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:45:43",
            "last_seen_utc": "2025-10-13 11:53:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613412": [
        {
            "ioc_value": "bcm.stix2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:44:16",
            "last_seen_utc": "2025-10-13 11:59:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613411": [
        {
            "ioc_value": "q.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:44:05",
            "last_seen_utc": "2025-10-13 11:45:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613410": [
        {
            "ioc_value": "m3qe.zzax4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:38:44",
            "last_seen_utc": "2025-10-13 11:45:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613409": [
        {
            "ioc_value": "xt.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:37:52",
            "last_seen_utc": "2025-10-13 11:38:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613408": [
        {
            "ioc_value": "z9.stix2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:28:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613407": [
        {
            "ioc_value": "n5.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:28:03",
            "last_seen_utc": "2025-10-13 11:28:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613406": [
        {
            "ioc_value": "9j.dlun7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613405": [
        {
            "ioc_value": "t5vo.kqag6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:18:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613404": [
        {
            "ioc_value": "b.7wh2n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:17:43",
            "last_seen_utc": "2025-10-13 11:18:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613403": [
        {
            "ioc_value": "d7qx.kqag6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:07:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613402": [
        {
            "ioc_value": "x.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:05:21",
            "last_seen_utc": "2025-10-13 11:07:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613401": [
        {
            "ioc_value": "y1mc.kqag6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 11:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613400": [
        {
            "ioc_value": "jpv.dlun7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:59:02",
            "last_seen_utc": "2025-10-13 11:05:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613399": [
        {
            "ioc_value": "h9m.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:58:38",
            "last_seen_utc": "2025-10-13 11:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613397": [
        {
            "ioc_value": "rb54.kqag6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:49:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613396": [
        {
            "ioc_value": "bj.dlun7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:49:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613395": [
        {
            "ioc_value": "tq.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:48:11",
            "last_seen_utc": "2025-10-13 10:49:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613394": [
        {
            "ioc_value": "g6ta.kqag6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:39:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613393": [
        {
            "ioc_value": "z1.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:38:23",
            "last_seen_utc": "2025-10-13 10:39:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613392": [
        {
            "ioc_value": "i7.dlun7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:31:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613391": [
        {
            "ioc_value": "n8yr.kqag6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:28:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613390": [
        {
            "ioc_value": "bd.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:25:03",
            "last_seen_utc": "2025-10-13 10:31:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613389": [
        {
            "ioc_value": "q7.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:12:08",
            "last_seen_utc": "2025-10-13 10:14:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613388": [
        {
            "ioc_value": "c3fn.kpyw8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:10:10",
            "last_seen_utc": "2025-10-13 10:14:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613387": [
        {
            "ioc_value": "g.9zk8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:07:54",
            "last_seen_utc": "2025-10-13 10:10:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613386": [
        {
            "ioc_value": "9v.dlun7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 10:04:39",
            "last_seen_utc": "2025-10-13 10:13:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613385": [
        {
            "ioc_value": "zz19.kpyw8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613384": [
        {
            "ioc_value": "xq9.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:57:34",
            "last_seen_utc": "2025-10-13 10:04:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613383": [
        {
            "ioc_value": "h7.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:40:40",
            "last_seen_utc": "2025-10-13 09:42:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613382": [
        {
            "ioc_value": "ax73.kpyw8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:39:11",
            "last_seen_utc": "2025-10-13 09:42:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613381": [
        {
            "ioc_value": "pv.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:37:31",
            "last_seen_utc": "2025-10-13 09:39:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613378": [
        {
            "ioc_value": "8cf.ldef4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:34:16",
            "last_seen_utc": "2025-10-13 09:42:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613377": [
        {
            "ioc_value": "p0qe.kpyw8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:30:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613376": [
        {
            "ioc_value": "a1.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:28:38",
            "last_seen_utc": "2025-10-13 09:34:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613373": [
        {
            "ioc_value": "0bd.ldef4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613372": [
        {
            "ioc_value": "zt.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:18:19",
            "last_seen_utc": "2025-10-13 09:20:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613370": [
        {
            "ioc_value": "u4xz.kpyw8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:10:32",
            "last_seen_utc": "2025-10-13 09:19:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613369": [
        {
            "ioc_value": "g8.ldef4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:09:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613368": [
        {
            "ioc_value": "n3.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 09:08:02",
            "last_seen_utc": "2025-10-13 09:10:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613367": [
        {
            "ioc_value": "9g.ldef4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:59:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613366": [
        {
            "ioc_value": "e.5sv1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:58:16",
            "last_seen_utc": "2025-10-13 08:59:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613363": [
        {
            "ioc_value": "h7lm.kpyw8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:49:41",
            "last_seen_utc": "2025-10-13 08:58:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613362": [
        {
            "ioc_value": "z9m.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:48:54",
            "last_seen_utc": "2025-10-13 08:49:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613361": [
        {
            "ioc_value": "vd3h.llim8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:39:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613360": [
        {
            "ioc_value": "qb.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:39:07",
            "last_seen_utc": "2025-10-13 08:41:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613359": [
        {
            "ioc_value": "up.ldef4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:33:32",
            "last_seen_utc": "2025-10-13 08:41:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613358": [
        {
            "ioc_value": "m2.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:27:49",
            "last_seen_utc": "2025-10-13 08:33:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613357": [
        {
            "ioc_value": "mt05.llim8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:21:16",
            "last_seen_utc": "2025-10-13 08:33:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613356": [
        {
            "ioc_value": "x.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:19:04",
            "last_seen_utc": "2025-10-13 08:22:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613355": [
        {
            "ioc_value": "mj.ldef4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:18:27",
            "last_seen_utc": "2025-10-13 08:22:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613354": [
        {
            "ioc_value": "pl.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:07:27",
            "last_seen_utc": "2025-10-13 08:18:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613344": [
        {
            "ioc_value": "q9pw.llim8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 08:00:35",
            "last_seen_utc": "2025-10-13 08:08:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613343": [
        {
            "ioc_value": "h38.sxuj7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:59:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613342": [
        {
            "ioc_value": "h3.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:58:30",
            "last_seen_utc": "2025-10-13 08:00:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613341": [
        {
            "ioc_value": "s.4cv6c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:44:08",
            "last_seen_utc": "2025-10-13 07:47:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613336": [
        {
            "ioc_value": "xp.andersonscrochet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-13 07:41:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1613337": [
        {
            "ioc_value": "ty.r.bluewave-shipping.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-13 07:41:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1613338": [
        {
            "ioc_value": "ty.r.shutupkissme.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-13 07:41:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1613335": [
        {
            "ioc_value": "xp.lorenabulei.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-13 07:41:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1613330": [
        {
            "ioc_value": "ks.sxuj7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:40:49",
            "last_seen_utc": "2025-10-13 07:45:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613329": [
        {
            "ioc_value": "nuevos2526.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-13 07:40:32",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1613324": [
        {
            "ioc_value": "xoilaczzzaz.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-13 07:39:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1613325": [
        {
            "ioc_value": "old0monedy.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-13 07:39:32",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1613326": [
        {
            "ioc_value": "rvt50mekz.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-13 07:39:32",
            "last_seen_utc": "2025-10-13 07:39:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1613321": [
        {
            "ioc_value": "x8n.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:38:26",
            "last_seen_utc": "2025-10-13 07:40:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613319": [
        {
            "ioc_value": "e2rv.llim8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:33:43",
            "last_seen_utc": "2025-10-13 07:47:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613318": [
        {
            "ioc_value": "h9.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:28:38",
            "last_seen_utc": "2025-10-13 07:33:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613317": [
        {
            "ioc_value": "9zc.sxuj7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613316": [
        {
            "ioc_value": "tq.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:18:11",
            "last_seen_utc": "2025-10-13 07:21:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613314": [
        {
            "ioc_value": "ka84.llim8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:11:28",
            "last_seen_utc": "2025-10-13 07:21:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613313": [
        {
            "ioc_value": "qq.sxuj7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:08:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613312": [
        {
            "ioc_value": "z1.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 07:07:52",
            "last_seen_utc": "2025-10-13 07:11:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613311": [
        {
            "ioc_value": "s1ob.llim8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613310": [
        {
            "ioc_value": "kgv.sxuj7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613309": [
        {
            "ioc_value": "bd.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:57:33",
            "last_seen_utc": "2025-10-13 06:58:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613308": [
        {
            "ioc_value": "jm58.nmys4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:49:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613307": [
        {
            "ioc_value": "vr6.sxuj7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:48:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613306": [
        {
            "ioc_value": "q4.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:47:48",
            "last_seen_utc": "2025-10-13 06:49:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613305": [
        {
            "ioc_value": "g0ny.nmys4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:39:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613304": [
        {
            "ioc_value": "g.1jd3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:38:32",
            "last_seen_utc": "2025-10-13 06:39:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613303": [
        {
            "ioc_value": "zyk.dzem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:30:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613302": [
        {
            "ioc_value": "p9.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:24:39",
            "last_seen_utc": "2025-10-13 06:30:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613301": [
        {
            "ioc_value": "r2cz.nmys4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:20:36",
            "last_seen_utc": "2025-10-13 06:26:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613300": [
        {
            "ioc_value": "hui.dzem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:19:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613299": [
        {
            "ioc_value": "h7.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:18:25",
            "last_seen_utc": "2025-10-13 06:20:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613298": [
        {
            "ioc_value": "lt3b.nmys4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:09:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613297": [
        {
            "ioc_value": "et1.dzem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:08:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613296": [
        {
            "ioc_value": "x.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 06:08:07",
            "last_seen_utc": "2025-10-13 06:09:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613294": [
        {
            "ioc_value": "73uhd7893hn23cvshdscw.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-13 06:01:26",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/251013-cctstas1dt",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1613293": [
        {
            "ioc_value": "w9qk.nmys4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:59:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613292": [
        {
            "ioc_value": "l8.dzem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:59:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613291": [
        {
            "ioc_value": "t1.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:58:19",
            "last_seen_utc": "2025-10-13 05:59:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613290": [
        {
            "ioc_value": "f6ud.nmys4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:49:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613289": [
        {
            "ioc_value": "brp.dzem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:49:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613288": [
        {
            "ioc_value": "zc.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:48:03",
            "last_seen_utc": "2025-10-13 05:49:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613287": [
        {
            "ioc_value": "y3aj.plig5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:39:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613286": [
        {
            "ioc_value": "n3.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:36:44",
            "last_seen_utc": "2025-10-13 05:39:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613285": [
        {
            "ioc_value": "69c.dzem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:28:45",
            "last_seen_utc": "2025-10-13 05:36:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613284": [
        {
            "ioc_value": "a.1wd2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:27:57",
            "last_seen_utc": "2025-10-13 05:29:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613282": [
        {
            "ioc_value": "zn4e.plig5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:20:30",
            "last_seen_utc": "2025-10-13 05:29:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613280": [
        {
            "ioc_value": "ln.qzad3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:17:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613281": [
        {
            "ioc_value": "q1n.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:17:59",
            "last_seen_utc": "2025-10-13 05:20:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613279": [
        {
            "ioc_value": "b.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:05:49",
            "last_seen_utc": "2025-10-13 05:06:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613056": [
        {
            "ioc_value": "portykold.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-13 05:04:36",
            "last_seen_utc": "2025-10-12 21:33:17",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115363278868220639",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1613278": [
        {
            "ioc_value": "p7km.plig5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 05:00:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613276": [
        {
            "ioc_value": "u.qzad3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:58:33",
            "last_seen_utc": "2025-10-13 05:06:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613277": [
        {
            "ioc_value": "r7.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:58:33",
            "last_seen_utc": "2025-10-13 05:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613275": [
        {
            "ioc_value": "b2vt.plig5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:49:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613274": [
        {
            "ioc_value": "x.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:48:08",
            "last_seen_utc": "2025-10-13 04:49:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613273": [
        {
            "ioc_value": "1h.qzad3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:43:33",
            "last_seen_utc": "2025-10-13 04:48:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613272": [
        {
            "ioc_value": "xq91.plig5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:39:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613271": [
        {
            "ioc_value": "vk.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:38:20",
            "last_seen_utc": "2025-10-13 04:43:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613270": [
        {
            "ioc_value": "1uy.qzad3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:28:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613269": [
        {
            "ioc_value": "m8.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:28:03",
            "last_seen_utc": "2025-10-13 04:29:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613268": [
        {
            "ioc_value": "hd5r.plig5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:20:21",
            "last_seen_utc": "2025-10-13 04:29:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613267": [
        {
            "ioc_value": "s.4xq2k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:18:13",
            "last_seen_utc": "2025-10-13 04:20:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613266": [
        {
            "ioc_value": "q4ws.hpap6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:08:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613265": [
        {
            "ioc_value": "w1n.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:07:51",
            "last_seen_utc": "2025-10-13 04:08:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613264": [
        {
            "ioc_value": "sx.qzad3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:03:03",
            "last_seen_utc": "2025-10-13 04:18:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613238": [
        {
            "ioc_value": "c7pa.hpap6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 04:00:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613237": [
        {
            "ioc_value": "h7.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:58:01",
            "last_seen_utc": "2025-10-13 04:03:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613236": [
        {
            "ioc_value": "q9.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:47:43",
            "last_seen_utc": "2025-10-13 03:50:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613235": [
        {
            "ioc_value": "7k5.qzad3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:40:22",
            "last_seen_utc": "2025-10-13 03:49:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613234": [
        {
            "ioc_value": "m1yl.hpap6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:38:51",
            "last_seen_utc": "2025-10-13 03:50:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613233": [
        {
            "ioc_value": "x.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:38:26",
            "last_seen_utc": "2025-10-13 03:40:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613232": [
        {
            "ioc_value": "pt.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:27:37",
            "last_seen_utc": "2025-10-13 03:29:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613231": [
        {
            "ioc_value": "z2.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:24:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613230": [
        {
            "ioc_value": "k.5lr1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:18:15",
            "last_seen_utc": "2025-10-13 03:19:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613229": [
        {
            "ioc_value": "f.wsit4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:14:07",
            "last_seen_utc": "2025-10-13 03:28:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613228": [
        {
            "ioc_value": "vr2x.hpap6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:13:19",
            "last_seen_utc": "2025-10-13 03:29:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613227": [
        {
            "ioc_value": "70.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:08:27",
            "last_seen_utc": "2025-10-13 03:14:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613226": [
        {
            "ioc_value": "n6u.wsit4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 03:05:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613224": [
        {
            "ioc_value": "u0.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:58:06",
            "last_seen_utc": "2025-10-13 03:05:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613223": [
        {
            "ioc_value": "t8qn.hpap6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:50:01",
            "last_seen_utc": "2025-10-13 02:58:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613221": [
        {
            "ioc_value": "rb.wsit4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:49:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613220": [
        {
            "ioc_value": "pw.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:48:14",
            "last_seen_utc": "2025-10-13 02:50:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613219": [
        {
            "ioc_value": "1.wsit4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:44:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613218": [
        {
            "ioc_value": "kz3m.hpap6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:41:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613217": [
        {
            "ioc_value": "3c.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:37:56",
            "last_seen_utc": "2025-10-13 02:44:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613216": [
        {
            "ioc_value": "ae.wsit4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:34:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613215": [
        {
            "ioc_value": "et.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:27:39",
            "last_seen_utc": "2025-10-13 02:34:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613214": [
        {
            "ioc_value": "k8.wsit4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613213": [
        {
            "ioc_value": "hm.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:17:50",
            "last_seen_utc": "2025-10-13 02:19:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613212": [
        {
            "ioc_value": "33f.gtus4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:09:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613211": [
        {
            "ioc_value": "nq.xbiq2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 02:08:31",
            "last_seen_utc": "2025-10-13 02:09:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613209": [
        {
            "ioc_value": "ydw.gtus4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:58:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613208": [
        {
            "ioc_value": "sgy.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:58:14",
            "last_seen_utc": "2025-10-13 01:58:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613207": [
        {
            "ioc_value": "rwh.gtus4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:48:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613206": [
        {
            "ioc_value": "wso.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:48:25",
            "last_seen_utc": "2025-10-13 01:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613205": [
        {
            "ioc_value": "hu.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:38:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613204": [
        {
            "ioc_value": "gqj.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:28:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613203": [
        {
            "ioc_value": "s4.pf6o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:24:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613202": [
        {
            "ioc_value": "iyw.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:17:55",
            "last_seen_utc": "2025-10-13 01:24:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613201": [
        {
            "ioc_value": "z0h.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:13:43",
            "last_seen_utc": "2025-10-13 01:17:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613200": [
        {
            "ioc_value": "hm.pf6o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:09:41",
            "last_seen_utc": "2025-10-13 01:17:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613199": [
        {
            "ioc_value": "tr.gtus4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:08:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613198": [
        {
            "ioc_value": "fq.wdax1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 01:08:01",
            "last_seen_utc": "2025-10-13 01:09:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613197": [
        {
            "ioc_value": "t1.pf6o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613196": [
        {
            "ioc_value": "9r.gtus4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613195": [
        {
            "ioc_value": "va3.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:57:43",
            "last_seen_utc": "2025-10-13 00:59:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613194": [
        {
            "ioc_value": "qz9.pf6o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:50:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613193": [
        {
            "ioc_value": "fj.gtus4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:50:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613192": [
        {
            "ioc_value": "a27.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:47:52",
            "last_seen_utc": "2025-10-13 00:50:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613191": [
        {
            "ioc_value": "v2.pf6o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:39:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613190": [
        {
            "ioc_value": "lo.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:38:37",
            "last_seen_utc": "2025-10-13 00:39:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613189": [
        {
            "ioc_value": "k.pf6o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:30:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613188": [
        {
            "ioc_value": "mom.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:28:13",
            "last_seen_utc": "2025-10-13 00:30:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613187": [
        {
            "ioc_value": "7zt.vqod2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:21:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613186": [
        {
            "ioc_value": "s4.rk8y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613185": [
        {
            "ioc_value": "ajf.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:19:26",
            "last_seen_utc": "2025-10-13 00:21:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613184": [
        {
            "ioc_value": "hm.rk8y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:10:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613182": [
        {
            "ioc_value": "fe.vqod2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:09:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613183": [
        {
            "ioc_value": "n8x.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-13 00:09:38",
            "last_seen_utc": "2025-10-13 00:11:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613169": [
        {
            "ioc_value": "t1.rk8y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:59:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613168": [
        {
            "ioc_value": "ni.vqod2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:58:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613167": [
        {
            "ioc_value": "zi.jcof9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:58:19",
            "last_seen_utc": "2025-10-12 23:59:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613166": [
        {
            "ioc_value": "2.vqod2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:48:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613165": [
        {
            "ioc_value": "qz9.rk8y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:48:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613164": [
        {
            "ioc_value": "7r.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:48:02",
            "last_seen_utc": "2025-10-12 23:48:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613162": [
        {
            "ioc_value": "v2.rk8y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:40:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613161": [
        {
            "ioc_value": "je.vqod2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:39:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613160": [
        {
            "ioc_value": "yp.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:38:14",
            "last_seen_utc": "2025-10-12 23:40:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613099": [
        {
            "ioc_value": "h.vqod2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:34:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613098": [
        {
            "ioc_value": "k.rk8y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:32:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613097": [
        {
            "ioc_value": "6lv.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:32:18",
            "last_seen_utc": "2025-10-12 23:34:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613096": [
        {
            "ioc_value": "hl.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:27:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613095": [
        {
            "ioc_value": "s4.ls2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:22:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613094": [
        {
            "ioc_value": "s4.mg1u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:18:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613093": [
        {
            "ioc_value": "cwp.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:17:47",
            "last_seen_utc": "2025-10-12 23:22:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613092": [
        {
            "ioc_value": "hm.ls2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:09:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613091": [
        {
            "ioc_value": "hm.mg1u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:09:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613090": [
        {
            "ioc_value": "v5.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 23:08:30",
            "last_seen_utc": "2025-10-12 23:09:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613089": [
        {
            "ioc_value": "t1.ls2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613088": [
        {
            "ioc_value": "xj.qrow6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:58:35",
            "last_seen_utc": "2025-10-12 22:59:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613087": [
        {
            "ioc_value": "qz9.ls2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:51:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613086": [
        {
            "ioc_value": "t1.mg1u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:50:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613085": [
        {
            "ioc_value": "o9n.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:48:17",
            "last_seen_utc": "2025-10-12 22:51:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613083": [
        {
            "ioc_value": "qz9.mg1u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:44:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613082": [
        {
            "ioc_value": "ge.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:43:36",
            "last_seen_utc": "2025-10-12 22:46:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613081": [
        {
            "ioc_value": "v2.ls2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:39:01",
            "last_seen_utc": "2025-10-12 22:46:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613080": [
        {
            "ioc_value": "dh.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:38:14",
            "last_seen_utc": "2025-10-12 22:39:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613079": [
        {
            "ioc_value": "v2.mg1u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:33:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613078": [
        {
            "ioc_value": "k.ls2a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:30:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613077": [
        {
            "ioc_value": "2k.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:27:55",
            "last_seen_utc": "2025-10-12 22:33:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613076": [
        {
            "ioc_value": "k.mg1u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613075": [
        {
            "ioc_value": "s4.fp0y9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:18:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613074": [
        {
            "ioc_value": "q3.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:18:09",
            "last_seen_utc": "2025-10-12 22:19:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613073": [
        {
            "ioc_value": "s4.ll7y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:13:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613072": [
        {
            "ioc_value": "hm.fp0y9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:10:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613071": [
        {
            "ioc_value": "ei3.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 22:07:49",
            "last_seen_utc": "2025-10-12 22:13:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613070": [
        {
            "ioc_value": "t1.fp0y9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613069": [
        {
            "ioc_value": "hm.ll7y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613068": [
        {
            "ioc_value": "m21.sheh0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:57:33",
            "last_seen_utc": "2025-10-12 21:59:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613067": [
        {
            "ioc_value": "t1.ll7y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:49:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613066": [
        {
            "ioc_value": "qz9.fp0y9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:49:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613065": [
        {
            "ioc_value": "9a.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:47:44",
            "last_seen_utc": "2025-10-12 21:49:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613064": [
        {
            "ioc_value": "qz9.ll7y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:44:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613063": [
        {
            "ioc_value": "v2.fp0y9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:39:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613062": [
        {
            "ioc_value": "l9.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:38:27",
            "last_seen_utc": "2025-10-12 21:44:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613061": [
        {
            "ioc_value": "g0.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:28:42",
            "last_seen_utc": "2025-10-12 21:35:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613060": [
        {
            "ioc_value": "v2.ll7y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:24:51",
            "last_seen_utc": "2025-10-12 21:35:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613059": [
        {
            "ioc_value": "k.fp0y9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:21:05",
            "last_seen_utc": "2025-10-12 21:29:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613054": [
        {
            "ioc_value": "mmd.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:18:23",
            "last_seen_utc": "2025-10-12 21:24:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613052": [
        {
            "ioc_value": "s4.bh3i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:09:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613053": [
        {
            "ioc_value": "k.ll7y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:09:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613051": [
        {
            "ioc_value": "nis.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 21:08:05",
            "last_seen_utc": "2025-10-12 21:09:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613050": [
        {
            "ioc_value": "hm.bh3i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613049": [
        {
            "ioc_value": "s4.ss9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613048": [
        {
            "ioc_value": "olf.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:58:17",
            "last_seen_utc": "2025-10-12 20:59:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613039": [
        {
            "ioc_value": "kib.zqof0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:47:58",
            "last_seen_utc": "2025-10-12 20:54:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613038": [
        {
            "ioc_value": "hm.ss9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:42:27",
            "last_seen_utc": "2025-10-12 20:54:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613037": [
        {
            "ioc_value": "t1.bh3i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:40:21",
            "last_seen_utc": "2025-10-12 20:49:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613036": [
        {
            "ioc_value": "y3a.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:38:04",
            "last_seen_utc": "2025-10-12 20:42:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613035": [
        {
            "ioc_value": "qz9.bh3i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:29:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613034": [
        {
            "ioc_value": "t1.ss9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:29:07",
            "last_seen_utc": "2025-10-12 20:38:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613033": [
        {
            "ioc_value": "gk.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:27:47",
            "last_seen_utc": "2025-10-12 20:29:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613032": [
        {
            "ioc_value": "qz9.ss9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613031": [
        {
            "ioc_value": "zue.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:17:59",
            "last_seen_utc": "2025-10-12 20:22:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613030": [
        {
            "ioc_value": "v2.bh3i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:17:56",
            "last_seen_utc": "2025-10-12 20:22:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613029": [
        {
            "ioc_value": "v2.ss9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:07:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613028": [
        {
            "ioc_value": "5k.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 20:07:32",
            "last_seen_utc": "2025-10-12 20:17:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613015": [
        {
            "ioc_value": "onz.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:56:35",
            "last_seen_utc": "2025-10-12 19:57:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613014": [
        {
            "ioc_value": "k.ss9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:48:35",
            "last_seen_utc": "2025-10-12 19:57:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613013": [
        {
            "ioc_value": "6p.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:48:17",
            "last_seen_utc": "2025-10-12 19:48:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613012": [
        {
            "ioc_value": "11.dnek6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:37:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613011": [
        {
            "ioc_value": "s4.fj2e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:32:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613009": [
        {
            "ioc_value": "bz.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:25:08",
            "last_seen_utc": "2025-10-12 19:32:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613008": [
        {
            "ioc_value": "hm.fj2e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:18:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613007": [
        {
            "ioc_value": "s4.kj4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:18:25",
            "last_seen_utc": "2025-10-12 19:26:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613006": [
        {
            "ioc_value": "wm.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:17:53",
            "last_seen_utc": "2025-10-12 19:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613005": [
        {
            "ioc_value": "t1.fj2e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:08:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613004": [
        {
            "ioc_value": "1s.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:05:51",
            "last_seen_utc": "2025-10-12 19:10:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613003": [
        {
            "ioc_value": "vy.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:01:42",
            "last_seen_utc": "2025-10-12 19:04:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613002": [
        {
            "ioc_value": "hm.kj4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 19:01:00",
            "last_seen_utc": "2025-10-12 19:10:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1613001": [
        {
            "ioc_value": "jw.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:50:41",
            "last_seen_utc": "2025-10-12 19:01:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1613000": [
        {
            "ioc_value": "t1.kj4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:49:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612997": [
        {
            "ioc_value": "qz9.fj2e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:48:20",
            "last_seen_utc": "2025-10-12 18:52:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612996": [
        {
            "ioc_value": "e4e.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:47:00",
            "last_seen_utc": "2025-10-12 18:49:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612993": [
        {
            "ioc_value": "yay.ktox5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:38:35",
            "last_seen_utc": "2025-10-12 18:42:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612992": [
        {
            "ioc_value": "v2.fj2e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:34:30",
            "last_seen_utc": "2025-10-12 18:42:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612991": [
        {
            "ioc_value": "qz9.kj4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:30:55",
            "last_seen_utc": "2025-10-12 18:41:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612990": [
        {
            "ioc_value": "98.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:28:48",
            "last_seen_utc": "2025-10-12 18:34:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612989": [
        {
            "ioc_value": "v2.kj4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612988": [
        {
            "ioc_value": "k.fj2e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612987": [
        {
            "ioc_value": "au.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:18:18",
            "last_seen_utc": "2025-10-12 18:19:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612986": [
        {
            "ioc_value": "3l.kj-4-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:05:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612978": [
        {
            "ioc_value": "DariusBazukii2025-38390.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-12 18:02:50",
            "last_seen_utc": "2025-10-22 12:44:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251012-r6kvbswxb1",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612977": [
        {
            "ioc_value": "0tl.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:01:53",
            "last_seen_utc": "2025-10-12 18:07:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612976": [
        {
            "ioc_value": "k.kj4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 18:01:30",
            "last_seen_utc": "2025-10-12 18:07:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612975": [
        {
            "ioc_value": "udp.cloudpub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-12 18:01:10",
            "last_seen_utc": "2025-10-14 14:34:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251012-tk7s3swky7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612974": [
        {
            "ioc_value": "d4.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:58:45",
            "last_seen_utc": "2025-10-12 18:01:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612971": [
        {
            "ioc_value": "y5.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:47:57",
            "last_seen_utc": "2025-10-12 17:48:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612969": [
        {
            "ioc_value": "s4.mw9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:40:12",
            "last_seen_utc": "2025-10-12 17:48:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612968": [
        {
            "ioc_value": "2tx.kj-4-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:39:18",
            "last_seen_utc": "2025-10-12 17:47:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612967": [
        {
            "ioc_value": "nw.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:38:09",
            "last_seen_utc": "2025-10-12 17:40:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612966": [
        {
            "ioc_value": "rc.kj-4-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612965": [
        {
            "ioc_value": "hm.mw9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:28:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612964": [
        {
            "ioc_value": "0e.hnaq6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:27:51",
            "last_seen_utc": "2025-10-12 17:29:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612963": [
        {
            "ioc_value": "3n.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:17:32",
            "last_seen_utc": "2025-10-12 17:23:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612961": [
        {
            "ioc_value": "t1.mw9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:10:41",
            "last_seen_utc": "2025-10-12 17:20:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612962": [
        {
            "ioc_value": "8s.kj-4-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:10:41",
            "last_seen_utc": "2025-10-12 17:23:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612960": [
        {
            "ioc_value": "2yf.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 17:08:45",
            "last_seen_utc": "2025-10-12 17:10:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612959": [
        {
            "ioc_value": "qz9.mw9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:59:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612958": [
        {
            "ioc_value": "ewm.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:58:27",
            "last_seen_utc": "2025-10-12 16:59:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612957": [
        {
            "ioc_value": "c8l.kj-4-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:53:15",
            "last_seen_utc": "2025-10-12 16:59:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612956": [
        {
            "ioc_value": "ut.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:48:11",
            "last_seen_utc": "2025-10-12 16:53:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612955": [
        {
            "ioc_value": "v2.mw9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:40:21",
            "last_seen_utc": "2025-10-12 16:52:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612954": [
        {
            "ioc_value": "csz.kj-4-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:39:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612953": [
        {
            "ioc_value": "85.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:38:25",
            "last_seen_utc": "2025-10-12 16:40:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612952": [
        {
            "ioc_value": "q3b.mg-1-u-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:29:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612951": [
        {
            "ioc_value": "k.mw9y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:28:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612950": [
        {
            "ioc_value": "4ol.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:28:06",
            "last_seen_utc": "2025-10-12 16:29:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612949": [
        {
            "ioc_value": "vgg.ndoq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:15:46",
            "last_seen_utc": "2025-10-12 16:17:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612948": [
        {
            "ioc_value": "s4.zk5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:11:46",
            "last_seen_utc": "2025-10-12 16:17:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612947": [
        {
            "ioc_value": "wyp.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:07:52",
            "last_seen_utc": "2025-10-12 16:11:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612946": [
        {
            "ioc_value": "q2g.mg-1-u-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 16:04:10",
            "last_seen_utc": "2025-10-12 16:17:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612940": [
        {
            "ioc_value": "cg.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:57:35",
            "last_seen_utc": "2025-10-12 16:04:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612939": [
        {
            "ioc_value": "hm.zk5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:51:04",
            "last_seen_utc": "2025-10-12 16:00:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612938": [
        {
            "ioc_value": "6j.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:47:46",
            "last_seen_utc": "2025-10-12 15:53:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612937": [
        {
            "ioc_value": "02a.mg-1-u-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:40:47",
            "last_seen_utc": "2025-10-12 15:53:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612936": [
        {
            "ioc_value": "t1.zk5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:39:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612935": [
        {
            "ioc_value": "lio.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:38:24",
            "last_seen_utc": "2025-10-12 15:40:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612934": [
        {
            "ioc_value": "qz9.zk5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:29:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612933": [
        {
            "ioc_value": "7n.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:28:38",
            "last_seen_utc": "2025-10-12 15:29:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612932": [
        {
            "ioc_value": "pf.mg-1-u-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:24:04",
            "last_seen_utc": "2025-10-12 15:28:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612931": [
        {
            "ioc_value": "v2.zk5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612930": [
        {
            "ioc_value": "hk.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:18:21",
            "last_seen_utc": "2025-10-12 15:24:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612929": [
        {
            "ioc_value": "r79.mg-1-u-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:09:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612928": [
        {
            "ioc_value": "k.zk5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:09:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612927": [
        {
            "ioc_value": "1k.vbep3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 15:08:33",
            "last_seen_utc": "2025-10-12 15:09:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612926": [
        {
            "ioc_value": "r2.mg-1-u-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612925": [
        {
            "ioc_value": "31x.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:56:52",
            "last_seen_utc": "2025-10-12 14:58:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612924": [
        {
            "ioc_value": "s4.fj4i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:52:24",
            "last_seen_utc": "2025-10-12 14:58:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612923": [
        {
            "ioc_value": "lf8.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:48:03",
            "last_seen_utc": "2025-10-12 14:53:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612922": [
        {
            "ioc_value": "vr4.bh-3-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:44:49",
            "last_seen_utc": "2025-10-12 14:53:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612920": [
        {
            "ioc_value": "67.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:37:45",
            "last_seen_utc": "2025-10-12 14:44:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612919": [
        {
            "ioc_value": "hm.fj4i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:29:17",
            "last_seen_utc": "2025-10-12 14:38:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612918": [
        {
            "ioc_value": "jvu.bh-3-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:29:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612917": [
        {
            "ioc_value": "z1f.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:27:58",
            "last_seen_utc": "2025-10-12 14:29:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612916": [
        {
            "ioc_value": "gd.bh-3-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612915": [
        {
            "ioc_value": "t1.fj4i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612914": [
        {
            "ioc_value": "b5d.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:17:37",
            "last_seen_utc": "2025-10-12 14:18:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612913": [
        {
            "ioc_value": "wpy.bh-3-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:07:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612912": [
        {
            "ioc_value": "at7.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:07:18",
            "last_seen_utc": "2025-10-12 14:09:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612911": [
        {
            "ioc_value": "qz9.fj4i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 14:00:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612910": [
        {
            "ioc_value": "6c.rjuq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:58:33",
            "last_seen_utc": "2025-10-12 14:00:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612909": [
        {
            "ioc_value": "kf.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:52:29",
            "last_seen_utc": "2025-10-12 13:54:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612908": [
        {
            "ioc_value": "lk.bh-3-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:50:18",
            "last_seen_utc": "2025-10-12 13:59:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612907": [
        {
            "ioc_value": "ai.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:48:46",
            "last_seen_utc": "2025-10-12 13:50:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612906": [
        {
            "ioc_value": "s4.fq1y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:40:23",
            "last_seen_utc": "2025-10-12 13:53:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612905": [
        {
            "ioc_value": "jdv.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:38:58",
            "last_seen_utc": "2025-10-12 13:40:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612904": [
        {
            "ioc_value": "s64.bh-3-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:34:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612903": [
        {
            "ioc_value": "v2.fj4i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:28:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612902": [
        {
            "ioc_value": "1jd.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:27:58",
            "last_seen_utc": "2025-10-12 13:34:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612901": [
        {
            "ioc_value": "k.fj4i6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:20:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612900": [
        {
            "ioc_value": "mi.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:19:44",
            "last_seen_utc": "2025-10-12 13:21:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612899": [
        {
            "ioc_value": "1z3.ss-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:17:21",
            "last_seen_utc": "2025-10-12 13:21:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612898": [
        {
            "ioc_value": "m2f.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:10:58",
            "last_seen_utc": "2025-10-12 13:17:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612897": [
        {
            "ioc_value": "hm.fq1y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:02:54",
            "last_seen_utc": "2025-10-12 13:11:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612896": [
        {
            "ioc_value": "wz.bvuf2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 13:02:02",
            "last_seen_utc": "2025-10-12 13:06:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612895": [
        {
            "ioc_value": "gc.ss-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:58:57",
            "last_seen_utc": "2025-10-12 13:05:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612894": [
        {
            "ioc_value": "cv.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:58:20",
            "last_seen_utc": "2025-10-12 13:02:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612892": [
        {
            "ioc_value": "t1.fq1y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:49:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612891": [
        {
            "ioc_value": "lv.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:47:31",
            "last_seen_utc": "2025-10-12 12:49:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612890": [
        {
            "ioc_value": "2zi.ss-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:40:46",
            "last_seen_utc": "2025-10-12 12:47:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612889": [
        {
            "ioc_value": "qz9.fq1y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:39:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612888": [
        {
            "ioc_value": "w3.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:38:45",
            "last_seen_utc": "2025-10-12 12:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612887": [
        {
            "ioc_value": "rw.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:28:22",
            "last_seen_utc": "2025-10-12 12:30:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612886": [
        {
            "ioc_value": "sn.ss-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:23:36",
            "last_seen_utc": "2025-10-12 12:29:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612885": [
        {
            "ioc_value": "v2.fq1y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:21:59",
            "last_seen_utc": "2025-10-12 12:30:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612884": [
        {
            "ioc_value": "nkv.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:18:04",
            "last_seen_utc": "2025-10-12 12:23:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612883": [
        {
            "ioc_value": "k.fq1y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:09:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612882": [
        {
            "ioc_value": "o6v.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 12:06:08",
            "last_seen_utc": "2025-10-12 12:09:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612874": [
        {
            "ioc_value": "xworm7000.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-12 12:01:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251012-jj6jhssxex",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612873": [
        {
            "ioc_value": "hm.db3a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612872": [
        {
            "ioc_value": "11.ss-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:59:05",
            "last_seen_utc": "2025-10-12 12:07:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612871": [
        {
            "ioc_value": "omg.gdyl2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:57:50",
            "last_seen_utc": "2025-10-12 11:59:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612870": [
        {
            "ioc_value": "pw.ss-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:48:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612869": [
        {
            "ioc_value": "t1.db3a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:48:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612868": [
        {
            "ioc_value": "qx.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:47:04",
            "last_seen_utc": "2025-10-12 11:48:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612867": [
        {
            "ioc_value": "9h2.rk-8-y-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:39:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612866": [
        {
            "ioc_value": "qrk.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:37:46",
            "last_seen_utc": "2025-10-12 11:40:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612865": [
        {
            "ioc_value": "qz9.db3a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:31:34",
            "last_seen_utc": "2025-10-12 11:40:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612864": [
        {
            "ioc_value": "m3.rk-8-y-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:29:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612863": [
        {
            "ioc_value": "umw.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:27:58",
            "last_seen_utc": "2025-10-12 11:31:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612862": [
        {
            "ioc_value": "ui.rk-8-y-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612861": [
        {
            "ioc_value": "7k.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:17:41",
            "last_seen_utc": "2025-10-12 11:19:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612860": [
        {
            "ioc_value": "v2.db3a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:13:06",
            "last_seen_utc": "2025-10-12 11:19:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612859": [
        {
            "ioc_value": "6z.rk-8-y-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:09:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612858": [
        {
            "ioc_value": "l2v.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 11:08:23",
            "last_seen_utc": "2025-10-12 11:13:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612856": [
        {
            "ioc_value": "qa.rk-8-y-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:59:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612855": [
        {
            "ioc_value": "ayl.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:58:36",
            "last_seen_utc": "2025-10-12 10:59:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612854": [
        {
            "ioc_value": "k.db3a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:50:27",
            "last_seen_utc": "2025-10-12 10:59:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612853": [
        {
            "ioc_value": "s.vss.sh",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-12 10:49:41",
            "last_seen_utc": "2025-11-13 21:53:58",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1612852": [
        {
            "ioc_value": "lyg.kjyx7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:48:20",
            "last_seen_utc": "2025-10-12 10:50:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612851": [
        {
            "ioc_value": "1qb.rk-8-y-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:44:16",
            "last_seen_utc": "2025-10-12 10:49:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612850": [
        {
            "ioc_value": "s4.rd1a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:40:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612849": [
        {
            "ioc_value": "y4.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:38:00",
            "last_seen_utc": "2025-10-12 10:44:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612848": [
        {
            "ioc_value": "hm.rd1a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:28:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612847": [
        {
            "ioc_value": "ee.fp-0-y-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:28:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612846": [
        {
            "ioc_value": "0jz.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:28:10",
            "last_seen_utc": "2025-10-12 10:28:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612845": [
        {
            "ioc_value": "2tj.fp-0-y-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612844": [
        {
            "ioc_value": "t1.rd1a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:18:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612843": [
        {
            "ioc_value": "prr.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:17:53",
            "last_seen_utc": "2025-10-12 10:18:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612842": [
        {
            "ioc_value": "uo.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:07:36",
            "last_seen_utc": "2025-10-12 10:10:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612841": [
        {
            "ioc_value": "ubs.fp-0-y-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 10:06:09",
            "last_seen_utc": "2025-10-12 10:10:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612840": [
        {
            "ioc_value": "qz9.rd1a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:59:42",
            "last_seen_utc": "2025-10-12 10:07:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612839": [
        {
            "ioc_value": "w4g.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:57:49",
            "last_seen_utc": "2025-10-12 10:06:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612838": [
        {
            "ioc_value": "eng-sub.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-12 09:55:43",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612836": [
        {
            "ioc_value": "hypudyk.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-12 09:55:42",
            "last_seen_utc": "2025-10-20 09:12:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612837": [
        {
            "ioc_value": "misdgxr.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-12 09:55:42",
            "last_seen_utc": "2025-11-19 15:36:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612835": [
        {
            "ioc_value": "4y4.fp-0-y-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:49:26",
            "last_seen_utc": "2025-10-12 09:57:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612834": [
        {
            "ioc_value": "a4.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:43:25",
            "last_seen_utc": "2025-10-12 09:49:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612833": [
        {
            "ioc_value": "f3l.fp-0-y-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:40:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612832": [
        {
            "ioc_value": "v2.rd1a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:39:11",
            "last_seen_utc": "2025-10-12 09:45:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612831": [
        {
            "ioc_value": "he.mcej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:38:42",
            "last_seen_utc": "2025-10-12 09:40:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612830": [
        {
            "ioc_value": "k.rd1a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:29:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612829": [
        {
            "ioc_value": "dy.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:28:25",
            "last_seen_utc": "2025-10-12 09:29:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612828": [
        {
            "ioc_value": "i3.ll-7-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:24:30",
            "last_seen_utc": "2025-10-12 09:29:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612827": [
        {
            "ioc_value": "sv.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:22:12",
            "last_seen_utc": "2025-10-12 09:24:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612826": [
        {
            "ioc_value": "s4.bw6u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:19:01",
            "last_seen_utc": "2025-10-12 09:23:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612825": [
        {
            "ioc_value": "uwf.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:18:30",
            "last_seen_utc": "2025-10-12 09:19:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612824": [
        {
            "ioc_value": "z5.ll-7-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:09:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612822": [
        {
            "ioc_value": "1e.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:03:07",
            "last_seen_utc": "2025-10-12 09:09:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612821": [
        {
            "ioc_value": "hm.bw6u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 09:01:21",
            "last_seen_utc": "2025-10-12 09:04:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612820": [
        {
            "ioc_value": "4ed.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:57:49",
            "last_seen_utc": "2025-10-12 09:01:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612819": [
        {
            "ioc_value": "ep.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:45:55",
            "last_seen_utc": "2025-10-12 08:52:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612817": [
        {
            "ioc_value": "07o.ll-7-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:43:48",
            "last_seen_utc": "2025-10-12 08:52:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612816": [
        {
            "ioc_value": "t1.bw6u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:38:21",
            "last_seen_utc": "2025-10-12 08:46:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612815": [
        {
            "ioc_value": "fv.nqyf7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:37:36",
            "last_seen_utc": "2025-10-12 08:43:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612814": [
        {
            "ioc_value": "qz9.bw6u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:29:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612813": [
        {
            "ioc_value": "7r.ll-7-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:28:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612812": [
        {
            "ioc_value": "hb9.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:27:52",
            "last_seen_utc": "2025-10-12 08:29:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612811": [
        {
            "ioc_value": "l0a.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:11:21",
            "last_seen_utc": "2025-10-12 08:14:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612809": [
        {
            "ioc_value": "hr.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:08:44",
            "last_seen_utc": "2025-10-12 08:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612808": [
        {
            "ioc_value": "no.ll-7-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:04:00",
            "last_seen_utc": "2025-10-12 08:13:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612805": [
        {
            "ioc_value": "v2.bw6u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 08:02:12",
            "last_seen_utc": "2025-10-12 08:14:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612801": [
        {
            "ioc_value": "u98.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:58:19",
            "last_seen_utc": "2025-10-12 08:04:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612798": [
        {
            "ioc_value": "xxxxz-61067.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-12 07:46:41",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612795": [
        {
            "ioc_value": "polextrading.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-12 07:46:08",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612796": [
        {
            "ioc_value": "poliy.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-12 07:46:08",
            "last_seen_utc": "2025-10-14 14:34:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612794": [
        {
            "ioc_value": "vicious-net.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-12 07:45:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612792": [
        {
            "ioc_value": "wanted-clinic.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-12 07:45:21",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612793": [
        {
            "ioc_value": "zagwe17.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-12 07:45:21",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612791": [
        {
            "ioc_value": "service-76f05sx7-1313036808.bj.apigw.tencentcs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-12 07:45:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612788": [
        {
            "ioc_value": "album-earthquake.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-12 07:44:49",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612789": [
        {
            "ioc_value": "not-mountain.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-12 07:44:49",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612790": [
        {
            "ioc_value": "skitput.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-12 07:44:49",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1612786": [
        {
            "ioc_value": "k.bw6u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:42:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612785": [
        {
            "ioc_value": "rg.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:40:31",
            "last_seen_utc": "2025-10-12 07:43:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612784": [
        {
            "ioc_value": "gb.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:38:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612783": [
        {
            "ioc_value": "cy7.fj-2-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:34:00",
            "last_seen_utc": "2025-10-12 07:43:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612782": [
        {
            "ioc_value": "7i.bqet3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:27:54",
            "last_seen_utc": "2025-10-12 07:33:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612781": [
        {
            "ioc_value": "s4.gr3e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:20:24",
            "last_seen_utc": "2025-10-12 07:28:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612780": [
        {
            "ioc_value": "st7.fj-2-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:19:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612779": [
        {
            "ioc_value": "lyh.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:18:06",
            "last_seen_utc": "2025-10-12 07:20:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612778": [
        {
            "ioc_value": "y0.fj-2-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:09:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612777": [
        {
            "ioc_value": "hm.gr3e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:08:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612776": [
        {
            "ioc_value": "fg7.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 07:07:46",
            "last_seen_utc": "2025-10-12 07:09:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612729": [
        {
            "ioc_value": "t1.gr3e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:58:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612714": [
        {
            "ioc_value": "os.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:57:27",
            "last_seen_utc": "2025-10-12 06:58:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612042": [
        {
            "ioc_value": "natanisralninoklips.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612043": [
        {
            "ioc_value": "bubuklaysdertolitodas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:26",
            "last_seen_utc": "2025-11-23 23:00:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612044": [
        {
            "ioc_value": "asderaopafolasuys.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612045": [
        {
            "ioc_value": "hasadipocopshas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612046": [
        {
            "ioc_value": "fifalolafasertikonex.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612047": [
        {
            "ioc_value": "vivaboklaysdera.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612048": [
        {
            "ioc_value": "mareditrixfiresa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612049": [
        {
            "ioc_value": "fasecompasedfjjd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612050": [
        {
            "ioc_value": "stasdirecthpsumsufgh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612051": [
        {
            "ioc_value": "didogpjokertroya.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612052": [
        {
            "ioc_value": "ninojokerfireyxfisto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612053": [
        {
            "ioc_value": "gasdoinertiolkihas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612054": [
        {
            "ioc_value": "bundosceradfolia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612055": [
        {
            "ioc_value": "nuriaduriokalklass.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612056": [
        {
            "ioc_value": "maximakampanijosnuostatai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612057": [
        {
            "ioc_value": "h1asoplooproe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612058": [
        {
            "ioc_value": "valoikdortordas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1612059": [
        {
            "ioc_value": "chachsdorinatrinitripokla.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-12 06:49:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1611992": [
        {
            "ioc_value": "ladybugs.hair",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-12 06:49:14",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://tria.ge/251011-v15t4avyhv/behavioral1",
            "tags": "infostealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1612098": [
        {
            "ioc_value": "onboard.veranobuilders.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-12 06:49:13",
            "last_seen_utc": "2025-10-17 09:05:04",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115358076955633201",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1612437": [
        {
            "ioc_value": "meet.veranobuilders.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-12 06:49:12",
            "last_seen_utc": "2025-10-17 09:05:04",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115358550462536217",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1612575": [
        {
            "ioc_value": "qz9.gr3e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:48:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612574": [
        {
            "ioc_value": "xh7.fj-2-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:48:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612573": [
        {
            "ioc_value": "f1.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:47:40",
            "last_seen_utc": "2025-10-12 06:48:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612572": [
        {
            "ioc_value": "29.fj-2-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:39:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612571": [
        {
            "ioc_value": "sp1.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:38:54",
            "last_seen_utc": "2025-10-12 06:40:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612570": [
        {
            "ioc_value": "v2.gr3e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:30:38",
            "last_seen_utc": "2025-10-12 06:40:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612569": [
        {
            "ioc_value": "y6m.fj-2-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:29:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612568": [
        {
            "ioc_value": "ks.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:28:24",
            "last_seen_utc": "2025-10-12 06:30:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612567": [
        {
            "ioc_value": "65.tvoj5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:18:06",
            "last_seen_utc": "2025-10-12 06:18:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612566": [
        {
            "ioc_value": "k.gr3e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:11:44",
            "last_seen_utc": "2025-10-12 06:18:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612565": [
        {
            "ioc_value": "sxkset-39222.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-12 06:05:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251012-dzykysdn6z",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612563": [
        {
            "ioc_value": "makis12-20904.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-12 06:05:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251012-eag3cadp8y",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612564": [
        {
            "ioc_value": "makis12-33748.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-12 06:05:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251012-d3g3daxrx9",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612559": [
        {
            "ioc_value": "nice-chairman.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-12 06:05:09",
            "last_seen_utc": "2025-10-22 12:44:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251012-db2mpsxpx2",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612556": [
        {
            "ioc_value": "i2.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:02:13",
            "last_seen_utc": "2025-10-12 06:11:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612554": [
        {
            "ioc_value": "marcofreilelora09.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-12 06:01:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251012-bgaeasdj2z",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1612553": [
        {
            "ioc_value": "t1.qj4y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 06:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612552": [
        {
            "ioc_value": "b6v.pf-6-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:59:40",
            "last_seen_utc": "2025-10-12 06:03:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612551": [
        {
            "ioc_value": "nxz.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:58:01",
            "last_seen_utc": "2025-10-12 06:00:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612550": [
        {
            "ioc_value": "7m.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:47:43",
            "last_seen_utc": "2025-10-12 05:49:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612549": [
        {
            "ioc_value": "qz9.qj4y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:40:35",
            "last_seen_utc": "2025-10-12 05:49:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612548": [
        {
            "ioc_value": "ic3.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:37:56",
            "last_seen_utc": "2025-10-12 05:40:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612547": [
        {
            "ioc_value": "p0.pf-6-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:34:47",
            "last_seen_utc": "2025-10-12 05:38:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612546": [
        {
            "ioc_value": "v2.qj4y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612545": [
        {
            "ioc_value": "3oi.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:27:40",
            "last_seen_utc": "2025-10-12 05:34:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612544": [
        {
            "ioc_value": "k.qj4y4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612543": [
        {
            "ioc_value": "32.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:17:20",
            "last_seen_utc": "2025-10-12 05:21:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612542": [
        {
            "ioc_value": "wh.pf-6-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:17:14",
            "last_seen_utc": "2025-10-12 05:21:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612541": [
        {
            "ioc_value": "s4.zv1a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:09:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612540": [
        {
            "ioc_value": "xt.wtok2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 05:09:15",
            "last_seen_utc": "2025-10-12 05:17:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612539": [
        {
            "ioc_value": "x8n.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:58:15",
            "last_seen_utc": "2025-10-12 05:00:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612538": [
        {
            "ioc_value": "hm.zv1a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:50:32",
            "last_seen_utc": "2025-10-12 05:00:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612537": [
        {
            "ioc_value": "h9.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:48:59",
            "last_seen_utc": "2025-10-12 04:50:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612536": [
        {
            "ioc_value": "hd.pf-6-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:48:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612535": [
        {
            "ioc_value": "t1.zv1a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:39:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612534": [
        {
            "ioc_value": "tq.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:38:04",
            "last_seen_utc": "2025-10-12 04:48:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612533": [
        {
            "ioc_value": "qz9.zv1a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:28:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612532": [
        {
            "ioc_value": "z1.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:27:46",
            "last_seen_utc": "2025-10-12 04:28:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612531": [
        {
            "ioc_value": "bd.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:17:58",
            "last_seen_utc": "2025-10-12 04:19:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612530": [
        {
            "ioc_value": "ip.pf-6-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:14:09",
            "last_seen_utc": "2025-10-12 04:28:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612529": [
        {
            "ioc_value": "v2.zv1a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:11:09",
            "last_seen_utc": "2025-10-12 04:19:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612528": [
        {
            "ioc_value": "q4.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 04:07:43",
            "last_seen_utc": "2025-10-12 04:14:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612477": [
        {
            "ioc_value": "px.pf-6-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:58:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612476": [
        {
            "ioc_value": "k.zv1a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:58:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612475": [
        {
            "ioc_value": "g.p74yi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:57:51",
            "last_seen_utc": "2025-10-12 03:58:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612474": [
        {
            "ioc_value": "d5.8a-mg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:48:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612473": [
        {
            "ioc_value": "p9.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:47:33",
            "last_seen_utc": "2025-10-12 03:53:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612472": [
        {
            "ioc_value": "p2.ls-2-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:45:24",
            "last_seen_utc": "2025-10-12 03:53:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612471": [
        {
            "ioc_value": "h7m.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:38:16",
            "last_seen_utc": "2025-10-12 03:45:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612470": [
        {
            "ioc_value": "m6.8a-mg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:30:30",
            "last_seen_utc": "2025-10-12 03:39:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612469": [
        {
            "ioc_value": "wmw.ls-2-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:28:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612468": [
        {
            "ioc_value": "x.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:28:27",
            "last_seen_utc": "2025-10-12 03:30:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612467": [
        {
            "ioc_value": "t1.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:18:00",
            "last_seen_utc": "2025-10-12 03:18:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612466": [
        {
            "ioc_value": "t1.8a-mg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:10:47",
            "last_seen_utc": "2025-10-12 03:18:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612465": [
        {
            "ioc_value": "9m.ls-2-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:08:23",
            "last_seen_utc": "2025-10-12 03:18:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612464": [
        {
            "ioc_value": "zk.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 03:07:09",
            "last_seen_utc": "2025-10-12 03:10:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612463": [
        {
            "ioc_value": "n2.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:57:51",
            "last_seen_utc": "2025-10-12 02:58:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612461": [
        {
            "ioc_value": "qz9.8a-mg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:49:35",
            "last_seen_utc": "2025-10-12 02:58:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612459": [
        {
            "ioc_value": "v2.ls-2-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:49:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612458": [
        {
            "ioc_value": "b.p51io.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:48:04",
            "last_seen_utc": "2025-10-12 02:49:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612457": [
        {
            "ioc_value": "5f.ls-2-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:38:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612456": [
        {
            "ioc_value": "y7n.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:37:46",
            "last_seen_utc": "2025-10-12 02:38:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612455": [
        {
            "ioc_value": "v2.8a-mg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:30:20",
            "last_seen_utc": "2025-10-12 02:38:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612454": [
        {
            "ioc_value": "95.ls-2-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:27:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612453": [
        {
            "ioc_value": "qz.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:27:26",
            "last_seen_utc": "2025-10-12 02:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612452": [
        {
            "ioc_value": "ent.bw-6-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:19:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612451": [
        {
            "ioc_value": "k.8a-mg.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612450": [
        {
            "ioc_value": "m3.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:18:41",
            "last_seen_utc": "2025-10-12 02:19:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612449": [
        {
            "ioc_value": "t2.0y-pm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:09:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612447": [
        {
            "ioc_value": "x.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:08:35",
            "last_seen_utc": "2025-10-12 02:09:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612448": [
        {
            "ioc_value": "sx.bw-6-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 02:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612446": [
        {
            "ioc_value": "vv.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:58:28",
            "last_seen_utc": "2025-10-12 02:04:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612445": [
        {
            "ioc_value": "75.bw-6-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:54:49",
            "last_seen_utc": "2025-10-12 02:04:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612444": [
        {
            "ioc_value": "b1.0y-pm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:51:33",
            "last_seen_utc": "2025-10-12 02:00:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612443": [
        {
            "ioc_value": "a9.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:48:09",
            "last_seen_utc": "2025-10-12 01:54:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612442": [
        {
            "ioc_value": "p.c34uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:37:56",
            "last_seen_utc": "2025-10-12 01:38:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612441": [
        {
            "ioc_value": "xp3.bw-6-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:29:54",
            "last_seen_utc": "2025-10-12 01:38:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612440": [
        {
            "ioc_value": "t1v.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:28:04",
            "last_seen_utc": "2025-10-12 01:29:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612439": [
        {
            "ioc_value": "g4.0y-pm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:20:54",
            "last_seen_utc": "2025-10-12 01:38:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612438": [
        {
            "ioc_value": "k0.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:17:44",
            "last_seen_utc": "2025-10-12 01:20:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612436": [
        {
            "ioc_value": "pm7.0y-pm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:10:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612435": [
        {
            "ioc_value": "hx.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:07:55",
            "last_seen_utc": "2025-10-12 01:10:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612434": [
        {
            "ioc_value": "837.bw-6-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 01:03:00",
            "last_seen_utc": "2025-10-12 01:19:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612433": [
        {
            "ioc_value": "k4.0y-pm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:59:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612432": [
        {
            "ioc_value": "z7.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:57:36",
            "last_seen_utc": "2025-10-12 01:03:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612430": [
        {
            "ioc_value": "y.0y-pm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:49:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612429": [
        {
            "ioc_value": "qa.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:48:20",
            "last_seen_utc": "2025-10-12 00:49:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612428": [
        {
            "ioc_value": "oh.bw-6-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:39:27",
            "last_seen_utc": "2025-10-12 00:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612427": [
        {
            "ioc_value": "g8.7a-xz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:39:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612426": [
        {
            "ioc_value": "m2.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:38:32",
            "last_seen_utc": "2025-10-12 00:39:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612425": [
        {
            "ioc_value": "e.v57eo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:28:14",
            "last_seen_utc": "2025-10-12 00:30:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612424": [
        {
            "ioc_value": "xw.fj-4-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:25:22",
            "last_seen_utc": "2025-10-12 00:29:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612423": [
        {
            "ioc_value": "k4.7a-xz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:21:19",
            "last_seen_utc": "2025-10-12 00:30:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612421": [
        {
            "ioc_value": "1m.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:19:28",
            "last_seen_utc": "2025-10-12 00:25:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612192": [
        {
            "ioc_value": "z3.7a-xz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:09:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612191": [
        {
            "ioc_value": "gw.fj-4-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:08:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612190": [
        {
            "ioc_value": "c8.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-12 00:08:02",
            "last_seen_utc": "2025-10-12 00:09:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612108": [
        {
            "ioc_value": "p0.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:57:43",
            "last_seen_utc": "2025-10-12 00:04:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612107": [
        {
            "ioc_value": "3tq.fj-4-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:53:03",
            "last_seen_utc": "2025-10-12 00:04:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612106": [
        {
            "ioc_value": "qm9.7a-xz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:51:40",
            "last_seen_utc": "2025-10-12 00:01:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612105": [
        {
            "ioc_value": "0zq.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:47:55",
            "last_seen_utc": "2025-10-11 23:53:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612104": [
        {
            "ioc_value": "u1.7a-xz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:40:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612103": [
        {
            "ioc_value": "v3.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:37:37",
            "last_seen_utc": "2025-10-11 23:40:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612102": [
        {
            "ioc_value": "h1.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:27:50",
            "last_seen_utc": "2025-10-11 23:30:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612101": [
        {
            "ioc_value": "lw.fj-4-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:24:43",
            "last_seen_utc": "2025-10-11 23:28:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612100": [
        {
            "ioc_value": "h.7a-xz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:20:33",
            "last_seen_utc": "2025-10-11 23:30:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612099": [
        {
            "ioc_value": "s.s91ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:18:33",
            "last_seen_utc": "2025-10-11 23:24:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612097": [
        {
            "ioc_value": "qoc.fj-4-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:09:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612096": [
        {
            "ioc_value": "j0.0o-js.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:08:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612095": [
        {
            "ioc_value": "t1n.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:08:15",
            "last_seen_utc": "2025-10-11 23:09:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612094": [
        {
            "ioc_value": "zd.0o-js.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 23:00:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612093": [
        {
            "ioc_value": "oy.fj-4-i-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:59:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612092": [
        {
            "ioc_value": "r9.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:58:28",
            "last_seen_utc": "2025-10-11 23:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612091": [
        {
            "ioc_value": "jv0.mw-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612090": [
        {
            "ioc_value": "bq.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:48:08",
            "last_seen_utc": "2025-10-11 22:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612089": [
        {
            "ioc_value": "r2.0o-js.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:40:42",
            "last_seen_utc": "2025-10-11 22:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612088": [
        {
            "ioc_value": "x2j.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:38:17",
            "last_seen_utc": "2025-10-11 22:40:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612087": [
        {
            "ioc_value": "pc.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:27:58",
            "last_seen_utc": "2025-10-11 22:34:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612086": [
        {
            "ioc_value": "ml.mw-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:23:52",
            "last_seen_utc": "2025-10-11 22:34:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612085": [
        {
            "ioc_value": "wq9.0o-js.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:20:46",
            "last_seen_utc": "2025-10-11 22:33:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612084": [
        {
            "ioc_value": "m8.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:17:41",
            "last_seen_utc": "2025-10-11 22:23:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612083": [
        {
            "ioc_value": "c7.0o-js.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:09:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612082": [
        {
            "ioc_value": "a.d44yy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 22:07:51",
            "last_seen_utc": "2025-10-11 22:09:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612081": [
        {
            "ioc_value": "k0n.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:57:21",
            "last_seen_utc": "2025-10-11 21:58:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612080": [
        {
            "ioc_value": "7ff.mw-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:54:47",
            "last_seen_utc": "2025-10-11 22:08:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612079": [
        {
            "ioc_value": "n.0o-js.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:51:56",
            "last_seen_utc": "2025-10-11 21:58:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612078": [
        {
            "ioc_value": "wz.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:48:36",
            "last_seen_utc": "2025-10-11 21:54:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612077": [
        {
            "ioc_value": "9w.mw-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:31:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612076": [
        {
            "ioc_value": "h2.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:30:38",
            "last_seen_utc": "2025-10-11 21:33:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612074": [
        {
            "ioc_value": "p1.5u-zk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:28:29",
            "last_seen_utc": "2025-10-11 21:33:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612073": [
        {
            "ioc_value": "q.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:21:21",
            "last_seen_utc": "2025-10-11 21:28:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612072": [
        {
            "ioc_value": "k9.5u-zk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:19:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612071": [
        {
            "ioc_value": "mq3.mw-9-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:18:05",
            "last_seen_utc": "2025-10-11 21:21:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612070": [
        {
            "ioc_value": "xt.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:17:06",
            "last_seen_utc": "2025-10-11 21:19:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612069": [
        {
            "ioc_value": "n5.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:07:50",
            "last_seen_utc": "2025-10-11 21:10:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612068": [
        {
            "ioc_value": "m7.5u-zk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 21:01:34",
            "last_seen_utc": "2025-10-11 21:10:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612067": [
        {
            "ioc_value": "yh5.db-3-a-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:58:32",
            "last_seen_utc": "2025-10-11 21:08:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612066": [
        {
            "ioc_value": "b.g26ia.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:58:03",
            "last_seen_utc": "2025-10-11 21:01:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612064": [
        {
            "ioc_value": "jlk.db-3-a-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:50:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612063": [
        {
            "ioc_value": "tq1.5u-zk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:49:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612062": [
        {
            "ioc_value": "x.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:47:43",
            "last_seen_utc": "2025-10-11 20:50:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612061": [
        {
            "ioc_value": "x5c.db-3-a-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:39:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612060": [
        {
            "ioc_value": "h9m.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:37:55",
            "last_seen_utc": "2025-10-11 20:39:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612041": [
        {
            "ioc_value": "qns.db-3-a-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:29:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612040": [
        {
            "ioc_value": "tq.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:27:36",
            "last_seen_utc": "2025-10-11 20:29:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612038": [
        {
            "ioc_value": "b2.5u-zk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:23:25",
            "last_seen_utc": "2025-10-11 20:38:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612037": [
        {
            "ioc_value": "z1.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:18:19",
            "last_seen_utc": "2025-10-11 20:23:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1612036": [
        {
            "ioc_value": "ai.db-3-a-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:14:36",
            "last_seen_utc": "2025-10-11 20:19:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612034": [
        {
            "ioc_value": "x.5u-zk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:09:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1612033": [
        {
            "ioc_value": "bd.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 20:08:30",
            "last_seen_utc": "2025-10-11 20:14:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611994": [
        {
            "ioc_value": "9f9.qj-4-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:59:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611993": [
        {
            "ioc_value": "q7.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:58:12",
            "last_seen_utc": "2025-10-11 20:00:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611991": [
        {
            "ioc_value": "y4.8e-hr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:55:51",
            "last_seen_utc": "2025-10-11 20:00:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611990": [
        {
            "ioc_value": "g.b10ou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:54:20",
            "last_seen_utc": "2025-10-11 19:55:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611988": [
        {
            "ioc_value": "hf.qj-4-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:48:53",
            "last_seen_utc": "2025-10-11 19:55:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611987": [
        {
            "ioc_value": "xq9.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:48:07",
            "last_seen_utc": "2025-10-11 19:48:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611986": [
        {
            "ioc_value": "n0.8e-hr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:40:06",
            "last_seen_utc": "2025-10-11 19:48:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611985": [
        {
            "ioc_value": "h7.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:36:49",
            "last_seen_utc": "2025-10-11 19:40:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611984": [
        {
            "ioc_value": "0jd.qj-4-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:34:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611983": [
        {
            "ioc_value": "e1.8e-hr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:29:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611982": [
        {
            "ioc_value": "pv.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:28:34",
            "last_seen_utc": "2025-10-11 19:34:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611981": [
        {
            "ioc_value": "ew4.qj-4-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611980": [
        {
            "ioc_value": "qk2.8e-hr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:19:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611979": [
        {
            "ioc_value": "a1.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:18:46",
            "last_seen_utc": "2025-10-11 19:21:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611978": [
        {
            "ioc_value": "uv.qj-4-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611977": [
        {
            "ioc_value": "zt.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 19:07:28",
            "last_seen_utc": "2025-10-11 19:08:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611976": [
        {
            "ioc_value": "u5.8e-hr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:59:59",
            "last_seen_utc": "2025-10-11 19:08:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611975": [
        {
            "ioc_value": "n3.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:57:43",
            "last_seen_utc": "2025-10-11 18:59:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611974": [
        {
            "ioc_value": "e.r65ao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:50:28",
            "last_seen_utc": "2025-10-11 18:55:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611973": [
        {
            "ioc_value": "r.8e-hr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:49:49",
            "last_seen_utc": "2025-10-11 18:54:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611969": [
        {
            "ioc_value": "4ht.qj-4-y-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:47:34",
            "last_seen_utc": "2025-10-11 18:59:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611964": [
        {
            "ioc_value": "v2n.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:46:16",
            "last_seen_utc": "2025-10-11 18:49:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611963": [
        {
            "ioc_value": "tn.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:35:27",
            "last_seen_utc": "2025-10-11 18:37:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611961": [
        {
            "ioc_value": "f1.6i-xm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:31:18",
            "last_seen_utc": "2025-10-11 18:36:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611960": [
        {
            "ioc_value": "qw.zk-5-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:29:24",
            "last_seen_utc": "2025-10-11 18:37:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611959": [
        {
            "ioc_value": "x.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:28:13",
            "last_seen_utc": "2025-10-11 18:31:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611807": [
        {
            "ioc_value": "ftp.arcon.com.pe",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.agent_tesla",
            "malware_alias": "AgenTesla,AgentTesla,Negasteal",
            "malware_printable": "Agent Tesla",
            "first_seen_utc": "2025-10-11 18:20:56",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "chronobserver"
        }
    ],
    "1611958": [
        {
            "ioc_value": "r3.6i-xm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611957": [
        {
            "ioc_value": "yn.zk-5-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:18:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611956": [
        {
            "ioc_value": "r1.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:17:55",
            "last_seen_utc": "2025-10-11 18:20:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611955": [
        {
            "ioc_value": "k7.6i-xm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:10:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611954": [
        {
            "ioc_value": "vhx.zk-5-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:09:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611953": [
        {
            "ioc_value": "qp.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:08:00",
            "last_seen_utc": "2025-10-11 18:10:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611952": [
        {
            "ioc_value": "take-baker.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-10-11 18:05:43",
            "last_seen_utc": "2025-10-20 12:27:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/251011-v7ypcssqx7",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611951": [
        {
            "ioc_value": "hanezack.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-11 18:01:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251011-tzyhyssnt6",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611950": [
        {
            "ioc_value": "aa9.6i-xm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 18:00:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611949": [
        {
            "ioc_value": "5pc.zk-5-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611948": [
        {
            "ioc_value": "m9.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:57:42",
            "last_seen_utc": "2025-10-11 18:00:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611947": [
        {
            "ioc_value": "v2.6i-xm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:49:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611946": [
        {
            "ioc_value": "4n.zk-5-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:48:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611945": [
        {
            "ioc_value": "a.s80ye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:47:54",
            "last_seen_utc": "2025-10-11 17:49:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611944": [
        {
            "ioc_value": "s9.zk-5-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611943": [
        {
            "ioc_value": "g.6i-xm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:41:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611942": [
        {
            "ioc_value": "ybi.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:40:40",
            "last_seen_utc": "2025-10-11 17:43:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611941": [
        {
            "ioc_value": "ae3.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:37:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611940": [
        {
            "ioc_value": "zj.1y-zt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:30:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611939": [
        {
            "ioc_value": "9ki.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:27:27",
            "last_seen_utc": "2025-10-11 17:30:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611938": [
        {
            "ioc_value": "fta.fq-1-y-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:19:51",
            "last_seen_utc": "2025-10-11 17:27:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611937": [
        {
            "ioc_value": "m2.1y-zt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:19:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611936": [
        {
            "ioc_value": "m4.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:18:12",
            "last_seen_utc": "2025-10-11 17:19:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611935": [
        {
            "ioc_value": "c9q.fq-1-y-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:13:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611934": [
        {
            "ioc_value": "aa9.1y-zt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:10:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611933": [
        {
            "ioc_value": "pe.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:08:24",
            "last_seen_utc": "2025-10-11 17:13:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611932": [
        {
            "ioc_value": "mv.fq-1-y-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 17:00:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611931": [
        {
            "ioc_value": "yw.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:58:05",
            "last_seen_utc": "2025-10-11 17:01:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611930": [
        {
            "ioc_value": "xq0.1y-zt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:50:22",
            "last_seen_utc": "2025-10-11 17:01:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611929": [
        {
            "ioc_value": "ib.fq-1-y-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:49:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611928": [
        {
            "ioc_value": "jm.vw0e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:48:12",
            "last_seen_utc": "2025-10-11 16:50:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611925": [
        {
            "ioc_value": "3t2.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:37:53",
            "last_seen_utc": "2025-10-11 16:40:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611924": [
        {
            "ioc_value": "ddo.fq-1-y-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:34:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611923": [
        {
            "ioc_value": "c5.1y-zt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:33:21",
            "last_seen_utc": "2025-10-11 16:40:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611922": [
        {
            "ioc_value": "3tq.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:28:06",
            "last_seen_utc": "2025-10-11 16:34:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611921": [
        {
            "ioc_value": "phd.fq-1-y-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611920": [
        {
            "ioc_value": "l.1y-zt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611919": [
        {
            "ioc_value": "fj.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:17:49",
            "last_seen_utc": "2025-10-11 16:19:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611918": [
        {
            "ioc_value": "k3.9a-hd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:09:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611917": [
        {
            "ioc_value": "lw.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:08:01",
            "last_seen_utc": "2025-10-11 16:09:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611915": [
        {
            "ioc_value": "fpt.bdkj.com.ng",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-11 16:02:01",
            "last_seen_utc": "2025-10-12 04:01:53",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.230.157.220+fpt.bdkj.com.ng",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611911": [
        {
            "ioc_value": "90t.rd-1-a-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 16:01:25",
            "last_seen_utc": "2025-10-11 16:08:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611907": [
        {
            "ioc_value": "kwi.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:59:37",
            "last_seen_utc": "2025-10-11 16:02:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611906": [
        {
            "ioc_value": "aa.9a-hd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:51:23",
            "last_seen_utc": "2025-10-11 16:02:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611905": [
        {
            "ioc_value": "qoc.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:49:15",
            "last_seen_utc": "2025-10-11 15:51:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611904": [
        {
            "ioc_value": "41i.rd-1-a-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:45:12",
            "last_seen_utc": "2025-10-11 15:49:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611903": [
        {
            "ioc_value": "ywc.dk2o1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:45:03",
            "last_seen_utc": "2025-10-11 15:47:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611902": [
        {
            "ioc_value": "n0c.rd-1-a-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:39:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611901": [
        {
            "ioc_value": "rn.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:38:17",
            "last_seen_utc": "2025-10-11 15:39:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611900": [
        {
            "ioc_value": "h1.9a-hd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:33:25",
            "last_seen_utc": "2025-10-11 15:47:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611899": [
        {
            "ioc_value": "5iz.rd-1-a-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:29:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611898": [
        {
            "ioc_value": "6r.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:27:58",
            "last_seen_utc": "2025-10-11 15:33:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611897": [
        {
            "ioc_value": "mq3.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:18:11",
            "last_seen_utc": "2025-10-11 15:21:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611896": [
        {
            "ioc_value": "ho7.rd-1-a-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:16:49",
            "last_seen_utc": "2025-10-11 15:21:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611895": [
        {
            "ioc_value": "x7.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:07:53",
            "last_seen_utc": "2025-10-11 15:16:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611894": [
        {
            "ioc_value": "dwl.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:03:42",
            "last_seen_utc": "2025-10-11 15:05:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611893": [
        {
            "ioc_value": "pz8.9a-hd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 15:01:07",
            "last_seen_utc": "2025-10-11 15:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611892": [
        {
            "ioc_value": "ma.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 14:57:40",
            "last_seen_utc": "2025-10-11 15:01:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611891": [
        {
            "ioc_value": "w4.9a-hd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 14:48:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611890": [
        {
            "ioc_value": "pai.rd-1-a-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 14:48:06",
            "last_seen_utc": "2025-10-11 14:58:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611889": [
        {
            "ioc_value": "h5r.xt7y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 14:47:48",
            "last_seen_utc": "2025-10-11 14:48:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611888": [
        {
            "ioc_value": "6h.gr-3-e-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 14:38:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611887": [
        {
            "ioc_value": "d.9a-hd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 14:33:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611886": [
        {
            "ioc_value": "p5k.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 14:31:24",
            "last_seen_utc": "2025-10-11 14:38:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611885": [
        {
            "ioc_value": "s4.4u-rr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:50:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611884": [
        {
            "ioc_value": "jd.gr-3-e-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611883": [
        {
            "ioc_value": "hf.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:48:10",
            "last_seen_utc": "2025-10-11 13:50:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611882": [
        {
            "ioc_value": "v0m.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:32:47",
            "last_seen_utc": "2025-10-11 13:34:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611881": [
        {
            "ioc_value": "hm.4u-rr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:27:58",
            "last_seen_utc": "2025-10-11 13:34:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611880": [
        {
            "ioc_value": "0jd.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:26:04",
            "last_seen_utc": "2025-10-11 13:27:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611879": [
        {
            "ioc_value": "qs.gr-3-e-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:23:01",
            "last_seen_utc": "2025-10-11 13:33:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611878": [
        {
            "ioc_value": "t1.4u-rr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611877": [
        {
            "ioc_value": "ec.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:17:48",
            "last_seen_utc": "2025-10-11 13:23:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611876": [
        {
            "ioc_value": "qz9.4u-rr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:08:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611875": [
        {
            "ioc_value": "3rv.gr-3-e-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:07:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611874": [
        {
            "ioc_value": "ew4.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 13:07:32",
            "last_seen_utc": "2025-10-11 13:08:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611873": [
        {
            "ioc_value": "gne.gr-3-e-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611872": [
        {
            "ioc_value": "88.xr6u9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:58:46",
            "last_seen_utc": "2025-10-11 13:02:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611871": [
        {
            "ioc_value": "v2.4u-rr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:51:10",
            "last_seen_utc": "2025-10-11 13:02:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611869": [
        {
            "ioc_value": "vhx.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:48:28",
            "last_seen_utc": "2025-10-11 12:51:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611868": [
        {
            "ioc_value": "zu.zv-1-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:45:36",
            "last_seen_utc": "2025-10-11 12:48:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611867": [
        {
            "ioc_value": "u3.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:38:10",
            "last_seen_utc": "2025-10-11 12:45:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611866": [
        {
            "ioc_value": "k.4u-rr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:31:38",
            "last_seen_utc": "2025-10-11 12:43:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611865": [
        {
            "ioc_value": "qj.zv-1-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:29:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611864": [
        {
            "ioc_value": "5pc.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:28:23",
            "last_seen_utc": "2025-10-11 12:31:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611863": [
        {
            "ioc_value": "51p.pf4i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611862": [
        {
            "ioc_value": "bt.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:18:03",
            "last_seen_utc": "2025-10-11 12:19:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611861": [
        {
            "ioc_value": "04j.zv-1-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:13:17",
            "last_seen_utc": "2025-10-11 12:18:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611860": [
        {
            "ioc_value": "4n.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:07:47",
            "last_seen_utc": "2025-10-11 12:13:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611859": [
        {
            "ioc_value": "intltradingcomp.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-10-11 12:05:57",
            "last_seen_utc": "2025-10-20 12:27:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/251011-h9s6fazxbw",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611853": [
        {
            "ioc_value": "qeo.pf4i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 12:02:14",
            "last_seen_utc": "2025-10-11 12:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611849": [
        {
            "ioc_value": "tksexe.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-11 12:01:11",
            "last_seen_utc": "2025-10-14 14:34:15",
            "confidence_level": 100,
            "reference": "https://tria.ge/251011-jtj39szyev",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611847": [
        {
            "ioc_value": "tv-starting.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-11 12:01:03",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251011-m4yk7aymy2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611848": [
        {
            "ioc_value": "W0rmLeFilou-26308.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-11 12:01:03",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251011-nbj3rsynt5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611846": [
        {
            "ioc_value": "890.zv-1-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611845": [
        {
            "ioc_value": "skz.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:57:59",
            "last_seen_utc": "2025-10-11 12:02:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611844": [
        {
            "ioc_value": "gz.pf4i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:40:45",
            "last_seen_utc": "2025-10-11 11:45:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611843": [
        {
            "ioc_value": "s9.jt4o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:40:34",
            "last_seen_utc": "2025-10-11 11:45:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611842": [
        {
            "ioc_value": "6ci.zv-1-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:38:50",
            "last_seen_utc": "2025-10-11 11:42:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611841": [
        {
            "ioc_value": "uik.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:37:50",
            "last_seen_utc": "2025-10-11 11:40:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611840": [
        {
            "ioc_value": "5u.pf4i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:28:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611839": [
        {
            "ioc_value": "ddo.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:28:33",
            "last_seen_utc": "2025-10-11 11:28:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611838": [
        {
            "ioc_value": "se.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:18:38",
            "last_seen_utc": "2025-10-11 11:22:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611837": [
        {
            "ioc_value": "k6.pf4i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:10:30",
            "last_seen_utc": "2025-10-11 11:22:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611836": [
        {
            "ioc_value": "phd.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:08:22",
            "last_seen_utc": "2025-10-11 11:10:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611835": [
        {
            "ioc_value": "qbo.sd-4-o-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 11:00:30",
            "last_seen_utc": "2025-10-11 11:08:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611834": [
        {
            "ioc_value": "092.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:58:34",
            "last_seen_utc": "2025-10-11 11:00:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611832": [
        {
            "ioc_value": "vh.pf4i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:53:15",
            "last_seen_utc": "2025-10-11 11:00:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611830": [
        {
            "ioc_value": "fx.sd-4-o-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:49:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611829": [
        {
            "ioc_value": "d90.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:48:04",
            "last_seen_utc": "2025-10-11 10:53:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611828": [
        {
            "ioc_value": "6ni.nq-8-e-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:38:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611827": [
        {
            "ioc_value": "jw.vj4e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:37:47",
            "last_seen_utc": "2025-10-11 10:38:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611826": [
        {
            "ioc_value": "wv1.nq-8-e-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:28:13",
            "last_seen_utc": "2025-10-11 10:31:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611825": [
        {
            "ioc_value": "pai.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:27:58",
            "last_seen_utc": "2025-10-11 10:31:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611824": [
        {
            "ioc_value": "wjs.dk9a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611823": [
        {
            "ioc_value": "tbi.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:17:40",
            "last_seen_utc": "2025-10-11 10:19:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611822": [
        {
            "ioc_value": "ncj.nq-8-e-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:12:27",
            "last_seen_utc": "2025-10-11 10:18:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611821": [
        {
            "ioc_value": "gne.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:06:52",
            "last_seen_utc": "2025-10-11 10:12:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611820": [
        {
            "ioc_value": "yk.dk9a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 10:02:08",
            "last_seen_utc": "2025-10-11 10:09:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611819": [
        {
            "ioc_value": "si3.nq-8-e-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611818": [
        {
            "ioc_value": "uy1.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:58:36",
            "last_seen_utc": "2025-10-11 10:02:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611816": [
        {
            "ioc_value": "jump.hometrendoo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-11 09:56:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251011-h51dysxqw8",
            "tags": "c2,ConnectWise,RAT,ScreenConnect,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611814": [
        {
            "ioc_value": "ydb.dk9a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:49:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611813": [
        {
            "ioc_value": "3rv.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:48:18",
            "last_seen_utc": "2025-10-11 09:53:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611812": [
        {
            "ioc_value": "qtc.nq-8-e-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:44:26",
            "last_seen_utc": "2025-10-11 09:53:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611810": [
        {
            "ioc_value": "astonmartiomanebiklos.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-11 09:43:14",
            "last_seen_utc": "2025-10-11 20:31:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611809": [
        {
            "ioc_value": "q3.dk9a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:39:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611808": [
        {
            "ioc_value": "m9.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:38:31",
            "last_seen_utc": "2025-10-11 09:44:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611805": [
        {
            "ioc_value": "jej.nq-8-e-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:30:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611804": [
        {
            "ioc_value": "eah.dk9a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:29:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611803": [
        {
            "ioc_value": "qs.lr2y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:28:13",
            "last_seen_utc": "2025-10-11 09:30:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611802": [
        {
            "ioc_value": "17s.dk9a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:19:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611801": [
        {
            "ioc_value": "kk0.pf-4-i-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:18:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611800": [
        {
            "ioc_value": "04j.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:17:56",
            "last_seen_utc": "2025-10-11 09:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611799": [
        {
            "ioc_value": "mz.sd4o7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:09:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611798": [
        {
            "ioc_value": "vgk.pf-4-i-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:09:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611796": [
        {
            "ioc_value": "90.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 09:08:08",
            "last_seen_utc": "2025-10-11 09:09:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611795": [
        {
            "ioc_value": "4cv.sd4o7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:59:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611794": [
        {
            "ioc_value": "ybg.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:57:48",
            "last_seen_utc": "2025-10-11 08:59:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611784": [
        {
            "ioc_value": "1je.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:44:27",
            "last_seen_utc": "2025-10-11 08:45:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611782": [
        {
            "ioc_value": "4o2.sd4o7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:39:30",
            "last_seen_utc": "2025-10-11 08:45:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611781": [
        {
            "ioc_value": "890.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:38:14",
            "last_seen_utc": "2025-10-11 08:39:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611780": [
        {
            "ioc_value": "jsd.pf-4-i-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:34:27",
            "last_seen_utc": "2025-10-11 08:45:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611779": [
        {
            "ioc_value": "l3.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:28:25",
            "last_seen_utc": "2025-10-11 08:34:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611778": [
        {
            "ioc_value": "td.sd4o7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:21:22",
            "last_seen_utc": "2025-10-11 08:31:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611777": [
        {
            "ioc_value": "6ci.gc0o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:18:30",
            "last_seen_utc": "2025-10-11 08:21:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611776": [
        {
            "ioc_value": "yo.pf-4-i-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:14:38",
            "last_seen_utc": "2025-10-11 08:20:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611775": [
        {
            "ioc_value": "cm.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:08:13",
            "last_seen_utc": "2025-10-11 08:14:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611767": [
        {
            "ioc_value": "ffu.sd4o7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:00:49",
            "last_seen_utc": "2025-10-11 08:10:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611766": [
        {
            "ioc_value": "8sl.pf-4-i-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 08:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611765": [
        {
            "ioc_value": "y7.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 07:58:24",
            "last_seen_utc": "2025-10-11 08:00:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611764": [
        {
            "ioc_value": "u.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 07:48:08",
            "last_seen_utc": "2025-10-11 07:50:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611763": [
        {
            "ioc_value": "6g.sd4o7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 07:40:20",
            "last_seen_utc": "2025-10-11 07:50:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611762": [
        {
            "ioc_value": "r3.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 07:38:20",
            "last_seen_utc": "2025-10-11 07:40:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611761": [
        {
            "ioc_value": "uec.pf-4-i-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 07:33:58",
            "last_seen_utc": "2025-10-11 07:39:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611760": [
        {
            "ioc_value": "ve.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 07:28:32",
            "last_seen_utc": "2025-10-11 07:33:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611759": [
        {
            "ioc_value": "k8.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 07:17:32",
            "last_seen_utc": "2025-10-11 07:20:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611758": [
        {
            "ioc_value": "p.su6ak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 07:07:44",
            "last_seen_utc": "2025-10-11 07:09:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611756": [
        {
            "ioc_value": "x.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 06:58:27",
            "last_seen_utc": "2025-10-11 06:59:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611755": [
        {
            "ioc_value": "h9m.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 06:48:10",
            "last_seen_utc": "2025-10-11 06:52:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611754": [
        {
            "ioc_value": "tq.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 06:38:53",
            "last_seen_utc": "2025-10-11 06:45:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611559": [
        {
            "ioc_value": "fixprojectbest.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-11 06:36:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/450bfb67-7cef-495a-a257-44fe31d3b08c",
            "tags": "FixStealer,infostealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611608": [
        {
            "ioc_value": "entergo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-11 06:36:18",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1611609": [
        {
            "ioc_value": "mikhail-bulgakov.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-11 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1611610": [
        {
            "ioc_value": "lost-heaven.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-11 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1611611": [
        {
            "ioc_value": "jack-sparrow.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-11 06:36:17",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1611612": [
        {
            "ioc_value": "tengmev.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-11 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1611613": [
        {
            "ioc_value": "natctqo.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-11 06:36:16",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1611753": [
        {
            "ioc_value": "z1.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 06:28:04",
            "last_seen_utc": "2025-10-11 06:30:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611752": [
        {
            "ioc_value": "333e.gl.3ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-11 06:20:26",
            "last_seen_utc": "2025-10-14 14:34:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1611748": [
        {
            "ioc_value": "www.bepansa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-11 06:19:50",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1611749": [
        {
            "ioc_value": "www.bestcommodites.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-11 06:19:50",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1611750": [
        {
            "ioc_value": "www.volkerhuge.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-11 06:19:50",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1611740": [
        {
            "ioc_value": "bd.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 06:18:18",
            "last_seen_utc": "2025-10-11 06:19:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611737": [
        {
            "ioc_value": "q7.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 06:07:59",
            "last_seen_utc": "2025-10-11 06:09:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611736": [
        {
            "ioc_value": "ydbao4.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-11 06:06:32",
            "last_seen_utc": "2025-10-20 12:27:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/251011-bvma1swn15",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611734": [
        {
            "ioc_value": "downloads-central.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-11 06:01:03",
            "last_seen_utc": "2025-10-14 14:34:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/251011-bwm9pscp6w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611733": [
        {
            "ioc_value": "a.si3un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 05:57:41",
            "last_seen_utc": "2025-10-11 06:01:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611732": [
        {
            "ioc_value": "cm.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 05:47:54",
            "last_seen_utc": "2025-10-11 05:50:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611731": [
        {
            "ioc_value": "y7.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 05:37:34",
            "last_seen_utc": "2025-10-11 05:44:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611728": [
        {
            "ioc_value": "u.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 05:28:20",
            "last_seen_utc": "2025-10-11 05:31:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611727": [
        {
            "ioc_value": "r3.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 05:18:31",
            "last_seen_utc": "2025-10-11 05:19:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611726": [
        {
            "ioc_value": "ve.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 05:08:13",
            "last_seen_utc": "2025-10-11 05:09:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611725": [
        {
            "ioc_value": "k8.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 04:58:18",
            "last_seen_utc": "2025-10-11 05:05:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611724": [
        {
            "ioc_value": "p.li7ut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 04:48:01",
            "last_seen_utc": "2025-10-11 04:50:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611723": [
        {
            "ioc_value": "c1m.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 04:43:19",
            "last_seen_utc": "2025-10-11 04:44:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611722": [
        {
            "ioc_value": "wz.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 04:37:55",
            "last_seen_utc": "2025-10-11 04:40:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611721": [
        {
            "ioc_value": "h2.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 04:27:36",
            "last_seen_utc": "2025-10-11 04:28:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611720": [
        {
            "ioc_value": "q.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 04:17:51",
            "last_seen_utc": "2025-10-11 04:24:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611719": [
        {
            "ioc_value": "xt.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 04:07:32",
            "last_seen_utc": "2025-10-11 04:09:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611672": [
        {
            "ioc_value": "m.7o.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-11 04:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/78.47.26.0+m.7o.gg",
            "tags": "AS24940,C2,censys,HETZNER-AS,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1611671": [
        {
            "ioc_value": "vps-4ce15e9a.vps.ovh.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-11 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/217.182.253.119+vps-4ce15e9a.vps.ovh.net",
            "tags": "AS16276,C2,censys,OVH",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1611670": [
        {
            "ioc_value": "n4.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 03:52:38",
            "last_seen_utc": "2025-10-11 03:54:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611669": [
        {
            "ioc_value": "b.sa8yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 03:48:28",
            "last_seen_utc": "2025-10-11 03:48:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611668": [
        {
            "ioc_value": "c2n.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 03:38:08",
            "last_seen_utc": "2025-10-11 03:38:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611667": [
        {
            "ioc_value": "hv.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 03:28:21",
            "last_seen_utc": "2025-10-11 03:30:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611666": [
        {
            "ioc_value": "x9.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 03:18:05",
            "last_seen_utc": "2025-10-11 03:24:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611665": [
        {
            "ioc_value": "t.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 03:08:17",
            "last_seen_utc": "2025-10-11 03:15:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611663": [
        {
            "ioc_value": "pz.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 02:57:51",
            "last_seen_utc": "2025-10-11 02:58:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611662": [
        {
            "ioc_value": "m7.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 02:47:33",
            "last_seen_utc": "2025-10-11 02:48:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611661": [
        {
            "ioc_value": "a.da2yw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 02:38:48",
            "last_seen_utc": "2025-10-11 02:41:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611660": [
        {
            "ioc_value": "z9m.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 02:27:29",
            "last_seen_utc": "2025-10-11 02:30:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611659": [
        {
            "ioc_value": "qb.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 02:18:32",
            "last_seen_utc": "2025-10-11 02:24:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611658": [
        {
            "ioc_value": "m2.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 02:08:13",
            "last_seen_utc": "2025-10-11 02:09:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611656": [
        {
            "ioc_value": "x.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 01:56:15",
            "last_seen_utc": "2025-10-11 01:57:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611655": [
        {
            "ioc_value": "pn.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 01:48:01",
            "last_seen_utc": "2025-10-11 01:52:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611654": [
        {
            "ioc_value": "h3.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 01:38:06",
            "last_seen_utc": "2025-10-11 01:40:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611653": [
        {
            "ioc_value": "s.vi8im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 01:27:46",
            "last_seen_utc": "2025-10-11 01:29:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611652": [
        {
            "ioc_value": "z.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 01:17:30",
            "last_seen_utc": "2025-10-11 01:19:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611651": [
        {
            "ioc_value": "t1v.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 01:07:40",
            "last_seen_utc": "2025-10-11 01:14:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611650": [
        {
            "ioc_value": "m2.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 00:58:21",
            "last_seen_utc": "2025-10-11 00:59:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611649": [
        {
            "ioc_value": "q.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 00:47:33",
            "last_seen_utc": "2025-10-11 00:48:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611648": [
        {
            "ioc_value": "hx.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 00:38:17",
            "last_seen_utc": "2025-10-11 00:40:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611647": [
        {
            "ioc_value": "d4.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 00:28:29",
            "last_seen_utc": "2025-10-11 00:34:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611646": [
        {
            "ioc_value": "n.wi7id.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 00:18:01",
            "last_seen_utc": "2025-10-11 00:18:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611645": [
        {
            "ioc_value": "p2n.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-11 00:07:41",
            "last_seen_utc": "2025-10-11 00:08:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611629": [
        {
            "ioc_value": "hv.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 23:57:54",
            "last_seen_utc": "2025-10-11 00:00:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611628": [
        {
            "ioc_value": "x9.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 23:47:37",
            "last_seen_utc": "2025-10-10 23:49:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611627": [
        {
            "ioc_value": "mho.xb-4-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 23:38:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611626": [
        {
            "ioc_value": "t1.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 23:34:27",
            "last_seen_utc": "2025-10-10 23:38:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611625": [
        {
            "ioc_value": "qs.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 23:28:15",
            "last_seen_utc": "2025-10-10 23:33:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611623": [
        {
            "ioc_value": "8n5.xb-4-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 23:20:36",
            "last_seen_utc": "2025-10-10 23:33:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611622": [
        {
            "ioc_value": "m8.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 23:18:27",
            "last_seen_utc": "2025-10-10 23:22:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611621": [
        {
            "ioc_value": "b.fa6ic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 23:05:23",
            "last_seen_utc": "2025-10-10 23:07:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611620": [
        {
            "ioc_value": "mxt.xb-4-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:59:04",
            "last_seen_utc": "2025-10-11 07:08:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611619": [
        {
            "ioc_value": "xq9.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:58:08",
            "last_seen_utc": "2025-10-10 22:59:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611618": [
        {
            "ioc_value": "sue.xb-4-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:48:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611617": [
        {
            "ioc_value": "h7.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:47:50",
            "last_seen_utc": "2025-10-10 22:51:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611616": [
        {
            "ioc_value": "pv.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:38:02",
            "last_seen_utc": "2025-10-10 22:39:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611615": [
        {
            "ioc_value": "1kd.xb-4-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:29:23",
            "last_seen_utc": "2025-10-10 22:38:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611614": [
        {
            "ioc_value": "a1.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:27:43",
            "last_seen_utc": "2025-10-10 22:29:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611607": [
        {
            "ioc_value": "u4g.xb-4-e-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:12:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611606": [
        {
            "ioc_value": "zt.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:11:49",
            "last_seen_utc": "2025-10-10 22:13:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611605": [
        {
            "ioc_value": "n3.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 22:07:38",
            "last_seen_utc": "2025-10-10 22:08:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611603": [
        {
            "ioc_value": "e.ni0uz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 21:58:21",
            "last_seen_utc": "2025-10-10 22:01:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611599": [
        {
            "ioc_value": "v2n.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 21:43:29",
            "last_seen_utc": "2025-10-10 21:45:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611598": [
        {
            "ioc_value": "u1z.lj3u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 21:40:53",
            "last_seen_utc": "2025-10-10 21:45:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611597": [
        {
            "ioc_value": "tn.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 21:38:17",
            "last_seen_utc": "2025-10-10 21:40:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611596": [
        {
            "ioc_value": "x.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 21:27:59",
            "last_seen_utc": "2025-10-10 21:33:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611595": [
        {
            "ioc_value": "ge.lj3u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 21:18:59",
            "last_seen_utc": "2025-10-10 21:28:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611594": [
        {
            "ioc_value": "r1.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 21:18:13",
            "last_seen_utc": "2025-10-10 21:18:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611593": [
        {
            "ioc_value": "5pe.lj3u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 21:08:47",
            "last_seen_utc": "2025-10-11 07:30:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611592": [
        {
            "ioc_value": "qz.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 21:07:54",
            "last_seen_utc": "2025-10-10 21:08:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611590": [
        {
            "ioc_value": "m9.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:50:28",
            "last_seen_utc": "2025-10-10 20:53:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611589": [
        {
            "ioc_value": "hkg.lj3u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:49:33",
            "last_seen_utc": "2025-10-10 20:53:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611588": [
        {
            "ioc_value": "a.pi9yj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:47:49",
            "last_seen_utc": "2025-10-10 20:49:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611587": [
        {
            "ioc_value": "tx.lj3u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:38:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611586": [
        {
            "ioc_value": "y7n.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:37:32",
            "last_seen_utc": "2025-10-10 20:38:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611585": [
        {
            "ioc_value": "qz.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:28:15",
            "last_seen_utc": "2025-10-10 20:31:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611584": [
        {
            "ioc_value": "n24.lj3u5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:28:11",
            "last_seen_utc": "2025-10-10 20:31:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611582": [
        {
            "ioc_value": "m3.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:18:27",
            "last_seen_utc": "2025-10-10 20:28:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611581": [
        {
            "ioc_value": "x.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:08:10",
            "last_seen_utc": "2025-10-10 20:18:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611579": [
        {
            "ioc_value": "f0k.xb4e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 20:03:13",
            "last_seen_utc": "2025-10-10 20:10:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611577": [
        {
            "ioc_value": "oauth.1web4all.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 20:02:45",
            "last_seen_utc": "2025-10-11 04:01:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/216.126.237.195+oauth.1web4all.net",
            "tags": "AS14956,censys,EvilGinx,panel,Phishing,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611578": [
        {
            "ioc_value": "home.1web4all.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 20:02:45",
            "last_seen_utc": "2025-10-11 04:01:04",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/216.126.237.195+home.1web4all.net",
            "tags": "AS14956,censys,EvilGinx,panel,Phishing,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611560": [
        {
            "ioc_value": "vv.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:58:23",
            "last_seen_utc": "2025-10-10 20:03:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611557": [
        {
            "ioc_value": "sz8.xb4e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:49:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611556": [
        {
            "ioc_value": "a9.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:47:52",
            "last_seen_utc": "2025-10-10 19:49:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611555": [
        {
            "ioc_value": "p.m9i5l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:33:00",
            "last_seen_utc": "2025-10-10 19:45:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611554": [
        {
            "ioc_value": "9t.xb4e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:27:14",
            "last_seen_utc": "2025-10-10 19:35:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611553": [
        {
            "ioc_value": "t1v.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:25:33",
            "last_seen_utc": "2025-10-10 19:31:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611552": [
        {
            "ioc_value": "q1.xb4e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611551": [
        {
            "ioc_value": "k0.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:17:49",
            "last_seen_utc": "2025-10-10 19:21:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611550": [
        {
            "ioc_value": "hx.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:07:30",
            "last_seen_utc": "2025-10-10 19:10:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611549": [
        {
            "ioc_value": "i5t.xb4e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 19:01:04",
            "last_seen_utc": "2025-10-10 19:10:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611547": [
        {
            "ioc_value": "z7.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 18:58:13",
            "last_seen_utc": "2025-10-10 19:03:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611543": [
        {
            "ioc_value": "qa.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 18:45:24",
            "last_seen_utc": "2025-10-10 18:51:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611541": [
        {
            "ioc_value": "m2.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 18:38:03",
            "last_seen_utc": "2025-10-10 18:39:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611540": [
        {
            "ioc_value": "windowsedgeupdater.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-10-10 18:36:02",
            "last_seen_utc": "2025-11-08 23:48:03",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=windowsedgeupdater.com",
            "tags": "Amadey,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1611539": [
        {
            "ioc_value": "dir.xb4e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 18:31:42",
            "last_seen_utc": "2025-10-10 18:46:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611538": [
        {
            "ioc_value": "e.q7y4s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 18:28:12",
            "last_seen_utc": "2025-10-10 18:34:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611537": [
        {
            "ioc_value": "wlj.bg4o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 18:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611536": [
        {
            "ioc_value": "1m.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 18:17:52",
            "last_seen_utc": "2025-10-10 18:19:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611535": [
        {
            "ioc_value": "c8.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 18:02:46",
            "last_seen_utc": "2025-10-10 18:03:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611534": [
        {
            "ioc_value": "xxxsss20250830.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-10 18:02:36",
            "last_seen_utc": "2025-10-20 12:27:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-q433fsdk2w",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611533": [
        {
            "ioc_value": "kesmn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-10 18:01:11",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-ql5tbswnv9",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611531": [
        {
            "ioc_value": "sales-wisdom.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 18:01:05",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-rrfbasxmz3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611532": [
        {
            "ioc_value": "dfgdfgdfg.dfgdfg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 18:01:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-rf5rtadm3y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611527": [
        {
            "ioc_value": "communications-cleveland.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 18:01:04",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-vprhbsszay",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611528": [
        {
            "ioc_value": "sony-corps.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 18:01:04",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-vprhbsszay",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611529": [
        {
            "ioc_value": "processing-mongolia.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 18:01:04",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-va6npsep7y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611530": [
        {
            "ioc_value": "kit-explosion.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 18:01:04",
            "last_seen_utc": "2025-10-14 14:34:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-sftj8axqz4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611526": [
        {
            "ioc_value": "daily-disputes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 18:01:03",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-vv8nsser7z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611525": [
        {
            "ioc_value": "p0.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 17:58:07",
            "last_seen_utc": "2025-10-10 17:59:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611523": [
        {
            "ioc_value": "0zq.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 17:48:27",
            "last_seen_utc": "2025-10-10 17:49:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611522": [
        {
            "ioc_value": "v3.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 17:37:39",
            "last_seen_utc": "2025-10-10 17:39:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611521": [
        {
            "ioc_value": "h1.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 17:28:23",
            "last_seen_utc": "2025-10-10 17:30:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611520": [
        {
            "ioc_value": "s.p2a3p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 17:18:35",
            "last_seen_utc": "2025-10-10 17:20:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611519": [
        {
            "ioc_value": "t1n.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 17:08:14",
            "last_seen_utc": "2025-10-10 17:10:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611518": [
        {
            "ioc_value": "ly.bg4o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 17:02:01",
            "last_seen_utc": "2025-10-10 17:10:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611517": [
        {
            "ioc_value": "r9.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:58:10",
            "last_seen_utc": "2025-10-10 17:02:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611516": [
        {
            "ioc_value": "bq.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:48:41",
            "last_seen_utc": "2025-10-10 16:50:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611515": [
        {
            "ioc_value": "4f.bg4o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:41:00",
            "last_seen_utc": "2025-10-10 16:50:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611514": [
        {
            "ioc_value": "ftz.gj-2-i-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:40:37",
            "last_seen_utc": "2025-10-10 16:50:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611513": [
        {
            "ioc_value": "x2j.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:38:42",
            "last_seen_utc": "2025-10-10 16:41:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611512": [
        {
            "ioc_value": "3zv.bg4o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:29:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611511": [
        {
            "ioc_value": "pc.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:27:42",
            "last_seen_utc": "2025-10-10 16:29:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611508": [
        {
            "ioc_value": "m8.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:17:25",
            "last_seen_utc": "2025-10-10 16:19:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611507": [
        {
            "ioc_value": "4i4.gj-2-i-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:15:10",
            "last_seen_utc": "2025-10-10 16:28:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611506": [
        {
            "ioc_value": "2k3.bg4o2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:10:30",
            "last_seen_utc": "2025-10-10 16:19:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611505": [
        {
            "ioc_value": "a.v7e1v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:08:39",
            "last_seen_utc": "2025-10-10 16:15:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611503": [
        {
            "ioc_value": "apis.aawe.finance",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 16:02:03",
            "last_seen_utc": "2025-10-11 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/109.120.137.142+apis.aawe.finance",
            "tags": "AS215730,censys,EvilGinx,H2NEXUS-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611502": [
        {
            "ioc_value": "youtube.aawe.finance",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 16:02:02",
            "last_seen_utc": "2025-10-11 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/109.120.137.142+youtube.aawe.finance",
            "tags": "AS215730,censys,EvilGinx,H2NEXUS-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611501": [
        {
            "ioc_value": "myaccount.aawe.finance",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 16:02:01",
            "last_seen_utc": "2025-10-11 04:01:04",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/109.120.137.142+myaccount.aawe.finance",
            "tags": "AS215730,censys,EvilGinx,H2NEXUS-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611499": [
        {
            "ioc_value": "ssl.aawe.finance",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 16:02:00",
            "last_seen_utc": "2025-10-11 04:01:03",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/109.120.137.142+ssl.aawe.finance",
            "tags": "AS215730,censys,EvilGinx,H2NEXUS-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611500": [
        {
            "ioc_value": "play.aawe.finance",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 16:02:00",
            "last_seen_utc": "2025-10-11 04:01:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/109.120.137.142+play.aawe.finance",
            "tags": "AS215730,censys,EvilGinx,H2NEXUS-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611498": [
        {
            "ioc_value": "content.aawe.finance",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 16:01:59",
            "last_seen_utc": "2025-10-11 04:01:01",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/109.120.137.142+content.aawe.finance",
            "tags": "AS215730,censys,EvilGinx,H2NEXUS-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611495": [
        {
            "ioc_value": "tdinvestmentfunding.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-10 16:01:42",
            "last_seen_utc": "2025-10-11 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/212.11.64.49+tdinvestmentfunding.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611491": [
        {
            "ioc_value": "9lb.gj2i3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 16:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611489": [
        {
            "ioc_value": "r6.gj-2-i-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:59:12",
            "last_seen_utc": "2025-10-10 22:07:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611488": [
        {
            "ioc_value": "k0n.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:56:18",
            "last_seen_utc": "2025-10-10 16:00:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611487": [
        {
            "ioc_value": "wz.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:44:29",
            "last_seen_utc": "2025-10-10 15:46:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611486": [
        {
            "ioc_value": "zs.gj2i3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:39:49",
            "last_seen_utc": "2025-10-10 15:44:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611485": [
        {
            "ioc_value": "3s.gj-2-i-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:39:00",
            "last_seen_utc": "2025-10-10 15:46:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611484": [
        {
            "ioc_value": "h2.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:37:15",
            "last_seen_utc": "2025-10-10 15:39:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611481": [
        {
            "ioc_value": "s.pa.andersonscrochet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-10 15:31:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1611480": [
        {
            "ioc_value": "s.pa.lorenabulei.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-10 15:31:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1611477": [
        {
            "ioc_value": "2g.gj-2-i-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:28:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611476": [
        {
            "ioc_value": "q.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:27:58",
            "last_seen_utc": "2025-10-10 15:29:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611475": [
        {
            "ioc_value": "c3.gj2i3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:21:19",
            "last_seen_utc": "2025-10-10 15:29:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611473": [
        {
            "ioc_value": "xt.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:18:10",
            "last_seen_utc": "2025-10-10 15:21:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611472": [
        {
            "ioc_value": "h77.dk-9-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:12:03",
            "last_seen_utc": "2025-10-10 15:18:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611471": [
        {
            "ioc_value": "n5.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 15:06:41",
            "last_seen_utc": "2025-10-10 15:12:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611470": [
        {
            "ioc_value": "ty7.gj2i3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:59:18",
            "last_seen_utc": "2025-10-10 15:07:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611469": [
        {
            "ioc_value": "b.j9i2c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:56:41",
            "last_seen_utc": "2025-10-10 14:59:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611468": [
        {
            "ioc_value": "l6j.gj2i3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:49:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611467": [
        {
            "ioc_value": "x.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:47:53",
            "last_seen_utc": "2025-10-10 14:54:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611466": [
        {
            "ioc_value": "lyu.dk-9-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:43:22",
            "last_seen_utc": "2025-10-10 14:58:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611465": [
        {
            "ioc_value": "h9m.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:37:35",
            "last_seen_utc": "2025-10-10 14:43:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611464": [
        {
            "ioc_value": "tq.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:28:17",
            "last_seen_utc": "2025-10-10 14:29:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611459": [
        {
            "ioc_value": "kdu.gj2i3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:20:35",
            "last_seen_utc": "2025-10-10 14:43:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611457": [
        {
            "ioc_value": "z1.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:18:30",
            "last_seen_utc": "2025-10-10 14:20:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611456": [
        {
            "ioc_value": "a75.dk-9-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:14:26",
            "last_seen_utc": "2025-10-10 14:29:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611455": [
        {
            "ioc_value": "vale-sanete-investment.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 14:12:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/8223b482-cbae-44bb-bb51-d4ca6db082fc",
            "tags": "infostealer,MaskGramStealer,stealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611454": [
        {
            "ioc_value": "z6.wz3a7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:09:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611453": [
        {
            "ioc_value": "bd.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:08:13",
            "last_seen_utc": "2025-10-10 14:14:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611452": [
        {
            "ioc_value": "i6.wz3a7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 14:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611451": [
        {
            "ioc_value": "vne.dk-9-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611450": [
        {
            "ioc_value": "q7.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:58:25",
            "last_seen_utc": "2025-10-10 14:00:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611448": [
        {
            "ioc_value": "g.k3o9d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:45:03",
            "last_seen_utc": "2025-10-10 13:48:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611447": [
        {
            "ioc_value": "shy.dk-9-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:44:09",
            "last_seen_utc": "2025-10-10 13:48:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611445": [
        {
            "ioc_value": "hy.wz3a7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:39:38",
            "last_seen_utc": "2025-10-10 13:47:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611444": [
        {
            "ioc_value": "xq9.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:37:49",
            "last_seen_utc": "2025-10-10 13:44:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611441": [
        {
            "ioc_value": "h7.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:25:30",
            "last_seen_utc": "2025-10-10 13:28:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611440": [
        {
            "ioc_value": "vq.wz3a7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:19:10",
            "last_seen_utc": "2025-10-10 13:28:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611439": [
        {
            "ioc_value": "pv.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:17:45",
            "last_seen_utc": "2025-10-10 13:19:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611438": [
        {
            "ioc_value": "dyh.dk-9-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:08:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611437": [
        {
            "ioc_value": "a1.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 13:07:18",
            "last_seen_utc": "2025-10-10 13:08:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611436": [
        {
            "ioc_value": "zt.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 12:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611435": [
        {
            "ioc_value": "f.lj-3-u-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 12:45:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611434": [
        {
            "ioc_value": "n3.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 12:42:07",
            "last_seen_utc": "2025-10-10 12:45:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611433": [
        {
            "ioc_value": "e.p9a0k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 12:34:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611432": [
        {
            "ioc_value": "z9m.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 12:28:07",
            "last_seen_utc": "2025-10-10 12:29:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611430": [
        {
            "ioc_value": "bng.bg-4-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 12:20:18",
            "last_seen_utc": "2025-10-10 12:29:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611429": [
        {
            "ioc_value": "qb.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 12:19:21",
            "last_seen_utc": "2025-10-10 12:20:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611428": [
        {
            "ioc_value": "gh2.bg-4-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 12:08:10",
            "last_seen_utc": "2025-10-10 12:12:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611427": [
        {
            "ioc_value": "m2.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 12:08:05",
            "last_seen_utc": "2025-10-10 12:12:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611425": [
        {
            "ioc_value": "fegakid809-25883.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-10 12:01:58",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-l16xqaal6s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611414": [
        {
            "ioc_value": "system-conceptual.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 12:01:04",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-naxbpsbj4t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611412": [
        {
            "ioc_value": "county-anywhere.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 12:01:03",
            "last_seen_utc": "2025-10-14 14:34:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-njxc3atr16",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611413": [
        {
            "ioc_value": "agency-ch.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 12:01:03",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-njs1mstr14",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1611410": [
        {
            "ioc_value": "r.bg-4-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:58:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611409": [
        {
            "ioc_value": "x.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:57:45",
            "last_seen_utc": "2025-10-10 11:58:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611401": [
        {
            "ioc_value": "gserv.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.tempting_cedar",
            "malware_alias": null,
            "malware_printable": "TemptingCedar Spyware",
            "first_seen_utc": "2025-10-10 11:51:15",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware",
            "tags": "apk",
            "anonymous": "0",
            "reporter": "d1v35h"
        }
    ],
    "1611399": [
        {
            "ioc_value": "chat-world.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.tempting_cedar",
            "malware_alias": null,
            "malware_printable": "TemptingCedar Spyware",
            "first_seen_utc": "2025-10-10 11:51:14",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware",
            "tags": "apk",
            "anonymous": "0",
            "reporter": "d1v35h"
        }
    ],
    "1611400": [
        {
            "ioc_value": "chat-messenger.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.tempting_cedar",
            "malware_alias": null,
            "malware_printable": "TemptingCedar Spyware",
            "first_seen_utc": "2025-10-10 11:51:13",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware",
            "tags": "apk",
            "anonymous": "0",
            "reporter": "d1v35h"
        }
    ],
    "1611402": [
        {
            "ioc_value": "arab-chat.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.tempting_cedar",
            "malware_alias": null,
            "malware_printable": "TemptingCedar Spyware",
            "first_seen_utc": "2025-10-10 11:51:12",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware",
            "tags": "apk",
            "anonymous": "0",
            "reporter": "d1v35h"
        }
    ],
    "1611403": [
        {
            "ioc_value": "onlineclub.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.tempting_cedar",
            "malware_alias": null,
            "malware_printable": "TemptingCedar Spyware",
            "first_seen_utc": "2025-10-10 11:51:12",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware",
            "tags": "apk",
            "anonymous": "0",
            "reporter": "d1v35h"
        }
    ],
    "1611404": [
        {
            "ioc_value": "free-apps.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.tempting_cedar",
            "malware_alias": null,
            "malware_printable": "TemptingCedar Spyware",
            "first_seen_utc": "2025-10-10 11:51:12",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware",
            "tags": "apk",
            "anonymous": "0",
            "reporter": "d1v35h"
        }
    ],
    "1611405": [
        {
            "ioc_value": "network-lab.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.tempting_cedar",
            "malware_alias": null,
            "malware_printable": "TemptingCedar Spyware",
            "first_seen_utc": "2025-10-10 11:51:12",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware",
            "tags": "apk",
            "anonymous": "0",
            "reporter": "d1v35h"
        }
    ],
    "1611406": [
        {
            "ioc_value": "kikstore.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.tempting_cedar",
            "malware_alias": null,
            "malware_printable": "TemptingCedar Spyware",
            "first_seen_utc": "2025-10-10 11:51:11",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware",
            "tags": "apk",
            "anonymous": "0",
            "reporter": "d1v35h"
        }
    ],
    "1611408": [
        {
            "ioc_value": "oyi.bg-4-o-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:48:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611407": [
        {
            "ioc_value": "pl.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:47:26",
            "last_seen_utc": "2025-10-10 11:48:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611398": [
        {
            "ioc_value": "3f.wz-3-a-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:39:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611397": [
        {
            "ioc_value": "h3.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:37:40",
            "last_seen_utc": "2025-10-10 11:39:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611395": [
        {
            "ioc_value": "xiongdax.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-10 11:35:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611396": [
        {
            "ioc_value": "wangfada6888.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-10 11:35:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611347": [
        {
            "ioc_value": "buckeyedude.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-10 11:34:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611348": [
        {
            "ioc_value": "noloho3015cspaus.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-10 11:34:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611349": [
        {
            "ioc_value": "qboujskql54fd.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-10 11:34:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611350": [
        {
            "ioc_value": "fodewet662ekuali.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-10 11:34:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611351": [
        {
            "ioc_value": "vovitoc299merumart.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-10 11:34:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611352": [
        {
            "ioc_value": "pejoci8009fanwn.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-10 11:34:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611344": [
        {
            "ioc_value": "redoli8645obirah.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-10 11:34:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611345": [
        {
            "ioc_value": "limam23874kwifa.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-10 11:34:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611346": [
        {
            "ioc_value": "mahmoudlamrani.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-10-10 11:34:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611334": [
        {
            "ioc_value": "testnetv4.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611335": [
        {
            "ioc_value": "cnc1.naldlh.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611336": [
        {
            "ioc_value": "p2.dstat.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611337": [
        {
            "ioc_value": "bot.orcacrash.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611338": [
        {
            "ioc_value": "allahmisin.musallat.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611339": [
        {
            "ioc_value": "scan.naldlh.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611340": [
        {
            "ioc_value": "cnc.naldlh.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611341": [
        {
            "ioc_value": "cnc2.naldlh.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611342": [
        {
            "ioc_value": "cnc3.naldlh.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611329": [
        {
            "ioc_value": "the-rekanze.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.extreme_rat",
            "malware_alias": "ExtRat",
            "malware_printable": "Xtreme RAT",
            "first_seen_utc": "2025-10-10 11:34:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611330": [
        {
            "ioc_value": "sytese.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.extreme_rat",
            "malware_alias": "ExtRat",
            "malware_printable": "Xtreme RAT",
            "first_seen_utc": "2025-10-10 11:34:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611331": [
        {
            "ioc_value": "evelynn.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611332": [
        {
            "ioc_value": "ip.nebulabin.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611333": [
        {
            "ioc_value": "cnc4.naldlh.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-10 11:34:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611325": [
        {
            "ioc_value": "comobucetas.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-10 11:34:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611326": [
        {
            "ioc_value": "almost-circular.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-10 11:34:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611321": [
        {
            "ioc_value": "cata06.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-10 11:34:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611322": [
        {
            "ioc_value": "dolu123.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-10 11:34:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611323": [
        {
            "ioc_value": "lulalau2025.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-10 11:34:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611316": [
        {
            "ioc_value": "internet-uni.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611317": [
        {
            "ioc_value": "masterforshizllett.giize.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611318": [
        {
            "ioc_value": "anyone-archives.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 11:34:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611312": [
        {
            "ioc_value": "madeinmood1-51626.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611313": [
        {
            "ioc_value": "teste.123.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611314": [
        {
            "ioc_value": "content-organisations.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611315": [
        {
            "ioc_value": "steel-afternoon.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-10 11:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611287": [
        {
            "ioc_value": "dc23sep.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-10 11:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611288": [
        {
            "ioc_value": "lanzary-28116.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-10 11:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611289": [
        {
            "ioc_value": "chapter-evening.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-10 11:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611290": [
        {
            "ioc_value": "canada5566.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-10 11:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611283": [
        {
            "ioc_value": "fun-conduct.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-10 11:34:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611284": [
        {
            "ioc_value": "cawoslix-58635.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-10 11:34:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1611273": [
        {
            "ioc_value": "s.d5y6x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:31:26",
            "last_seen_utc": "2025-10-10 11:34:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611272": [
        {
            "ioc_value": "q.wz-3-a-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:30:26",
            "last_seen_utc": "2025-10-10 11:34:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611270": [
        {
            "ioc_value": "x8n.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:28:14",
            "last_seen_utc": "2025-10-10 11:30:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611268": [
        {
            "ioc_value": "fuck.wz-3-a-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:24:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611267": [
        {
            "ioc_value": "h9.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:18:27",
            "last_seen_utc": "2025-10-10 11:24:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611266": [
        {
            "ioc_value": "md4.wz-3-a-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:15:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611264": [
        {
            "ioc_value": "ff.fk9o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:10:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611263": [
        {
            "ioc_value": "tq.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:08:28",
            "last_seen_utc": "2025-10-10 11:15:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611262": [
        {
            "ioc_value": "dm.wz-3-a-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 11:03:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611261": [
        {
            "ioc_value": "hf5.fk9o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:59:21",
            "last_seen_utc": "2025-10-10 11:03:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611260": [
        {
            "ioc_value": "z1.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:59:11",
            "last_seen_utc": "2025-10-10 11:03:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611259": [
        {
            "ioc_value": "bd.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:57:00",
            "last_seen_utc": "2025-10-10 10:59:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611248": [
        {
            "ioc_value": "u9w.fk9o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:48:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611247": [
        {
            "ioc_value": "q4.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:47:43",
            "last_seen_utc": "2025-10-10 10:48:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611245": [
        {
            "ioc_value": "3it.fk9o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:38:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611244": [
        {
            "ioc_value": "g.z1u2z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:37:57",
            "last_seen_utc": "2025-10-10 10:38:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611210": [
        {
            "ioc_value": "5b2.fk9o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:28:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611209": [
        {
            "ioc_value": "p9.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:27:39",
            "last_seen_utc": "2025-10-10 10:28:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611208": [
        {
            "ioc_value": "lme.fk-9-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611207": [
        {
            "ioc_value": "juo.fk9o0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611206": [
        {
            "ioc_value": "h7m.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:17:51",
            "last_seen_utc": "2025-10-10 10:18:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611205": [
        {
            "ioc_value": "x70.nq8e9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:08:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611204": [
        {
            "ioc_value": "bcb.fk-9-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:08:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611203": [
        {
            "ioc_value": "x.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:07:33",
            "last_seen_utc": "2025-10-10 10:08:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611202": [
        {
            "ioc_value": "c.fk-9-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 10:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611200": [
        {
            "ioc_value": "t1.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:58:17",
            "last_seen_utc": "2025-10-10 10:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611198": [
        {
            "ioc_value": "ie7.nq8e9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:50:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611197": [
        {
            "ioc_value": "xa.fk-9-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:49:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611196": [
        {
            "ioc_value": "zk.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:48:30",
            "last_seen_utc": "2025-10-10 09:50:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611195": [
        {
            "ioc_value": "ut.nq8e9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:41:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611193": [
        {
            "ioc_value": "n2.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:38:43",
            "last_seen_utc": "2025-10-10 09:41:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611194": [
        {
            "ioc_value": "5w.fk-9-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:38:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611192": [
        {
            "ioc_value": "nv.nq8e9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:30:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611191": [
        {
            "ioc_value": "9zj.fk-9-o-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:28:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611190": [
        {
            "ioc_value": "b.h9u8w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:28:26",
            "last_seen_utc": "2025-10-10 09:30:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611187": [
        {
            "ioc_value": "m6.llcvb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:24:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611186": [
        {
            "ioc_value": "2in.nq8e9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611185": [
        {
            "ioc_value": "y7n.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:18:08",
            "last_seen_utc": "2025-10-10 09:24:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611184": [
        {
            "ioc_value": "t1.llcvb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:13:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611181": [
        {
            "ioc_value": "kychelp.live",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 09:10:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "apk,dropper",
            "anonymous": "0",
            "reporter": "d1v35h"
        }
    ],
    "1611183": [
        {
            "ioc_value": "jl.nq8e9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:10:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611182": [
        {
            "ioc_value": "qz.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 09:07:49",
            "last_seen_utc": "2025-10-10 09:13:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611180": [
        {
            "ioc_value": "qz9.llcvb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611179": [
        {
            "ioc_value": "m3.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:56:31",
            "last_seen_utc": "2025-10-10 08:58:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611177": [
        {
            "ioc_value": "v2.llcvb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:49:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611176": [
        {
            "ioc_value": "m6.ou-86.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:48:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611175": [
        {
            "ioc_value": "x.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:47:45",
            "last_seen_utc": "2025-10-10 08:49:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611173": [
        {
            "ioc_value": "arizzzz.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-10 08:40:43",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/8a03d6f804310f077ce22b30b6ae4c2d9f741b040f2098781028a357642f59f4/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1611172": [
        {
            "ioc_value": "k.llcvb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:38:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611171": [
        {
            "ioc_value": "t1.ou-86.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:38:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611170": [
        {
            "ioc_value": "vv.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:37:22",
            "last_seen_utc": "2025-10-10 08:38:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611168": [
        {
            "ioc_value": "esxcare.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-10 08:29:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1611167": [
        {
            "ioc_value": "b1.hwgmm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:29:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611166": [
        {
            "ioc_value": "a9.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:28:36",
            "last_seen_utc": "2025-10-10 08:31:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611165": [
        {
            "ioc_value": "qz9.ou-86.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:22:31",
            "last_seen_utc": "2025-10-10 08:31:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611164": [
        {
            "ioc_value": "g4.hwgmm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:19:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611163": [
        {
            "ioc_value": "p.i50m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:18:23",
            "last_seen_utc": "2025-10-10 08:22:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611162": [
        {
            "ioc_value": "t1v.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 08:02:25",
            "last_seen_utc": "2025-10-10 08:03:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611153": [
        {
            "ioc_value": "v2.ou-86.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:59:23",
            "last_seen_utc": "2025-10-10 08:03:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611152": [
        {
            "ioc_value": "pm7.hwgmm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:58:22",
            "last_seen_utc": "2025-10-10 08:02:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611151": [
        {
            "ioc_value": "k0.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:58:05",
            "last_seen_utc": "2025-10-10 07:59:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611094": [
        {
            "ioc_value": "k.ou-86.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:48:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611065": [
        {
            "ioc_value": "hx.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:47:47",
            "last_seen_utc": "2025-10-10 07:48:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611063": [
        {
            "ioc_value": "b1.ua-20.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:38:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611062": [
        {
            "ioc_value": "z7.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:38:00",
            "last_seen_utc": "2025-10-10 07:40:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611060": [
        {
            "ioc_value": "k4.hwgmm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:34:45",
            "last_seen_utc": "2025-10-10 07:40:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611059": [
        {
            "ioc_value": "g4.ua-20.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:28:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611058": [
        {
            "ioc_value": "qa.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:27:42",
            "last_seen_utc": "2025-10-10 07:34:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611032": [
        {
            "ioc_value": "k23scpbns32qywfu.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611033": [
        {
            "ioc_value": "xe73nnakx6d0sgsi.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611034": [
        {
            "ioc_value": "ng9a21hb3o8omky7.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611035": [
        {
            "ioc_value": "qdnv6smsp85l80a2.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611036": [
        {
            "ioc_value": "c8cjnri5l9njf13b.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611037": [
        {
            "ioc_value": "i078pt1f7dpiuhl1.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611038": [
        {
            "ioc_value": "npjq2iv26idx61gr.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611039": [
        {
            "ioc_value": "h9svce3ye8y9grq0.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611040": [
        {
            "ioc_value": "bk3rtkbjt2mw1sbe.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611043": [
        {
            "ioc_value": "zgbpspyb10qq5uz0.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611041": [
        {
            "ioc_value": "5fn542lfohsup239.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611042": [
        {
            "ioc_value": "uv1vkj2ikj00kwn6.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611045": [
        {
            "ioc_value": "0o1wfsn6h4hnhiz5.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611044": [
        {
            "ioc_value": "q36203ee73j7h4iw.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611046": [
        {
            "ioc_value": "7ujmwy0vqrlzt33h.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611047": [
        {
            "ioc_value": "qcn6vqsfuvfmkp2u.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611048": [
        {
            "ioc_value": "bvbwuqtepa2982rx.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611050": [
        {
            "ioc_value": "8e1f34d0ex29drf3.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611049": [
        {
            "ioc_value": "tqz1f4kokbbylgih.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611051": [
        {
            "ioc_value": "e6fv5zvscmr48b0v.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 07:20:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/iloveanimals.shop/relations",
            "tags": "stealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1611053": [
        {
            "ioc_value": "y.hwgmm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:13:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611052": [
        {
            "ioc_value": "pm7.ua-20.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611031": [
        {
            "ioc_value": "m2.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:11:47",
            "last_seen_utc": "2025-10-10 07:13:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611026": [
        {
            "ioc_value": "booking.com-reactivate.de",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 07:04:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "fakecaptcha",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1611024": [
        {
            "ioc_value": "e.u49n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 07:02:30",
            "last_seen_utc": "2025-10-10 07:04:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611023": [
        {
            "ioc_value": "1m.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:58:16",
            "last_seen_utc": "2025-10-10 06:58:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611022": [
        {
            "ioc_value": "k4.tqrjf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:54:56",
            "last_seen_utc": "2025-10-10 06:58:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611021": [
        {
            "ioc_value": "k4.ua-20.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:54:40",
            "last_seen_utc": "2025-10-10 07:04:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611020": [
        {
            "ioc_value": "c8.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:48:26",
            "last_seen_utc": "2025-10-10 06:54:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611014": [
        {
            "ioc_value": "bger.giuliasirbu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-10 06:39:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1611015": [
        {
            "ioc_value": "bger.behtunisie.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-10 06:39:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1611016": [
        {
            "ioc_value": "xpak.beatriceflorea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-10 06:39:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1611013": [
        {
            "ioc_value": "z3.tqrjf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:39:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611009": [
        {
            "ioc_value": "p0.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:33:53",
            "last_seen_utc": "2025-10-10 06:39:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611008": [
        {
            "ioc_value": "y.ua-20.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:31:46",
            "last_seen_utc": "2025-10-10 06:39:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611007": [
        {
            "ioc_value": "qm9.tqrjf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:29:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1611005": [
        {
            "ioc_value": "0zq.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:28:09",
            "last_seen_utc": "2025-10-10 06:31:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1611003": [
        {
            "ioc_value": "servicio.corinyo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-10 06:20:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1611000": [
        {
            "ioc_value": "www.zaolaf666.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1611001": [
        {
            "ioc_value": "www.zdjk.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1611002": [
        {
            "ioc_value": "www.zxcshop.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610987": [
        {
            "ioc_value": "www.tihk.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610988": [
        {
            "ioc_value": "www.tryuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610989": [
        {
            "ioc_value": "www.u4.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610990": [
        {
            "ioc_value": "www.ultanwinbest.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610991": [
        {
            "ioc_value": "www.unitedorthopedic.contact",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610992": [
        {
            "ioc_value": "www.unjabitrendplus.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610993": [
        {
            "ioc_value": "www.us185.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610994": [
        {
            "ioc_value": "www.vojds.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610995": [
        {
            "ioc_value": "www.washing-machine-pl12.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610996": [
        {
            "ioc_value": "www.wattforfun.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610997": [
        {
            "ioc_value": "www.ww13898.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610998": [
        {
            "ioc_value": "www.xmrhh.autos",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610999": [
        {
            "ioc_value": "www.yysg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610975": [
        {
            "ioc_value": "www.rwin-casino-dogames4.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610976": [
        {
            "ioc_value": "www.satukacaslot03.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610977": [
        {
            "ioc_value": "www.shared-remittance-app6.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610978": [
        {
            "ioc_value": "www.silversystem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610979": [
        {
            "ioc_value": "www.sisff.autos",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610980": [
        {
            "ioc_value": "www.somissplentstaphs.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610981": [
        {
            "ioc_value": "www.stanbulwipud.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610982": [
        {
            "ioc_value": "www.sy7vs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610983": [
        {
            "ioc_value": "www.sy857.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610984": [
        {
            "ioc_value": "www.t-loc.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610985": [
        {
            "ioc_value": "www.tahubandungraos.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610986": [
        {
            "ioc_value": "www.testecliente.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610963": [
        {
            "ioc_value": "www.part-time-job-14534.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610964": [
        {
            "ioc_value": "www.personal-loans-22484.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610965": [
        {
            "ioc_value": "www.petsilkwellness.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610966": [
        {
            "ioc_value": "www.plumber-jobs-in-us-56918.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610967": [
        {
            "ioc_value": "www.puredelights.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610968": [
        {
            "ioc_value": "www.qq8336qq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610969": [
        {
            "ioc_value": "www.rackingmorehq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610970": [
        {
            "ioc_value": "www.rbhdba.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610971": [
        {
            "ioc_value": "www.rcanecodex.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610972": [
        {
            "ioc_value": "www.ress-room-sky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610973": [
        {
            "ioc_value": "www.riggdival.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610974": [
        {
            "ioc_value": "www.riseart.design",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610951": [
        {
            "ioc_value": "www.leaning-jobs-22264.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610952": [
        {
            "ioc_value": "www.lecons.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610953": [
        {
            "ioc_value": "www.lipopodlirotlitotic.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610954": [
        {
            "ioc_value": "www.loud-backup-solutions-rkm.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610955": [
        {
            "ioc_value": "www.luenode.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610956": [
        {
            "ioc_value": "www.madisonriley.actor",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610957": [
        {
            "ioc_value": "www.magineup.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610958": [
        {
            "ioc_value": "www.ndredevestucomercio.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610959": [
        {
            "ioc_value": "www.oesoblear.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610960": [
        {
            "ioc_value": "www.ortune-telling-jp-6709348.zone",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610961": [
        {
            "ioc_value": "www.otorclub.bar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610962": [
        {
            "ioc_value": "www.ovieboss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610939": [
        {
            "ioc_value": "www.gibi7.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610940": [
        {
            "ioc_value": "www.hackingcrypto.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610941": [
        {
            "ioc_value": "www.hatchncatch.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610942": [
        {
            "ioc_value": "www.herockedge.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610943": [
        {
            "ioc_value": "www.home-remodeling-74269.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610944": [
        {
            "ioc_value": "www.hsdfecc498xya.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610945": [
        {
            "ioc_value": "www.iecjebp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610946": [
        {
            "ioc_value": "www.irtualbuildingstudio.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610947": [
        {
            "ioc_value": "www.iscore.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610948": [
        {
            "ioc_value": "www.iyuhiyu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610949": [
        {
            "ioc_value": "www.j25dr987d.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610950": [
        {
            "ioc_value": "www.klad-7729.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610927": [
        {
            "ioc_value": "www.enoja.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610928": [
        {
            "ioc_value": "www.ensingtoninc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610929": [
        {
            "ioc_value": "www.entotoe.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610930": [
        {
            "ioc_value": "www.euzec.autos",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610931": [
        {
            "ioc_value": "www.eye-doctors.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610932": [
        {
            "ioc_value": "www.faithnomore.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610933": [
        {
            "ioc_value": "www.folabs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610934": [
        {
            "ioc_value": "www.fv2lj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610935": [
        {
            "ioc_value": "www.fzolgi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610936": [
        {
            "ioc_value": "www.g-5id.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610937": [
        {
            "ioc_value": "www.galaxyjsc.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610938": [
        {
            "ioc_value": "www.galen-mpl15aag.rest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610915": [
        {
            "ioc_value": "www.eartclinic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610916": [
        {
            "ioc_value": "www.eb1-899b4.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610917": [
        {
            "ioc_value": "www.ebraquotevastnode.christmas",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610918": [
        {
            "ioc_value": "www.echospheres.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610919": [
        {
            "ioc_value": "www.eewithsyl.studio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610920": [
        {
            "ioc_value": "www.egendrider598.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610921": [
        {
            "ioc_value": "www.ekuxoxe.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610922": [
        {
            "ioc_value": "www.ell-phones-for-cz.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610923": [
        {
            "ioc_value": "www.emonlightus.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610924": [
        {
            "ioc_value": "www.emuku.africa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610925": [
        {
            "ioc_value": "www.endryx.africa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610926": [
        {
            "ioc_value": "www.enior-living-61814.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610903": [
        {
            "ioc_value": "www.cannabiscbg.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610904": [
        {
            "ioc_value": "www.car-dealerships-5002.zone",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610905": [
        {
            "ioc_value": "www.chatgratuit.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610906": [
        {
            "ioc_value": "www.construction-jobs-73946.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610907": [
        {
            "ioc_value": "www.csvger.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610908": [
        {
            "ioc_value": "www.dentist-dental-care-99908.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610909": [
        {
            "ioc_value": "www.dentures-37384.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610910": [
        {
            "ioc_value": "www.dev-quest.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610911": [
        {
            "ioc_value": "www.dgtl.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610912": [
        {
            "ioc_value": "www.dosaindriftydrummy.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610913": [
        {
            "ioc_value": "www.dpudzovac.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610914": [
        {
            "ioc_value": "www.e51ku379r.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610891": [
        {
            "ioc_value": "www.bacteriopsonin.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610892": [
        {
            "ioc_value": "www.baran-pichali2.rest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610893": [
        {
            "ioc_value": "www.bdylg.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610894": [
        {
            "ioc_value": "www.bgslot789x.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610895": [
        {
            "ioc_value": "www.bichoelegante.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610896": [
        {
            "ioc_value": "www.bladekaswari77.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610897": [
        {
            "ioc_value": "www.blockchainsong.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610898": [
        {
            "ioc_value": "www.brunette.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610899": [
        {
            "ioc_value": "www.businessbreakfast.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610900": [
        {
            "ioc_value": "www.bvfom.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610901": [
        {
            "ioc_value": "www.c2601.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610902": [
        {
            "ioc_value": "www.cancer-insurance-expert.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610879": [
        {
            "ioc_value": "www.38bitcoin.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610880": [
        {
            "ioc_value": "www.3945.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610881": [
        {
            "ioc_value": "www.6v1e8.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610882": [
        {
            "ioc_value": "www.82463.party",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610883": [
        {
            "ioc_value": "www.airui.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610884": [
        {
            "ioc_value": "www.allpit.studio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610885": [
        {
            "ioc_value": "www.amjackonbsc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610886": [
        {
            "ioc_value": "www.amopo-pokofu.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610887": [
        {
            "ioc_value": "www.ampnet88.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610888": [
        {
            "ioc_value": "www.amsnz.kiwi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610889": [
        {
            "ioc_value": "www.antobot.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610890": [
        {
            "ioc_value": "www.aviation-training-32472.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610875": [
        {
            "ioc_value": "www.067679.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610876": [
        {
            "ioc_value": "www.1014.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610877": [
        {
            "ioc_value": "www.25cha.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610878": [
        {
            "ioc_value": "www.38696.legal",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-10 06:20:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610805": [
        {
            "ioc_value": "k4.ei-84.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610742": [
        {
            "ioc_value": "exchange.dumb1.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-10 06:18:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610741": [
        {
            "ioc_value": "atcaak.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-10 06:18:33",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610740": [
        {
            "ioc_value": "u1.tqrjf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:18:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610739": [
        {
            "ioc_value": "v3.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:17:51",
            "last_seen_utc": "2025-10-10 06:19:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610735": [
        {
            "ioc_value": "h.tqrjf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:09:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610734": [
        {
            "ioc_value": "h1.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:08:04",
            "last_seen_utc": "2025-10-10 06:09:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610732": [
        {
            "ioc_value": "z3.ei-84.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 06:01:19",
            "last_seen_utc": "2025-10-10 06:08:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610731": [
        {
            "ioc_value": "enviocombi1.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-10 06:01:11",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/251010-ga1wka1j13",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610728": [
        {
            "ioc_value": "zd.nbpvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:57:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610727": [
        {
            "ioc_value": "s.e41m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:55:43",
            "last_seen_utc": "2025-10-10 06:01:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610726": [
        {
            "ioc_value": "qm9.ei-84.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:49:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610725": [
        {
            "ioc_value": "r2.nbpvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:48:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610724": [
        {
            "ioc_value": "t1n.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:47:28",
            "last_seen_utc": "2025-10-10 05:49:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610723": [
        {
            "ioc_value": "wq9.nbpvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:39:11",
            "last_seen_utc": "2025-10-10 05:42:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610722": [
        {
            "ioc_value": "r9.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:38:42",
            "last_seen_utc": "2025-10-10 05:42:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610721": [
        {
            "ioc_value": "u1.ei-84.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:30:25",
            "last_seen_utc": "2025-10-10 05:42:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610720": [
        {
            "ioc_value": "bq.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:28:24",
            "last_seen_utc": "2025-10-10 05:35:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610719": [
        {
            "ioc_value": "c7.nbpvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:23:42",
            "last_seen_utc": "2025-10-10 05:35:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610187": [
        {
            "ioc_value": "3kyh9kntiomknv89.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 05:19:14",
            "last_seen_utc": "2025-10-10 07:12:25",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-sa685afl91",
            "tags": "infostealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1610188": [
        {
            "ioc_value": "cloud.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 05:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-sa685afl91",
            "tags": "infostealer,Stealit",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1610236": [
        {
            "ioc_value": "karabuk.kedi.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-10 05:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/e4de074f-e50f-4269-aa45-8df7557e648b",
            "tags": "infostealer,RustyStealer,stealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1610256": [
        {
            "ioc_value": "xpac.behtunisie.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-10 05:18:51",
            "last_seen_utc": "2025-10-10 06:39:24",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/588477ea-7fe1-4f7f-802a-8e5e0ea3efc0",
            "tags": "infostealer,vidar",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1610299": [
        {
            "ioc_value": "c3lestial.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-10 05:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/b53d9601-0003-4ad9-873a-ffa58c2977bd",
            "tags": "CelestialRAT,RAT",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1610304": [
        {
            "ioc_value": "saerw-caesre-scalova.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 05:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-y1gdaayzb1/behavioral1",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1610718": [
        {
            "ioc_value": "x2j.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:18:05",
            "last_seen_utc": "2025-10-10 05:23:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610717": [
        {
            "ioc_value": "h.ei-84.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:13:05",
            "last_seen_utc": "2025-10-10 05:20:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610716": [
        {
            "ioc_value": "n.nbpvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:08:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610715": [
        {
            "ioc_value": "pc.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 05:08:18",
            "last_seen_utc": "2025-10-10 05:13:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610714": [
        {
            "ioc_value": "m8.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 04:58:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610713": [
        {
            "ioc_value": "a.u84t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 04:47:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610712": [
        {
            "ioc_value": "k0n.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 04:36:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610711": [
        {
            "ioc_value": "wz.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 04:29:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610710": [
        {
            "ioc_value": "h2.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 04:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610709": [
        {
            "ioc_value": "q.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 04:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610653": [
        {
            "ioc_value": "xt.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 03:58:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610652": [
        {
            "ioc_value": "n5.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 03:53:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610651": [
        {
            "ioc_value": "b.a89b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 03:48:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610650": [
        {
            "ioc_value": "x.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 03:38:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610649": [
        {
            "ioc_value": "h9m.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 03:32:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610648": [
        {
            "ioc_value": "tq.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 03:27:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610647": [
        {
            "ioc_value": "z1.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 03:18:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610646": [
        {
            "ioc_value": "k9.rwzqh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 03:08:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610645": [
        {
            "ioc_value": "bd.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 03:07:43",
            "last_seen_utc": "2025-10-10 03:08:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610642": [
        {
            "ioc_value": "m7.rwzqh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:58:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610641": [
        {
            "ioc_value": "q7.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:57:54",
            "last_seen_utc": "2025-10-10 02:58:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610640": [
        {
            "ioc_value": "dark.anonym.team",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-10 02:48:53",
            "last_seen_utc": "2025-10-24 19:53:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1610639": [
        {
            "ioc_value": "tq1.rwzqh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:48:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610638": [
        {
            "ioc_value": "g.o82g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:47:38",
            "last_seen_utc": "2025-10-10 02:48:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610637": [
        {
            "ioc_value": "zd.oe-69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:39:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610636": [
        {
            "ioc_value": "xq9.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:37:16",
            "last_seen_utc": "2025-10-10 02:39:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610635": [
        {
            "ioc_value": "b2.rwzqh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:30:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610634": [
        {
            "ioc_value": "r2.oe-69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:28:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610633": [
        {
            "ioc_value": "h7.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:28:29",
            "last_seen_utc": "2025-10-10 02:30:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610632": [
        {
            "ioc_value": "x.rwzqh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610631": [
        {
            "ioc_value": "wq9.oe-69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610630": [
        {
            "ioc_value": "pv.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:18:13",
            "last_seen_utc": "2025-10-10 02:19:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610629": [
        {
            "ioc_value": "n0.rdlkc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:13:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610628": [
        {
            "ioc_value": "c7.oe-69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:10:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610627": [
        {
            "ioc_value": "a1.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:08:24",
            "last_seen_utc": "2025-10-10 02:13:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610626": [
        {
            "ioc_value": "n.oe-69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 02:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610625": [
        {
            "ioc_value": "e1.rdlkc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610624": [
        {
            "ioc_value": "zt.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:57:56",
            "last_seen_utc": "2025-10-10 02:00:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610623": [
        {
            "ioc_value": "qk2.rdlkc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:49:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610622": [
        {
            "ioc_value": "n3.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:48:09",
            "last_seen_utc": "2025-10-10 01:49:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610621": [
        {
            "ioc_value": "k9.ae-18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:40:23",
            "last_seen_utc": "2025-10-10 01:49:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610620": [
        {
            "ioc_value": "e.y83v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:37:56",
            "last_seen_utc": "2025-10-10 01:40:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610619": [
        {
            "ioc_value": "u5.rdlkc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:34:46",
            "last_seen_utc": "2025-10-10 01:39:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610618": [
        {
            "ioc_value": "m7.ae-18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:28:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610617": [
        {
            "ioc_value": "p9.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:27:34",
            "last_seen_utc": "2025-10-10 01:34:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610616": [
        {
            "ioc_value": "r.rdlkc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:19:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610615": [
        {
            "ioc_value": "tq1.ae-18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610614": [
        {
            "ioc_value": "h7.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:17:46",
            "last_seen_utc": "2025-10-10 01:19:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610613": [
        {
            "ioc_value": "b2.ae-18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:08:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610612": [
        {
            "ioc_value": "r3.tqxfs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:08:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610611": [
        {
            "ioc_value": "x.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 01:07:27",
            "last_seen_utc": "2025-10-10 01:08:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610610": [
        {
            "ioc_value": "k7.tqxfs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:58:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610609": [
        {
            "ioc_value": "x.ae-18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610608": [
        {
            "ioc_value": "t1.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:58:10",
            "last_seen_utc": "2025-10-10 00:58:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610607": [
        {
            "ioc_value": "aa9.tqxfs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:50:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610606": [
        {
            "ioc_value": "n0.ea-43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:49:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610605": [
        {
            "ioc_value": "zc.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:48:22",
            "last_seen_utc": "2025-10-10 00:50:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610604": [
        {
            "ioc_value": "n3.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:38:07",
            "last_seen_utc": "2025-10-10 00:38:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610603": [
        {
            "ioc_value": "v2.tqxfs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:33:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610602": [
        {
            "ioc_value": "e1.ea-43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:32:52",
            "last_seen_utc": "2025-10-10 00:38:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610601": [
        {
            "ioc_value": "a.u11q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:27:17",
            "last_seen_utc": "2025-10-10 00:33:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610600": [
        {
            "ioc_value": "g.tqxfs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610599": [
        {
            "ioc_value": "qk2.ea-43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:19:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610598": [
        {
            "ioc_value": "x8n.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:18:00",
            "last_seen_utc": "2025-10-10 00:19:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610381": [
        {
            "ioc_value": "u5.ea-43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:09:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610380": [
        {
            "ioc_value": "h9.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:07:44",
            "last_seen_utc": "2025-10-10 00:09:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610379": [
        {
            "ioc_value": "m2.jbffq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-10 00:03:20",
            "last_seen_utc": "2025-10-10 00:08:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610376": [
        {
            "ioc_value": "accounts.aawe.finance",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-10 00:02:30",
            "last_seen_utc": "2025-10-10 16:02:00",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/109.120.137.142+accounts.aawe.finance",
            "tags": "AS215730,censys,EvilGinx,H2NEXUS-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610358": [
        {
            "ioc_value": "r.ea-43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:58:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610357": [
        {
            "ioc_value": "tq.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:57:48",
            "last_seen_utc": "2025-10-10 00:03:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610356": [
        {
            "ioc_value": "r3.oo-07.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:48:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610355": [
        {
            "ioc_value": "aa9.jbffq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:48:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610354": [
        {
            "ioc_value": "z1.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:47:30",
            "last_seen_utc": "2025-10-09 23:48:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610353": [
        {
            "ioc_value": "k7.oo-07.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:39:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610352": [
        {
            "ioc_value": "bd.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:38:44",
            "last_seen_utc": "2025-10-09 23:44:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610351": [
        {
            "ioc_value": "xq0.jbffq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:32:53",
            "last_seen_utc": "2025-10-09 23:44:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610350": [
        {
            "ioc_value": "aa9.oo-07.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:28:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610349": [
        {
            "ioc_value": "q4.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:27:24",
            "last_seen_utc": "2025-10-09 23:32:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610348": [
        {
            "ioc_value": "c5.jbffq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610347": [
        {
            "ioc_value": "g.o05h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:18:01",
            "last_seen_utc": "2025-10-09 23:19:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610346": [
        {
            "ioc_value": "v2.oo-07.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:10:18",
            "last_seen_utc": "2025-10-09 23:19:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610345": [
        {
            "ioc_value": "w1n.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:08:15",
            "last_seen_utc": "2025-10-09 23:10:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610344": [
        {
            "ioc_value": "l.jbffq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 23:02:24",
            "last_seen_utc": "2025-10-09 23:09:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610342": [
        {
            "ioc_value": "g.oo-07.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:59:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610341": [
        {
            "ioc_value": "h7.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:57:59",
            "last_seen_utc": "2025-10-09 23:02:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610340": [
        {
            "ioc_value": "aa.rxhvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:49:36",
            "last_seen_utc": "2025-10-09 22:58:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610339": [
        {
            "ioc_value": "m2.ee-17.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:48:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610338": [
        {
            "ioc_value": "q9.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:48:10",
            "last_seen_utc": "2025-10-09 22:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610336": [
        {
            "ioc_value": "x.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:37:51",
            "last_seen_utc": "2025-10-09 22:38:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610335": [
        {
            "ioc_value": "h1.rxhvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:33:35",
            "last_seen_utc": "2025-10-09 22:38:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610334": [
        {
            "ioc_value": "aa9.ee-17.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:32:22",
            "last_seen_utc": "2025-10-09 22:38:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610333": [
        {
            "ioc_value": "pt.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:28:16",
            "last_seen_utc": "2025-10-09 22:33:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610332": [
        {
            "ioc_value": "pz8.rxhvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610331": [
        {
            "ioc_value": "z2.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:13:24",
            "last_seen_utc": "2025-10-09 22:18:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610330": [
        {
            "ioc_value": "xq0.ee-17.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:10:13",
            "last_seen_utc": "2025-10-09 22:14:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610329": [
        {
            "ioc_value": "a.u79p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:08:29",
            "last_seen_utc": "2025-10-09 22:10:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610328": [
        {
            "ioc_value": "w4.rxhvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:02:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610327": [
        {
            "ioc_value": "c5.ee-17.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 22:00:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610326": [
        {
            "ioc_value": "er.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:58:11",
            "last_seen_utc": "2025-10-09 22:02:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610325": [
        {
            "ioc_value": "712.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:44:20",
            "last_seen_utc": "2025-10-09 21:44:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610324": [
        {
            "ioc_value": "l.ee-17.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:39:41",
            "last_seen_utc": "2025-10-09 21:44:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610323": [
        {
            "ioc_value": "a1f.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:38:11",
            "last_seen_utc": "2025-10-09 21:39:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610322": [
        {
            "ioc_value": "d.rxhvt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:32:03",
            "last_seen_utc": "2025-10-09 21:38:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610321": [
        {
            "ioc_value": "aa.ay-63.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:26:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610320": [
        {
            "ioc_value": "b4m.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:25:08",
            "last_seen_utc": "2025-10-09 21:32:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610319": [
        {
            "ioc_value": "510.mw2o3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:18:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610318": [
        {
            "ioc_value": "pcd.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:17:52",
            "last_seen_utc": "2025-10-09 21:18:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610317": [
        {
            "ioc_value": "h1.ay-63.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:10:02",
            "last_seen_utc": "2025-10-09 21:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610316": [
        {
            "ioc_value": "9n.mw2o3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:08:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610315": [
        {
            "ioc_value": "fth.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:07:35",
            "last_seen_utc": "2025-10-09 21:10:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610314": [
        {
            "ioc_value": "pz8.ay-63.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 21:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610313": [
        {
            "ioc_value": "sv.mw2o3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:58:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610312": [
        {
            "ioc_value": "je6.cv-3-a-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:57:47",
            "last_seen_utc": "2025-10-09 21:00:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610309": [
        {
            "ioc_value": "xj0.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:47:28",
            "last_seen_utc": "2025-10-09 20:47:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610308": [
        {
            "ioc_value": "wi8.mw2o3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:39:24",
            "last_seen_utc": "2025-10-09 20:47:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610307": [
        {
            "ioc_value": "w4.ay-63.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:38:05",
            "last_seen_utc": "2025-10-09 20:47:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610306": [
        {
            "ioc_value": "fr.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:37:39",
            "last_seen_utc": "2025-10-09 20:39:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610305": [
        {
            "ioc_value": "ojw.mw2o3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:29:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610302": [
        {
            "ioc_value": "ucx.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:23:17",
            "last_seen_utc": "2025-10-09 20:29:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610301": [
        {
            "ioc_value": "vvi.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:18:04",
            "last_seen_utc": "2025-10-09 20:19:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610300": [
        {
            "ioc_value": "qmq.mw2o3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:14:34",
            "last_seen_utc": "2025-10-09 20:19:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610297": [
        {
            "ioc_value": "d.ay-63.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:10:40",
            "last_seen_utc": "2025-10-09 20:24:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610296": [
        {
            "ioc_value": "773.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 20:08:12",
            "last_seen_utc": "2025-10-09 20:14:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610277": [
        {
            "ioc_value": "wof.qh1a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610276": [
        {
            "ioc_value": "hm.uy-55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:59:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610275": [
        {
            "ioc_value": "xz.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:57:53",
            "last_seen_utc": "2025-10-09 19:59:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610268": [
        {
            "ioc_value": "j8.qh1a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:48:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610267": [
        {
            "ioc_value": "t1.uy-55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:48:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610266": [
        {
            "ioc_value": "d14.bb-3-y-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:44:01",
            "last_seen_utc": "2025-10-09 19:48:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610265": [
        {
            "ioc_value": "k5.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:37:48",
            "last_seen_utc": "2025-10-09 19:38:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610264": [
        {
            "ioc_value": "2n0.qh1a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:34:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610263": [
        {
            "ioc_value": "qz9.uy-55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:30:31",
            "last_seen_utc": "2025-10-09 19:38:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610262": [
        {
            "ioc_value": "rbg.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:27:59",
            "last_seen_utc": "2025-10-09 19:34:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610260": [
        {
            "ioc_value": "46.qh1a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:19:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610259": [
        {
            "ioc_value": "w9s.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:13:59",
            "last_seen_utc": "2025-10-09 19:19:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610258": [
        {
            "ioc_value": "d85.qh1a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:09:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610257": [
        {
            "ioc_value": "v2.uy-55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:09:55",
            "last_seen_utc": "2025-10-09 19:15:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610255": [
        {
            "ioc_value": "os.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 19:08:34",
            "last_seen_utc": "2025-10-09 19:09:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610254": [
        {
            "ioc_value": "k.uy-55.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610253": [
        {
            "ioc_value": "ls.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:58:17",
            "last_seen_utc": "2025-10-09 18:59:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610251": [
        {
            "ioc_value": "skr.qh1a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:50:41",
            "last_seen_utc": "2025-10-09 18:59:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610247": [
        {
            "ioc_value": "m2.nm-0-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:49:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610246": [
        {
            "ioc_value": "7a.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:48:22",
            "last_seen_utc": "2025-10-09 18:50:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610244": [
        {
            "ioc_value": "bd.sj-5-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:34:23",
            "last_seen_utc": "2025-10-09 18:37:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610243": [
        {
            "ioc_value": "aa9.nm-0-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:29:42",
            "last_seen_utc": "2025-10-09 18:37:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610242": [
        {
            "ioc_value": "fz.qf0u2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:29:40",
            "last_seen_utc": "2025-10-09 18:35:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610241": [
        {
            "ioc_value": "1r.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:28:08",
            "last_seen_utc": "2025-10-09 18:29:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610240": [
        {
            "ioc_value": "r02.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:18:51",
            "last_seen_utc": "2025-10-09 18:24:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610239": [
        {
            "ioc_value": "1hj.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:16:42",
            "last_seen_utc": "2025-10-09 18:17:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610238": [
        {
            "ioc_value": "b0.qf0u2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:14:51",
            "last_seen_utc": "2025-10-09 18:24:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610237": [
        {
            "ioc_value": "xq0.nm-0-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:11:51",
            "last_seen_utc": "2025-10-09 18:20:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610235": [
        {
            "ioc_value": "uzw.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 18:07:56",
            "last_seen_utc": "2025-10-09 18:14:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610228": [
        {
            "ioc_value": "www.tuamec.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-09 18:01:15",
            "last_seen_utc": "2025-10-14 14:34:15",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-wgygcaspy4",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610229": [
        {
            "ioc_value": "www.agrogreenalax.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-09 18:01:15",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-wgygcaspy4",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610227": [
        {
            "ioc_value": "uchiwa5.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-09 18:00:57",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-pp7xesxrs6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610226": [
        {
            "ioc_value": "c5.nm-0-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:58:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610225": [
        {
            "ioc_value": "3u.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:57:36",
            "last_seen_utc": "2025-10-09 17:58:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610224": [
        {
            "ioc_value": "m87.qf0u2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:54:05",
            "last_seen_utc": "2025-10-09 17:58:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610223": [
        {
            "ioc_value": "l.nm-0-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:49:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610222": [
        {
            "ioc_value": "gm.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:47:49",
            "last_seen_utc": "2025-10-09 17:54:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610219": [
        {
            "ioc_value": "aa.lq-8-e-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:38:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610218": [
        {
            "ioc_value": "7c3.sx-2-u-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:37:33",
            "last_seen_utc": "2025-10-09 17:38:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610202": [
        {
            "ioc_value": "h1.lq-8-e-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:29:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610201": [
        {
            "ioc_value": "bk.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:28:15",
            "last_seen_utc": "2025-10-09 17:35:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610200": [
        {
            "ioc_value": "ss.qf0u2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:24:30",
            "last_seen_utc": "2025-10-09 17:35:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610199": [
        {
            "ioc_value": "pz8.lq-8-e-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:19:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610198": [
        {
            "ioc_value": "5o.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:18:28",
            "last_seen_utc": "2025-10-09 17:24:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610195": [
        {
            "ioc_value": "mw.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 17:03:06",
            "last_seen_utc": "2025-10-09 17:05:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610193": [
        {
            "ioc_value": "kk.qf0u2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:59:08",
            "last_seen_utc": "2025-10-09 17:04:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610192": [
        {
            "ioc_value": "pcz.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:57:51",
            "last_seen_utc": "2025-10-09 17:00:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610191": [
        {
            "ioc_value": "w4.lq-8-e-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:50:20",
            "last_seen_utc": "2025-10-09 17:05:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610190": [
        {
            "ioc_value": "2d0.qf0u2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:49:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610189": [
        {
            "ioc_value": "b2.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:47:58",
            "last_seen_utc": "2025-10-09 16:50:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610186": [
        {
            "ioc_value": "cfa.hl5a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:39:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610185": [
        {
            "ioc_value": "57.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:33:35",
            "last_seen_utc": "2025-10-09 16:39:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610184": [
        {
            "ioc_value": "d.lq-8-e-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:29:10",
            "last_seen_utc": "2025-10-09 16:37:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610183": [
        {
            "ioc_value": "k76.hl5a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:28:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610182": [
        {
            "ioc_value": "r5.jk-3-y-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:27:52",
            "last_seen_utc": "2025-10-09 16:29:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610181": [
        {
            "ioc_value": "287.hl5a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:19:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610179": [
        {
            "ioc_value": "m6.fs-8-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:18:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610178": [
        {
            "ioc_value": "3w.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:17:35",
            "last_seen_utc": "2025-10-09 16:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610175": [
        {
            "ioc_value": "t1.fs-8-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:11:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610174": [
        {
            "ioc_value": "zj.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:08:14",
            "last_seen_utc": "2025-10-09 16:11:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610173": [
        {
            "ioc_value": "ia.hl5a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 16:05:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610171": [
        {
            "ioc_value": "rr.yolo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-09 16:01:54",
            "last_seen_utc": "2025-10-10 04:01:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/95.165.149.124+rr.yolo.su",
            "tags": "AS25513,ASN-MGTS-USPD,C2,censys,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610169": [
        {
            "ioc_value": "accounts.teacish.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-09 16:01:37",
            "last_seen_utc": "2025-10-10 04:00:34",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.168.225.154+accounts.teacish.uk",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610161": [
        {
            "ioc_value": "sdat.beatriceflorea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-09 15:59:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1610158": [
        {
            "ioc_value": "qz9.fs-8-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:59:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610157": [
        {
            "ioc_value": "uz5.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:58:27",
            "last_seen_utc": "2025-10-09 16:05:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610156": [
        {
            "ioc_value": "v2.fs-8-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:48:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610155": [
        {
            "ioc_value": "22x.hl5a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:48:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610154": [
        {
            "ioc_value": "k17.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:47:08",
            "last_seen_utc": "2025-10-09 15:48:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610153": [
        {
            "ioc_value": "k.fs-8-e-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:40:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610152": [
        {
            "ioc_value": "gjh.hl5a6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:39:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610151": [
        {
            "ioc_value": "8b.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:38:23",
            "last_seen_utc": "2025-10-09 15:40:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610150": [
        {
            "ioc_value": "wgp.lq8e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:30:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610149": [
        {
            "ioc_value": "b1.dk-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:28:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610148": [
        {
            "ioc_value": "kv.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:28:02",
            "last_seen_utc": "2025-10-09 15:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610146": [
        {
            "ioc_value": "g3.lq8e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:20:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610145": [
        {
            "ioc_value": "g4.dk-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610144": [
        {
            "ioc_value": "5hj.mt-3-o-4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:18:14",
            "last_seen_utc": "2025-10-09 15:20:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610142": [
        {
            "ioc_value": "pm.dk-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:07:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610141": [
        {
            "ioc_value": "tla.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 15:05:45",
            "last_seen_utc": "2025-10-09 15:07:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610140": [
        {
            "ioc_value": "vzd.lq8e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:57:55",
            "last_seen_utc": "2025-10-09 15:07:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610139": [
        {
            "ioc_value": "47b.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:57:27",
            "last_seen_utc": "2025-10-09 14:58:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610138": [
        {
            "ioc_value": "k4.dk-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:48:25",
            "last_seen_utc": "2025-10-09 14:58:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610137": [
        {
            "ioc_value": "nr.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:47:39",
            "last_seen_utc": "2025-10-09 14:48:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610136": [
        {
            "ioc_value": "z5k.lq8e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:39:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610135": [
        {
            "ioc_value": "db8.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:38:21",
            "last_seen_utc": "2025-10-09 14:40:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610134": [
        {
            "ioc_value": "y.dk-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:36:00",
            "last_seen_utc": "2025-10-09 14:40:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610125": [
        {
            "ioc_value": "5z.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:34:14",
            "last_seen_utc": "2025-10-09 14:04:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610127": [
        {
            "ioc_value": "0f.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:34:14",
            "last_seen_utc": "2025-10-09 14:15:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610130": [
        {
            "ioc_value": "6fl.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:34:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610133": [
        {
            "ioc_value": "ydq.sj5o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:34:12",
            "last_seen_utc": "2025-10-09 14:36:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610129": [
        {
            "ioc_value": "3va.lq8e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:15:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610128": [
        {
            "ioc_value": "k4.mw-2-o-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:11:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610126": [
        {
            "ioc_value": "tfh.lq8e1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 14:04:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610123": [
        {
            "ioc_value": "yhu.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 13:48:32",
            "last_seen_utc": "2025-10-09 13:48:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610124": [
        {
            "ioc_value": "z3.mw-2-o-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 13:48:32",
            "last_seen_utc": "2025-10-09 13:53:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610111": [
        {
            "ioc_value": "xpl.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 13:35:52",
            "last_seen_utc": "2025-10-09 13:08:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610115": [
        {
            "ioc_value": "mlampell.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-09 13:35:51",
            "last_seen_utc": "2025-10-09 13:19:34",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115344406615005731",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1610119": [
        {
            "ioc_value": "b27.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 13:35:50",
            "last_seen_utc": "2025-10-09 13:30:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610121": [
        {
            "ioc_value": "ctrl.puertoricolsla.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-09 13:35:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "C2,SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1610122": [
        {
            "ioc_value": "7x.xg5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 13:30:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610120": [
        {
            "ioc_value": "qm.mw-2-o-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 13:25:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610113": [
        {
            "ioc_value": "u1.mw-2-o-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 13:08:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610112": [
        {
            "ioc_value": "hxi.xg5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 13:08:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610090": [
        {
            "ioc_value": "sdat.morayscouts.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-09 12:51:28",
            "last_seen_utc": "2025-10-09 15:59:52",
            "confidence_level": 75,
            "reference": "https://app.any.run/tasks/8105703b-b516-42e0-9379-7f6172715c1a",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1610091": [
        {
            "ioc_value": "subscribe.prtaxheaven.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-09 12:51:28",
            "last_seen_utc": "2025-10-16 13:25:15",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1610092": [
        {
            "ioc_value": "s7u.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:51:27",
            "last_seen_utc": "2025-10-09 12:48:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610095": [
        {
            "ioc_value": "apple.cobaltstrike.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-09 12:49:24",
            "last_seen_utc": "2025-11-11 15:48:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1610094": [
        {
            "ioc_value": "1ai.xg5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:48:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610093": [
        {
            "ioc_value": "h.mw-2-o-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:48:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610044": [
        {
            "ioc_value": "07.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:31:20",
            "last_seen_utc": "2025-10-09 11:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610048": [
        {
            "ioc_value": "agv.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:31:19",
            "last_seen_utc": "2025-10-09 11:33:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610051": [
        {
            "ioc_value": "om7.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:31:19",
            "last_seen_utc": "2025-10-09 11:41:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610052": [
        {
            "ioc_value": "1ax.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:31:19",
            "last_seen_utc": "2025-10-09 11:45:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610057": [
        {
            "ioc_value": "5tl.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:31:17",
            "last_seen_utc": "2025-10-09 12:07:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610086": [
        {
            "ioc_value": "vy.sx2u0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:31:16",
            "last_seen_utc": "2025-10-09 12:22:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610089": [
        {
            "ioc_value": "action.prtaxheaven.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-09 12:31:14",
            "last_seen_utc": "2025-10-16 13:25:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "SocGholish",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1610088": [
        {
            "ioc_value": "etl.xg5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:22:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610085": [
        {
            "ioc_value": "ci7.xg5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:07:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610077": [
        {
            "ioc_value": "cenonyenaro.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-10-09 12:02:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-hecvzaztds",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610072": [
        {
            "ioc_value": "hawkeye.v6.army",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-09 12:01:42",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-j9dleswjy8",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610073": [
        {
            "ioc_value": "hawkeye.dns.navy",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-09 12:01:42",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-j9dleswjy8",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610074": [
        {
            "ioc_value": "hawkeye.dns.army",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-09 12:01:42",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-j9dleswjy8",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610068": [
        {
            "ioc_value": "r2.qh-1-a-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 12:01:04",
            "last_seen_utc": "2025-10-09 12:17:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610067": [
        {
            "ioc_value": "l3mon.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-09 12:00:58",
            "last_seen_utc": "2025-10-14 14:34:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-kbk4aack21",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610065": [
        {
            "ioc_value": "parts-ways.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-09 12:00:57",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-kk9s1a1tbx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610066": [
        {
            "ioc_value": "h4wk.loseyourip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-09 12:00:57",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-kbk4aack21",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610064": [
        {
            "ioc_value": "our-tumor.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-09 12:00:56",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-k1azlswmy7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1610050": [
        {
            "ioc_value": "yd.xg5e7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 11:33:44",
            "last_seen_utc": "2025-10-09 11:45:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610049": [
        {
            "ioc_value": "wq.qh-1-a-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 11:33:43",
            "last_seen_utc": "2025-10-09 11:45:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610046": [
        {
            "ioc_value": "c7.qh-1-a-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 11:09:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610045": [
        {
            "ioc_value": "kb.fs8e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 11:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610030": [
        {
            "ioc_value": "me8.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 10:55:09",
            "last_seen_utc": "2025-10-09 09:43:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610034": [
        {
            "ioc_value": "61g.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 10:55:09",
            "last_seen_utc": "2025-10-09 09:56:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610037": [
        {
            "ioc_value": "5v6.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 10:55:08",
            "last_seen_utc": "2025-10-09 10:38:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610039": [
        {
            "ioc_value": "sv.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 10:55:07",
            "last_seen_utc": "2025-10-09 10:43:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610042": [
        {
            "ioc_value": "ws.cv3a9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 10:55:07",
            "last_seen_utc": "2025-10-09 10:54:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610043": [
        {
            "ioc_value": "n.qh-1-a-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 10:54:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610041": [
        {
            "ioc_value": "gmars.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-09 10:50:36",
            "last_seen_utc": "2025-11-10 07:50:29",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1610040": [
        {
            "ioc_value": "pq.fs8e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 10:42:14",
            "last_seen_utc": "2025-10-09 10:51:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610038": [
        {
            "ioc_value": "h1.qf-0-u-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 10:38:35",
            "last_seen_utc": "2025-10-09 10:43:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610032": [
        {
            "ioc_value": "fu6.fs8e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 09:43:25",
            "last_seen_utc": "2025-10-09 09:54:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610031": [
        {
            "ioc_value": "z9.qf-0-u-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 09:43:21",
            "last_seen_utc": "2025-10-09 09:56:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609997": [
        {
            "ioc_value": "eu.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 09:30:21",
            "last_seen_utc": "2025-10-09 08:51:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610020": [
        {
            "ioc_value": "i4j.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 09:30:20",
            "last_seen_utc": "2025-10-09 09:01:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610025": [
        {
            "ioc_value": "7tq.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 09:30:20",
            "last_seen_utc": "2025-10-09 09:11:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1610027": [
        {
            "ioc_value": "u5.qf-0-u-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 09:11:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610026": [
        {
            "ioc_value": "gd.fs8e0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 09:10:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610022": [
        {
            "ioc_value": "fr.cdn.riannarusu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-09 09:03:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1610019": [
        {
            "ioc_value": "yungask.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-09 08:56:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "zphp",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610017": [
        {
            "ioc_value": "bntelz.correola-com.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-09 08:55:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610018": [
        {
            "ioc_value": "schuiopl.correola-com.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-09 08:55:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610013": [
        {
            "ioc_value": "eagle1997.executorstresser.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-09 08:55:10",
            "last_seen_utc": "2025-10-20 12:27:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610014": [
        {
            "ioc_value": "liltrippy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-09 08:55:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610012": [
        {
            "ioc_value": "dckis3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-09 08:54:50",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610010": [
        {
            "ioc_value": "login.nethhelper.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-09 08:54:33",
            "last_seen_utc": "2025-10-09 08:54:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610011": [
        {
            "ioc_value": "sso.nethhelper.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-09 08:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610005": [
        {
            "ioc_value": "process-find.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-09 08:53:47",
            "last_seen_utc": "2025-10-10 11:34:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610006": [
        {
            "ioc_value": "shfh-54092.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-09 08:53:47",
            "last_seen_utc": "2025-10-10 11:34:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1610003": [
        {
            "ioc_value": "r.qf-0-u-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 08:51:46",
            "last_seen_utc": "2025-10-09 09:01:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1610000": [
        {
            "ioc_value": "iw.dk2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 08:51:17",
            "last_seen_utc": "2025-10-09 08:59:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609982": [
        {
            "ioc_value": "fr.cdn.ahmadarief.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-09 08:49:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609983": [
        {
            "ioc_value": "topk.beatriceflorea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-09 08:49:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609984": [
        {
            "ioc_value": "topk.morayscouts.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-09 08:49:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609970": [
        {
            "ioc_value": "extingx.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:43",
            "last_seen_utc": "2025-10-14 18:54:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609971": [
        {
            "ioc_value": "decresk.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:43",
            "last_seen_utc": "2025-10-13 18:33:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609972": [
        {
            "ioc_value": "backsth.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:43",
            "last_seen_utc": "2025-10-14 18:54:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609973": [
        {
            "ioc_value": "avenutk.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:43",
            "last_seen_utc": "2025-10-14 18:54:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609974": [
        {
            "ioc_value": "bezvbv.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609975": [
        {
            "ioc_value": "bezvbv.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609976": [
        {
            "ioc_value": "keylessgorepeaters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609977": [
        {
            "ioc_value": "buycryptograbbers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609978": [
        {
            "ioc_value": "walkersvillecomputers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609964": [
        {
            "ioc_value": "vacancz.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:42",
            "last_seen_utc": "2025-10-14 18:54:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609965": [
        {
            "ioc_value": "trampst.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:42",
            "last_seen_utc": "2025-10-14 18:54:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609966": [
        {
            "ioc_value": "splkulr.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:42",
            "last_seen_utc": "2025-10-14 18:54:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609967": [
        {
            "ioc_value": "parkdau.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:42",
            "last_seen_utc": "2025-10-14 18:54:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609968": [
        {
            "ioc_value": "ozoffky.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:42",
            "last_seen_utc": "2025-10-14 18:54:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609969": [
        {
            "ioc_value": "morybhb.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-09 08:45:42",
            "last_seen_utc": "2025-10-14 18:54:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609939": [
        {
            "ioc_value": "q73.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 08:43:00",
            "last_seen_utc": "2025-10-09 06:50:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609942": [
        {
            "ioc_value": "zoa.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 08:43:00",
            "last_seen_utc": "2025-10-09 07:24:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609945": [
        {
            "ioc_value": "6t.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 08:42:59",
            "last_seen_utc": "2025-10-09 07:35:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609946": [
        {
            "ioc_value": "45b.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 08:42:58",
            "last_seen_utc": "2025-10-09 07:39:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609959": [
        {
            "ioc_value": "vt7.rv-2-o-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 08:42:57",
            "last_seen_utc": "2025-10-09 08:07:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609961": [
        {
            "ioc_value": "kq.hl-5-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 08:07:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609960": [
        {
            "ioc_value": "sgz.dk2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 08:07:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609948": [
        {
            "ioc_value": "sx9.dk2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 07:39:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609947": [
        {
            "ioc_value": "m1.hl-5-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 07:39:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609944": [
        {
            "ioc_value": "tn7.hl-5-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 07:24:21",
            "last_seen_utc": "2025-10-09 07:30:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609943": [
        {
            "ioc_value": "js.dk2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 07:23:07",
            "last_seen_utc": "2025-10-09 07:35:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609941": [
        {
            "ioc_value": "b3.hl-5-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 06:50:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609940": [
        {
            "ioc_value": "c4.dk2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 06:50:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609933": [
        {
            "ioc_value": "lp.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 06:41:03",
            "last_seen_utc": "2025-10-09 06:04:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609938": [
        {
            "ioc_value": "ee.dk2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 06:04:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609937": [
        {
            "ioc_value": "dckis7.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-09 06:01:09",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-dbjrwsxwht",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609935": [
        {
            "ioc_value": "moving-digital.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-09 06:00:52",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251009-ceyvjsskx5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609934": [
        {
            "ioc_value": "x.hl-5-a-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 06:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609932": [
        {
            "ioc_value": "wmu.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:41:55",
            "last_seen_utc": "2025-10-09 05:43:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609931": [
        {
            "ioc_value": "b1.t-14o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:32:26",
            "last_seen_utc": "2025-10-09 05:40:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609930": [
        {
            "ioc_value": "pw.dr3a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:28:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609929": [
        {
            "ioc_value": "ioa.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:25:11",
            "last_seen_utc": "2025-10-09 05:32:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609835": [
        {
            "ioc_value": "5tq.xr-7-a-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:21:04",
            "last_seen_utc": "2025-10-09 03:37:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609805": [
        {
            "ioc_value": "kn3.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:40",
            "last_seen_utc": "2025-10-09 02:32:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609803": [
        {
            "ioc_value": "7k.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:39",
            "last_seen_utc": "2025-10-09 01:37:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609797": [
        {
            "ioc_value": "70.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:38",
            "last_seen_utc": "2025-10-09 00:08:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609800": [
        {
            "ioc_value": "g8z.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:38",
            "last_seen_utc": "2025-10-09 01:25:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609778": [
        {
            "ioc_value": "ady.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609775": [
        {
            "ioc_value": "y8.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:36",
            "last_seen_utc": "2025-10-08 22:42:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609772": [
        {
            "ioc_value": "b7.fk-9-e-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:35",
            "last_seen_utc": "2025-10-08 21:48:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609769": [
        {
            "ioc_value": "7l.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:34",
            "last_seen_utc": "2025-10-08 21:41:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609568": [
        {
            "ioc_value": "wp.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:33",
            "last_seen_utc": "2025-10-08 20:27:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609545": [
        {
            "ioc_value": "gh.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:32",
            "last_seen_utc": "2025-10-08 19:26:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609542": [
        {
            "ioc_value": "ey.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:31",
            "last_seen_utc": "2025-10-08 19:17:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609529": [
        {
            "ioc_value": "pd.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:30",
            "last_seen_utc": "2025-10-08 18:42:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609526": [
        {
            "ioc_value": "3j.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:29",
            "last_seen_utc": "2025-10-08 18:19:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609524": [
        {
            "ioc_value": "9iy.rm6a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:28",
            "last_seen_utc": "2025-10-08 18:11:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609520": [
        {
            "ioc_value": "ec.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:27",
            "last_seen_utc": "2025-10-08 18:07:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609500": [
        {
            "ioc_value": "jk.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:26",
            "last_seen_utc": "2025-10-08 17:43:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609496": [
        {
            "ioc_value": "9gh.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:24",
            "last_seen_utc": "2025-10-08 16:49:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609498": [
        {
            "ioc_value": "33.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:24",
            "last_seen_utc": "2025-10-08 16:59:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609495": [
        {
            "ioc_value": "tdbfvgwe456yt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-09 05:20:23",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1609494": [
        {
            "ioc_value": "miteamss.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-10-09 05:20:22",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1609467": [
        {
            "ioc_value": "ay.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 05:20:19",
            "last_seen_utc": "2025-10-08 16:09:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609919": [
        {
            "ioc_value": "Sharanilodge.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609920": [
        {
            "ioc_value": "asmicareer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609921": [
        {
            "ioc_value": "crm.jskymedia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609922": [
        {
            "ioc_value": "coffeyelectric.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609923": [
        {
            "ioc_value": "Sifld.rajeshmhegde.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609924": [
        {
            "ioc_value": "Pixelline.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609925": [
        {
            "ioc_value": "techinnovhub.co.za",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609926": [
        {
            "ioc_value": "fudgeshop.com.au",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609927": [
        {
            "ioc_value": "evodigital.com.au",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609928": [
        {
            "ioc_value": "365-drive.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609914": [
        {
            "ioc_value": "favorite-hotels.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609915": [
        {
            "ioc_value": "watchlist-verizon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609916": [
        {
            "ioc_value": "Growsearch.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609917": [
        {
            "ioc_value": "Creatorssky.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609918": [
        {
            "ioc_value": "quirkyrealty.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,deerstealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609905": [
        {
            "ioc_value": "Macosxappstore.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609906": [
        {
            "ioc_value": "Cryptoinfo-news.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609907": [
        {
            "ioc_value": "Cryptoinfo-allnews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609908": [
        {
            "ioc_value": "apposx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609909": [
        {
            "ioc_value": "ttxttx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609910": [
        {
            "ioc_value": "Greenpropertycert.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609911": [
        {
            "ioc_value": "cloudlare-lndex.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609912": [
        {
            "ioc_value": "Dactarhome.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609913": [
        {
            "ioc_value": "ibs-express.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609893": [
        {
            "ioc_value": "sdojifsfiudgigfiv.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609894": [
        {
            "ioc_value": "Charge0x.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": "2025-10-21 20:17:30",
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609895": [
        {
            "ioc_value": "speedtestcheck.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609896": [
        {
            "ioc_value": "claudflurer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609897": [
        {
            "ioc_value": "teamsonsoft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609898": [
        {
            "ioc_value": "Macosapp-apple.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609899": [
        {
            "ioc_value": "tradingview.connect-app.us.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609900": [
        {
            "ioc_value": "treadingveew.last-desk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609901": [
        {
            "ioc_value": "tradingviewen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609902": [
        {
            "ioc_value": "financementure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609903": [
        {
            "ioc_value": "Cryptoinfnews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609904": [
        {
            "ioc_value": "Emailreddit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-09 05:09:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609840": [
        {
            "ioc_value": "btvo.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-09 04:00:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/95.165.144.221+btvo.ru",
            "tags": "AS25513,ASN-MGTS-USPD,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1609837": [
        {
            "ioc_value": "g4.t-14o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 03:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609836": [
        {
            "ioc_value": "qep.dr3a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 03:37:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609814": [
        {
            "ioc_value": "www.hlhj2253.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-09 02:48:51",
            "last_seen_utc": "2025-11-16 19:48:59",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1609807": [
        {
            "ioc_value": "pm7.t-14o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 02:32:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609806": [
        {
            "ioc_value": "ed.dr3a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 02:31:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609804": [
        {
            "ioc_value": "k4.t-14o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 01:37:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609802": [
        {
            "ioc_value": "uis.dr3a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 01:25:14",
            "last_seen_utc": "2025-10-09 01:37:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609801": [
        {
            "ioc_value": "y.t-14o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 01:24:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609799": [
        {
            "ioc_value": "7ji.dr3a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 00:08:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609798": [
        {
            "ioc_value": "k4.w-48u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-09 00:07:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609777": [
        {
            "ioc_value": "z3.w-48u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 22:42:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609776": [
        {
            "ioc_value": "9h.dr3a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 22:40:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609773": [
        {
            "ioc_value": "qm9.w-48u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 21:48:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609771": [
        {
            "ioc_value": "inc.nm0e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 21:41:44",
            "last_seen_utc": "2025-10-08 21:47:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609770": [
        {
            "ioc_value": "u1.w-48u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 21:41:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609764": [
        {
            "ioc_value": "c1a.91pronhub.pw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-08 20:53:22",
            "last_seen_utc": "2025-11-10 15:50:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1609570": [
        {
            "ioc_value": "h.w-48u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 20:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609569": [
        {
            "ioc_value": "tp.nm0e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 20:27:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609544": [
        {
            "ioc_value": "zd.w-33e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 19:17:08",
            "last_seen_utc": "2025-10-08 19:26:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609543": [
        {
            "ioc_value": "sxp.nm0e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 19:16:44",
            "last_seen_utc": "2025-10-08 19:24:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609532": [
        {
            "ioc_value": "04.nm0e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 18:42:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609530": [
        {
            "ioc_value": "r2.w-33e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 18:28:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609528": [
        {
            "ioc_value": "we.nm0e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 18:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609527": [
        {
            "ioc_value": "wq9.w-33e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 18:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609523": [
        {
            "ioc_value": "osnetwork.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-10-08 18:07:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,revengerat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609522": [
        {
            "ioc_value": "c7.w-33e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 18:07:02",
            "last_seen_utc": "2025-10-08 18:11:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609521": [
        {
            "ioc_value": "26x.nm0e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 18:07:00",
            "last_seen_utc": "2025-10-08 18:10:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609517": [
        {
            "ioc_value": "klikdewaadsdisini8.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-08 18:04:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609518": [
        {
            "ioc_value": "254-badaimaxwin.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-08 18:04:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609512": [
        {
            "ioc_value": "karim44.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-08 18:03:11",
            "last_seen_utc": "2025-10-22 12:44:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-pthhbsfr5x",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609511": [
        {
            "ioc_value": "only-symposium.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-08 18:01:27",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-slc5esysax",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609510": [
        {
            "ioc_value": "7octubredc.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-08 18:01:13",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-qk1g8aw1gt",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609508": [
        {
            "ioc_value": "prakashjadha.ddnsgeek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-08 18:01:00",
            "last_seen_utc": "2025-10-15 15:29:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-p48ghawyct",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609506": [
        {
            "ioc_value": "classes-massachusetts.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-08 18:00:58",
            "last_seen_utc": "2025-10-14 14:34:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-ssg2yshn8t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609505": [
        {
            "ioc_value": "test.example.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-08 18:00:57",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-tld76aal6x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609504": [
        {
            "ioc_value": "places-turning.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-08 18:00:56",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-weg2kszycv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609502": [
        {
            "ioc_value": "al.jwm3e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 17:43:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609501": [
        {
            "ioc_value": "n.w-33e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 17:36:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609499": [
        {
            "ioc_value": "k9.l-70y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 16:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609497": [
        {
            "ioc_value": "m7.l-70y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 16:49:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609480": [
        {
            "ioc_value": "smallfootmyfor.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861841399329244",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609481": [
        {
            "ioc_value": "understandott.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861841399329244",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609482": [
        {
            "ioc_value": "blueprintsfdskjhfd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861841399329244",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609483": [
        {
            "ioc_value": "universitynsd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:16:20",
            "last_seen_utc": "2025-11-01 13:39:09",
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861841399329244",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609484": [
        {
            "ioc_value": "adventurergsdfjg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861841399329244",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609485": [
        {
            "ioc_value": "foundationasdasd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:16:20",
            "last_seen_utc": "2025-10-23 10:50:18",
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861841399329244",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609486": [
        {
            "ioc_value": "basketballast.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861841399329244",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609487": [
        {
            "ioc_value": "generationkasdm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861841399329244",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609488": [
        {
            "ioc_value": "remarkableaskf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861841399329244",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609477": [
        {
            "ioc_value": "sonosarcx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:13:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861845320929399",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609478": [
        {
            "ioc_value": "sonosarcl.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-08 16:13:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1975861845320929399",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609476": [
        {
            "ioc_value": "eh.jwm3e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 16:09:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609468": [
        {
            "ioc_value": "tq1.l-70y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 16:00:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609466": [
        {
            "ioc_value": "um.jwm3e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:48:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609464": [
        {
            "ioc_value": "mt.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:48:23",
            "last_seen_utc": "2025-10-08 15:48:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609465": [
        {
            "ioc_value": "b2.l-70y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:47:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609436": [
        {
            "ioc_value": "l51.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:40:44",
            "last_seen_utc": "2025-10-08 13:39:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609448": [
        {
            "ioc_value": "mcp.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:40:44",
            "last_seen_utc": "2025-10-08 14:02:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609451": [
        {
            "ioc_value": "54.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:40:43",
            "last_seen_utc": "2025-10-08 14:40:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609456": [
        {
            "ioc_value": "kd1.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:40:43",
            "last_seen_utc": "2025-10-08 15:15:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609460": [
        {
            "ioc_value": "xd.bb3y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:40:43",
            "last_seen_utc": "2025-10-08 15:32:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609463": [
        {
            "ioc_value": "05q0h4x0-5500.euw.devtunnels.ms",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-08 15:40:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/05q0h4x0-5500.euw.devtunnels.ms/relations",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1609462": [
        {
            "ioc_value": "er.jwm3e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:32:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609458": [
        {
            "ioc_value": "da.hqs9i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:15:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609457": [
        {
            "ioc_value": "x.l-70y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 15:13:44",
            "last_seen_utc": "2025-10-08 15:22:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609453": [
        {
            "ioc_value": "ma.hqs9i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 14:40:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609452": [
        {
            "ioc_value": "n0.x-12o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 14:39:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609450": [
        {
            "ioc_value": "ta.hqs9i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 14:08:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609449": [
        {
            "ioc_value": "e1.x-12o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 14:02:25",
            "last_seen_utc": "2025-10-08 14:08:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609447": [
        {
            "ioc_value": "na.hqs9i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 13:58:24",
            "last_seen_utc": "2025-10-08 14:02:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609446": [
        {
            "ioc_value": "qk2.x-12o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 13:50:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609445": [
        {
            "ioc_value": "ck.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 13:50:04",
            "last_seen_utc": "2025-10-08 14:08:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609439": [
        {
            "ioc_value": "ir.cdn.riannarusu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-08 13:45:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609440": [
        {
            "ioc_value": "ir.cdn.ahmadarief.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-08 13:45:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609438": [
        {
            "ioc_value": "u5.x-12o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 13:39:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609437": [
        {
            "ioc_value": "si.hqs9i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 13:38:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609433": [
        {
            "ioc_value": "vx.jk3y7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 13:20:19",
            "last_seen_utc": "2025-10-08 13:04:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609435": [
        {
            "ioc_value": "ti.hqs9i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 13:04:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609434": [
        {
            "ioc_value": "r.x-12o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 12:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609409": [
        {
            "ioc_value": "zhc.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 12:45:03",
            "last_seen_utc": "2025-10-08 11:41:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609411": [
        {
            "ioc_value": "2pb.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 12:45:02",
            "last_seen_utc": "2025-10-08 11:46:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609412": [
        {
            "ioc_value": "m9q.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 12:45:02",
            "last_seen_utc": "2025-10-08 11:51:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609428": [
        {
            "ioc_value": "4m.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 12:45:01",
            "last_seen_utc": "2025-10-08 12:21:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609431": [
        {
            "ioc_value": "bryncoed.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-08 12:45:01",
            "last_seen_utc": "2025-10-08 12:22:51",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115338521352856216",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1609429": [
        {
            "ioc_value": "r3.t-68e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 12:21:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609417": [
        {
            "ioc_value": "bv0n1d6w.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-08 12:00:51",
            "last_seen_utc": "2025-10-14 14:34:15",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-nt78bafl21",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609418": [
        {
            "ioc_value": "dz1p-nn0x.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-08 12:00:51",
            "last_seen_utc": "2025-10-14 14:34:15",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-ll768sel7v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609419": [
        {
            "ioc_value": "widayou.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-08 12:00:51",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-hzd9jadn21",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609415": [
        {
            "ioc_value": "nchawa.magizz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-08 12:00:44",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251008-jepp7stsgv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609410": [
        {
            "ioc_value": "k7.t-68e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 11:41:42",
            "last_seen_utc": "2025-10-08 11:51:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609406": [
        {
            "ioc_value": "jys.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 11:36:11",
            "last_seen_utc": "2025-10-08 11:29:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609408": [
        {
            "ioc_value": "aa9.t-68e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 11:29:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609402": [
        {
            "ioc_value": "k8u.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 11:11:32",
            "last_seen_utc": "2025-10-08 11:12:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609403": [
        {
            "ioc_value": "v2.t-68e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 11:07:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609388": [
        {
            "ioc_value": "zv.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 10:51:53",
            "last_seen_utc": "2025-10-08 09:42:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609390": [
        {
            "ioc_value": "mx.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 10:51:52",
            "last_seen_utc": "2025-10-08 09:55:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609396": [
        {
            "ioc_value": "6u1.mt3o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 10:51:52",
            "last_seen_utc": "2025-10-08 10:47:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609398": [
        {
            "ioc_value": "hyperrbeat.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-08 10:51:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "Pamparam"
        }
    ],
    "1609397": [
        {
            "ioc_value": "g.t-68e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 10:44:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609392": [
        {
            "ioc_value": "ismailh.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-08 10:37:04",
            "last_seen_utc": "2025-10-13 18:33:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609393": [
        {
            "ioc_value": "stevedw.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-08 10:37:04",
            "last_seen_utc": "2025-10-13 18:33:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609394": [
        {
            "ioc_value": "fightat.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-08 10:37:04",
            "last_seen_utc": "2025-10-13 18:33:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609395": [
        {
            "ioc_value": "citropt.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-08 10:37:04",
            "last_seen_utc": "2025-10-13 18:33:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1609391": [
        {
            "ioc_value": "m2.p-99o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 09:55:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609389": [
        {
            "ioc_value": "aa9.p-99o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 09:42:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609386": [
        {
            "ioc_value": "rd.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 09:22:43",
            "last_seen_utc": "2025-10-08 09:20:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609387": [
        {
            "ioc_value": "xq0.p-99o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 09:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609384": [
        {
            "ioc_value": "pdz.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 09:07:20",
            "last_seen_utc": "2025-10-08 08:59:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609385": [
        {
            "ioc_value": "l.p-99o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 08:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609335": [
        {
            "ioc_value": "hv3.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 08:53:35",
            "last_seen_utc": "2025-10-08 07:39:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609338": [
        {
            "ioc_value": "shreejayjalaramgroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-08 08:53:34",
            "last_seen_utc": "2025-11-03 18:37:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "cr4shtest"
        }
    ],
    "1609340": [
        {
            "ioc_value": "sr.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 08:53:30",
            "last_seen_utc": "2025-10-08 08:00:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609371": [
        {
            "ioc_value": "tj.rv2o5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 08:53:29",
            "last_seen_utc": "2025-10-08 08:21:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609372": [
        {
            "ioc_value": "aa.m-77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 08:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609350": [
        {
            "ioc_value": "fg.r.ap-execcompliance.vu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-08 07:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609351": [
        {
            "ioc_value": "tr.d.thejackdawsfly.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-08 07:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609352": [
        {
            "ioc_value": "bg.cdn.riannarusu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-08 07:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609353": [
        {
            "ioc_value": "bg.cdn.ahmadarief.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-08 07:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609354": [
        {
            "ioc_value": "rf.o.leangeeks.am",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-08 07:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609355": [
        {
            "ioc_value": "tre.m.astrum.vu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-08 07:58:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609356": [
        {
            "ioc_value": "go.4.thejackdawsfly.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-08 07:58:06",
            "last_seen_utc": "2025-10-09 08:49:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1609341": [
        {
            "ioc_value": "h1.m-77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 07:50:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609336": [
        {
            "ioc_value": "pz8.m-77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 07:30:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609329": [
        {
            "ioc_value": "aue.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 07:20:14",
            "last_seen_utc": "2025-10-08 07:09:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609331": [
        {
            "ioc_value": "vps.denissalazar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-08 07:20:13",
            "last_seen_utc": "2025-10-08 07:41:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1609334": [
        {
            "ioc_value": "b.yuxuanow.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-08 07:20:12",
            "last_seen_utc": "2025-10-08 07:18:58",
            "confidence_level": 88,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1609330": [
        {
            "ioc_value": "w4.m-77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 07:09:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609324": [
        {
            "ioc_value": "w4l.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 06:58:21",
            "last_seen_utc": "2025-10-08 06:54:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609325": [
        {
            "ioc_value": "d.m-77u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 06:48:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609320": [
        {
            "ioc_value": "pkf.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 06:41:53",
            "last_seen_utc": "2025-10-08 06:44:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609321": [
        {
            "ioc_value": "hm.k-72o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 06:40:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609315": [
        {
            "ioc_value": "l1.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 06:31:22",
            "last_seen_utc": "2025-10-08 06:20:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609317": [
        {
            "ioc_value": "death-net.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-08 06:31:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1609319": [
        {
            "ioc_value": "lite511.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-08 06:30:58",
            "last_seen_utc": "2025-10-14 14:34:04",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/011c95e1c3e4c516deda11b4039dc8ad135860dd944a12a630aec20583fac677/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1609318": [
        {
            "ioc_value": "t1.k-72o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 06:20:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609313": [
        {
            "ioc_value": "axctofwar.correola-com.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-08 06:08:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609314": [
        {
            "ioc_value": "myfreeenedd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-08 06:08:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609306": [
        {
            "ioc_value": "srzozkwog.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-08 06:06:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609271": [
        {
            "ioc_value": "vh7.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 06:06:03",
            "last_seen_utc": "2025-10-08 05:59:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609293": [
        {
            "ioc_value": "files-health.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-08 06:05:57",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609294": [
        {
            "ioc_value": "l5shrnoej.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-08 06:05:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1609270": [
        {
            "ioc_value": "qz9.k-72o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:53:57",
            "last_seen_utc": "2025-10-08 05:59:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609269": [
        {
            "ioc_value": "gq9.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:49:59",
            "last_seen_utc": "2025-10-08 05:53:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609040": [
        {
            "ioc_value": "s.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:40:45",
            "last_seen_utc": "2025-10-07 20:56:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609046": [
        {
            "ioc_value": "h1.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:40:41",
            "last_seen_utc": "2025-10-07 21:08:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609016": [
        {
            "ioc_value": "t1n.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:40:32",
            "last_seen_utc": "2025-10-07 20:37:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608992": [
        {
            "ioc_value": "r9.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:40:26",
            "last_seen_utc": "2025-10-07 20:22:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608988": [
        {
            "ioc_value": "bq.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:40:25",
            "last_seen_utc": "2025-10-07 20:07:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608976": [
        {
            "ioc_value": "x2j.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:40:24",
            "last_seen_utc": "2025-10-07 20:04:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608974": [
        {
            "ioc_value": "pc.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:40:23",
            "last_seen_utc": "2025-10-07 19:38:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609268": [
        {
            "ioc_value": "v2.k-72o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:20:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609267": [
        {
            "ioc_value": "h5z.xr7a0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 05:20:15",
            "last_seen_utc": "2025-10-08 05:36:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609266": [
        {
            "ioc_value": "k.k-72o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 04:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609265": [
        {
            "ioc_value": "vk.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 04:56:02",
            "last_seen_utc": "2025-10-08 04:58:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609264": [
        {
            "ioc_value": "au.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 04:29:25",
            "last_seen_utc": "2025-10-08 04:32:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609263": [
        {
            "ioc_value": "m6.b-9lyb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 04:27:16",
            "last_seen_utc": "2025-10-08 04:32:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609262": [
        {
            "ioc_value": "36.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 04:25:48",
            "last_seen_utc": "2025-10-08 04:27:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609234": [
        {
            "ioc_value": "mail.bels.pw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-08 04:01:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/95.165.144.221+mail.bels.pw",
            "tags": "AS25513,ASN-MGTS-USPD,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1609231": [
        {
            "ioc_value": "t1.b-9lyb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 03:55:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609230": [
        {
            "ioc_value": "vd.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 03:54:01",
            "last_seen_utc": "2025-10-08 04:00:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609229": [
        {
            "ioc_value": "id.dvn4i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 03:19:54",
            "last_seen_utc": "2025-10-08 12:20:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609228": [
        {
            "ioc_value": "4ia.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 03:13:41",
            "last_seen_utc": "2025-10-08 03:19:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609227": [
        {
            "ioc_value": "qz9.b-9lyb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 03:08:18",
            "last_seen_utc": "2025-10-08 03:15:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609225": [
        {
            "ioc_value": "s04.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 03:06:29",
            "last_seen_utc": "2025-10-08 03:08:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609226": [
        {
            "ioc_value": "ho.xkx0o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 03:06:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609222": [
        {
            "ioc_value": "ha.xkx0o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 01:32:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609221": [
        {
            "ioc_value": "2xh.fk9e2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 01:29:33",
            "last_seen_utc": "2025-10-08 01:32:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609220": [
        {
            "ioc_value": "1m.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 01:23:20",
            "last_seen_utc": "2025-10-08 01:24:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609219": [
        {
            "ioc_value": "v2.b-9lyb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 01:20:58",
            "last_seen_utc": "2025-10-08 01:31:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609218": [
        {
            "ioc_value": "c8.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-08 01:18:39",
            "last_seen_utc": "2025-10-08 01:20:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609205": [
        {
            "ioc_value": "ay.xkx0o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 23:39:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609204": [
        {
            "ioc_value": "k.b-9lyb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 23:28:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609203": [
        {
            "ioc_value": "p0.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 23:28:23",
            "last_seen_utc": "2025-10-07 23:39:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609132": [
        {
            "ioc_value": "b1.x-6kox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 22:08:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609131": [
        {
            "ioc_value": "aw.xkx0o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 22:07:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609095": [
        {
            "ioc_value": "0zq.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 22:06:15",
            "last_seen_utc": "2025-10-07 22:08:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609086": [
        {
            "ioc_value": "g4.x-6kox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 21:43:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609085": [
        {
            "ioc_value": "ax.xkx0o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 21:41:10",
            "last_seen_utc": "2025-10-07 21:50:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609084": [
        {
            "ioc_value": "v3.w5j7z0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 21:41:04",
            "last_seen_utc": "2025-10-07 21:50:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1609067": [
        {
            "ioc_value": "pm7.x-6kox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 21:08:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609043": [
        {
            "ioc_value": "k4.x-6kox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 20:56:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609041": [
        {
            "ioc_value": "am.xkx0o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 20:54:14",
            "last_seen_utc": "2025-10-07 21:06:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1609018": [
        {
            "ioc_value": "oh.cpc8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 20:37:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608997": [
        {
            "ioc_value": "y.x-6kox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 20:22:46",
            "last_seen_utc": "2025-10-07 20:37:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608987": [
        {
            "ioc_value": "ah.cpc8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 20:04:16",
            "last_seen_utc": "2025-10-07 20:12:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608975": [
        {
            "ioc_value": "ok.cpc8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 19:38:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608970": [
        {
            "ioc_value": "dcnewton5552.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-07 19:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,censys,DCRat,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608967": [
        {
            "ioc_value": "dccomicrat81.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-07 19:24:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.153.34.67",
            "tags": "c2,censys,DCRat,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608968": [
        {
            "ioc_value": "dc9887.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-07 19:24:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.153.34.67",
            "tags": "c2,censys,DCRat,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608969": [
        {
            "ioc_value": "dc9977.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-07 19:24:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.153.34.67",
            "tags": "c2,censys,DCRat,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608963": [
        {
            "ioc_value": "m8.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 19:23:56",
            "last_seen_utc": "2025-10-07 19:21:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608966": [
        {
            "ioc_value": "k4.c-3dax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 19:21:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608964": [
        {
            "ioc_value": "hi.cpc8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 19:19:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608958": [
        {
            "ioc_value": "wz.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 19:09:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608959": [
        {
            "ioc_value": "a.w9k6m9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 19:09:11",
            "last_seen_utc": "2025-10-07 19:07:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608960": [
        {
            "ioc_value": "so.cpc8u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 19:07:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608951": [
        {
            "ioc_value": "h2.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:58:06",
            "last_seen_utc": "2025-10-07 18:54:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608955": [
        {
            "ioc_value": "z3.c-3dax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:50:58",
            "last_seen_utc": "2025-10-07 19:07:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608809": [
        {
            "ioc_value": "g.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:39:06",
            "last_seen_utc": "2025-10-07 15:03:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608811": [
        {
            "ioc_value": "q7.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:39:04",
            "last_seen_utc": "2025-10-07 15:07:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608815": [
        {
            "ioc_value": "bd.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:39:04",
            "last_seen_utc": "2025-10-07 15:12:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608816": [
        {
            "ioc_value": "z1.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:39:03",
            "last_seen_utc": "2025-10-07 15:21:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608818": [
        {
            "ioc_value": "tq.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:39:03",
            "last_seen_utc": "2025-10-07 15:25:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608819": [
        {
            "ioc_value": "h9m.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:39:02",
            "last_seen_utc": "2025-10-07 15:32:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608837": [
        {
            "ioc_value": "x.s4m7v4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:39:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608838": [
        {
            "ioc_value": "b.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:39:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608839": [
        {
            "ioc_value": "n5.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:39:01",
            "last_seen_utc": "2025-10-07 17:34:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608840": [
        {
            "ioc_value": "bookings.escapesdollars.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-07 18:39:00",
            "last_seen_utc": "2025-10-16 13:25:15",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1608841": [
        {
            "ioc_value": "images.inversionflorida.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-07 18:39:00",
            "last_seen_utc": "2025-10-16 13:25:15",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1608842": [
        {
            "ioc_value": "panel.futurainternationalrealty.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-07 18:38:59",
            "last_seen_utc": "2025-10-16 13:25:15",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1608843": [
        {
            "ioc_value": "files.cellustrong.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-07 18:38:59",
            "last_seen_utc": "2025-10-07 18:23:04",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1608883": [
        {
            "ioc_value": "xt.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:38:46",
            "last_seen_utc": "2025-10-07 17:49:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608904": [
        {
            "ioc_value": "concept.mexicanstays.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-07 18:38:42",
            "last_seen_utc": "2025-10-07 18:23:04",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1608905": [
        {
            "ioc_value": "cpanel.experiencejiujitsu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-07 18:38:41",
            "last_seen_utc": "2025-10-07 18:23:04",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1608906": [
        {
            "ioc_value": "q.c2x0b1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:38:40",
            "last_seen_utc": "2025-10-07 18:21:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608917": [
        {
            "ioc_value": "townnoise.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-07 18:24:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608918": [
        {
            "ioc_value": "religionjudge.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-07 18:24:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608915": [
        {
            "ioc_value": "qm9.c-3dax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 18:21:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608898": [
        {
            "ioc_value": "dramendralux.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-07 18:01:05",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-tdpnxsfk9w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608895": [
        {
            "ioc_value": "executive-bath.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-07 18:00:58",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-pakhkscn8s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608896": [
        {
            "ioc_value": "career-sm.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-07 18:00:58",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-pc72nacn91",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608891": [
        {
            "ioc_value": "HITROL-60505.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-07 18:00:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-tfz8fazls4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608884": [
        {
            "ioc_value": "u1.c-3dax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 17:49:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608854": [
        {
            "ioc_value": "h.c-3dax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 17:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608820": [
        {
            "ioc_value": "zd.z-0xug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 15:32:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608817": [
        {
            "ioc_value": "r2.z-0xug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 15:20:19",
            "last_seen_utc": "2025-10-07 15:25:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608814": [
        {
            "ioc_value": "wq9.z-0xug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 15:07:58",
            "last_seen_utc": "2025-10-07 15:12:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608813": [
        {
            "ioc_value": "on.vzj1o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 15:06:58",
            "last_seen_utc": "2025-10-07 18:54:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608812": [
        {
            "ioc_value": "c7.z-0xug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 15:03:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608807": [
        {
            "ioc_value": "xq9.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 14:53:19",
            "last_seen_utc": "2025-10-07 14:43:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608808": [
        {
            "ioc_value": "n.z-0xug.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 14:41:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608803": [
        {
            "ioc_value": "h7.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 14:32:18",
            "last_seen_utc": "2025-10-07 14:20:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608805": [
        {
            "ioc_value": "cfb8.ba5eq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 14:23:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608802": [
        {
            "ioc_value": "k9.n-7sol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 14:07:59",
            "last_seen_utc": "2025-10-07 14:17:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608794": [
        {
            "ioc_value": "app.orlandodiscounts.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-07 14:05:27",
            "last_seen_utc": "2025-10-16 13:25:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1608795": [
        {
            "ioc_value": "n3.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 14:05:26",
            "last_seen_utc": "2025-10-07 13:41:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608797": [
        {
            "ioc_value": "zt.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 14:05:24",
            "last_seen_utc": "2025-10-07 13:48:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608800": [
        {
            "ioc_value": "a1.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 14:05:23",
            "last_seen_utc": "2025-10-07 13:58:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608801": [
        {
            "ioc_value": "pv.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 14:05:22",
            "last_seen_utc": "2025-10-07 14:07:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608798": [
        {
            "ioc_value": "m7.n-7sol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 13:48:10",
            "last_seen_utc": "2025-10-07 13:55:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608796": [
        {
            "ioc_value": "n0.n-4daw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 13:41:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608791": [
        {
            "ioc_value": "z9m.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 13:22:44",
            "last_seen_utc": "2025-10-07 13:19:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608793": [
        {
            "ioc_value": "e.b5k6f4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 13:22:44",
            "last_seen_utc": "2025-10-07 13:26:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608792": [
        {
            "ioc_value": "tq1.n-7sol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 13:19:03",
            "last_seen_utc": "2025-10-07 13:26:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608786": [
        {
            "ioc_value": "m2.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 13:09:48",
            "last_seen_utc": "2025-10-07 13:01:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608788": [
        {
            "ioc_value": "qb.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 13:09:48",
            "last_seen_utc": "2025-10-07 13:12:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608787": [
        {
            "ioc_value": "b2.n-7sol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 13:01:23",
            "last_seen_utc": "2025-10-07 13:12:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608784": [
        {
            "ioc_value": "netsupportsoftware.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-10-07 12:45:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "NetSupport,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608781": [
        {
            "ioc_value": "x.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 12:44:19",
            "last_seen_utc": "2025-10-07 12:39:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608783": [
        {
            "ioc_value": "x.n-7sol.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 12:39:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608782": [
        {
            "ioc_value": "no.frl0i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 12:38:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608753": [
        {
            "ioc_value": "s.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 12:22:21",
            "last_seen_utc": "2025-10-07 11:24:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608774": [
        {
            "ioc_value": "h3.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 12:22:20",
            "last_seen_utc": "2025-10-07 12:13:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608778": [
        {
            "ioc_value": "amgi1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-07 12:22:19",
            "last_seen_utc": "2025-10-07 12:19:27",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115332845629687514",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1608780": [
        {
            "ioc_value": "pl.v9r3g1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 12:22:18",
            "last_seen_utc": "2025-10-07 12:22:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608776": [
        {
            "ioc_value": "my.frl0i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 12:13:50",
            "last_seen_utc": "2025-10-07 14:43:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608775": [
        {
            "ioc_value": "e1.n-4daw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 12:13:31",
            "last_seen_utc": "2025-10-07 12:21:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608773": [
        {
            "ioc_value": "offer-relationships.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-07 12:02:31",
            "last_seen_utc": "2025-10-10 11:34:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-l8nfca1xfs",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608771": [
        {
            "ioc_value": "times-initially.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-07 12:02:30",
            "last_seen_utc": "2025-10-10 11:34:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-n3d1tscn3w",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608765": [
        {
            "ioc_value": "dckis9.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-07 12:01:11",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-h5w2javky5",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608762": [
        {
            "ioc_value": "scooptownscarwash.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-07 12:01:00",
            "last_seen_utc": "2025-10-14 14:34:15",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-k7geza1tgy",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608757": [
        {
            "ioc_value": "taxlogs.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-07 12:00:47",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-mwllnack7z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608758": [
        {
            "ioc_value": "premiemclient-4570.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-07 12:00:47",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-mwllnack7z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608755": [
        {
            "ioc_value": "refrech.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-07 12:00:45",
            "last_seen_utc": "2025-10-14 14:34:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-nbd7hs11bw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608754": [
        {
            "ioc_value": "me.frl0i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 11:24:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608750": [
        {
            "ioc_value": "h9.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 11:14:41",
            "last_seen_utc": "2025-10-07 10:58:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608751": [
        {
            "ioc_value": "x8n.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 11:14:40",
            "last_seen_utc": "2025-10-07 11:10:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608752": [
        {
            "ioc_value": "qk2.n-4daw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 11:10:27",
            "last_seen_utc": "2025-10-07 11:16:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608749": [
        {
            "ioc_value": "u5.n-4daw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:51:53",
            "last_seen_utc": "2025-10-07 10:58:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608679": [
        {
            "ioc_value": "a.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:23",
            "last_seen_utc": "2025-10-07 08:08:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608683": [
        {
            "ioc_value": "n3.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:23",
            "last_seen_utc": "2025-10-07 08:22:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608685": [
        {
            "ioc_value": "zc.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:22",
            "last_seen_utc": "2025-10-07 08:42:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608734": [
        {
            "ioc_value": "t1.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:22",
            "last_seen_utc": "2025-10-07 09:05:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608737": [
        {
            "ioc_value": "h7m.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:21",
            "last_seen_utc": "2025-10-07 09:13:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608735": [
        {
            "ioc_value": "x.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:20",
            "last_seen_utc": "2025-10-07 09:08:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608738": [
        {
            "ioc_value": "p9.x7f4g2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:19",
            "last_seen_utc": "2025-10-07 09:31:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608742": [
        {
            "ioc_value": "g.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608743": [
        {
            "ioc_value": "q4.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608745": [
        {
            "ioc_value": "bd.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:18",
            "last_seen_utc": "2025-10-07 10:40:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608747": [
        {
            "ioc_value": "z1.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:17",
            "last_seen_utc": "2025-10-07 10:44:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608748": [
        {
            "ioc_value": "tq.w9v5r4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:49:17",
            "last_seen_utc": "2025-10-07 10:51:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608746": [
        {
            "ioc_value": "r.n-4daw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 10:35:01",
            "last_seen_utc": "2025-10-07 10:44:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608739": [
        {
            "ioc_value": "r3.q-5ket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 09:30:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608736": [
        {
            "ioc_value": "k7.q-5ket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 09:05:57",
            "last_seen_utc": "2025-10-07 09:13:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608726": [
        {
            "ioc_value": "www.flywing.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-07 09:01:38",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608727": [
        {
            "ioc_value": "www.wingofffly.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-07 09:01:38",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608724": [
        {
            "ioc_value": "accessdennied.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-07 09:01:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608725": [
        {
            "ioc_value": "void.proxywall.p-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-07 09:01:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608723": [
        {
            "ioc_value": "path.p7s9.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-07 09:01:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,elknot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608720": [
        {
            "ioc_value": "securityhealthservice.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-07 09:00:28",
            "last_seen_utc": "2025-10-14 14:34:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608709": [
        {
            "ioc_value": "tpi.api-microsoftcom.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-07 08:55:24",
            "last_seen_utc": "2025-11-10 07:50:45",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608686": [
        {
            "ioc_value": "aa9.q-5ket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 08:42:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608684": [
        {
            "ioc_value": "v2.q-5ket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 08:22:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608682": [
        {
            "ioc_value": "pdfs.ba5eq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 08:15:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608680": [
        {
            "ioc_value": "g.q-5ket.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 08:06:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608669": [
        {
            "ioc_value": "q1n.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 07:55:12",
            "last_seen_utc": "2025-10-07 08:05:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608655": [
        {
            "ioc_value": "x.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 07:52:43",
            "last_seen_utc": "2025-10-07 07:03:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608658": [
        {
            "ioc_value": "r7.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 07:52:43",
            "last_seen_utc": "2025-10-07 07:19:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608667": [
        {
            "ioc_value": "b.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 07:52:30",
            "last_seen_utc": "2025-10-07 07:48:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608668": [
        {
            "ioc_value": "m2.j-9fuw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 07:42:40",
            "last_seen_utc": "2025-10-07 07:53:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608659": [
        {
            "ioc_value": "aa9.j-9fuw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 07:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608657": [
        {
            "ioc_value": "xq0.j-9fuw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 07:01:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608656": [
        {
            "ioc_value": "is.frl0i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 07:00:20",
            "last_seen_utc": "2025-10-07 10:58:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608653": [
        {
            "ioc_value": "vk.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 06:49:07",
            "last_seen_utc": "2025-10-07 06:29:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608654": [
        {
            "ioc_value": "c5.j-9fuw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 06:28:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608652": [
        {
            "ioc_value": "l.j-9fuw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 06:17:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608649": [
        {
            "ioc_value": "s.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 06:17:11",
            "last_seen_utc": "2025-10-07 06:09:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608651": [
        {
            "ioc_value": "m8.p3t9b3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 06:17:11",
            "last_seen_utc": "2025-10-07 06:17:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608650": [
        {
            "ioc_value": "aa.n-4cas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 06:08:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608646": [
        {
            "ioc_value": "fourt2949aslumes9.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-07 06:00:51",
            "last_seen_utc": "2025-10-10 11:34:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-dyv4faxzf1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608644": [
        {
            "ioc_value": "four-radiation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-07 06:00:40",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251007-asp4fsgm9s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608643": [
        {
            "ioc_value": "h1.n-4cas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 05:56:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608642": [
        {
            "ioc_value": "w1n.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 05:55:38",
            "last_seen_utc": "2025-10-07 05:56:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608639": [
        {
            "ioc_value": "glassgovernment.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-07 05:54:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608640": [
        {
            "ioc_value": "boundarycaption.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-07 05:54:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608641": [
        {
            "ioc_value": "tablesuggestion.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-07 05:54:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608637": [
        {
            "ioc_value": "h.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 05:45:54",
            "last_seen_utc": "2025-10-07 05:37:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608638": [
        {
            "ioc_value": "pz8.n-4cas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 05:37:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608635": [
        {
            "ioc_value": "q9.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 05:22:53",
            "last_seen_utc": "2025-10-07 05:27:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608636": [
        {
            "ioc_value": "w4.n-4cas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 05:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608443": [
        {
            "ioc_value": "desk.miamionly.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-07 05:10:01",
            "last_seen_utc": "2025-10-16 13:25:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "C2,SocGholish",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1608634": [
        {
            "ioc_value": "x.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 05:09:57",
            "last_seen_utc": "2025-10-07 05:11:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608633": [
        {
            "ioc_value": "d.n-4cas.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 05:07:04",
            "last_seen_utc": "2025-10-07 05:10:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608632": [
        {
            "ioc_value": "pt.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 05:05:47",
            "last_seen_utc": "2025-10-07 05:07:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608631": [
        {
            "ioc_value": "z2.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 04:30:32",
            "last_seen_utc": "2025-10-07 04:32:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608630": [
        {
            "ioc_value": "hm.x-7daf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 04:27:52",
            "last_seen_utc": "2025-10-07 04:31:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608629": [
        {
            "ioc_value": "k.m4d8q9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 04:25:51",
            "last_seen_utc": "2025-10-07 04:27:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608611": [
        {
            "ioc_value": "mythic.r.stf.printf.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-07 04:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/152.42.172.130+mythic.r.stf.printf.store",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1608610": [
        {
            "ioc_value": "sushinoking.ddnsking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-07 04:00:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.49.46.153+sushinoking.ddnsking.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1608603": [
        {
            "ioc_value": "t1.x-7daf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 01:48:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608602": [
        {
            "ioc_value": "if.xzb6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 01:44:39",
            "last_seen_utc": "2025-10-07 01:48:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608601": [
        {
            "ioc_value": "cm.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-07 01:44:30",
            "last_seen_utc": "2025-10-07 01:48:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608591": [
        {
            "ioc_value": "he.xzb6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 23:15:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608590": [
        {
            "ioc_value": "qz9.x-7daf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 23:15:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608589": [
        {
            "ioc_value": "y7.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 23:14:08",
            "last_seen_utc": "2025-10-06 23:15:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608455": [
        {
            "ioc_value": "u.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 22:59:36",
            "last_seen_utc": "2025-10-06 23:01:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608454": [
        {
            "ioc_value": "go.xzb6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 22:56:57",
            "last_seen_utc": "2025-10-07 06:29:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608453": [
        {
            "ioc_value": "v2.x-7daf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 22:55:50",
            "last_seen_utc": "2025-10-06 23:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608452": [
        {
            "ioc_value": "r3.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 22:54:54",
            "last_seen_utc": "2025-10-06 22:56:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608451": [
        {
            "ioc_value": "k.x-7daf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 22:29:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608450": [
        {
            "ioc_value": "do.xzb6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 22:28:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608449": [
        {
            "ioc_value": "by.xzb6i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 21:57:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608448": [
        {
            "ioc_value": "q4.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 21:56:06",
            "last_seen_utc": "2025-10-06 22:02:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608447": [
        {
            "ioc_value": "m6.d-76u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 21:55:55",
            "last_seen_utc": "2025-10-06 22:02:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608446": [
        {
            "ioc_value": "g.qoruva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 21:53:26",
            "last_seen_utc": "2025-10-06 22:29:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608445": [
        {
            "ioc_value": "qz.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 21:50:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608444": [
        {
            "ioc_value": "m3.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 21:45:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608440": [
        {
            "ioc_value": "x.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 21:22:03",
            "last_seen_utc": "2025-10-06 21:24:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608435": [
        {
            "ioc_value": "thretadm.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-06 21:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1790168/0/html",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608436": [
        {
            "ioc_value": "fivadm.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-06 21:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1790168/0/html",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608437": [
        {
            "ioc_value": "onsevadm.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-06 21:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1790168/0/html",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608438": [
        {
            "ioc_value": "tesshi.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-06 21:20:25",
            "last_seen_utc": "2025-10-08 18:14:00",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1790168/0/html",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608439": [
        {
            "ioc_value": "fouradm.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-06 21:20:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1790168/0/html",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608434": [
        {
            "ioc_value": "t1.d-76u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 21:20:09",
            "last_seen_utc": "2025-10-06 21:24:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608433": [
        {
            "ioc_value": "vv.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 21:17:10",
            "last_seen_utc": "2025-10-06 21:20:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608432": [
        {
            "ioc_value": "qz9.d-76u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 20:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608431": [
        {
            "ioc_value": "a9.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 20:26:08",
            "last_seen_utc": "2025-10-06 20:34:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608430": [
        {
            "ioc_value": "v2.d-76u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 20:06:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608429": [
        {
            "ioc_value": "p.henyta.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 20:06:02",
            "last_seen_utc": "2025-10-06 20:07:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608426": [
        {
            "ioc_value": "noreply1.resgatarcupomipirang.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-10-06 20:03:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/216.9.227.203+noreply1.resgatarcupomipirang.org",
            "tags": "AS44382,C2,censys,Gafgyt,open-dir,WHITELABEL",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608420": [
        {
            "ioc_value": "api.transbankdevelopers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-06 20:02:57",
            "last_seen_utc": "2025-10-07 04:00:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.65.3+api.transbankdevelopers.com",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608421": [
        {
            "ioc_value": "purplehax.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-06 20:02:57",
            "last_seen_utc": "2025-10-07 04:00:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.216.130.82+purplehax.com",
            "tags": "AMAZON-AES,AS14618,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608409": [
        {
            "ioc_value": "k.d-76u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 19:42:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608408": [
        {
            "ioc_value": "t1v.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 19:40:51",
            "last_seen_utc": "2025-10-06 19:42:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608382": [
        {
            "ioc_value": "k0.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 19:24:27",
            "last_seen_utc": "2025-10-06 19:27:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608381": [
        {
            "ioc_value": "b1.w-45u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 19:19:20",
            "last_seen_utc": "2025-10-06 19:24:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608380": [
        {
            "ioc_value": "hx.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 19:16:31",
            "last_seen_utc": "2025-10-06 19:19:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608378": [
        {
            "ioc_value": "pdfs.vototao9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 18:52:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608375": [
        {
            "ioc_value": "g4.w-45u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 18:49:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608373": [
        {
            "ioc_value": "z7.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 18:46:14",
            "last_seen_utc": "2025-10-06 18:49:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608372": [
        {
            "ioc_value": "qa.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 18:31:39",
            "last_seen_utc": "2025-10-06 18:32:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608371": [
        {
            "ioc_value": "pm7.w-45u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 18:28:49",
            "last_seen_utc": "2025-10-06 18:32:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608370": [
        {
            "ioc_value": "m2.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 18:22:53",
            "last_seen_utc": "2025-10-06 18:29:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608368": [
        {
            "ioc_value": "e.nykeju.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 18:07:30",
            "last_seen_utc": "2025-10-06 18:17:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608367": [
        {
            "ioc_value": "k4.w-45u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 18:03:55",
            "last_seen_utc": "2025-10-06 18:10:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608366": [
        {
            "ioc_value": "select-laura.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-06 18:01:46",
            "last_seen_utc": "2025-10-10 11:34:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/251006-smmegscq41",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608365": [
        {
            "ioc_value": "1m.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 18:01:16",
            "last_seen_utc": "2025-10-06 18:03:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608362": [
        {
            "ioc_value": "gloria.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-06 18:00:54",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251006-syqlaaswbx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608358": [
        {
            "ioc_value": "dad9idois-24522.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-06 18:00:37",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251006-vbddjsdm4y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608357": [
        {
            "ioc_value": "y.w-45u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 17:40:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608356": [
        {
            "ioc_value": "c8.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 17:29:05",
            "last_seen_utc": "2025-10-06 17:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608355": [
        {
            "ioc_value": "p0.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 17:22:50",
            "last_seen_utc": "2025-10-06 17:28:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608354": [
        {
            "ioc_value": "k4.v-36u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 17:11:40",
            "last_seen_utc": "2025-10-06 17:28:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608353": [
        {
            "ioc_value": "0zq.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 17:07:56",
            "last_seen_utc": "2025-10-06 17:19:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608306": [
        {
            "ioc_value": "h1.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 16:50:16",
            "last_seen_utc": "2025-10-06 16:31:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608320": [
        {
            "ioc_value": "v3.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 16:50:15",
            "last_seen_utc": "2025-10-06 16:44:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608345": [
        {
            "ioc_value": "ns3.sotawatanabi.trade",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-06 16:49:37",
            "last_seen_utc": "2025-11-22 07:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608343": [
        {
            "ioc_value": "ns2.littllee365c.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-06 16:49:35",
            "last_seen_utc": "2025-11-06 07:49:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608344": [
        {
            "ioc_value": "ns2.sotawatanabi.trade",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-06 16:49:35",
            "last_seen_utc": "2025-11-22 07:48:05",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608341": [
        {
            "ioc_value": "ns1.littllee365c.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-06 16:49:33",
            "last_seen_utc": "2025-11-06 07:49:05",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608342": [
        {
            "ioc_value": "ns1.sotawatanabi.trade",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-06 16:49:33",
            "last_seen_utc": "2025-11-22 07:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608307": [
        {
            "ioc_value": "z3.v-36u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 16:31:09",
            "last_seen_utc": "2025-10-06 16:44:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608303": [
        {
            "ioc_value": "ho.andreicerbu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-06 16:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1608304": [
        {
            "ioc_value": "ho.gulfscholarships.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-06 16:18:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1608300": [
        {
            "ioc_value": "s.ryzuka.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 16:14:27",
            "last_seen_utc": "2025-10-06 16:18:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608284": [
        {
            "ioc_value": "r9.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 16:06:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608285": [
        {
            "ioc_value": "t1n.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 16:06:18",
            "last_seen_utc": "2025-10-06 16:00:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608296": [
        {
            "ioc_value": "api.formall.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-06 16:01:39",
            "last_seen_utc": "2025-10-07 04:01:53",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.27.46.49+api.formall.org",
            "tags": "AS149440,censys,EvilGinx,EVOXTENTERPRISE-AS-AP,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608287": [
        {
            "ioc_value": "qm9.v-36u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 16:00:42",
            "last_seen_utc": "2025-10-06 16:10:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608275": [
        {
            "ioc_value": "pc.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 15:44:43",
            "last_seen_utc": "2025-10-06 15:28:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608278": [
        {
            "ioc_value": "x2j.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 15:44:42",
            "last_seen_utc": "2025-10-06 15:40:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608280": [
        {
            "ioc_value": "bq.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 15:44:41",
            "last_seen_utc": "2025-10-06 15:47:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608279": [
        {
            "ioc_value": "u1.v-36u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 15:40:17",
            "last_seen_utc": "2025-10-06 15:47:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608276": [
        {
            "ioc_value": "h.v-36u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 15:25:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608271": [
        {
            "ioc_value": "a.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 15:13:24",
            "last_seen_utc": "2025-10-06 14:26:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608273": [
        {
            "ioc_value": "m8.kyhely.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 15:13:23",
            "last_seen_utc": "2025-10-06 14:49:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608274": [
        {
            "ioc_value": "fixstealerthebest.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-10-06 15:13:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251006-r4s3xswnz6/behavioral2",
            "tags": "FixStealer,stealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1608272": [
        {
            "ioc_value": "zd.p-94u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 14:22:29",
            "last_seen_utc": "2025-10-06 14:36:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608261": [
        {
            "ioc_value": "q.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 14:16:08",
            "last_seen_utc": "2025-10-06 13:40:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608255": [
        {
            "ioc_value": "xt.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 14:16:07",
            "last_seen_utc": "2025-10-06 13:23:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608259": [
        {
            "ioc_value": "bibifarisfarilsd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-06 14:16:07",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "BlackWidow",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1608258": [
        {
            "ioc_value": "feradonmanilosaki.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-06 14:16:06",
            "last_seen_utc": "2025-10-11 20:31:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "BlackWidow",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1608260": [
        {
            "ioc_value": "laifedorikomakons.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-06 14:16:04",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "BlackWidow",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1608263": [
        {
            "ioc_value": "viadigm.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-06 14:16:03",
            "last_seen_utc": "2025-10-06 13:39:21",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115327497507637151",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1608266": [
        {
            "ioc_value": "h2.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 14:16:02",
            "last_seen_utc": "2025-10-06 13:44:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608267": [
        {
            "ioc_value": "wz.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 14:16:02",
            "last_seen_utc": "2025-10-06 13:55:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608269": [
        {
            "ioc_value": "k0n.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 14:16:01",
            "last_seen_utc": "2025-10-06 14:05:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608268": [
        {
            "ioc_value": "r2.p-94u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 13:55:26",
            "last_seen_utc": "2025-10-06 14:05:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608265": [
        {
            "ioc_value": "c7.p-94u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 13:40:11",
            "last_seen_utc": "2025-10-06 13:44:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608256": [
        {
            "ioc_value": "n.p-94u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 13:19:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608252": [
        {
            "ioc_value": "b.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 13:04:21",
            "last_seen_utc": "2025-10-06 12:53:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608254": [
        {
            "ioc_value": "n5.bupuva.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 13:04:20",
            "last_seen_utc": "2025-10-06 13:06:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608253": [
        {
            "ioc_value": "k9.w-78i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 12:52:04",
            "last_seen_utc": "2025-10-06 12:56:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608251": [
        {
            "ioc_value": "m7.w-78i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 12:39:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608250": [
        {
            "ioc_value": "x.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 12:39:05",
            "last_seen_utc": "2025-10-06 12:39:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608248": [
        {
            "ioc_value": "h9m.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 12:29:57",
            "last_seen_utc": "2025-10-06 12:19:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608249": [
        {
            "ioc_value": "tq1.w-78i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 12:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608233": [
        {
            "ioc_value": "q7.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 12:05:18",
            "last_seen_utc": "2025-10-06 11:22:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608237": [
        {
            "ioc_value": "bd.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 12:05:16",
            "last_seen_utc": "2025-10-06 11:53:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608238": [
        {
            "ioc_value": "z1.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 12:05:16",
            "last_seen_utc": "2025-10-06 11:57:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608247": [
        {
            "ioc_value": "tq.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 12:05:15",
            "last_seen_utc": "2025-10-06 12:07:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608246": [
        {
            "ioc_value": "lsoj0-51746.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-06 12:01:59",
            "last_seen_utc": "2025-10-10 11:34:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/251006-jtztqaxtat",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608241": [
        {
            "ioc_value": "reservasdelmar888.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-06 12:00:51",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251006-jj2wbs1qw2",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1608239": [
        {
            "ioc_value": "x.w-78i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 11:53:51",
            "last_seen_utc": "2025-10-06 12:07:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608232": [
        {
            "ioc_value": "g.favezi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 11:09:14",
            "last_seen_utc": "2025-10-06 11:19:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608230": [
        {
            "ioc_value": "sm4.vototao9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 11:02:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608229": [
        {
            "ioc_value": "xq9.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 10:55:41",
            "last_seen_utc": "2025-10-06 10:59:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608216": [
        {
            "ioc_value": "d.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 10:44:01",
            "last_seen_utc": "2025-10-06 09:25:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608218": [
        {
            "ioc_value": "n3.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 10:44:01",
            "last_seen_utc": "2025-10-06 09:44:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608220": [
        {
            "ioc_value": "zx.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 10:44:00",
            "last_seen_utc": "2025-10-06 09:56:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608222": [
        {
            "ioc_value": "a1.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 10:43:59",
            "last_seen_utc": "2025-10-06 10:04:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608223": [
        {
            "ioc_value": "pv.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 10:43:59",
            "last_seen_utc": "2025-10-06 10:08:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608224": [
        {
            "ioc_value": "h7.pisora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 10:43:59",
            "last_seen_utc": "2025-10-06 10:33:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608221": [
        {
            "ioc_value": "b2.w-78i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 09:55:46",
            "last_seen_utc": "2025-10-06 10:04:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608219": [
        {
            "ioc_value": "n0.h-23u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 09:44:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608217": [
        {
            "ioc_value": "e1.h-23u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 09:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608212": [
        {
            "ioc_value": "qb.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 09:09:51",
            "last_seen_utc": "2025-10-06 08:22:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608214": [
        {
            "ioc_value": "z9m.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 09:09:51",
            "last_seen_utc": "2025-10-06 09:15:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608215": [
        {
            "ioc_value": "qk2.h-23u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 09:09:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608213": [
        {
            "ioc_value": "u5.h-23u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 08:20:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608208": [
        {
            "ioc_value": "x.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 08:14:29",
            "last_seen_utc": "2025-10-06 07:54:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608210": [
        {
            "ioc_value": "m2.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 08:14:29",
            "last_seen_utc": "2025-10-06 08:06:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608211": [
        {
            "ioc_value": "r.h-23u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 08:02:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608209": [
        {
            "ioc_value": "r3.x-57u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 07:49:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608207": [
        {
            "ioc_value": "k7.x-57u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 07:41:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608155": [
        {
            "ioc_value": "s.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 07:39:24",
            "last_seen_utc": "2025-10-06 06:50:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608159": [
        {
            "ioc_value": "h2.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 07:39:24",
            "last_seen_utc": "2025-10-06 07:18:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608206": [
        {
            "ioc_value": "pl.vamuwe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 07:39:23",
            "last_seen_utc": "2025-10-06 07:41:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608203": [
        {
            "ioc_value": "deadyh2849ijest.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-06 07:37:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608204": [
        {
            "ioc_value": "top.wenevergoing2abuse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-06 07:37:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608202": [
        {
            "ioc_value": "madeinmood1-27123.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-06 07:37:32",
            "last_seen_utc": "2025-10-10 11:34:39",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608201": [
        {
            "ioc_value": "butternet.vietnamddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-06 07:37:18",
            "last_seen_utc": "2025-10-20 12:27:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608199": [
        {
            "ioc_value": "availability-ks.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-06 07:37:05",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608200": [
        {
            "ioc_value": "calendar-egyptian.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-06 07:37:05",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1608160": [
        {
            "ioc_value": "aa9.x-57u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 07:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608156": [
        {
            "ioc_value": "v2.x-57u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 06:50:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608154": [
        {
            "ioc_value": "ede3.vototao9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 06:47:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608141": [
        {
            "ioc_value": "cm.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 06:41:24",
            "last_seen_utc": "2025-10-06 06:44:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608143": [
        {
            "ioc_value": "diarrhea-diaper-scat-fart-midget-stink.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-06 06:41:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1608149": [
        {
            "ioc_value": "g.x-57u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 06:41:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608147": [
        {
            "ioc_value": "ma.gulfscholarships.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-06 06:40:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1608148": [
        {
            "ioc_value": "ma.andreicerbu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-06 06:40:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1608139": [
        {
            "ioc_value": "y7.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 06:23:45",
            "last_seen_utc": "2025-10-06 06:20:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608140": [
        {
            "ioc_value": "m2.f-07y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 06:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608135": [
        {
            "ioc_value": "centre-samples.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-06 06:01:47",
            "last_seen_utc": "2025-10-10 11:34:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251006-ahrjjadk4t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607711": [
        {
            "ioc_value": "alfa.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-06 05:38:06",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1607712": [
        {
            "ioc_value": "sonnet.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-06 05:38:06",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1608130": [
        {
            "ioc_value": "aa9.f-07y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 05:16:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608129": [
        {
            "ioc_value": "u.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 05:11:58",
            "last_seen_utc": "2025-10-06 05:16:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608107": [
        {
            "ioc_value": "laposada.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-06 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.114.120+laposada.pro",
            "tags": "AS401116,C2,censys,NYBULA",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1608106": [
        {
            "ioc_value": "r3.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 03:49:47",
            "last_seen_utc": "2025-10-06 03:56:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608105": [
        {
            "ioc_value": "xq0.f-07y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 03:47:30",
            "last_seen_utc": "2025-10-06 03:50:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608104": [
        {
            "ioc_value": "ve.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 03:46:08",
            "last_seen_utc": "2025-10-06 03:47:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608103": [
        {
            "ioc_value": "c5.f-07y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 03:02:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608102": [
        {
            "ioc_value": "k8.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 03:00:40",
            "last_seen_utc": "2025-10-06 03:02:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608099": [
        {
            "ioc_value": "frienel-blog.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-06 02:48:29",
            "last_seen_utc": "2025-11-07 07:49:38",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608098": [
        {
            "ioc_value": "api.updatesreview.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-06 02:48:24",
            "last_seen_utc": "2025-11-05 13:50:35",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1608097": [
        {
            "ioc_value": "l.f-07y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 02:39:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608096": [
        {
            "ioc_value": "p.n726z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 02:37:11",
            "last_seen_utc": "2025-10-06 02:48:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608075": [
        {
            "ioc_value": "aa.m-05o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 01:19:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608074": [
        {
            "ioc_value": "x.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 01:16:34",
            "last_seen_utc": "2025-10-06 01:19:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608073": [
        {
            "ioc_value": "h1.m-05o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 00:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608072": [
        {
            "ioc_value": "h9m.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 00:18:49",
            "last_seen_utc": "2025-10-06 00:22:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608069": [
        {
            "ioc_value": "tq.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 00:12:37",
            "last_seen_utc": "2025-10-06 00:18:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1608068": [
        {
            "ioc_value": "pz8.m-05o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 00:06:40",
            "last_seen_utc": "2025-10-06 00:14:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1608064": [
        {
            "ioc_value": "z1.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-06 00:04:43",
            "last_seen_utc": "2025-10-06 00:06:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607905": [
        {
            "ioc_value": "bd.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 23:14:10",
            "last_seen_utc": "2025-10-05 23:15:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607904": [
        {
            "ioc_value": "d.m-05o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 23:09:16",
            "last_seen_utc": "2025-10-05 23:15:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607903": [
        {
            "ioc_value": "q7.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 23:06:55",
            "last_seen_utc": "2025-10-05 23:09:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607902": [
        {
            "ioc_value": "a.t938q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 22:40:44",
            "last_seen_utc": "2025-10-05 22:42:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607899": [
        {
            "ioc_value": "cm.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 22:13:08",
            "last_seen_utc": "2025-10-05 22:28:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607898": [
        {
            "ioc_value": "y7.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 21:36:45",
            "last_seen_utc": "2025-10-05 21:39:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607897": [
        {
            "ioc_value": "u.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 21:11:33",
            "last_seen_utc": "2025-10-05 21:13:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607896": [
        {
            "ioc_value": "hm.h-29i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 21:01:56",
            "last_seen_utc": "2025-10-05 21:13:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607895": [
        {
            "ioc_value": "r3.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 21:00:32",
            "last_seen_utc": "2025-10-05 21:01:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607892": [
        {
            "ioc_value": "t1.h-29i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 20:42:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607891": [
        {
            "ioc_value": "ve.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 20:41:04",
            "last_seen_utc": "2025-10-05 20:42:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607890": [
        {
            "ioc_value": "k8.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 20:30:16",
            "last_seen_utc": "2025-10-05 20:37:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607889": [
        {
            "ioc_value": "qz9.h-29i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 20:24:51",
            "last_seen_utc": "2025-10-05 20:37:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607888": [
        {
            "ioc_value": "p.m935w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 20:23:02",
            "last_seen_utc": "2025-10-05 20:24:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607878": [
        {
            "ioc_value": "v2.h-29i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 19:36:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607876": [
        {
            "ioc_value": "c1m.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 19:33:33",
            "last_seen_utc": "2025-10-05 19:36:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607871": [
        {
            "ioc_value": "k.h-29i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 18:44:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607869": [
        {
            "ioc_value": "wz.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 18:42:50",
            "last_seen_utc": "2025-10-05 18:48:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607867": [
        {
            "ioc_value": "m6.4-z493.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 18:33:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607866": [
        {
            "ioc_value": "h2.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 18:31:00",
            "last_seen_utc": "2025-10-05 18:33:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607865": [
        {
            "ioc_value": "t1.4-z493.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 18:19:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607864": [
        {
            "ioc_value": "q.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 18:17:38",
            "last_seen_utc": "2025-10-05 18:19:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607859": [
        {
            "ioc_value": "qz9.4-z493.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 17:19:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607858": [
        {
            "ioc_value": "xt.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 17:16:56",
            "last_seen_utc": "2025-10-05 17:19:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607857": [
        {
            "ioc_value": "v2.4-z493.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 17:07:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607856": [
        {
            "ioc_value": "n4.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 17:05:07",
            "last_seen_utc": "2025-10-05 17:07:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607855": [
        {
            "ioc_value": "b.w135v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:56:43",
            "last_seen_utc": "2025-10-05 16:57:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607854": [
        {
            "ioc_value": "c2n.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:53:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607853": [
        {
            "ioc_value": "k.4-z493.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:50:22",
            "last_seen_utc": "2025-10-05 16:57:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607852": [
        {
            "ioc_value": "hv.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:46:26",
            "last_seen_utc": "2025-10-05 16:50:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607851": [
        {
            "ioc_value": "x9.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:42:46",
            "last_seen_utc": "2025-10-05 16:45:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607850": [
        {
            "ioc_value": "b1.6-b408.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:41:08",
            "last_seen_utc": "2025-10-05 16:44:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607849": [
        {
            "ioc_value": "t.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:39:31",
            "last_seen_utc": "2025-10-05 16:41:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607834": [
        {
            "ioc_value": "usa-miss.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607835": [
        {
            "ioc_value": "re-goat.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607836": [
        {
            "ioc_value": "gmt-inner.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607837": [
        {
            "ioc_value": "news-kw.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607838": [
        {
            "ioc_value": "example-saturn.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607839": [
        {
            "ioc_value": "now-clause.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607840": [
        {
            "ioc_value": "running-giants.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607823": [
        {
            "ioc_value": "gifts-nhl.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607824": [
        {
            "ioc_value": "seen-leader.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607825": [
        {
            "ioc_value": "locations-bow.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607826": [
        {
            "ioc_value": "stop-webshots.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607827": [
        {
            "ioc_value": "television-impressed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607828": [
        {
            "ioc_value": "education-black.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607829": [
        {
            "ioc_value": "assessment-scores.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607830": [
        {
            "ioc_value": "change-resolution.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607831": [
        {
            "ioc_value": "email-migration.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607832": [
        {
            "ioc_value": "main-traveller.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607833": [
        {
            "ioc_value": "greater-clearance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607811": [
        {
            "ioc_value": "smith-alternatively.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607812": [
        {
            "ioc_value": "trying-graphical.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607813": [
        {
            "ioc_value": "then-paper.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607814": [
        {
            "ioc_value": "center-viewpicture.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607815": [
        {
            "ioc_value": "health-faces.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607816": [
        {
            "ioc_value": "having-spring.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607817": [
        {
            "ioc_value": "fat-dc.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607818": [
        {
            "ioc_value": "press-written.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607819": [
        {
            "ioc_value": "windows-cio.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607820": [
        {
            "ioc_value": "professional-ultimately.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607821": [
        {
            "ioc_value": "ago-newsletter.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607822": [
        {
            "ioc_value": "peter-appendix.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607801": [
        {
            "ioc_value": "not-rosa.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607802": [
        {
            "ioc_value": "civil-additionally.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607803": [
        {
            "ioc_value": "listings-goal.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607804": [
        {
            "ioc_value": "first-walt.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607805": [
        {
            "ioc_value": "needed-tier.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607806": [
        {
            "ioc_value": "also-nebraska.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607807": [
        {
            "ioc_value": "processing-salem.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607808": [
        {
            "ioc_value": "boy-crack.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607809": [
        {
            "ioc_value": "the-administered.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607810": [
        {
            "ioc_value": "fat-extras.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607794": [
        {
            "ioc_value": "mean-airline.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:39",
            "last_seen_utc": "2025-12-12 18:39:21",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607795": [
        {
            "ioc_value": "according-european.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607796": [
        {
            "ioc_value": "browse-d.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607797": [
        {
            "ioc_value": "private-seas.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607798": [
        {
            "ioc_value": "remember-marks.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607799": [
        {
            "ioc_value": "complete-demonstrated.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607800": [
        {
            "ioc_value": "happy-poly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607783": [
        {
            "ioc_value": "word-stable.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607784": [
        {
            "ioc_value": "yet-patent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607785": [
        {
            "ioc_value": "wide-fires.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607786": [
        {
            "ioc_value": "thing-stud.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607787": [
        {
            "ioc_value": "money-andreas.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607788": [
        {
            "ioc_value": "ads-isle.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607789": [
        {
            "ioc_value": "so-byte.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607790": [
        {
            "ioc_value": "numbers-mens.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607791": [
        {
            "ioc_value": "open-amp.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607792": [
        {
            "ioc_value": "warning-gym.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607793": [
        {
            "ioc_value": "background-refined.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607776": [
        {
            "ioc_value": "canada-licensed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607777": [
        {
            "ioc_value": "become-evening.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607778": [
        {
            "ioc_value": "reading-catering.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:37",
            "last_seen_utc": "2025-10-14 14:34:11",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607779": [
        {
            "ioc_value": "their-pour.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607780": [
        {
            "ioc_value": "listed-revised.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607781": [
        {
            "ioc_value": "extra-strict.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607782": [
        {
            "ioc_value": "animal-flying.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 16:23:37",
            "last_seen_utc": "2025-10-14 14:34:11",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/147.185.221.17/relations",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1607775": [
        {
            "ioc_value": "pz.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:17:32",
            "last_seen_utc": "2025-10-05 16:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607774": [
        {
            "ioc_value": "g4.6-b408.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:15:29",
            "last_seen_utc": "2025-10-05 16:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607773": [
        {
            "ioc_value": "m7.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 16:14:10",
            "last_seen_utc": "2025-10-05 16:15:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607771": [
        {
            "ioc_value": "kenges-rakishev-investigation.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-05 16:03:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1597946/",
            "tags": "c2,infostealer,lumma,stealer",
            "anonymous": "1",
            "reporter": "ninjacatcher"
        }
    ],
    "1607769": [
        {
            "ioc_value": "pm7.6-b408.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 15:58:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607768": [
        {
            "ioc_value": "a.m046d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 15:55:12",
            "last_seen_utc": "2025-10-05 15:58:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607767": [
        {
            "ioc_value": "k4.6-b408.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 15:53:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607766": [
        {
            "ioc_value": "z9m.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 15:52:01",
            "last_seen_utc": "2025-10-05 15:53:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607765": [
        {
            "ioc_value": "alskaskao44242.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-05 15:49:38",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251005-qsb5lafk9z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607764": [
        {
            "ioc_value": "practice-pf.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 15:49:14",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251005-qe8xeatzfw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607763": [
        {
            "ioc_value": "different-walt.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 15:49:13",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251005-sg6k6szrv8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607722": [
        {
            "ioc_value": "qb.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 15:18:50",
            "last_seen_utc": "2025-10-05 15:24:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607721": [
        {
            "ioc_value": "y.6-b408.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 15:15:42",
            "last_seen_utc": "2025-10-05 15:19:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607720": [
        {
            "ioc_value": "m2.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 15:13:35",
            "last_seen_utc": "2025-10-05 15:15:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607719": [
        {
            "ioc_value": "person-expansion.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 15:03:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,XWorm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607718": [
        {
            "ioc_value": "k4.3-c719.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:57:18",
            "last_seen_utc": "2025-10-05 15:02:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607717": [
        {
            "ioc_value": "x.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:57:09",
            "last_seen_utc": "2025-10-05 15:10:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607716": [
        {
            "ioc_value": "pn.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:55:28",
            "last_seen_utc": "2025-10-05 14:57:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607715": [
        {
            "ioc_value": "z3.3-c719.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:40:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607714": [
        {
            "ioc_value": "h3.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:40:04",
            "last_seen_utc": "2025-10-05 14:42:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607713": [
        {
            "ioc_value": "s.x352x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:36:17",
            "last_seen_utc": "2025-10-05 14:37:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607710": [
        {
            "ioc_value": "qm9.3-c719.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:25:46",
            "last_seen_utc": "2025-10-05 14:37:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607709": [
        {
            "ioc_value": "z.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:21:44",
            "last_seen_utc": "2025-10-05 14:31:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607668": [
        {
            "ioc_value": "t1v.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:02:38",
            "last_seen_utc": "2025-10-05 14:04:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607667": [
        {
            "ioc_value": "u1.3-c719.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 14:00:59",
            "last_seen_utc": "2025-10-05 14:04:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607666": [
        {
            "ioc_value": "m2.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 13:57:57",
            "last_seen_utc": "2025-10-05 14:00:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607665": [
        {
            "ioc_value": "a.tqh2e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 13:49:45",
            "last_seen_utc": "2025-10-06 20:27:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607664": [
        {
            "ioc_value": "h.3-c719.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 13:48:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607663": [
        {
            "ioc_value": "q.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 13:47:40",
            "last_seen_utc": "2025-10-05 13:49:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607583": [
        {
            "ioc_value": "login.formall.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-05 13:45:33",
            "last_seen_utc": "2025-10-06 04:00:54",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.27.46.49+login.formall.org",
            "tags": "AS149440,censys,EvilGinx,EVOXTENTERPRISE-AS-AP,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607574": [
        {
            "ioc_value": "hx.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 13:23:35",
            "last_seen_utc": "2025-10-05 13:26:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607573": [
        {
            "ioc_value": "zd.7-j230.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 13:16:02",
            "last_seen_utc": "2025-10-05 13:26:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607572": [
        {
            "ioc_value": "ex.xhs-8-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 13:14:34",
            "last_seen_utc": "2025-10-05 13:23:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607571": [
        {
            "ioc_value": "d4.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 13:14:20",
            "last_seen_utc": "2025-10-05 13:16:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607568": [
        {
            "ioc_value": "r2.7-j230.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 12:35:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607567": [
        {
            "ioc_value": "ew.xhs-8-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 12:33:05",
            "last_seen_utc": "2025-10-05 12:37:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607566": [
        {
            "ioc_value": "n.z491l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 12:32:57",
            "last_seen_utc": "2025-10-05 12:37:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607565": [
        {
            "ioc_value": "oqslpwgyxjfbxp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-05 12:02:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251005-h19rtsdj2w",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607556": [
        {
            "ioc_value": "basis-appropriations.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 12:00:34",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251005-lmvmjaxpw7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607557": [
        {
            "ioc_value": "canadian-inexpensive.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 12:00:34",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251005-h13zaawrv8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607554": [
        {
            "ioc_value": "tree-assistance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 12:00:33",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251005-nfwblaymy8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607552": [
        {
            "ioc_value": "wq9.7-j230.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607551": [
        {
            "ioc_value": "er.xhs-8-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:58:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607550": [
        {
            "ioc_value": "p2n.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:58:06",
            "last_seen_utc": "2025-10-05 11:59:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607549": [
        {
            "ioc_value": "hv.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:56:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607548": [
        {
            "ioc_value": "x9.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:53:18",
            "last_seen_utc": "2025-10-05 11:54:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607547": [
        {
            "ioc_value": "c7.7-j230.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:49:42",
            "last_seen_utc": "2025-10-05 11:54:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607546": [
        {
            "ioc_value": "et.xhs-8-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:49:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607545": [
        {
            "ioc_value": "t1.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:49:08",
            "last_seen_utc": "2025-10-05 11:49:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607544": [
        {
            "ioc_value": "n.7-j230.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:24:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607543": [
        {
            "ioc_value": "qs.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:24:03",
            "last_seen_utc": "2025-10-05 11:24:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607542": [
        {
            "ioc_value": "es.xhs-8-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:20:55",
            "last_seen_utc": "2025-10-05 11:24:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607541": [
        {
            "ioc_value": "m8.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:15:49",
            "last_seen_utc": "2025-10-05 11:20:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607540": [
        {
            "ioc_value": "k9.2-j695.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:08:59",
            "last_seen_utc": "2025-10-05 11:17:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607539": [
        {
            "ioc_value": "b.c109s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 11:08:30",
            "last_seen_utc": "2025-10-05 11:09:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607534": [
        {
            "ioc_value": "genuspt.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-05 10:52:35",
            "last_seen_utc": "2025-10-13 18:33:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607535": [
        {
            "ioc_value": "glimmed.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-05 10:52:35",
            "last_seen_utc": "2025-10-13 18:33:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607536": [
        {
            "ioc_value": "spideri.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-05 10:52:35",
            "last_seen_utc": "2025-10-12 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607537": [
        {
            "ioc_value": "likeheb.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-05 10:52:35",
            "last_seen_utc": "2025-10-12 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607538": [
        {
            "ioc_value": "anteria.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-05 10:52:35",
            "last_seen_utc": "2025-10-12 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607504": [
        {
            "ioc_value": "qz.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:26",
            "last_seen_utc": "2025-10-05 07:45:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607502": [
        {
            "ioc_value": "m9.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:25",
            "last_seen_utc": "2025-10-05 07:26:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607510": [
        {
            "ioc_value": "r1.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:24",
            "last_seen_utc": "2025-10-05 08:15:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607512": [
        {
            "ioc_value": "x.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:23",
            "last_seen_utc": "2025-10-05 08:36:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607518": [
        {
            "ioc_value": "tn.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:23",
            "last_seen_utc": "2025-10-05 08:58:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607520": [
        {
            "ioc_value": "v2n.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:23",
            "last_seen_utc": "2025-10-05 09:26:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607522": [
        {
            "ioc_value": "e.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:21",
            "last_seen_utc": "2025-10-05 09:30:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607523": [
        {
            "ioc_value": "n3.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:20",
            "last_seen_utc": "2025-10-05 10:04:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607525": [
        {
            "ioc_value": "zt.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:20",
            "last_seen_utc": "2025-10-05 10:10:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607527": [
        {
            "ioc_value": "a1.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:19",
            "last_seen_utc": "2025-10-05 10:26:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607529": [
        {
            "ioc_value": "pv.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:19",
            "last_seen_utc": "2025-10-05 10:34:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607530": [
        {
            "ioc_value": "h7.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:18",
            "last_seen_utc": "2025-10-05 10:38:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607532": [
        {
            "ioc_value": "xq9.f926m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:51:17",
            "last_seen_utc": "2025-10-05 10:43:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607533": [
        {
            "ioc_value": "universal-analytics-cdn.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-05 10:50:32",
            "last_seen_utc": "2025-11-06 11:51:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1607531": [
        {
            "ioc_value": "m7.2-j695.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:38:20",
            "last_seen_utc": "2025-10-05 10:43:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607528": [
        {
            "ioc_value": "tq1.2-j695.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:26:35",
            "last_seen_utc": "2025-10-05 10:34:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607526": [
        {
            "ioc_value": "b2.2-j695.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 10:09:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607524": [
        {
            "ioc_value": "x.2-j695.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 09:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607521": [
        {
            "ioc_value": "n0.4-j722.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 09:26:02",
            "last_seen_utc": "2025-10-05 09:30:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607519": [
        {
            "ioc_value": "e1.4-j722.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 08:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607513": [
        {
            "ioc_value": "qk2.4-j722.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 08:32:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607511": [
        {
            "ioc_value": "u5.4-j722.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 08:15:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607505": [
        {
            "ioc_value": "r.4-j722.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 07:44:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607503": [
        {
            "ioc_value": "r3.9-k588.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 07:26:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607497": [
        {
            "ioc_value": "1m.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 07:11:05",
            "last_seen_utc": "2025-10-05 06:35:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607498": [
        {
            "ioc_value": "a.g601c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 07:11:04",
            "last_seen_utc": "2025-10-05 07:03:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607499": [
        {
            "ioc_value": "k7.9-k588.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 07:03:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607496": [
        {
            "ioc_value": "aa9.9-k588.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:28:11",
            "last_seen_utc": "2025-10-05 06:35:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607495": [
        {
            "ioc_value": "c8.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:27:02",
            "last_seen_utc": "2025-10-05 06:28:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607453": [
        {
            "ioc_value": "itzprocabal.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 06:26:29",
            "last_seen_utc": "2025-12-12 18:39:28",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/itzprocabal.duckdns.org/detection",
            "tags": "xworm",
            "anonymous": "1",
            "reporter": "jpsilva421511"
        }
    ],
    "1607379": [
        {
            "ioc_value": "q.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:24:58",
            "last_seen_utc": "2025-10-04 21:23:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607291": [
        {
            "ioc_value": "jo.xvqy8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:24:54",
            "last_seen_utc": "2025-10-04 15:32:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607288": [
        {
            "ioc_value": "la.xvqy8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:24:51",
            "last_seen_utc": "2025-10-04 16:27:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607290": [
        {
            "ioc_value": "ka.xvqy8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:24:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607494": [
        {
            "ioc_value": "v2.9-k588.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607493": [
        {
            "ioc_value": "p0.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:16:34",
            "last_seen_utc": "2025-10-05 06:17:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607488": [
        {
            "ioc_value": "g.9-k588.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:01:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607487": [
        {
            "ioc_value": "problem-livecam.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-05 06:00:26",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251005-emvtzazxhx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607486": [
        {
            "ioc_value": "0zq.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 06:00:14",
            "last_seen_utc": "2025-10-05 06:01:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607485": [
        {
            "ioc_value": "em.dbc-8-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 05:45:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607484": [
        {
            "ioc_value": "m2.9-f566.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 05:43:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607483": [
        {
            "ioc_value": "v3.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 05:40:10",
            "last_seen_utc": "2025-10-05 05:45:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607482": [
        {
            "ioc_value": "aa9.9-f566.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 05:27:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607481": [
        {
            "ioc_value": "h1.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 05:25:49",
            "last_seen_utc": "2025-10-05 05:27:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607480": [
        {
            "ioc_value": "xq0.9-f566.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 05:15:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607479": [
        {
            "ioc_value": "el.dbc-8-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 05:13:02",
            "last_seen_utc": "2025-10-05 11:09:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607478": [
        {
            "ioc_value": "s.wagoda.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 05:12:57",
            "last_seen_utc": "2025-10-05 05:15:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607462": [
        {
            "ioc_value": "etal0n.bels.pw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-05 04:00:56",
            "last_seen_utc": "2025-10-08 04:01:02",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/95.165.144.221+etal0n.bels.pw",
            "tags": "AS25513,ASN-MGTS-USPD,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1607459": [
        {
            "ioc_value": "eh.dbc-8-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 03:47:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607458": [
        {
            "ioc_value": "c5.9-f566.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 03:47:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607457": [
        {
            "ioc_value": "t1n.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 03:46:47",
            "last_seen_utc": "2025-10-05 03:47:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607456": [
        {
            "ioc_value": "l.9-f566.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 02:57:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607455": [
        {
            "ioc_value": "ef.dbc-8-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 02:55:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607454": [
        {
            "ioc_value": "r9.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 02:55:14",
            "last_seen_utc": "2025-10-05 02:57:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607451": [
        {
            "ioc_value": "aa.0-c448.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 01:40:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607450": [
        {
            "ioc_value": "bq.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 01:38:45",
            "last_seen_utc": "2025-10-05 01:40:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607449": [
        {
            "ioc_value": "h1.0-c448.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 01:17:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607448": [
        {
            "ioc_value": "x2j.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 01:17:13",
            "last_seen_utc": "2025-10-05 01:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607447": [
        {
            "ioc_value": "pz8.0-c448.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 00:50:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607446": [
        {
            "ioc_value": "pc.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-05 00:48:44",
            "last_seen_utc": "2025-10-05 00:50:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607439": [
        {
            "ioc_value": "m8.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 22:54:31",
            "last_seen_utc": "2025-10-04 22:56:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607438": [
        {
            "ioc_value": "w4.0-c448.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 22:48:55",
            "last_seen_utc": "2025-10-04 22:56:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607437": [
        {
            "ioc_value": "a.mexizo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 22:46:45",
            "last_seen_utc": "2025-10-04 22:48:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607436": [
        {
            "ioc_value": "d.0-c448.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 22:21:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607435": [
        {
            "ioc_value": "k0n.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 22:20:10",
            "last_seen_utc": "2025-10-04 22:37:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607434": [
        {
            "ioc_value": "wz.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 22:14:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607433": [
        {
            "ioc_value": "h2.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 21:37:41",
            "last_seen_utc": "2025-10-04 22:13:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607354": [
        {
            "ioc_value": "xt.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 21:09:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607352": [
        {
            "ioc_value": "n5.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 20:50:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607353": [
        {
            "ioc_value": "hm.0-g845.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 20:50:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607351": [
        {
            "ioc_value": "t1.0-g845.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 20:21:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607350": [
        {
            "ioc_value": "b.faqyhi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 20:21:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607348": [
        {
            "ioc_value": "x.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 20:09:10",
            "last_seen_utc": "2025-10-04 20:09:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607349": [
        {
            "ioc_value": "qz9.0-g845.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 20:09:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607337": [
        {
            "ioc_value": "h9m.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 19:58:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607335": [
        {
            "ioc_value": "tq.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 19:48:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607336": [
        {
            "ioc_value": "v2.0-g845.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 19:48:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607334": [
        {
            "ioc_value": "k.0-g845.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 19:38:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607333": [
        {
            "ioc_value": "z1.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 19:38:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607331": [
        {
            "ioc_value": "k4.p-13a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 19:17:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607332": [
        {
            "ioc_value": "bd.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 19:17:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607330": [
        {
            "ioc_value": "q7.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 19:02:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607329": [
        {
            "ioc_value": "z3.p-13a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 18:58:14",
            "last_seen_utc": "2025-10-04 19:02:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607328": [
        {
            "ioc_value": "g.kudaxy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 18:56:17",
            "last_seen_utc": "2025-10-04 18:58:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607322": [
        {
            "ioc_value": "h7.focove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 18:27:34",
            "last_seen_utc": "2025-10-04 18:32:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607323": [
        {
            "ioc_value": "qm9.p-13a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 18:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607320": [
        {
            "ioc_value": "pv.focove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 18:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607321": [
        {
            "ioc_value": "u1.p-13a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 18:18:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607319": [
        {
            "ioc_value": "da.tqh-2-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 18:10:12",
            "last_seen_utc": "2025-10-05 01:40:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607317": [
        {
            "ioc_value": "h.p-13a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 18:09:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607318": [
        {
            "ioc_value": "a1.focove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 18:09:13",
            "last_seen_utc": "2025-10-04 18:10:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607316": [
        {
            "ioc_value": "listings-stop.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-04 18:00:57",
            "last_seen_utc": "2025-10-10 11:34:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-vks6cszpv8",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607312": [
        {
            "ioc_value": "january-sitemap.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-04 18:00:38",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-v7w6jazqy9",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607311": [
        {
            "ioc_value": "mean-disease.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-04 18:00:25",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-s4mftavtat",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607309": [
        {
            "ioc_value": "zt.focove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 17:57:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607308": [
        {
            "ioc_value": "ch.xxx-2-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 17:42:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607306": [
        {
            "ioc_value": "zd.j-31u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 17:42:33",
            "last_seen_utc": "2025-10-04 17:57:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607307": [
        {
            "ioc_value": "n3.focove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 17:42:33",
            "last_seen_utc": "2025-10-04 17:42:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607305": [
        {
            "ioc_value": "e.focove.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 17:24:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607303": [
        {
            "ioc_value": "r2.j-31u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 17:17:33",
            "last_seen_utc": "2025-10-04 17:24:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607304": [
        {
            "ioc_value": "hi.xrxo2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 17:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607302": [
        {
            "ioc_value": "ho.xrxo2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 17:03:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607300": [
        {
            "ioc_value": "if.xrxo2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 16:54:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607301": [
        {
            "ioc_value": "wq9.j-31u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 16:54:33",
            "last_seen_utc": "2025-10-04 17:03:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607299": [
        {
            "ioc_value": "in.xrxo2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 16:37:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607298": [
        {
            "ioc_value": "c7.j-31u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 16:37:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607297": [
        {
            "ioc_value": "n.j-31u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 16:11:52",
            "last_seen_utc": "2025-10-04 16:27:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607285": [
        {
            "ioc_value": "lo.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 14:37:54",
            "last_seen_utc": "2025-10-04 14:33:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607287": [
        {
            "ioc_value": "li.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 14:37:53",
            "last_seen_utc": "2025-10-04 14:37:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607286": [
        {
            "ioc_value": "k9.n-82o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 14:23:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607284": [
        {
            "ioc_value": "ma.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 14:02:59",
            "last_seen_utc": "2025-10-04 14:05:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607282": [
        {
            "ioc_value": "me.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 14:01:01",
            "last_seen_utc": "2025-10-04 13:54:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607283": [
        {
            "ioc_value": "m7.n-82o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 13:54:37",
            "last_seen_utc": "2025-10-04 14:05:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607280": [
        {
            "ioc_value": "tq1.n-82o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 13:34:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607277": [
        {
            "ioc_value": "mm.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 13:32:50",
            "last_seen_utc": "2025-10-04 13:18:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607279": [
        {
            "ioc_value": "mi.tvti-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 13:32:50",
            "last_seen_utc": "2025-10-04 13:48:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607278": [
        {
            "ioc_value": "b2.n-82o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 13:18:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607271": [
        {
            "ioc_value": "my.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 13:09:28",
            "last_seen_utc": "2025-10-04 12:24:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607272": [
        {
            "ioc_value": "mu.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 13:09:28",
            "last_seen_utc": "2025-10-04 12:26:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607274": [
        {
            "ioc_value": "mo.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 13:09:27",
            "last_seen_utc": "2025-10-04 12:46:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607275": [
        {
            "ioc_value": "x.n-82o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 12:46:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607273": [
        {
            "ioc_value": "n0.m-49e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 12:26:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607269": [
        {
            "ioc_value": "na.vwjy-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 12:07:58",
            "last_seen_utc": "2025-10-04 12:09:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607270": [
        {
            "ioc_value": "e1.m-49e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 12:07:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607263": [
        {
            "ioc_value": "effect-meet.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-04 12:01:35",
            "last_seen_utc": "2025-10-10 11:34:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-lx5kgsz1b1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607264": [
        {
            "ioc_value": "northern-unwrap.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-04 12:01:35",
            "last_seen_utc": "2025-10-10 11:34:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-kpv6eavny4",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607248": [
        {
            "ioc_value": "tu.pvzi-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 11:52:27",
            "last_seen_utc": "2025-10-04 11:04:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607252": [
        {
            "ioc_value": "ty.pvzi-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 11:52:25",
            "last_seen_utc": "2025-10-04 11:25:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607254": [
        {
            "ioc_value": "va.pvzi-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 11:52:25",
            "last_seen_utc": "2025-10-04 11:41:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607256": [
        {
            "ioc_value": "ve.pvzi-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 11:52:25",
            "last_seen_utc": "2025-10-04 11:46:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607255": [
        {
            "ioc_value": "qk2.m-49e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 11:41:21",
            "last_seen_utc": "2025-10-04 11:46:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607253": [
        {
            "ioc_value": "u5.m-49e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 11:25:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607251": [
        {
            "ioc_value": "r.m-49e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 10:56:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607238": [
        {
            "ioc_value": "sy.phpa-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 10:38:31",
            "last_seen_utc": "2025-10-04 10:10:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607243": [
        {
            "ioc_value": "te.pvzi-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 10:38:29",
            "last_seen_utc": "2025-10-04 10:21:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607247": [
        {
            "ioc_value": "dctask8000.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-04 10:27:51",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-mec8ysbr6v/behavioral1",
            "tags": "AsyncRAT,c2,domain,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607246": [
        {
            "ioc_value": "bo.xxx-2-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 10:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607244": [
        {
            "ioc_value": "shim1.enrouteltd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-04 10:16:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.vmray.com/analyses/_vt/b3f957fd841b/report/ioc.html",
            "tags": "c2,domain,Rhadamanthys,stealer,vmray",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607245": [
        {
            "ioc_value": "shim1.umbandung.ac.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-04 10:16:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.vmray.com/analyses/_vt/b3f957fd841b/report/ioc.html",
            "tags": "c2,domain,Rhadamanthys,stealer,vmray",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607242": [
        {
            "ioc_value": "r3.l-75y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 10:10:39",
            "last_seen_utc": "2025-10-04 10:14:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607239": [
        {
            "ioc_value": "bi.xxx-2-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:59:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607237": [
        {
            "ioc_value": "be.xxx-2-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:48:34",
            "last_seen_utc": "2025-10-04 16:12:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607236": [
        {
            "ioc_value": "su.phpa-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:45:42",
            "last_seen_utc": "2025-10-04 09:48:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607234": [
        {
            "ioc_value": "k7.l-75y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:41:27",
            "last_seen_utc": "2025-10-04 09:45:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607235": [
        {
            "ioc_value": "se.phpa-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:41:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607231": [
        {
            "ioc_value": "aa9.l-75y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:29:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607232": [
        {
            "ioc_value": "sa.phpa-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:29:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607229": [
        {
            "ioc_value": "ry.phpa-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:26:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607227": [
        {
            "ioc_value": "v2.l-75y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:18:20",
            "last_seen_utc": "2025-10-04 09:26:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607226": [
        {
            "ioc_value": "ru.nzki-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:18:19",
            "last_seen_utc": "2025-10-04 09:51:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606790": [
        {
            "ioc_value": "cdn-googlemanager.com",
            "ioc_type": "domain",
            "threat_type": "cc_skimming",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-04 09:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "magecart,skimming",
            "anonymous": "0",
            "reporter": "eremit4"
        }
    ],
    "1606791": [
        {
            "ioc_value": "nmn.is",
            "ioc_type": "domain",
            "threat_type": "cc_skimming",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-04 09:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "magecart,skimming",
            "anonymous": "0",
            "reporter": "eremit4"
        }
    ],
    "1606792": [
        {
            "ioc_value": "anl.is",
            "ioc_type": "domain",
            "threat_type": "cc_skimming",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-04 09:17:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "magecart,skimming",
            "anonymous": "0",
            "reporter": "eremit4"
        }
    ],
    "1606793": [
        {
            "ioc_value": "snf.is",
            "ioc_type": "domain",
            "threat_type": "cc_skimming",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-04 09:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "magecart,skimming",
            "anonymous": "0",
            "reporter": "eremit4"
        }
    ],
    "1606794": [
        {
            "ioc_value": "kof.one",
            "ioc_type": "domain",
            "threat_type": "cc_skimming",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-10-04 09:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "magecart,skimming",
            "anonymous": "0",
            "reporter": "eremit4"
        }
    ],
    "1607225": [
        {
            "ioc_value": "g.l-75y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:06:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607223": [
        {
            "ioc_value": "ro.nzki-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:02:32",
            "last_seen_utc": "2025-10-04 09:06:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607222": [
        {
            "ioc_value": "ba.cns-3-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607215": [
        {
            "ioc_value": "ri.nzki-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 08:40:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607216": [
        {
            "ioc_value": "m2.p-62i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 08:40:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607214": [
        {
            "ioc_value": "ra.nzki-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 08:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607212": [
        {
            "ioc_value": "qy.nzki-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 08:32:53",
            "last_seen_utc": "2025-10-04 09:51:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607213": [
        {
            "ioc_value": "ay.cns-3-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 08:32:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607210": [
        {
            "ioc_value": "aa9.p-62i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 08:30:21",
            "last_seen_utc": "2025-10-04 08:34:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607211": [
        {
            "ioc_value": "qu.mzvo-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 08:30:21",
            "last_seen_utc": "2025-10-04 09:51:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607206": [
        {
            "ioc_value": "xq0.p-62i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:57:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607205": [
        {
            "ioc_value": "ax.cns-3-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:55:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607204": [
        {
            "ioc_value": "qo.mzvo-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:54:31",
            "last_seen_utc": "2025-10-04 07:57:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607192": [
        {
            "ioc_value": "aw.cns-3-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:28:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607191": [
        {
            "ioc_value": "c5.p-62i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:28:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607190": [
        {
            "ioc_value": "qe.mzvo-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:26:55",
            "last_seen_utc": "2025-10-04 07:28:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607189": [
        {
            "ioc_value": "l.p-62i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:18:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607188": [
        {
            "ioc_value": "qa.mzvo-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:17:10",
            "last_seen_utc": "2025-10-04 07:18:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607187": [
        {
            "ioc_value": "aa.m-89a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:04:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607186": [
        {
            "ioc_value": "at.cns-3-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:02:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607185": [
        {
            "ioc_value": "py.mzvo-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 07:01:18",
            "last_seen_utc": "2025-10-04 07:04:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607175": [
        {
            "ioc_value": "core.r6ms.pw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-04 06:07:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,elknot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1607174": [
        {
            "ioc_value": "length-coverage.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-04 06:07:38",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1607164": [
        {
            "ioc_value": "development-unsigned.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-04 06:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-darfcagr4y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607161": [
        {
            "ioc_value": "venusmastermind.servehttp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-04 06:00:26",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-eyft7ahp9s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607162": [
        {
            "ioc_value": "texas-illinois.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-04 06:00:26",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-ebblyshl8t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607163": [
        {
            "ioc_value": "sports-thumbnails.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-04 06:00:26",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251004-dz8e6asn16",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1607152": [
        {
            "ioc_value": "h1.m-89a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 04:40:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607151": [
        {
            "ioc_value": "pu.khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 04:39:33",
            "last_seen_utc": "2025-10-04 04:54:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607150": [
        {
            "ioc_value": "ny.khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 04:27:11",
            "last_seen_utc": "2025-10-04 04:30:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607149": [
        {
            "ioc_value": "pz8.m-89a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 04:24:11",
            "last_seen_utc": "2025-10-04 04:30:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607148": [
        {
            "ioc_value": "ni.khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 04:22:34",
            "last_seen_utc": "2025-10-04 04:24:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607120": [
        {
            "ioc_value": "bounty.blackhatethicalhacking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-04 04:00:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.132.156+bounty.blackhatethicalhacking.com",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1607116": [
        {
            "ioc_value": "wss.xahweh.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-04 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.216.203.54+wss.xahweh.info",
            "tags": "AS51167,C2,censys,CONTABO",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1607112": [
        {
            "ioc_value": "w4.m-89a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 02:45:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607111": [
        {
            "ioc_value": "ly.khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 02:39:21",
            "last_seen_utc": "2025-10-04 02:49:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607110": [
        {
            "ioc_value": "d.m-89a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 02:10:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607109": [
        {
            "ioc_value": "lu.khhu-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 02:09:43",
            "last_seen_utc": "2025-10-04 02:10:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607108": [
        {
            "ioc_value": "hm.c-01e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 01:48:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607107": [
        {
            "ioc_value": "le.nxno-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 01:44:45",
            "last_seen_utc": "2025-10-04 01:48:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607106": [
        {
            "ioc_value": "ky.nxno-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 01:10:25",
            "last_seen_utc": "2025-10-04 01:30:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1607105": [
        {
            "ioc_value": "t1.c-01e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 01:08:40",
            "last_seen_utc": "2025-10-04 01:16:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1607104": [
        {
            "ioc_value": "ku.nxno-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 01:01:07",
            "last_seen_utc": "2025-10-04 01:08:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606914": [
        {
            "ioc_value": "qz9.c-01e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 00:37:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606913": [
        {
            "ioc_value": "ko.nxno-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-04 00:35:01",
            "last_seen_utc": "2025-10-04 00:40:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606902": [
        {
            "ioc_value": "v2.c-01e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 23:59:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606901": [
        {
            "ioc_value": "ke.nxno-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 23:59:11",
            "last_seen_utc": "2025-10-04 00:04:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606899": [
        {
            "ioc_value": "jy.lkci-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 23:54:30",
            "last_seen_utc": "2025-10-03 23:55:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606898": [
        {
            "ioc_value": "k.c-01e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 23:33:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606897": [
        {
            "ioc_value": "ju.lkci-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 23:28:14",
            "last_seen_utc": "2025-10-03 23:33:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606896": [
        {
            "ioc_value": "k.xzb-6-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 22:59:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606895": [
        {
            "ioc_value": "ji.lkci-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 22:56:31",
            "last_seen_utc": "2025-10-03 23:18:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606894": [
        {
            "ioc_value": "am.qjf-1-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 22:08:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606892": [
        {
            "ioc_value": "v2.xzb-6-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 22:03:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606870": [
        {
            "ioc_value": "je.lkci-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 22:00:50",
            "last_seen_utc": "2025-10-03 22:08:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606849": [
        {
            "ioc_value": "al.qjf-1-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 21:31:42",
            "last_seen_utc": "2025-10-04 04:54:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606848": [
        {
            "ioc_value": "qz9.xzb-6-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 21:30:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606847": [
        {
            "ioc_value": "ja.lkci-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 21:26:30",
            "last_seen_utc": "2025-10-03 21:31:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606846": [
        {
            "ioc_value": "ai.qqd-6-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 21:15:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606835": [
        {
            "ioc_value": "t1.xzb-6-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 21:12:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606834": [
        {
            "ioc_value": "hy.jnfe-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 21:12:25",
            "last_seen_utc": "2025-10-03 21:15:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606823": [
        {
            "ioc_value": "hu.jnfe-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 21:08:45",
            "last_seen_utc": "2025-10-03 21:12:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606822": [
        {
            "ioc_value": "m6.xzb-6-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 20:36:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606821": [
        {
            "ioc_value": "ah.qqd-6-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 20:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606815": [
        {
            "ioc_value": "gy.jnfe-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 20:00:42",
            "last_seen_utc": "2025-10-03 20:36:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606808": [
        {
            "ioc_value": "ag.qqd-6-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 19:22:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606807": [
        {
            "ioc_value": "gu.jnfe-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 19:12:13",
            "last_seen_utc": "2025-10-03 19:23:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606806": [
        {
            "ioc_value": "ae.qqd-6-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 19:03:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606805": [
        {
            "ioc_value": "ge.jnfe-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 19:01:54",
            "last_seen_utc": "2025-10-03 19:03:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606802": [
        {
            "ioc_value": "b1.xkx-0-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 18:58:18",
            "last_seen_utc": "2025-10-03 19:02:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606801": [
        {
            "ioc_value": "ga.nqju-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 18:56:11",
            "last_seen_utc": "2025-10-03 18:58:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606797": [
        {
            "ioc_value": "g4.xkx-0-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 18:43:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606796": [
        {
            "ioc_value": "fy.nqju-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 18:42:47",
            "last_seen_utc": "2025-10-03 18:43:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606789": [
        {
            "ioc_value": "pm7.xkx-0-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 18:28:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606788": [
        {
            "ioc_value": "fu.nqju-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 18:22:50",
            "last_seen_utc": "2025-10-03 18:28:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606787": [
        {
            "ioc_value": "k4.xkx-0-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 18:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606786": [
        {
            "ioc_value": "fo.nqju-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 18:17:33",
            "last_seen_utc": "2025-10-03 18:18:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606781": [
        {
            "ioc_value": "win-mph.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-03 18:01:26",
            "last_seen_utc": "2025-10-10 11:34:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251003-t8c9daej4y",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1606776": [
        {
            "ioc_value": "envi02-10.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 18:00:41",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251003-t16kystsgy",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1606769": [
        {
            "ioc_value": "y.xkx-0-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 17:50:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606768": [
        {
            "ioc_value": "fi.nqju-5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 17:47:24",
            "last_seen_utc": "2025-10-03 17:50:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606765": [
        {
            "ioc_value": "k4.vzj-1-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 17:01:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606764": [
        {
            "ioc_value": "dy.mxta-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 17:00:56",
            "last_seen_utc": "2025-10-03 17:01:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606763": [
        {
            "ioc_value": "z3.vzj-1-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 16:49:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606762": [
        {
            "ioc_value": "du.mxta-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 16:48:24",
            "last_seen_utc": "2025-10-03 16:49:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606761": [
        {
            "ioc_value": "qm9.vzj-1-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 16:33:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606760": [
        {
            "ioc_value": "cy.mxta-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 16:28:23",
            "last_seen_utc": "2025-10-03 16:33:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606759": [
        {
            "ioc_value": "u1.vzj-1-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 16:13:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606758": [
        {
            "ioc_value": "cu.mxta-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 16:12:06",
            "last_seen_utc": "2025-10-03 16:13:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606756": [
        {
            "ioc_value": "pp.andreeamunteanu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-03 16:10:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1606757": [
        {
            "ioc_value": "pp.jullianacalhau.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-03 16:10:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1606751": [
        {
            "ioc_value": "usa-investment-tax.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-03 16:01:18",
            "last_seen_utc": "2025-10-04 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.10+usa-investment-tax.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1606742": [
        {
            "ioc_value": "co.mxta-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 15:12:18",
            "last_seen_utc": "2025-10-03 15:14:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606741": [
        {
            "ioc_value": "ci.kmbo-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 15:08:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606740": [
        {
            "ioc_value": "h.vzj-1-o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 15:03:43",
            "last_seen_utc": "2025-10-03 15:14:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606739": [
        {
            "ioc_value": "ce.kmbo-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 14:58:08",
            "last_seen_utc": "2025-10-03 15:03:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606737": [
        {
            "ioc_value": "ca.kmbo-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 14:47:34",
            "last_seen_utc": "2025-10-03 14:42:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606738": [
        {
            "ioc_value": "zd.mbs-3-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 14:42:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606438": [
        {
            "ioc_value": "bu.kmbo-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 14:32:21",
            "last_seen_utc": "2025-10-03 14:21:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606734": [
        {
            "ioc_value": "adsservices.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-03 14:30:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Klopatra",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606735": [
        {
            "ioc_value": "adsservice2.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-03 14:30:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Klopatra",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606736": [
        {
            "ioc_value": "guncel-tv-player-lnat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-03 14:30:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Klopatra",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606726": [
        {
            "ioc_value": "teams-install.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-03 14:29:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "broomstick,c2,oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606727": [
        {
            "ioc_value": "techwisenetwork.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-03 14:29:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "broomstick,c2,oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606728": [
        {
            "ioc_value": "teams-download.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-03 14:29:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "broomstick,c2,oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606729": [
        {
            "ioc_value": "eastridge-infotech.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-03 14:29:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "broomstick,c2,oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606730": [
        {
            "ioc_value": "teams-install.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-03 14:29:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "broomstick,c2,oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606731": [
        {
            "ioc_value": "teams-download.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-03 14:29:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "broomstick,c2,oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606732": [
        {
            "ioc_value": "cybersavvynetwork.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-03 14:29:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "broomstick,c2,oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606733": [
        {
            "ioc_value": "witherspoon-law.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-03 14:29:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "broomstick,c2,oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606725": [
        {
            "ioc_value": "teams-install.run",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-03 14:29:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "broomstick,c2,oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606724": [
        {
            "ioc_value": "oneglobalvisa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-03 14:28:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,manticore,nimbus",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606723": [
        {
            "ioc_value": "content-website-analytics.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-03 14:27:44",
            "last_seen_utc": "2025-10-23 13:53:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2726",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606722": [
        {
            "ioc_value": "foolowme.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-03 14:27:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "zphp",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606717": [
        {
            "ioc_value": "archives-buried.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 14:26:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606718": [
        {
            "ioc_value": "agents-bind.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 14:26:10",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606719": [
        {
            "ioc_value": "documents-thanksgiving.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 14:26:10",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606720": [
        {
            "ioc_value": "thunderc4-32871.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 14:26:10",
            "last_seen_utc": "2025-10-10 11:34:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606712": [
        {
            "ioc_value": "sec1.diabolikk1.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-03 14:24:38",
            "last_seen_utc": "2025-10-10 11:34:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606713": [
        {
            "ioc_value": "wizbiz.dynu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-03 14:24:38",
            "last_seen_utc": "2025-10-10 11:34:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606707": [
        {
            "ioc_value": "draft247.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-03 14:23:37",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606708": [
        {
            "ioc_value": "m85-net.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-03 14:23:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606709": [
        {
            "ioc_value": "mangotruff.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-03 14:23:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606710": [
        {
            "ioc_value": "nettercrazy.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-03 14:23:37",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606698": [
        {
            "ioc_value": "www.wcer.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606699": [
        {
            "ioc_value": "www.xxv.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606700": [
        {
            "ioc_value": "www.y55ut8.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606701": [
        {
            "ioc_value": "www.ytyjiehuon.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606702": [
        {
            "ioc_value": "www.yudn.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606703": [
        {
            "ioc_value": "www.zsjelmqkruv.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606683": [
        {
            "ioc_value": "www.sy706.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606684": [
        {
            "ioc_value": "www.ta.beauty",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606685": [
        {
            "ioc_value": "www.tartcprbusiness.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606686": [
        {
            "ioc_value": "www.teluge.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606687": [
        {
            "ioc_value": "www.tormi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606688": [
        {
            "ioc_value": "www.u7xgk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606689": [
        {
            "ioc_value": "www.uddi.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606690": [
        {
            "ioc_value": "www.udiec.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606691": [
        {
            "ioc_value": "www.unse55.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606692": [
        {
            "ioc_value": "www.upvwp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606693": [
        {
            "ioc_value": "www.ura.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606694": [
        {
            "ioc_value": "www.ushattention.tokyo",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606695": [
        {
            "ioc_value": "www.usman.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606696": [
        {
            "ioc_value": "www.utasx.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606697": [
        {
            "ioc_value": "www.vcxb.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606666": [
        {
            "ioc_value": "www.oreaimoremoney.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606667": [
        {
            "ioc_value": "www.orecal.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606668": [
        {
            "ioc_value": "www.orota.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606669": [
        {
            "ioc_value": "www.ostepnosc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606670": [
        {
            "ioc_value": "www.ovarsshope.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606671": [
        {
            "ioc_value": "www.quqwb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606672": [
        {
            "ioc_value": "www.refabricated-homes-22120.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606673": [
        {
            "ioc_value": "www.remation-services-51778.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606674": [
        {
            "ioc_value": "www.rinkpanchitos.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606675": [
        {
            "ioc_value": "www.rkada4608.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606676": [
        {
            "ioc_value": "www.rookestevens.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606677": [
        {
            "ioc_value": "www.rovence-metropole-logements.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606678": [
        {
            "ioc_value": "www.rvadag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606679": [
        {
            "ioc_value": "www.s6ems.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606680": [
        {
            "ioc_value": "www.sux.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606681": [
        {
            "ioc_value": "www.sxuht.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606682": [
        {
            "ioc_value": "www.sy157.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606651": [
        {
            "ioc_value": "www.mvskzdtrpu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606652": [
        {
            "ioc_value": "www.nlinecasinokingdom.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606653": [
        {
            "ioc_value": "www.nowbird.homes",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606654": [
        {
            "ioc_value": "www.nviodigitaalloog.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606655": [
        {
            "ioc_value": "www.nything-foo.bar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606656": [
        {
            "ioc_value": "www.o55bm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606657": [
        {
            "ioc_value": "www.oastwithjam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606658": [
        {
            "ioc_value": "www.ocialpay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606659": [
        {
            "ioc_value": "www.ocsimples.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606660": [
        {
            "ioc_value": "www.olossus.channel",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606661": [
        {
            "ioc_value": "www.ome-pest-control-9evich.zone",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": "2025-10-03 14:22:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606662": [
        {
            "ioc_value": "www.omingoscomfort.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606663": [
        {
            "ioc_value": "www.onin69slot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606664": [
        {
            "ioc_value": "www.opycatinkteam.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606665": [
        {
            "ioc_value": "www.orddp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606635": [
        {
            "ioc_value": "www.hinecrest.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606636": [
        {
            "ioc_value": "www.hineontherapies.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606637": [
        {
            "ioc_value": "www.ideokit.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606638": [
        {
            "ioc_value": "www.igtech.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606639": [
        {
            "ioc_value": "www.ilasupply.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606640": [
        {
            "ioc_value": "www.ineflaire.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606641": [
        {
            "ioc_value": "www.irisinstallations.london",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606642": [
        {
            "ioc_value": "www.irluggage.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606643": [
        {
            "ioc_value": "www.isangtoto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606644": [
        {
            "ioc_value": "www.iti.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606645": [
        {
            "ioc_value": "www.iwo7n.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606646": [
        {
            "ioc_value": "www.layworld-club.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606647": [
        {
            "ioc_value": "www.lectric-cars-96313.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606648": [
        {
            "ioc_value": "www.ling-it-up.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606649": [
        {
            "ioc_value": "www.luecap.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606650": [
        {
            "ioc_value": "www.luprintpros.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606616": [
        {
            "ioc_value": "www.ellygardner.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606617": [
        {
            "ioc_value": "www.ennis-pointes.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606618": [
        {
            "ioc_value": "www.ent-casino-guo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606619": [
        {
            "ioc_value": "www.epression-test-77730.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606620": [
        {
            "ioc_value": "www.esr.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606621": [
        {
            "ioc_value": "www.etablr.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606622": [
        {
            "ioc_value": "www.etivaeqiuq.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606623": [
        {
            "ioc_value": "www.etmoonbuggy.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606624": [
        {
            "ioc_value": "www.euenvioultimopasso.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606625": [
        {
            "ioc_value": "www.evwarforensicinstitute.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606626": [
        {
            "ioc_value": "www.fdlhjb.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606627": [
        {
            "ioc_value": "www.ffshoreexecshub.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606628": [
        {
            "ioc_value": "www.fl583.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606629": [
        {
            "ioc_value": "www.gileplanner.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606630": [
        {
            "ioc_value": "www.hawala.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606631": [
        {
            "ioc_value": "www.heicebath.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606632": [
        {
            "ioc_value": "www.henextpiece.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606633": [
        {
            "ioc_value": "www.herice.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606634": [
        {
            "ioc_value": "www.hidingllc.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606598": [
        {
            "ioc_value": "www.ardrop.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606599": [
        {
            "ioc_value": "www.arsity-tutors.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606600": [
        {
            "ioc_value": "www.ass.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606601": [
        {
            "ioc_value": "www.avbord.rip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606602": [
        {
            "ioc_value": "www.axascontapag.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606603": [
        {
            "ioc_value": "www.aytime-sleepiness-79553.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606604": [
        {
            "ioc_value": "www.b177.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606605": [
        {
            "ioc_value": "www.badan-drc-tusabv.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606606": [
        {
            "ioc_value": "www.badiahmuriithiwachira.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606607": [
        {
            "ioc_value": "www.bpgmr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606608": [
        {
            "ioc_value": "www.c1045.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606609": [
        {
            "ioc_value": "www.c1723.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": "2025-10-28 21:46:39",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606610": [
        {
            "ioc_value": "www.c3024.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606611": [
        {
            "ioc_value": "www.c4192.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606612": [
        {
            "ioc_value": "www.dlabconnect.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606613": [
        {
            "ioc_value": "www.e520.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606614": [
        {
            "ioc_value": "www.eamglobaltalenthub.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606615": [
        {
            "ioc_value": "www.ebt-management.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606580": [
        {
            "ioc_value": "www.3lbmo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606581": [
        {
            "ioc_value": "www.5u7yr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606582": [
        {
            "ioc_value": "www.7cq.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606583": [
        {
            "ioc_value": "www.7sfb5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606584": [
        {
            "ioc_value": "www.8644.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606585": [
        {
            "ioc_value": "www.868com680.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606586": [
        {
            "ioc_value": "www.868com685.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606587": [
        {
            "ioc_value": "www.89betv2.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606588": [
        {
            "ioc_value": "www.8c1vl.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606589": [
        {
            "ioc_value": "www.90001.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606590": [
        {
            "ioc_value": "www.aabodl.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606591": [
        {
            "ioc_value": "www.aayu.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606592": [
        {
            "ioc_value": "www.accu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606593": [
        {
            "ioc_value": "www.adem.studio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606594": [
        {
            "ioc_value": "www.aldwinfinancialsolutions.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606595": [
        {
            "ioc_value": "www.anecia.realtor",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606596": [
        {
            "ioc_value": "www.aqmontser.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606597": [
        {
            "ioc_value": "www.aquishaportfolio.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606576": [
        {
            "ioc_value": "www.03sao.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606577": [
        {
            "ioc_value": "www.24-va9q13.rest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606578": [
        {
            "ioc_value": "www.2675.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606579": [
        {
            "ioc_value": "www.34a.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-10-03 14:22:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606446": [
        {
            "ioc_value": "r2.mbs-3-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 14:21:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606445": [
        {
            "ioc_value": "envio30-09.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-10-03 14:21:17",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606444": [
        {
            "ioc_value": "secdisks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-03 14:21:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606333": [
        {
            "ioc_value": "yo.kfko-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 14:19:59",
            "last_seen_utc": "2025-10-03 13:09:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606335": [
        {
            "ioc_value": "za.kmbo-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 14:19:58",
            "last_seen_utc": "2025-10-03 14:02:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606436": [
        {
            "ioc_value": "5mcars.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 14:19:55",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606437": [
        {
            "ioc_value": "chromeupdater.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 14:19:55",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606439": [
        {
            "ioc_value": "people.webredirect.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 14:19:55",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606440": [
        {
            "ioc_value": "shelbus99-30583.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 14:19:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1606336": [
        {
            "ioc_value": "wq9.mbs-3-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 14:02:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606334": [
        {
            "ioc_value": "c7.mbs-3-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 13:09:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606329": [
        {
            "ioc_value": "ya.kfko-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:56:43",
            "last_seen_utc": "2025-10-03 12:28:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606331": [
        {
            "ioc_value": "ye.kfko-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:56:43",
            "last_seen_utc": "2025-10-03 12:56:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606332": [
        {
            "ioc_value": "n.mbs-3-a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:56:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606330": [
        {
            "ioc_value": "k9.jwm-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:28:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606324": [
        {
            "ioc_value": "xu.kfko-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:20:08",
            "last_seen_utc": "2025-10-03 12:19:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606326": [
        {
            "ioc_value": "tylorperry.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-03 12:20:07",
            "last_seen_utc": "2025-10-03 12:18:57",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115310194430300590",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1606328": [
        {
            "ioc_value": "m7.jwm-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606306": [
        {
            "ioc_value": "uh.tfba6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:07:50",
            "last_seen_utc": "2025-10-03 11:28:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606309": [
        {
            "ioc_value": "un.tfba6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:07:49",
            "last_seen_utc": "2025-10-03 12:02:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606308": [
        {
            "ioc_value": "um.tfba6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:07:48",
            "last_seen_utc": "2025-10-03 11:36:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606322": [
        {
            "ioc_value": "xi.kfko-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:07:48",
            "last_seen_utc": "2025-10-03 12:07:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606320": [
        {
            "ioc_value": "tq1.jwm-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 12:02:48",
            "last_seen_utc": "2025-10-03 12:07:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606307": [
        {
            "ioc_value": "b2.jwm-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 11:28:56",
            "last_seen_utc": "2025-10-03 11:36:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606305": [
        {
            "ioc_value": "x.jwm-3-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 11:11:08",
            "last_seen_utc": "2025-10-03 11:20:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606304": [
        {
            "ioc_value": "ti.tfba6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 11:10:58",
            "last_seen_utc": "2025-10-03 11:20:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606294": [
        {
            "ioc_value": "re.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 11:01:27",
            "last_seen_utc": "2025-10-03 09:29:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606296": [
        {
            "ioc_value": "sh.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 11:01:26",
            "last_seen_utc": "2025-10-03 09:35:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606299": [
        {
            "ioc_value": "so.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 11:01:26",
            "last_seen_utc": "2025-10-03 10:40:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606297": [
        {
            "ioc_value": "si.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 11:01:25",
            "last_seen_utc": "2025-10-03 10:01:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606302": [
        {
            "ioc_value": "ta.sxqy9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 11:01:24",
            "last_seen_utc": "2025-10-03 10:54:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606303": [
        {
            "ioc_value": "n0.hqs-9-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 10:54:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606300": [
        {
            "ioc_value": "e1.hqs-9-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 10:40:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606298": [
        {
            "ioc_value": "qk2.hqs-9-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 10:01:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606295": [
        {
            "ioc_value": "u5.hqs-9-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 09:29:39",
            "last_seen_utc": "2025-10-03 09:35:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606292": [
        {
            "ioc_value": "qi.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 09:20:47",
            "last_seen_utc": "2025-10-03 09:17:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606293": [
        {
            "ioc_value": "r.hqs-9-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 09:17:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606157": [
        {
            "ioc_value": "ox.sgdi6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 09:03:24",
            "last_seen_utc": "2025-10-03 07:47:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606172": [
        {
            "ioc_value": "pi.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 09:03:23",
            "last_seen_utc": "2025-10-03 08:51:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606174": [
        {
            "ioc_value": "po.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 09:03:23",
            "last_seen_utc": "2025-10-03 08:55:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606288": [
        {
            "ioc_value": "hiboxy.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-10-03 09:02:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606284": [
        {
            "ioc_value": "mssecure.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-10-03 09:02:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606285": [
        {
            "ioc_value": "totalsecond.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-10-03 09:02:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606286": [
        {
            "ioc_value": "loveisacrime.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-10-03 09:02:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606287": [
        {
            "ioc_value": "spyzdns.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-10-03 09:02:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606266": [
        {
            "ioc_value": "rastahack.no-ip.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606267": [
        {
            "ioc_value": "rastaking.no-ip.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606268": [
        {
            "ioc_value": "ghvn.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606269": [
        {
            "ioc_value": "txgvd-84-84-38-102.a.free.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606270": [
        {
            "ioc_value": "darnnlogs.no.ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606271": [
        {
            "ioc_value": "raaasta.no-ip.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606272": [
        {
            "ioc_value": "leeshin.dyndns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606273": [
        {
            "ioc_value": "sayman89.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606274": [
        {
            "ioc_value": "thesheitan.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606275": [
        {
            "ioc_value": "kurdish96.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606276": [
        {
            "ioc_value": "harviesnewep.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606277": [
        {
            "ioc_value": "ghvn.dyndns-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606278": [
        {
            "ioc_value": "saxor1991.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606279": [
        {
            "ioc_value": "darkball.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606280": [
        {
            "ioc_value": "imorlock.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606281": [
        {
            "ioc_value": "unremotnes.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606282": [
        {
            "ioc_value": "rastaking.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-10-03 09:02:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606258": [
        {
            "ioc_value": "sinegazz.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-10-03 09:02:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606256": [
        {
            "ioc_value": "itop01.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-10-03 09:02:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606251": [
        {
            "ioc_value": "googly2020.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-03 09:02:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606252": [
        {
            "ioc_value": "power-comments.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-03 09:02:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606253": [
        {
            "ioc_value": "wrong-psychological.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-03 09:02:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606254": [
        {
            "ioc_value": "four-railway.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-10-03 09:02:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606242": [
        {
            "ioc_value": "paper-preparation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-03 09:02:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606243": [
        {
            "ioc_value": "awesome123.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-03 09:02:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606244": [
        {
            "ioc_value": "gabrielgarcialora09.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-03 09:02:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606239": [
        {
            "ioc_value": "electronic-sharp.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-03 09:02:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606240": [
        {
            "ioc_value": "amarre12.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-03 09:02:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606241": [
        {
            "ioc_value": "top.not4abuse01.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-03 09:02:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606230": [
        {
            "ioc_value": "process-depression.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 09:02:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606231": [
        {
            "ioc_value": "169nan-63274.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 09:02:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606232": [
        {
            "ioc_value": "military-bl.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 09:02:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606233": [
        {
            "ioc_value": "patrickedge001.myddns.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 09:02:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606234": [
        {
            "ioc_value": "golf-consolidation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 09:02:34",
            "last_seen_utc": "2025-10-05 16:26:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606235": [
        {
            "ioc_value": "virginia-waterproof.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 09:02:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606236": [
        {
            "ioc_value": "vxnsishjha-62957.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 09:02:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606228": [
        {
            "ioc_value": "sadsadsadadsdsa-61181.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 09:02:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606229": [
        {
            "ioc_value": "following-inspection.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 09:02:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606224": [
        {
            "ioc_value": "2025.cnmnmb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606225": [
        {
            "ioc_value": "primenewserviceogfirewall.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606212": [
        {
            "ioc_value": "async01.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606213": [
        {
            "ioc_value": "dontstopme07.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606214": [
        {
            "ioc_value": "dontstopme03.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606215": [
        {
            "ioc_value": "nike.ovh",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606216": [
        {
            "ioc_value": "jasonstatham777.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606217": [
        {
            "ioc_value": "dontstopme01.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": "2025-10-05 16:28:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606218": [
        {
            "ioc_value": "atlas115.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606219": [
        {
            "ioc_value": "dontstopme06.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606220": [
        {
            "ioc_value": "dontstopme04.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606221": [
        {
            "ioc_value": "cawoslix-52222.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606222": [
        {
            "ioc_value": "dontstopme02.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606223": [
        {
            "ioc_value": "replays-63019.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606211": [
        {
            "ioc_value": "dontstopme05.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-03 09:02:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606184": [
        {
            "ioc_value": "author-adoption.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-03 09:02:27",
            "last_seen_utc": "2025-10-05 16:26:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606185": [
        {
            "ioc_value": "degene000-44104.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-03 09:02:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606186": [
        {
            "ioc_value": "lonah28403-49949.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-03 09:02:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606187": [
        {
            "ioc_value": "07f4acdef99b.ofalias.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-03 09:02:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606183": [
        {
            "ioc_value": "billyjeanovpn-27149.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-03 09:02:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "3October2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1606173": [
        {
            "ioc_value": "r3.frl-0-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 08:51:49",
            "last_seen_utc": "2025-10-03 08:55:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606159": [
        {
            "ioc_value": "oy.sgdi6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 08:40:36",
            "last_seen_utc": "2025-10-03 08:00:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606166": [
        {
            "ioc_value": "botnet92.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-10-03 08:40:35",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1606167": [
        {
            "ioc_value": "pa.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 08:40:34",
            "last_seen_utc": "2025-10-03 08:27:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606169": [
        {
            "ioc_value": "pe.sqfe6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 08:40:34",
            "last_seen_utc": "2025-10-03 08:30:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606168": [
        {
            "ioc_value": "k7.frl-0-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 08:27:16",
            "last_seen_utc": "2025-10-03 08:30:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606163": [
        {
            "ioc_value": "aa9.frl-0-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 08:00:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606158": [
        {
            "ioc_value": "v2.frl-0-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 07:47:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606155": [
        {
            "ioc_value": "ow.sgdi6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 07:39:16",
            "last_seen_utc": "2025-10-03 07:09:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606156": [
        {
            "ioc_value": "g.frl-0-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 07:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606141": [
        {
            "ioc_value": "or.sgdi6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 06:53:47",
            "last_seen_utc": "2025-10-03 05:57:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606144": [
        {
            "ioc_value": "os.sgdi6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 06:53:46",
            "last_seen_utc": "2025-10-03 06:17:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606150": [
        {
            "ioc_value": "dn.andreeamunteanu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-03 06:38:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1606151": [
        {
            "ioc_value": "rp.andreeamunteanu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-03 06:38:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1606152": [
        {
            "ioc_value": "dn.jullianacalhau.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-03 06:38:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1606145": [
        {
            "ioc_value": "m2.dxp-5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 06:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606143": [
        {
            "ioc_value": "stars-beat.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-03 06:00:17",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251003-ft54ysxvfy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1606142": [
        {
            "ioc_value": "aa9.dxp-5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 05:57:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606138": [
        {
            "ioc_value": "op.rvni2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 05:49:45",
            "last_seen_utc": "2025-10-03 05:39:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606139": [
        {
            "ioc_value": "xq0.dxp-5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 05:39:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605779": [
        {
            "ioc_value": "pencilsprotocolcrypto.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-03 05:08:18",
            "last_seen_utc": "2025-10-04 21:16:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "vitalyj"
        }
    ],
    "1606136": [
        {
            "ioc_value": "c5.dxp-5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 04:47:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606024": [
        {
            "ioc_value": "om.rvni2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 02:13:34",
            "last_seen_utc": "2025-10-03 02:15:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606023": [
        {
            "ioc_value": "l.dxp-5-y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 02:10:41",
            "last_seen_utc": "2025-10-03 02:15:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606022": [
        {
            "ioc_value": "ok.rvni2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 02:09:54",
            "last_seen_utc": "2025-10-03 02:10:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606021": [
        {
            "ioc_value": "aa.dvn-4-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 01:41:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606020": [
        {
            "ioc_value": "ab.qgf-5-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 01:40:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606019": [
        {
            "ioc_value": "oi.rvni2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 01:40:16",
            "last_seen_utc": "2025-10-03 04:47:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606018": [
        {
            "ioc_value": "oh.pvzi1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 01:01:52",
            "last_seen_utc": "2025-10-03 01:02:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606017": [
        {
            "ioc_value": "h1.dvn-4-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 00:58:27",
            "last_seen_utc": "2025-10-03 01:02:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606016": [
        {
            "ioc_value": "aa.qgf-5-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 00:57:59",
            "last_seen_utc": "2025-10-03 01:02:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606015": [
        {
            "ioc_value": "pz8.dvn-4-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 00:37:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606014": [
        {
            "ioc_value": "oe.pvzi1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 00:36:40",
            "last_seen_utc": "2025-10-03 00:37:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1606013": [
        {
            "ioc_value": "w4.dvn-4-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 00:25:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606012": [
        {
            "ioc_value": "o.qgf-5-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 00:23:48",
            "last_seen_utc": "2025-10-03 00:36:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1606011": [
        {
            "ioc_value": "od.pvzi1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-03 00:23:16",
            "last_seen_utc": "2025-10-03 00:25:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605796": [
        {
            "ioc_value": "d.dvn-4-i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 23:44:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605795": [
        {
            "ioc_value": "nu.pvzi1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 23:43:55",
            "last_seen_utc": "2025-10-03 00:58:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605794": [
        {
            "ioc_value": "no.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 23:33:08",
            "last_seen_utc": "2025-10-02 23:34:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605793": [
        {
            "ioc_value": "hm.cpc-8-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 23:25:47",
            "last_seen_utc": "2025-10-02 23:34:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605792": [
        {
            "ioc_value": "ne.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 23:23:50",
            "last_seen_utc": "2025-10-02 23:25:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605791": [
        {
            "ioc_value": "t1.cpc-8-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 23:13:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605790": [
        {
            "ioc_value": "na.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 23:10:51",
            "last_seen_utc": "2025-10-02 23:13:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605789": [
        {
            "ioc_value": "qz9.cpc-8-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 23:00:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605788": [
        {
            "ioc_value": "my.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 22:59:31",
            "last_seen_utc": "2025-10-02 23:00:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605787": [
        {
            "ioc_value": "v2.cpc-8-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 22:42:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605786": [
        {
            "ioc_value": "mu.prli1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 22:41:31",
            "last_seen_utc": "2025-10-02 22:42:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605785": [
        {
            "ioc_value": "mo.phpa3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 22:27:10",
            "last_seen_utc": "2025-10-02 22:38:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605784": [
        {
            "ioc_value": "k.cpc-8-u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 22:24:56",
            "last_seen_utc": "2025-10-02 22:32:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605783": [
        {
            "ioc_value": "mm.phpa3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 22:00:04",
            "last_seen_utc": "2025-10-02 22:24:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605781": [
        {
            "ioc_value": "m6.u-66r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 21:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605780": [
        {
            "ioc_value": "mi.phpa3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 21:44:41",
            "last_seen_utc": "2025-10-02 21:46:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605775": [
        {
            "ioc_value": "rp.jullianacalhau.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-02 21:20:33",
            "last_seen_utc": "2025-10-03 06:38:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/251002-z2zfxsvydt/behavioral1",
            "tags": "c2,domain,stealer,triage,Vidar",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605774": [
        {
            "ioc_value": "t1.u-66r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 21:20:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605773": [
        {
            "ioc_value": "me.phpa3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 21:18:37",
            "last_seen_utc": "2025-10-02 21:20:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605769": [
        {
            "ioc_value": "oriolep.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-02 21:12:20",
            "last_seen_utc": "2025-10-12 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605770": [
        {
            "ioc_value": "rightea.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-02 21:12:20",
            "last_seen_utc": "2025-10-12 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605771": [
        {
            "ioc_value": "epitomv.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-02 21:12:20",
            "last_seen_utc": "2025-10-12 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605772": [
        {
            "ioc_value": "retrosa.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-02 21:12:20",
            "last_seen_utc": "2025-10-12 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605768": [
        {
            "ioc_value": "qz9.u-66r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 21:07:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605765": [
        {
            "ioc_value": "ma.phpa3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 21:05:16",
            "last_seen_utc": "2025-10-02 21:08:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605764": [
        {
            "ioc_value": "v2.u-66r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 20:58:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605763": [
        {
            "ioc_value": "lo.pgka9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 20:56:57",
            "last_seen_utc": "2025-10-02 20:58:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605759": [
        {
            "ioc_value": "k.u-66r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 20:07:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605758": [
        {
            "ioc_value": "li.pgka9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 20:06:27",
            "last_seen_utc": "2025-10-02 20:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605740": [
        {
            "ioc_value": "b1.a-90g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 19:21:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605738": [
        {
            "ioc_value": "ki.pgka9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 19:00:14",
            "last_seen_utc": "2025-10-02 19:15:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605737": [
        {
            "ioc_value": "g4.a-90g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 18:53:59",
            "last_seen_utc": "2025-10-02 19:03:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605736": [
        {
            "ioc_value": "ka.pgka9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 18:49:49",
            "last_seen_utc": "2025-10-02 19:21:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605727": [
        {
            "ioc_value": "jo.nzki7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 18:35:29",
            "last_seen_utc": "2025-10-02 18:42:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605726": [
        {
            "ioc_value": "pm7.a-90g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 18:30:44",
            "last_seen_utc": "2025-10-02 18:42:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605725": [
        {
            "ioc_value": "k4.a-90g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 18:14:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605724": [
        {
            "ioc_value": "england-hosting.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-02 18:00:36",
            "last_seen_utc": "2025-10-10 11:34:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251002-vv6jfaen8t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605722": [
        {
            "ioc_value": "y.a-90g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 17:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605721": [
        {
            "ioc_value": "k4.i-78b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 17:28:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605720": [
        {
            "ioc_value": "if.nzki7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 17:26:50",
            "last_seen_utc": "2025-10-02 18:30:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605719": [
        {
            "ioc_value": "1310084117-cdzk9xw7xy.ap-beijing.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-02 16:48:53",
            "last_seen_utc": "2025-11-02 07:48:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1605718": [
        {
            "ioc_value": "id.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 16:47:48",
            "last_seen_utc": "2025-10-02 16:57:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605717": [
        {
            "ioc_value": "z3.i-78b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 16:41:02",
            "last_seen_utc": "2025-10-02 16:57:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605716": [
        {
            "ioc_value": "hm.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 16:37:20",
            "last_seen_utc": "2025-10-02 16:42:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605715": [
        {
            "ioc_value": "ho.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 16:28:03",
            "last_seen_utc": "2025-10-02 16:30:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605714": [
        {
            "ioc_value": "qm9.i-78b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 16:25:57",
            "last_seen_utc": "2025-10-02 16:30:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605713": [
        {
            "ioc_value": "hi.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 16:23:52",
            "last_seen_utc": "2025-10-02 16:25:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605712": [
        {
            "ioc_value": "u1.i-78b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 16:06:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605711": [
        {
            "ioc_value": "he.nxno7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 16:04:55",
            "last_seen_utc": "2025-10-02 16:06:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605708": [
        {
            "ioc_value": "chaos.bitcialtrone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.chaos",
            "malware_alias": "FakeRyuk,RyukJoke,Yashma",
            "malware_printable": "Chaos",
            "first_seen_utc": "2025-10-02 16:02:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/195.32.108.238+chaos.bitcialtrone.com",
            "tags": "AS_DIMENSIONE,AS202870,censys,Chaos,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605709": [
        {
            "ioc_value": "chaos.web.thegoodfeeder.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.chaos",
            "malware_alias": "FakeRyuk,RyukJoke,Yashma",
            "malware_printable": "Chaos",
            "first_seen_utc": "2025-10-02 16:02:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/152.42.233.100+chaos.web.thegoodfeeder.xyz",
            "tags": "AS14061,censys,Chaos,DIGITALOCEAN-ASN,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605702": [
        {
            "ioc_value": "jamesriver-ins.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-02 16:01:55",
            "last_seen_utc": "2025-10-08 04:01:10",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.216.130.82+jamesriver-ins.com",
            "tags": "AMAZON-AES,AS14618,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605703": [
        {
            "ioc_value": "packetley.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-10-02 16:01:55",
            "last_seen_utc": "2025-10-03 04:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.62.134.6+packetley.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605700": [
        {
            "ioc_value": "h.i-78b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 15:50:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605699": [
        {
            "ioc_value": "ha.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 15:47:30",
            "last_seen_utc": "2025-10-02 15:54:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605698": [
        {
            "ioc_value": "zd.i-88b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 15:40:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605697": [
        {
            "ioc_value": "gi.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 15:29:33",
            "last_seen_utc": "2025-10-02 15:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605696": [
        {
            "ioc_value": "r2.i-88b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 15:11:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605695": [
        {
            "ioc_value": "go.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 15:06:00",
            "last_seen_utc": "2025-10-02 15:17:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605694": [
        {
            "ioc_value": "wq9.i-88b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 14:42:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605693": [
        {
            "ioc_value": "fe.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 14:37:53",
            "last_seen_utc": "2025-10-02 14:42:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605690": [
        {
            "ioc_value": "ex.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 14:29:27",
            "last_seen_utc": "2025-10-02 14:15:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605692": [
        {
            "ioc_value": "fa.nqju5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 14:29:26",
            "last_seen_utc": "2025-10-02 14:26:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605691": [
        {
            "ioc_value": "c7.i-88b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 14:15:49",
            "last_seen_utc": "2025-10-02 14:26:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605683": [
        {
            "ioc_value": "ew.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 14:08:19",
            "last_seen_utc": "2025-10-02 13:59:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605684": [
        {
            "ioc_value": "derfonlyadenmokrsw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-02 14:08:18",
            "last_seen_utc": "2025-10-11 20:31:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1605685": [
        {
            "ioc_value": "hisikolarionfire.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-02 14:08:17",
            "last_seen_utc": "2025-10-11 20:31:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1605686": [
        {
            "ioc_value": "fasiokiurtuiolkads.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-02 14:08:16",
            "last_seen_utc": "2025-10-11 20:31:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1605687": [
        {
            "ioc_value": "dakiloifhsnuukka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-02 14:08:16",
            "last_seen_utc": "2025-10-11 20:31:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1605688": [
        {
            "ioc_value": "erahitopupikloss.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-02 14:08:15",
            "last_seen_utc": "2025-10-11 20:31:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1605689": [
        {
            "ioc_value": "n.i-88b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 13:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605677": [
        {
            "ioc_value": "er.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 13:48:03",
            "last_seen_utc": "2025-10-02 12:56:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605678": [
        {
            "ioc_value": "es.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 13:48:02",
            "last_seen_utc": "2025-10-02 13:00:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605680": [
        {
            "ioc_value": "et.mzvo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 13:48:01",
            "last_seen_utc": "2025-10-02 13:31:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605679": [
        {
            "ioc_value": "k9.i-76t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:56:02",
            "last_seen_utc": "2025-10-02 13:05:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605623": [
        {
            "ioc_value": "a7.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:15",
            "last_seen_utc": "2025-10-02 08:51:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605625": [
        {
            "ioc_value": "rv.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:15",
            "last_seen_utc": "2025-10-02 09:14:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605628": [
        {
            "ioc_value": "t9.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:14",
            "last_seen_utc": "2025-10-02 09:41:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605631": [
        {
            "ioc_value": "x2.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:14",
            "last_seen_utc": "2025-10-02 09:59:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605640": [
        {
            "ioc_value": "h1n.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:14",
            "last_seen_utc": "2025-10-02 10:19:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605642": [
        {
            "ioc_value": "zq.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605647": [
        {
            "ioc_value": "h3.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:13",
            "last_seen_utc": "2025-10-02 11:11:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605643": [
        {
            "ioc_value": "s.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:12",
            "last_seen_utc": "2025-10-02 11:02:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605645": [
        {
            "ioc_value": "storsvc-win.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.warmcookie",
            "malware_alias": "Badspace,Carrotstick,QUICKBIND",
            "malware_printable": "WarmCookie",
            "first_seen_utc": "2025-10-02 12:48:11",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.elastic.co/security-labs/revisiting-warmcookie",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1605649": [
        {
            "ioc_value": "pl.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:10",
            "last_seen_utc": "2025-10-02 11:27:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605651": [
        {
            "ioc_value": "x.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:10",
            "last_seen_utc": "2025-10-02 11:31:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605668": [
        {
            "ioc_value": "aeropeics.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-10-02 12:48:09",
            "last_seen_utc": "2025-10-02 16:04:54",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115304526179110474",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1605671": [
        {
            "ioc_value": "m2.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:08",
            "last_seen_utc": "2025-10-02 12:34:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605673": [
        {
            "ioc_value": "qb.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:07",
            "last_seen_utc": "2025-10-02 12:37:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605675": [
        {
            "ioc_value": "z9m.bowibo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:48:07",
            "last_seen_utc": "2025-10-02 12:45:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605674": [
        {
            "ioc_value": "m7.i-76t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:37:58",
            "last_seen_utc": "2025-10-02 12:45:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605672": [
        {
            "ioc_value": "tq1.i-76t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 12:24:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605666": [
        {
            "ioc_value": "home.wtt.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-10-02 12:02:35",
            "last_seen_utc": "2025-10-10 11:35:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/251002-mrw7lavpz3",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605654": [
        {
            "ioc_value": "eririego.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-02 12:00:18",
            "last_seen_utc": "2025-10-10 11:34:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251002-hzg1esam9s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605652": [
        {
            "ioc_value": "b2.i-76t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 11:29:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605650": [
        {
            "ioc_value": "i.qgf-5-e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 11:27:36",
            "last_seen_utc": "2025-10-02 23:44:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605648": [
        {
            "ioc_value": "x.i-76t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 11:11:25",
            "last_seen_utc": "2025-10-02 11:16:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605646": [
        {
            "ioc_value": "m6.j1z2u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 11:02:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605644": [
        {
            "ioc_value": "n0.i-26h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 10:42:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605641": [
        {
            "ioc_value": "e1.i-26h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 10:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605635": [
        {
            "ioc_value": "pa.andreeamunteanu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-02 10:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1605636": [
        {
            "ioc_value": "pa.jullianacalhau.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-02 10:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1605632": [
        {
            "ioc_value": "qk2.i-26h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 09:59:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605630": [
        {
            "ioc_value": "u5.i-26h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 09:41:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605629": [
        {
            "ioc_value": "t1.j1z2u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 09:40:27",
            "last_seen_utc": "2025-10-02 09:51:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605627": [
        {
            "ioc_value": "qz9.j1z2u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 09:14:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605626": [
        {
            "ioc_value": "r.i-26h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 09:11:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605624": [
        {
            "ioc_value": "r3.e-52p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 08:51:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605520": [
        {
            "ioc_value": "g.nibulu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 08:39:57",
            "last_seen_utc": "2025-10-02 08:37:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605522": [
        {
            "ioc_value": "k7.e-52p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 08:37:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605521": [
        {
            "ioc_value": "v2.j1z2u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 08:35:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605510": [
        {
            "ioc_value": "h2.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 08:30:09",
            "last_seen_utc": "2025-10-02 07:57:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605517": [
        {
            "ioc_value": "wz.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 08:30:09",
            "last_seen_utc": "2025-10-02 08:18:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605519": [
        {
            "ioc_value": "k0n.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 08:30:08",
            "last_seen_utc": "2025-10-02 08:28:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605518": [
        {
            "ioc_value": "aa9.e-52p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 08:18:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605511": [
        {
            "ioc_value": "k.j1z2u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 07:57:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605509": [
        {
            "ioc_value": "b1.k0m7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 07:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605508": [
        {
            "ioc_value": "v2.e-52p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 07:42:12",
            "last_seen_utc": "2025-10-02 07:48:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605507": [
        {
            "ioc_value": "q.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 07:38:29",
            "last_seen_utc": "2025-10-02 07:43:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605505": [
        {
            "ioc_value": "xt.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 07:29:24",
            "last_seen_utc": "2025-10-02 07:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605506": [
        {
            "ioc_value": "g.e-52p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 07:29:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605502": [
        {
            "ioc_value": "n5.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 07:18:02",
            "last_seen_utc": "2025-10-02 07:15:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605504": [
        {
            "ioc_value": "g4.k0m7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 07:15:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605503": [
        {
            "ioc_value": "m2.y-45s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 07:09:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605495": [
        {
            "ioc_value": "c1m.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 06:55:07",
            "last_seen_utc": "2025-10-02 06:42:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605498": [
        {
            "ioc_value": "b.haxyli.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 06:55:07",
            "last_seen_utc": "2025-10-02 06:51:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605499": [
        {
            "ioc_value": "pm7.k0m7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 06:51:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605497": [
        {
            "ioc_value": "aa9.y-45s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 06:42:04",
            "last_seen_utc": "2025-10-02 06:51:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605496": [
        {
            "ioc_value": "k4.k0m7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 06:38:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605494": [
        {
            "ioc_value": "montblancgroup.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lokipws",
            "malware_alias": "Burkina,Loki,LokiBot,LokiPWS",
            "malware_printable": "Loki Password Stealer (PWS)",
            "first_seen_utc": "2025-10-02 06:36:02",
            "last_seen_utc": "2025-10-31 23:48:03",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=montblancgroup.cfd",
            "tags": "Lokibot,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1605486": [
        {
            "ioc_value": "t7.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 06:24:12",
            "last_seen_utc": "2025-10-02 06:16:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605488": [
        {
            "ioc_value": "xq0.y-45s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 06:16:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605487": [
        {
            "ioc_value": "y.k0m7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 06:16:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605472": [
        {
            "ioc_value": "pv.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 06:03:46",
            "last_seen_utc": "2025-10-02 05:59:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605479": [
        {
            "ioc_value": "envio1-10.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-02 06:00:35",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251002-fngjeaxtct",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605480": [
        {
            "ioc_value": "rusia20206.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-02 06:00:35",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/251002-enxd7awwhw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605478": [
        {
            "ioc_value": "ms-immigrants.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-02 06:00:19",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251002-dydt6awsgs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605477": [
        {
            "ioc_value": "car-aug.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-02 06:00:18",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251002-fcwh7aw1hy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605474": [
        {
            "ioc_value": "c5.y-45s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605473": [
        {
            "ioc_value": "k4.l6r7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:58:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605469": [
        {
            "ioc_value": "a1.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:47:19",
            "last_seen_utc": "2025-10-02 05:42:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605471": [
        {
            "ioc_value": "l.y-45s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:42:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605470": [
        {
            "ioc_value": "z3.l6r7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:38:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605468": [
        {
            "ioc_value": "aa.o-92h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:30:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605467": [
        {
            "ioc_value": "qm9.l6r7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:29:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605466": [
        {
            "ioc_value": "mk.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:29:01",
            "last_seen_utc": "2025-10-02 05:30:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605343": [
        {
            "ioc_value": "silverquillstone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-10-02 05:22:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "beepboop"
        }
    ],
    "1605347": [
        {
            "ioc_value": "sushi-swap.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-02 05:22:05",
            "last_seen_utc": "2025-10-01 21:27:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "vitalyj"
        }
    ],
    "1605383": [
        {
            "ioc_value": "tokenpockethd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-10-02 05:21:48",
            "last_seen_utc": "2025-10-02 22:25:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "galvanpol1989"
        }
    ],
    "1605385": [
        {
            "ioc_value": "zy.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:14:44",
            "last_seen_utc": "2025-10-01 23:04:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605388": [
        {
            "ioc_value": "ac.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:14:43",
            "last_seen_utc": "2025-10-01 23:14:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605399": [
        {
            "ioc_value": "af.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:14:42",
            "last_seen_utc": "2025-10-02 00:10:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605402": [
        {
            "ioc_value": "aj.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:14:41",
            "last_seen_utc": "2025-10-02 00:50:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605405": [
        {
            "ioc_value": "be.kmbo6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:14:41",
            "last_seen_utc": "2025-10-02 02:43:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605408": [
        {
            "ioc_value": "bi.kmbo6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:14:40",
            "last_seen_utc": "2025-10-02 01:17:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605410": [
        {
            "ioc_value": "bo.kmbo6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:14:35",
            "last_seen_utc": "2025-10-02 02:27:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605419": [
        {
            "ioc_value": "ch.kmbo6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:13:08",
            "last_seen_utc": "2025-10-02 03:12:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605421": [
        {
            "ioc_value": "xo.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:13:07",
            "last_seen_utc": "2025-10-02 03:22:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605423": [
        {
            "ioc_value": "a.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:13:06",
            "last_seen_utc": "2025-10-02 03:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605426": [
        {
            "ioc_value": "n3.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:13:05",
            "last_seen_utc": "2025-10-02 03:33:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605428": [
        {
            "ioc_value": "zp.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:13:04",
            "last_seen_utc": "2025-10-02 03:43:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605430": [
        {
            "ioc_value": "t.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:13:03",
            "last_seen_utc": "2025-10-02 03:53:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605432": [
        {
            "ioc_value": "x9.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:13:01",
            "last_seen_utc": "2025-10-02 03:59:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605456": [
        {
            "ioc_value": "hv.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:12:58",
            "last_seen_utc": "2025-10-02 04:08:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605458": [
        {
            "ioc_value": "m2n.qylyxi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:12:57",
            "last_seen_utc": "2025-10-02 04:14:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605460": [
        {
            "ioc_value": "e.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:12:56",
            "last_seen_utc": "2025-10-02 04:35:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605463": [
        {
            "ioc_value": "z4.hasefa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 05:12:55",
            "last_seen_utc": "2025-10-02 04:54:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605465": [
        {
            "ioc_value": "h1.o-92h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 04:54:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605464": [
        {
            "ioc_value": "u1.l6r7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 04:54:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605462": [
        {
            "ioc_value": "h.l6r7e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 04:35:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605461": [
        {
            "ioc_value": "pz8.o-92h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 04:31:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605459": [
        {
            "ioc_value": "zd.m3j8e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 04:13:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605457": [
        {
            "ioc_value": "w4.o-92h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 04:08:19",
            "last_seen_utc": "2025-10-02 04:14:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605431": [
        {
            "ioc_value": "d.o-92h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 03:53:33",
            "last_seen_utc": "2025-10-02 03:59:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605429": [
        {
            "ioc_value": "r2.m3j8e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 03:43:07",
            "last_seen_utc": "2025-10-02 03:57:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605427": [
        {
            "ioc_value": "hm.a-84l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 03:33:23",
            "last_seen_utc": "2025-10-02 03:38:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605425": [
        {
            "ioc_value": "n.m3j8e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 03:25:48",
            "last_seen_utc": "2025-10-02 03:32:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605422": [
        {
            "ioc_value": "t1.a-84l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 03:17:18",
            "last_seen_utc": "2025-10-02 03:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605420": [
        {
            "ioc_value": "wq9.m3j8e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 03:12:18",
            "last_seen_utc": "2025-10-02 03:22:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605414": [
        {
            "ioc_value": "qz9.a-84l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 02:43:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605413": [
        {
            "ioc_value": "c7.m3j8e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 02:42:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605412": [
        {
            "ioc_value": "v2.a-84l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 02:27:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605411": [
        {
            "ioc_value": "k9.j8k2a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 02:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605409": [
        {
            "ioc_value": "k.a-84l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 01:17:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605407": [
        {
            "ioc_value": "m6.f-57e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 01:03:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605406": [
        {
            "ioc_value": "m7.j8k2a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 01:01:53",
            "last_seen_utc": "2025-10-02 01:16:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605404": [
        {
            "ioc_value": "tq1.j8k2a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 00:50:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605403": [
        {
            "ioc_value": "t1.f-57e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 00:36:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605401": [
        {
            "ioc_value": "qz9.f-57e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 00:10:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605400": [
        {
            "ioc_value": "b2.j8k2a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-02 00:09:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605389": [
        {
            "ioc_value": "v2.f-57e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 23:14:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605387": [
        {
            "ioc_value": "x.j8k2a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 23:04:04",
            "last_seen_utc": "2025-10-01 23:14:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605386": [
        {
            "ioc_value": "k.f-57e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 22:59:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605372": [
        {
            "ioc_value": "b1.h-76a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 21:30:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605371": [
        {
            "ioc_value": "n0.l8w6u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 21:29:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605370": [
        {
            "ioc_value": "zu.pgka-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 21:28:55",
            "last_seen_utc": "2025-10-01 21:30:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605346": [
        {
            "ioc_value": "e1.l8w6u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 21:24:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605345": [
        {
            "ioc_value": "pm7.h-76a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 21:19:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605344": [
        {
            "ioc_value": "s.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 21:18:38",
            "last_seen_utc": "2025-10-01 21:24:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605339": [
        {
            "ioc_value": "y.h-76a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 20:48:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605338": [
        {
            "ioc_value": "qk2.l8w6u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 20:47:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605337": [
        {
            "ioc_value": "h3.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 20:46:56",
            "last_seen_utc": "2025-10-01 20:48:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605336": [
        {
            "ioc_value": "k4.n-80o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 20:23:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605335": [
        {
            "ioc_value": "u5.l8w6u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 20:23:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605334": [
        {
            "ioc_value": "pn.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 20:22:59",
            "last_seen_utc": "2025-10-01 20:23:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605327": [
        {
            "ioc_value": "mail.valorschoolsupplies.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-10-01 20:01:21",
            "last_seen_utc": "2025-10-02 04:00:19",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.74.8.8+mail.valorschoolsupplies.com",
            "tags": "AS3223,AsyncRAT,C2,censys,RAT,VOXILITY",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605318": [
        {
            "ioc_value": "r.l8w6u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 19:47:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605317": [
        {
            "ioc_value": "z3.n-80o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 19:47:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605316": [
        {
            "ioc_value": "x.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 19:46:08",
            "last_seen_utc": "2025-10-01 19:47:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605311": [
        {
            "ioc_value": "qm9.n-80o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:54:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605310": [
        {
            "ioc_value": "m2.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:53:35",
            "last_seen_utc": "2025-10-01 18:54:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605308": [
        {
            "ioc_value": "r3.b3n4o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:49:25",
            "last_seen_utc": "2025-10-01 18:54:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605305": [
        {
            "ioc_value": "qb.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:43:48",
            "last_seen_utc": "2025-10-01 18:49:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605304": [
        {
            "ioc_value": "k7.b3n4o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:37:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605303": [
        {
            "ioc_value": "z9m.h8o4g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:36:35",
            "last_seen_utc": "2025-10-01 18:40:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605302": [
        {
            "ioc_value": "u1.n-80o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:34:26",
            "last_seen_utc": "2025-10-01 18:45:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605297": [
        {
            "ioc_value": "aa9.b3n4o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:08:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605296": [
        {
            "ioc_value": "h.n-80o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:08:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605295": [
        {
            "ioc_value": "m7.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 18:08:22",
            "last_seen_utc": "2025-10-01 18:08:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605288": [
        {
            "ioc_value": "completed-somewhere.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-01 18:00:49",
            "last_seen_utc": "2025-10-10 11:34:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-vp7jjszwft",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605289": [
        {
            "ioc_value": "trial-suppose.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-01 18:00:49",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-tbaf8ayvcx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605291": [
        {
            "ioc_value": "patients-apparatus.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-01 18:00:49",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-pblf9styex",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605287": [
        {
            "ioc_value": "v2.b3n4o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 17:54:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605286": [
        {
            "ioc_value": "zd.z-11e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 17:51:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605285": [
        {
            "ioc_value": "pz.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 17:49:45",
            "last_seen_utc": "2025-10-01 17:54:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605282": [
        {
            "ioc_value": "r2.z-11e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 17:08:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605281": [
        {
            "ioc_value": "m2.q8g1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 17:06:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605280": [
        {
            "ioc_value": "t.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 17:05:21",
            "last_seen_utc": "2025-10-01 18:34:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605279": [
        {
            "ioc_value": "wq9.z-11e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605278": [
        {
            "ioc_value": "aa9.q8g1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:46:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605277": [
        {
            "ioc_value": "x9.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:44:20",
            "last_seen_utc": "2025-10-01 16:48:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605276": [
        {
            "ioc_value": "hv.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:30:58",
            "last_seen_utc": "2025-10-01 16:33:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605275": [
        {
            "ioc_value": "xq0.q8g1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:28:38",
            "last_seen_utc": "2025-10-01 16:33:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605274": [
        {
            "ioc_value": "c7.z-11e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:28:04",
            "last_seen_utc": "2025-10-01 16:33:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605273": [
        {
            "ioc_value": "c2n.n6e8h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:27:17",
            "last_seen_utc": "2025-10-01 16:28:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605272": [
        {
            "ioc_value": "b.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:22:06",
            "last_seen_utc": "2025-10-01 16:23:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605271": [
        {
            "ioc_value": "n.z-11e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:13:44",
            "last_seen_utc": "2025-10-01 16:23:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605270": [
        {
            "ioc_value": "c5.q8g1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:12:27",
            "last_seen_utc": "2025-10-01 16:22:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605269": [
        {
            "ioc_value": "n4.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:10:46",
            "last_seen_utc": "2025-10-01 16:13:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605255": [
        {
            "ioc_value": "l.q8g1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 16:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605254": [
        {
            "ioc_value": "k9.q-49o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605253": [
        {
            "ioc_value": "xt.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:57:55",
            "last_seen_utc": "2025-10-01 16:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605252": [
        {
            "ioc_value": "m7.q-49o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:48:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605251": [
        {
            "ioc_value": "q.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:47:28",
            "last_seen_utc": "2025-10-01 15:48:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605250": [
        {
            "ioc_value": "aa.k5d1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:33:00",
            "last_seen_utc": "2025-10-01 15:47:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605248": [
        {
            "ioc_value": "h2.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:31:55",
            "last_seen_utc": "2025-10-01 15:33:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605249": [
        {
            "ioc_value": "tq1.q-49o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:28:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605242": [
        {
            "ioc_value": "p.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:13:17",
            "last_seen_utc": "2025-10-01 14:54:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605244": [
        {
            "ioc_value": "c1m.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:13:17",
            "last_seen_utc": "2025-10-01 14:59:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605246": [
        {
            "ioc_value": "wz.n0y8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:13:16",
            "last_seen_utc": "2025-10-01 15:07:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605247": [
        {
            "ioc_value": "b2.q-49o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 15:07:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605245": [
        {
            "ioc_value": "h1.k5d1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 14:58:32",
            "last_seen_utc": "2025-10-01 15:07:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605243": [
        {
            "ioc_value": "x.q-49o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 14:54:50",
            "last_seen_utc": "2025-10-01 14:59:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605236": [
        {
            "ioc_value": "ve.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 14:48:52",
            "last_seen_utc": "2025-10-01 14:09:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605239": [
        {
            "ioc_value": "k8.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 14:48:52",
            "last_seen_utc": "2025-10-01 14:21:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605230": [
        {
            "ioc_value": "u.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 14:48:51",
            "last_seen_utc": "2025-10-01 13:33:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605241": [
        {
            "ioc_value": "n0.w-52a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 14:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605240": [
        {
            "ioc_value": "pz8.k5d1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 14:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605238": [
        {
            "ioc_value": "w4.k5d1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 14:09:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605237": [
        {
            "ioc_value": "e1.w-52a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 14:09:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605233": [
        {
            "ioc_value": "r3.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 13:59:07",
            "last_seen_utc": "2025-10-01 13:54:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605235": [
        {
            "ioc_value": "qk2.w-52a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 13:54:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605234": [
        {
            "ioc_value": "d.k5d1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 13:52:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605232": [
        {
            "ioc_value": "hm.q6t4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 13:33:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605231": [
        {
            "ioc_value": "u5.w-52a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 13:29:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605218": [
        {
            "ioc_value": "cm.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 13:17:03",
            "last_seen_utc": "2025-10-01 12:34:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605221": [
        {
            "ioc_value": "y7.q4e3n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 13:17:02",
            "last_seen_utc": "2025-10-01 13:01:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605229": [
        {
            "ioc_value": "whenthecodefinallyworks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-10-01 13:14:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.vmray.com/analyses/_vt/c6cb351bcc76/report/ioc.html",
            "tags": "c2,domain,Rhadamanthys,stealer,vmray",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605227": [
        {
            "ioc_value": "t1.q6t4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 13:01:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605226": [
        {
            "ioc_value": "r.w-52a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 12:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605220": [
        {
            "ioc_value": "r3.g-28e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 12:34:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605219": [
        {
            "ioc_value": "qz9.q6t4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 12:30:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605215": [
        {
            "ioc_value": "q7.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 12:28:26",
            "last_seen_utc": "2025-10-01 12:09:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605217": [
        {
            "ioc_value": "k7.g-28e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 12:17:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605216": [
        {
            "ioc_value": "v2.q6t4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 12:16:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605196": [
        {
            "ioc_value": "quietshalecompany.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-01 12:03:03",
            "last_seen_utc": "2025-10-06 07:39:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605197": [
        {
            "ioc_value": "bd.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 12:03:02",
            "last_seen_utc": "2025-10-01 12:01:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605214": [
        {
            "ioc_value": "aa9.g-28e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 12:01:36",
            "last_seen_utc": "2025-10-01 12:09:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605208": [
        {
            "ioc_value": "kamal11.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-01 12:01:08",
            "last_seen_utc": "2025-10-10 11:34:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-g5ftwabk9w",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605206": [
        {
            "ioc_value": "ghddfe.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-01 12:00:56",
            "last_seen_utc": "2025-10-10 11:34:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-g1j1qszthy",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605204": [
        {
            "ioc_value": "verygreatjourneyofthebabygirlwholivesfor.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-01 12:00:55",
            "last_seen_utc": "2025-10-10 11:34:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-hy9ztatqz2",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605205": [
        {
            "ioc_value": "bestwishesfornewstartingwithrems.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-10-01 12:00:55",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-g2gl1azvay",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605202": [
        {
            "ioc_value": "film-distinguished.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-01 12:00:49",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-kwnpxa11hv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605200": [
        {
            "ioc_value": "participationcontrol.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-01 12:00:48",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-naqtxsdr8z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605201": [
        {
            "ioc_value": "propracontrolly.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-10-01 12:00:48",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-naqtxsdr8z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605198": [
        {
            "ioc_value": "k.q6t4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 11:58:54",
            "last_seen_utc": "2025-10-01 12:07:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605184": [
        {
            "ioc_value": "x.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 11:43:39",
            "last_seen_utc": "2025-10-01 10:28:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605186": [
        {
            "ioc_value": "h9m.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 11:43:38",
            "last_seen_utc": "2025-10-01 10:44:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605190": [
        {
            "ioc_value": "tq.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 11:43:38",
            "last_seen_utc": "2025-10-01 11:13:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605194": [
        {
            "ioc_value": "z1.p2o7l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 11:43:37",
            "last_seen_utc": "2025-10-01 12:17:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605195": [
        {
            "ioc_value": "u1.x38ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 11:22:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605192": [
        {
            "ioc_value": "v2.g-28e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 11:13:25",
            "last_seen_utc": "2025-10-01 11:24:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605191": [
        {
            "ioc_value": "qm9.x38ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 11:09:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605187": [
        {
            "ioc_value": "g.g-28e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 10:44:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605185": [
        {
            "ioc_value": "k4.t99oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 10:28:51",
            "last_seen_utc": "2025-10-01 10:33:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605177": [
        {
            "ioc_value": "p.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 10:17:34",
            "last_seen_utc": "2025-10-01 10:00:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605180": [
        {
            "ioc_value": "routepickle.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-01 10:12:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1605181": [
        {
            "ioc_value": "shirtstraw.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-01 10:12:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1605182": [
        {
            "ioc_value": "atillawootten.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-01 10:12:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1605183": [
        {
            "ioc_value": "shoestop.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-10-01 10:12:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1605179": [
        {
            "ioc_value": "aa.d-54y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 10:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605178": [
        {
            "ioc_value": "pm7.t99oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:57:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605155": [
        {
            "ioc_value": "cm.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:41:50",
            "last_seen_utc": "2025-10-01 08:30:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605173": [
        {
            "ioc_value": "k8.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:41:50",
            "last_seen_utc": "2025-10-01 09:29:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605175": [
        {
            "ioc_value": "l.p-55u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:29:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605174": [
        {
            "ioc_value": "g4.t99oo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:29:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605172": [
        {
            "ioc_value": "k.l99oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:21:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605157": [
        {
            "ioc_value": "y7.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:20:10",
            "last_seen_utc": "2025-10-01 08:45:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605164": [
        {
            "ioc_value": "u.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:20:10",
            "last_seen_utc": "2025-10-01 08:52:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605167": [
        {
            "ioc_value": "r3.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:20:09",
            "last_seen_utc": "2025-10-01 09:08:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605170": [
        {
            "ioc_value": "ve.n4i2m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:20:09",
            "last_seen_utc": "2025-10-01 09:21:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605171": [
        {
            "ioc_value": "c5.p-55u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:17:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605169": [
        {
            "ioc_value": "xq0.p-55u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:08:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605168": [
        {
            "ioc_value": "v2.l99oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 09:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605166": [
        {
            "ioc_value": "qz9.l99oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 08:52:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605165": [
        {
            "ioc_value": "aa9.p-55u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 08:51:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605158": [
        {
            "ioc_value": "girondh.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-10-01 08:45:03",
            "last_seen_utc": "2025-10-12 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1605156": [
        {
            "ioc_value": "t1.l99oy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 08:30:24",
            "last_seen_utc": "2025-10-01 08:45:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605154": [
        {
            "ioc_value": "m2.p-55u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 08:26:27",
            "last_seen_utc": "2025-10-01 08:40:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605146": [
        {
            "ioc_value": "vip.googleminigames.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-10-01 07:38:53",
            "last_seen_utc": null,
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1605138": [
        {
            "ioc_value": "re.andreeamunteanu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-01 06:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1605139": [
        {
            "ioc_value": "re.valmetfinance.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-10-01 06:34:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1605130": [
        {
            "ioc_value": "built-hiring.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-10-01 06:01:13",
            "last_seen_utc": "2025-10-10 11:34:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/251001-a442raznt6",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604812": [
        {
            "ioc_value": "daom2gaslioryrocky.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:35",
            "last_seen_utc": "2025-09-30 18:03:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604813": [
        {
            "ioc_value": "fexelxilkopory.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:34",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604815": [
        {
            "ioc_value": "geargasporuion.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:34",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604814": [
        {
            "ioc_value": "gansroroyfgdst.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:33",
            "last_seen_utc": "2025-11-28 16:09:07",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604816": [
        {
            "ioc_value": "triosdoryumkas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:33",
            "last_seen_utc": "2025-09-30 18:03:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604817": [
        {
            "ioc_value": "ariokliasklfdnok.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:32",
            "last_seen_utc": "2025-09-30 18:03:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604818": [
        {
            "ioc_value": "dorevilokpadjghs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:32",
            "last_seen_utc": "2025-11-18 16:17:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604819": [
        {
            "ioc_value": "kwestgidokudiojek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:31",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604820": [
        {
            "ioc_value": "lilikutliputsdf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:30",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604821": [
        {
            "ioc_value": "sisadfriolkdle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:30",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604822": [
        {
            "ioc_value": "sigdalokanolkas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:30",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604823": [
        {
            "ioc_value": "signamoykloysd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:30",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604824": [
        {
            "ioc_value": "sistoronykastadro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:29",
            "last_seen_utc": "2025-11-18 16:17:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604825": [
        {
            "ioc_value": "sum1oxazaracklary.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:29",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604826": [
        {
            "ioc_value": "adsqwiolkuerkom.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:29",
            "last_seen_utc": "2025-11-18 16:17:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604827": [
        {
            "ioc_value": "afsdloiutropic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:29",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604828": [
        {
            "ioc_value": "alfryudabikuta.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:28",
            "last_seen_utc": "2025-11-18 16:17:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604829": [
        {
            "ioc_value": "basokilometrsdo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:28",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604830": [
        {
            "ioc_value": "blaksdioklery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:27",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604831": [
        {
            "ioc_value": "djkloyfarelbister.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:27",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604832": [
        {
            "ioc_value": "dlinofinopasster.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:27",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604833": [
        {
            "ioc_value": "doskaevriakjoilo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:26",
            "last_seen_utc": "2025-11-18 16:17:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604837": [
        {
            "ioc_value": "jauiolkerytamp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:25",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604839": [
        {
            "ioc_value": "k5aiodybloxdasom.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:25",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604834": [
        {
            "ioc_value": "ganstopliomalifas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:23",
            "last_seen_utc": "2025-11-18 16:17:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604835": [
        {
            "ioc_value": "gasrihoirteyui.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:23",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604836": [
        {
            "ioc_value": "h1hundynotesuom.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:23",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604838": [
        {
            "ioc_value": "jojikloertoys.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:23",
            "last_seen_utc": "2025-11-18 16:17:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604840": [
        {
            "ioc_value": "kasldericoname.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:22",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604841": [
        {
            "ioc_value": "kutakdokliurio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:22",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604844": [
        {
            "ioc_value": "gasrobariokley.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:21",
            "last_seen_utc": "2025-11-18 16:17:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604842": [
        {
            "ioc_value": "kwjfalvalkloun.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:20",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604843": [
        {
            "ioc_value": "lounfaslkijsdf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:20",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604845": [
        {
            "ioc_value": "fadoklismokley.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-10-01 05:24:20",
            "last_seen_utc": "2025-11-18 16:17:05",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604846": [
        {
            "ioc_value": "vy.sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:15",
            "last_seen_utc": "2025-09-30 18:38:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604848": [
        {
            "ioc_value": "vu.sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:15",
            "last_seen_utc": "2025-09-30 18:42:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604860": [
        {
            "ioc_value": "vo.sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:14",
            "last_seen_utc": "2025-09-30 19:26:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604863": [
        {
            "ioc_value": "vi.sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:14",
            "last_seen_utc": "2025-09-30 19:35:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604867": [
        {
            "ioc_value": "en.mxta6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:13",
            "last_seen_utc": "2025-09-30 20:25:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604880": [
        {
            "ioc_value": "em.mxta6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:13",
            "last_seen_utc": "2025-09-30 20:30:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604886": [
        {
            "ioc_value": "el.mxta6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:12",
            "last_seen_utc": "2025-09-30 21:03:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604890": [
        {
            "ioc_value": "eh.mxta6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:12",
            "last_seen_utc": "2025-09-30 21:50:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604893": [
        {
            "ioc_value": "ef.mxta6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:11",
            "last_seen_utc": "2025-09-30 21:59:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604898": [
        {
            "ioc_value": "do.lkci1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:10",
            "last_seen_utc": "2025-09-30 22:27:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604895": [
        {
            "ioc_value": "ed.lkci1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:09",
            "last_seen_utc": "2025-09-30 23:30:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604901": [
        {
            "ioc_value": "di.lkci1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:08",
            "last_seen_utc": "2025-09-30 23:09:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604906": [
        {
            "ioc_value": "da.lkci1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:07",
            "last_seen_utc": "2025-09-30 23:39:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604922": [
        {
            "ioc_value": "zo.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:07",
            "last_seen_utc": "2025-10-01 00:33:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605102": [
        {
            "ioc_value": "zi.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:24:05",
            "last_seen_utc": "2025-10-01 02:51:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605106": [
        {
            "ioc_value": "google-reviews-5l6.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-10-01 05:24:04",
            "last_seen_utc": null,
            "confidence_level": 80,
            "reference": null,
            "tags": "FAKEUPDATES",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1605107": [
        {
            "ioc_value": "files-transfer.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-10-01 05:24:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.71.22+files-transfer.info",
            "tags": "AS401120,C2,censys,CHEAPY-HOST",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1605122": [
        {
            "ioc_value": "ze.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:23:54",
            "last_seen_utc": "2025-10-01 04:07:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605126": [
        {
            "ioc_value": "xy.prli-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:23:53",
            "last_seen_utc": "2025-10-01 08:26:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604799": [
        {
            "ioc_value": "wa.sgdi-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 05:23:52",
            "last_seen_utc": "2025-09-30 17:45:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1605127": [
        {
            "ioc_value": "h.x38ii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 04:33:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605124": [
        {
            "ioc_value": "w4.d-54y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 04:07:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605123": [
        {
            "ioc_value": "wq9.z88ae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 04:07:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605104": [
        {
            "ioc_value": "c7.z88ae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 02:51:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1605103": [
        {
            "ioc_value": "d.d-54y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 02:51:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604924": [
        {
            "ioc_value": "hm.j-70o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 00:33:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604923": [
        {
            "ioc_value": "n.z88ae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-10-01 00:31:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604908": [
        {
            "ioc_value": "t1.j-70o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 23:39:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604907": [
        {
            "ioc_value": "m7.f14ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 23:38:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604905": [
        {
            "ioc_value": "qz9.j-70o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 23:30:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604904": [
        {
            "ioc_value": "tq1.f14ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 23:28:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604903": [
        {
            "ioc_value": "b2.f14ey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 23:09:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604902": [
        {
            "ioc_value": "v2.j-70o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 23:04:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604900": [
        {
            "ioc_value": "k.j-70o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 22:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604899": [
        {
            "ioc_value": "e1.j86ei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 22:27:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604897": [
        {
            "ioc_value": "m6.nu-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 22:14:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604896": [
        {
            "ioc_value": "qk2.j86ei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 22:10:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604894": [
        {
            "ioc_value": "t1.nu-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 21:59:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604892": [
        {
            "ioc_value": "u5.j86ei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 21:50:30",
            "last_seen_utc": "2025-09-30 21:58:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604891": [
        {
            "ioc_value": "qz9.nu-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 21:50:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604888": [
        {
            "ioc_value": "v2.nu-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 21:03:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604887": [
        {
            "ioc_value": "r.j86ei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 21:02:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604882": [
        {
            "ioc_value": "k.nu-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 20:30:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604881": [
        {
            "ioc_value": "k7.x12uy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 20:29:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604879": [
        {
            "ioc_value": "aa9.x12uy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 20:22:21",
            "last_seen_utc": "2025-09-30 20:25:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604878": [
        {
            "ioc_value": "v2.x12uy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 20:04:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604874": [
        {
            "ioc_value": "www.valorschoolsupplies.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-30 20:01:50",
            "last_seen_utc": "2025-10-01 04:00:19",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.74.8.8+www.valorschoolsupplies.com",
            "tags": "AS3223,AsyncRAT,C2,censys,RAT,VOXILITY",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604868": [
        {
            "ioc_value": "b1.zi-87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 19:55:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604866": [
        {
            "ioc_value": "x2.vototao9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 19:37:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604864": [
        {
            "ioc_value": "g4.zi-87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 19:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604862": [
        {
            "ioc_value": "g.x12uy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 19:26:47",
            "last_seen_utc": "2025-09-30 19:32:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604861": [
        {
            "ioc_value": "pm7.zi-87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 19:05:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604857": [
        {
            "ioc_value": "c2.chuliusec1.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-30 18:48:55",
            "last_seen_utc": "2025-11-03 09:48:54",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604850": [
        {
            "ioc_value": "aa9.r99ae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 18:42:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604847": [
        {
            "ioc_value": "k4.zi-87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 18:38:41",
            "last_seen_utc": "2025-09-30 18:42:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604806": [
        {
            "ioc_value": "medellin2027.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-30 18:00:53",
            "last_seen_utc": "2025-10-03 09:02:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-srekfahr4t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604804": [
        {
            "ioc_value": "rjwz.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-30 18:00:48",
            "last_seen_utc": "2025-10-10 11:34:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-vxvjyscl2v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604805": [
        {
            "ioc_value": "fahad-airlink.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-30 18:00:48",
            "last_seen_utc": "2025-10-10 11:34:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-pb4ylsfm3s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604803": [
        {
            "ioc_value": "prakashjadhav74738.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-30 18:00:41",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-swhgwsyxht",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604801": [
        {
            "ioc_value": "xq0.r99ae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:45:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604800": [
        {
            "ioc_value": "y.zi-87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:39:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604797": [
        {
            "ioc_value": "wi.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:32:34",
            "last_seen_utc": "2025-09-30 17:30:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604798": [
        {
            "ioc_value": "k4.ri-04.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:30:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604784": [
        {
            "ioc_value": "xe.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:23:59",
            "last_seen_utc": "2025-09-30 16:26:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604790": [
        {
            "ioc_value": "xa.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:23:58",
            "last_seen_utc": "2025-09-30 17:02:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604793": [
        {
            "ioc_value": "wy.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:23:57",
            "last_seen_utc": "2025-09-30 17:08:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604795": [
        {
            "ioc_value": "wu.sxqy-9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:23:57",
            "last_seen_utc": "2025-09-30 17:20:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604796": [
        {
            "ioc_value": "z3.ri-04.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:20:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604794": [
        {
            "ioc_value": "qm9.ri-04.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:08:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604792": [
        {
            "ioc_value": "u1.ri-04.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:02:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604791": [
        {
            "ioc_value": "c5.r99ae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 17:01:30",
            "last_seen_utc": "2025-09-30 17:07:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604787": [
        {
            "ioc_value": "l.r99ae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 16:26:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604785": [
        {
            "ioc_value": "h.ri-04.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 16:23:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604782": [
        {
            "ioc_value": "furiolkariomastbe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-09-30 16:13:09",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604696": [
        {
            "ioc_value": "aw.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 14:49:21",
            "last_seen_utc": "2025-09-30 11:56:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604709": [
        {
            "ioc_value": "ax.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 14:49:19",
            "last_seen_utc": "2025-09-30 12:43:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604713": [
        {
            "ioc_value": "ay.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 14:49:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604714": [
        {
            "ioc_value": "ba.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 14:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604728": [
        {
            "ioc_value": "fp.realassetsrealtors.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-30 14:16:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1604729": [
        {
            "ioc_value": "fp.andreeacomansinger.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-30 14:16:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1604716": [
        {
            "ioc_value": "loveinl.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:52",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604717": [
        {
            "ioc_value": "flattwg.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:52",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604718": [
        {
            "ioc_value": "ascomyl.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:52",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604719": [
        {
            "ioc_value": "artteaq.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:52",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604720": [
        {
            "ioc_value": "appallf.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:52",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604721": [
        {
            "ioc_value": "parliah.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:52",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604722": [
        {
            "ioc_value": "bufospp.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:52",
            "last_seen_utc": "2025-10-12 09:55:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604723": [
        {
            "ioc_value": "rollupf.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:52",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604724": [
        {
            "ioc_value": "holdonz.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:52",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604715": [
        {
            "ioc_value": "milmgqn.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-30 14:04:51",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604711": [
        {
            "ioc_value": "zd.qe-10.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 12:43:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604710": [
        {
            "ioc_value": "r2.qe-10.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 12:11:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604703": [
        {
            "ioc_value": "noseasapo.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-30 12:00:57",
            "last_seen_utc": "2025-10-10 11:34:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-jez6yasvfx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604704": [
        {
            "ioc_value": "ysan40kdhs.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-30 12:00:57",
            "last_seen_utc": "2025-10-03 09:02:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-hwkxxassex",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604699": [
        {
            "ioc_value": "AkshayTiwari-63234.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-30 12:00:46",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-n4a1kawvex",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604700": [
        {
            "ioc_value": "krakas2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-30 12:00:46",
            "last_seen_utc": "2025-10-10 11:34:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-l4mcgsxmx6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604697": [
        {
            "ioc_value": "beg87mka.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-30 12:00:38",
            "last_seen_utc": "2025-10-03 09:02:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-hwkxxassex",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604695": [
        {
            "ioc_value": "wq9.qe-10.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:48:53",
            "last_seen_utc": "2025-09-30 11:56:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604694": [
        {
            "ioc_value": "h1.d03ui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:48:29",
            "last_seen_utc": "2025-09-30 11:56:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604693": [
        {
            "ioc_value": "at.khhu8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:48:28",
            "last_seen_utc": "2025-09-30 11:48:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604687": [
        {
            "ioc_value": "t1v.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:38:46",
            "last_seen_utc": "2025-09-30 11:28:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604690": [
        {
            "ioc_value": "z.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:38:46",
            "last_seen_utc": "2025-09-30 11:38:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604692": [
        {
            "ioc_value": "c7.qe-10.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:38:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604691": [
        {
            "ioc_value": "pz7.d03ui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:38:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604689": [
        {
            "ioc_value": "w4.d03ui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:28:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604688": [
        {
            "ioc_value": "n.qe-10.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:28:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604686": [
        {
            "ioc_value": "d.d03ui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:24:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604684": [
        {
            "ioc_value": "m2.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:24:27",
            "last_seen_utc": "2025-09-30 11:24:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604685": [
        {
            "ioc_value": "k9.wy-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:20:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604677": [
        {
            "ioc_value": "d4.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:10:09",
            "last_seen_utc": "2025-09-30 10:32:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604680": [
        {
            "ioc_value": "hx.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:10:08",
            "last_seen_utc": "2025-09-30 10:59:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604683": [
        {
            "ioc_value": "q.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:10:07",
            "last_seen_utc": "2025-09-30 11:05:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604632": [
        {
            "ioc_value": "hv.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:09:56",
            "last_seen_utc": "2025-09-30 09:49:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604635": [
        {
            "ioc_value": "p2n.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:09:46",
            "last_seen_utc": "2025-09-30 10:13:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604637": [
        {
            "ioc_value": "n.m1y8v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 11:09:46",
            "last_seen_utc": "2025-09-30 10:21:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604682": [
        {
            "ioc_value": "t1.n46uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 10:59:13",
            "last_seen_utc": "2025-09-30 11:05:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604681": [
        {
            "ioc_value": "m7.wy-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 10:59:00",
            "last_seen_utc": "2025-09-30 11:05:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604679": [
        {
            "ioc_value": "tq1.wy-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 10:32:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604678": [
        {
            "ioc_value": "qz9.n46uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 10:30:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604638": [
        {
            "ioc_value": "v2.n46uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 10:19:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604636": [
        {
            "ioc_value": "b2.wy-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 10:13:52",
            "last_seen_utc": "2025-09-30 10:21:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604634": [
        {
            "ioc_value": "x.wy-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:49:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604633": [
        {
            "ioc_value": "k.n46uu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:48:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604602": [
        {
            "ioc_value": "h7.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:32:37",
            "last_seen_utc": "2025-09-30 08:01:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604613": [
        {
            "ioc_value": "xq9.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:32:37",
            "last_seen_utc": "2025-09-30 08:16:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604615": [
        {
            "ioc_value": "b.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:32:37",
            "last_seen_utc": "2025-09-30 08:19:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604618": [
        {
            "ioc_value": "m8.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:32:36",
            "last_seen_utc": "2025-09-30 08:43:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604624": [
        {
            "ioc_value": "qs.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:32:36",
            "last_seen_utc": "2025-09-30 09:05:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604628": [
        {
            "ioc_value": "t1.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:32:35",
            "last_seen_utc": "2025-09-30 09:15:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604631": [
        {
            "ioc_value": "x9.j0a8n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:32:34",
            "last_seen_utc": "2025-09-30 09:22:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604630": [
        {
            "ioc_value": "n0.su-08.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:15:33",
            "last_seen_utc": "2025-09-30 09:20:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604629": [
        {
            "ioc_value": "um.svga3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:13:51",
            "last_seen_utc": "2025-09-30 09:22:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604626": [
        {
            "ioc_value": "uh.svga3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:05:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604625": [
        {
            "ioc_value": "e1.su-08.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 09:04:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604620": [
        {
            "ioc_value": "qk2.su-08.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 08:43:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604619": [
        {
            "ioc_value": "ow.svga3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 08:42:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604616": [
        {
            "ioc_value": "u5.su-08.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 08:17:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604614": [
        {
            "ioc_value": "qi.svga3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 08:16:13",
            "last_seen_utc": "2025-09-30 08:19:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604607": [
        {
            "ioc_value": "r.su-08.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 08:01:41",
            "last_seen_utc": "2025-09-30 08:05:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604603": [
        {
            "ioc_value": "za.svga3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 08:00:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604584": [
        {
            "ioc_value": "e.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:48:28",
            "last_seen_utc": "2025-09-30 07:09:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604587": [
        {
            "ioc_value": "n3.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:48:27",
            "last_seen_utc": "2025-09-30 07:13:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604588": [
        {
            "ioc_value": "zt.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:48:27",
            "last_seen_utc": "2025-09-30 07:24:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604593": [
        {
            "ioc_value": "a1.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:48:26",
            "last_seen_utc": "2025-09-30 07:34:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604597": [
        {
            "ioc_value": "pv.k6u7d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:48:25",
            "last_seen_utc": "2025-09-30 07:38:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604599": [
        {
            "ioc_value": "yo.grjy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:38:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604596": [
        {
            "ioc_value": "ye.grjy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604594": [
        {
            "ioc_value": "r3.he-22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:29:55",
            "last_seen_utc": "2025-09-30 07:36:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604590": [
        {
            "ioc_value": "k7.he-22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:24:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604589": [
        {
            "ioc_value": "ti.grjy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:24:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604586": [
        {
            "ioc_value": "ta.grjy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:09:14",
            "last_seen_utc": "2025-09-30 07:13:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604585": [
        {
            "ioc_value": "aa9.he-22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 07:08:43",
            "last_seen_utc": "2025-09-30 07:13:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604581": [
        {
            "ioc_value": "v2n.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:56:25",
            "last_seen_utc": "2025-09-30 06:49:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604583": [
        {
            "ioc_value": "v2.he-22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604582": [
        {
            "ioc_value": "re.grjy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:48:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604576": [
        {
            "ioc_value": "x.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:43:53",
            "last_seen_utc": "2025-09-30 06:33:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604579": [
        {
            "ioc_value": "tn.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:43:52",
            "last_seen_utc": "2025-09-30 06:37:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604580": [
        {
            "ioc_value": "g.he-22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:37:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604578": [
        {
            "ioc_value": "m2.mu-16.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:33:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604577": [
        {
            "ioc_value": "pi.vhhe9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:28:12",
            "last_seen_utc": "2025-09-30 06:35:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604558": [
        {
            "ioc_value": "m9.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:14:01",
            "last_seen_utc": "2025-09-30 05:57:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604561": [
        {
            "ioc_value": "qz.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:14:00",
            "last_seen_utc": "2025-09-30 06:02:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604563": [
        {
            "ioc_value": "r1.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:13:59",
            "last_seen_utc": "2025-09-30 06:11:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604570": [
        {
            "ioc_value": "rt.andreeacomansinger.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-30 06:13:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1604571": [
        {
            "ioc_value": "xt.americanmusclecars.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-30 06:13:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1604572": [
        {
            "ioc_value": "rt.realassetsrealtors.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-30 06:13:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1604573": [
        {
            "ioc_value": "xt.liberatorpremiercompany.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-30 06:13:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1604565": [
        {
            "ioc_value": "pa.vhhe9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:11:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604564": [
        {
            "ioc_value": "aa9.mu-16.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 06:10:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604562": [
        {
            "ioc_value": "electric-deficit.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-30 06:00:42",
            "last_seen_utc": "2025-10-03 09:02:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250930-aa52yszjs4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604560": [
        {
            "ioc_value": "ma.vhhe9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 05:57:53",
            "last_seen_utc": "2025-09-30 06:02:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604559": [
        {
            "ioc_value": "xq0.mu-16.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 05:57:17",
            "last_seen_utc": "2025-09-30 06:01:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604557": [
        {
            "ioc_value": "microservisetrue.vip",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-30 05:55:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604556": [
        {
            "ioc_value": "pickleblade.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-30 05:54:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604227": [
        {
            "ioc_value": "aster-dex.finance",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-30 05:42:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "Antosha"
        }
    ],
    "1604550": [
        {
            "ioc_value": "a.x3u0s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 05:42:08",
            "last_seen_utc": "2025-09-30 05:39:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604553": [
        {
            "ioc_value": "behaviorcloth.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-30 05:40:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604554": [
        {
            "ioc_value": "fusilierfavourable.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-30 05:40:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604555": [
        {
            "ioc_value": "suitmemory.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-30 05:40:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604552": [
        {
            "ioc_value": "lo.vhhe9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 05:39:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604551": [
        {
            "ioc_value": "c5.mu-16.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 05:38:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604470": [
        {
            "ioc_value": "partycybertrap.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-30 05:30:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OysterLoader",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1604210": [
        {
            "ioc_value": "xn--pera-c7a.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-30 05:28:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "Antosha"
        }
    ],
    "1604074": [
        {
            "ioc_value": "op.tfpe-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 05:28:08",
            "last_seen_utc": "2025-09-29 18:43:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604549": [
        {
            "ioc_value": "ye.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 04:47:29",
            "last_seen_utc": "2025-09-30 04:51:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604548": [
        {
            "ioc_value": "id.vhhe9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 04:47:01",
            "last_seen_utc": "2025-09-30 04:51:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604547": [
        {
            "ioc_value": "l.mu-16.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 04:42:52",
            "last_seen_utc": "2025-09-30 04:50:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604546": [
        {
            "ioc_value": "ya.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 04:41:15",
            "last_seen_utc": "2025-09-30 04:47:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604545": [
        {
            "ioc_value": "ho.jdho3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 04:22:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604544": [
        {
            "ioc_value": "aa.fa-99.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 04:21:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604543": [
        {
            "ioc_value": "xu.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 04:21:18",
            "last_seen_utc": "2025-09-30 04:22:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604522": [
        {
            "ioc_value": "h1.fa-99.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 03:47:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604521": [
        {
            "ioc_value": "xi.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 03:45:53",
            "last_seen_utc": "2025-09-30 03:47:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604520": [
        {
            "ioc_value": "pz8.fa-99.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 03:36:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604519": [
        {
            "ioc_value": "ha.jdho3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 03:35:32",
            "last_seen_utc": "2025-09-30 03:47:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604518": [
        {
            "ioc_value": "wo.txso-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 03:35:05",
            "last_seen_utc": "2025-09-30 03:36:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604513": [
        {
            "ioc_value": "ex.jdho3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 02:21:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604512": [
        {
            "ioc_value": "w4.fa-99.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 02:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604511": [
        {
            "ioc_value": "we.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 02:20:57",
            "last_seen_utc": "2025-09-30 02:21:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604508": [
        {
            "ioc_value": "er.jdho3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 00:40:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604507": [
        {
            "ioc_value": "d.fa-99.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 00:40:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604506": [
        {
            "ioc_value": "ut.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 00:40:00",
            "last_seen_utc": "2025-09-30 00:40:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604504": [
        {
            "ioc_value": "us.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 00:22:22",
            "last_seen_utc": "2025-09-30 00:25:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604503": [
        {
            "ioc_value": "hm.jo-59.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 00:20:53",
            "last_seen_utc": "2025-09-30 00:25:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604502": [
        {
            "ioc_value": "eh.jdho3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 00:20:13",
            "last_seen_utc": "2025-09-30 00:23:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604501": [
        {
            "ioc_value": "ur.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-30 00:18:36",
            "last_seen_utc": "2025-09-30 00:20:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604490": [
        {
            "ioc_value": "t1.jo-59.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 23:59:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604489": [
        {
            "ioc_value": "up.xrly-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 23:58:28",
            "last_seen_utc": "2025-09-29 23:59:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604488": [
        {
            "ioc_value": "ah.qjxo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 23:54:50",
            "last_seen_utc": "2025-09-29 23:59:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604486": [
        {
            "ioc_value": "qz9.jo-59.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 23:49:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604485": [
        {
            "ioc_value": "un.xvqy-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 23:48:13",
            "last_seen_utc": "2025-09-29 23:54:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604484": [
        {
            "ioc_value": "v2.jo-59.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 23:24:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604483": [
        {
            "ioc_value": "um.xvqy-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 23:15:57",
            "last_seen_utc": "2025-09-29 23:24:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604482": [
        {
            "ioc_value": "k.jo-59.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 22:54:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604480": [
        {
            "ioc_value": "uh.xvqy-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 22:35:26",
            "last_seen_utc": "2025-09-29 22:54:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604478": [
        {
            "ioc_value": "t1.w-70a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 22:10:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604477": [
        {
            "ioc_value": "ti.xvqy-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 22:09:07",
            "last_seen_utc": "2025-09-29 22:20:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604476": [
        {
            "ioc_value": "qz9.w-70a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 22:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604475": [
        {
            "ioc_value": "ta.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 21:58:20",
            "last_seen_utc": "2025-09-29 22:00:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604474": [
        {
            "ioc_value": "so.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 21:44:58",
            "last_seen_utc": "2025-09-29 21:46:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604473": [
        {
            "ioc_value": "v2.w-70a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 21:36:27",
            "last_seen_utc": "2025-09-29 21:46:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604472": [
        {
            "ioc_value": "si.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 21:35:36",
            "last_seen_utc": "2025-09-29 21:36:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604471": [
        {
            "ioc_value": "sh.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 21:33:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604469": [
        {
            "ioc_value": "k.w-70a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 21:13:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604468": [
        {
            "ioc_value": "re.wzhy-1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 21:02:17",
            "last_seen_utc": "2025-09-29 21:13:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604467": [
        {
            "ioc_value": "g4.v-03e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 20:59:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604466": [
        {
            "ioc_value": "qi.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 20:57:28",
            "last_seen_utc": "2025-09-29 20:59:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604465": [
        {
            "ioc_value": "pm7.v-03e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 20:45:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604464": [
        {
            "ioc_value": "pi.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 20:37:59",
            "last_seen_utc": "2025-09-29 20:45:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604458": [
        {
            "ioc_value": "k4.v-03e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 20:27:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604457": [
        {
            "ioc_value": "pe.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 20:25:22",
            "last_seen_utc": "2025-09-29 20:27:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604278": [
        {
            "ioc_value": "y.v-03e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 20:12:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604277": [
        {
            "ioc_value": "pa.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 20:08:32",
            "last_seen_utc": "2025-09-29 20:12:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604259": [
        {
            "ioc_value": "oy.tsqe-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 19:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604258": [
        {
            "ioc_value": "ox.tfpe-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 19:48:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604246": [
        {
            "ioc_value": "ow.tfpe-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 19:24:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604235": [
        {
            "ioc_value": "z3.h-35i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 19:12:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604234": [
        {
            "ioc_value": "os.tfpe-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 19:11:05",
            "last_seen_utc": "2025-09-29 19:12:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604228": [
        {
            "ioc_value": "qm9.h-35i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 18:43:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604208": [
        {
            "ioc_value": "www.ygeug.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604209": [
        {
            "ioc_value": "www.ylvac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604179": [
        {
            "ioc_value": "www.l123456.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604180": [
        {
            "ioc_value": "www.mileofangkor.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604181": [
        {
            "ioc_value": "www.mrka.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604182": [
        {
            "ioc_value": "www.nchainwallet.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604183": [
        {
            "ioc_value": "www.nihype.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604184": [
        {
            "ioc_value": "www.nline-dating-12815.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604185": [
        {
            "ioc_value": "www.oachspothq.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604186": [
        {
            "ioc_value": "www.obingo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604187": [
        {
            "ioc_value": "www.ometownfoodz.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604188": [
        {
            "ioc_value": "www.orrentwhy176.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604189": [
        {
            "ioc_value": "www.ostbet6286.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604190": [
        {
            "ioc_value": "www.ostkarma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604191": [
        {
            "ioc_value": "www.oxsensor.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604192": [
        {
            "ioc_value": "www.oycasino-occ.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604193": [
        {
            "ioc_value": "www.ozoba.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604194": [
        {
            "ioc_value": "www.pyurd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604195": [
        {
            "ioc_value": "www.q1.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604196": [
        {
            "ioc_value": "www.ryopseratetech.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604197": [
        {
            "ioc_value": "www.rysimpsonjudgerecruitershub.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604198": [
        {
            "ioc_value": "www.sdh9.motorcycles",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604199": [
        {
            "ioc_value": "www.spstudio.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604200": [
        {
            "ioc_value": "www.ssabc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604201": [
        {
            "ioc_value": "www.sy639.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604202": [
        {
            "ioc_value": "www.tebarit.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604203": [
        {
            "ioc_value": "www.thnf6.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604204": [
        {
            "ioc_value": "www.unnae.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604205": [
        {
            "ioc_value": "www.usiccitytrapeze.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604206": [
        {
            "ioc_value": "www.ww58.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604207": [
        {
            "ioc_value": "www.x6ssv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604147": [
        {
            "ioc_value": "www.56cha.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604148": [
        {
            "ioc_value": "www.868com619.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604149": [
        {
            "ioc_value": "www.8lj-demandacivel.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604150": [
        {
            "ioc_value": "www.94mbw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604151": [
        {
            "ioc_value": "www.aosequ.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604152": [
        {
            "ioc_value": "www.arcostecnologi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604153": [
        {
            "ioc_value": "www.attaclothing.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604154": [
        {
            "ioc_value": "www.awangmburibiru.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604155": [
        {
            "ioc_value": "www.bercaja-es.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604156": [
        {
            "ioc_value": "www.bzxc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604157": [
        {
            "ioc_value": "www.cwlkj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604158": [
        {
            "ioc_value": "www.dawsswsh.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604159": [
        {
            "ioc_value": "www.dkhb.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604160": [
        {
            "ioc_value": "www.elay-express.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604161": [
        {
            "ioc_value": "www.elegwpxs.motorcycles",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604162": [
        {
            "ioc_value": "www.elloepiccleantec.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604163": [
        {
            "ioc_value": "www.eminai.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604164": [
        {
            "ioc_value": "www.entientsolutions.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604165": [
        {
            "ioc_value": "www.erpono.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604166": [
        {
            "ioc_value": "www.espachantejs.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604167": [
        {
            "ioc_value": "www.ez24.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604168": [
        {
            "ioc_value": "www.ffshoreexecscrew.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604169": [
        {
            "ioc_value": "www.haltontwenty.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604170": [
        {
            "ioc_value": "www.holesaleliquidationdeals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604171": [
        {
            "ioc_value": "www.idspvlayto.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604172": [
        {
            "ioc_value": "www.iftnovausa.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604173": [
        {
            "ioc_value": "www.iktokbet.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604174": [
        {
            "ioc_value": "www.irehireanywhere.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604175": [
        {
            "ioc_value": "www.isou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604176": [
        {
            "ioc_value": "www.itchxtwister.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604177": [
        {
            "ioc_value": "www.ixiam.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604178": [
        {
            "ioc_value": "www.k-corp.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604146": [
        {
            "ioc_value": "www.380x.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-29 18:25:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1604075": [
        {
            "ioc_value": "u1.h-35i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 18:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604073": [
        {
            "ioc_value": "anonymous5552.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-29 18:01:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-wjd6gstnz5",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604071": [
        {
            "ioc_value": "wonderfulstartwithneewseriousworkgreatan.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-29 18:00:49",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-tyaqhaspz9",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604072": [
        {
            "ioc_value": "mybestangelgirlinsideofmyheartwithlovebe.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-29 18:00:49",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-txx5eay1c1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604069": [
        {
            "ioc_value": "significant-olympus.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-29 18:00:40",
            "last_seen_utc": "2025-10-03 09:02:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-wgez1azzh1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604070": [
        {
            "ioc_value": "canadian-determines.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-29 18:00:40",
            "last_seen_utc": "2025-10-03 09:02:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-vaycbssrw2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604068": [
        {
            "ioc_value": "h.h-35i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:52:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604067": [
        {
            "ioc_value": "om.xrxo-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:50:16",
            "last_seen_utc": "2025-09-29 17:44:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604055": [
        {
            "ioc_value": "od.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:39:55",
            "last_seen_utc": "2025-09-29 16:43:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604057": [
        {
            "ioc_value": "oe.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:39:53",
            "last_seen_utc": "2025-09-29 16:52:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604061": [
        {
            "ioc_value": "of.xrxo-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:39:52",
            "last_seen_utc": "2025-09-29 17:07:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604062": [
        {
            "ioc_value": "oh.xrxo-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:39:52",
            "last_seen_utc": "2025-09-29 17:17:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604065": [
        {
            "ioc_value": "oi.xrxo-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:39:51",
            "last_seen_utc": "2025-09-29 17:52:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604066": [
        {
            "ioc_value": "r2.l-64a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:39:02",
            "last_seen_utc": "2025-09-29 17:44:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604064": [
        {
            "ioc_value": "we.qjxo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:17:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604063": [
        {
            "ioc_value": "wq9.l-64a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 17:16:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604059": [
        {
            "ioc_value": "us.qjxo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 16:52:15",
            "last_seen_utc": "2025-09-29 17:03:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604058": [
        {
            "ioc_value": "c7.l-64a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 16:50:26",
            "last_seen_utc": "2025-09-29 17:07:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604054": [
        {
            "ioc_value": "n.l-64a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 16:38:02",
            "last_seen_utc": "2025-09-29 16:43:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604053": [
        {
            "ioc_value": "jobdescriptionboohoo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-29 16:32:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/277a8c26a259cc0c6c0669c0f93d882ed55111c1bbff6329bffa2927c95162d9/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604052": [
        {
            "ioc_value": "esdrt1bao8a.cdiohsihfshfushf.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-29 16:31:59",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/c5a2ebd55fbf5dd0a1203f347d40d917cc45fd2b5e1569a21db0505b999b2890/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604051": [
        {
            "ioc_value": "loa10.espremedorlolita.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-29 16:31:32",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/4a31076f31a1e51fa52e8d4ee9e8c502646788cc03e4cc3c4fdc0fce568779eb/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604050": [
        {
            "ioc_value": "sbufiles.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-29 16:31:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f7d46c07ea06e9b2def9a048c58d8f2608842d055f69515755e7fb5e5d9fdeab/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604049": [
        {
            "ioc_value": "paste.c-net.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-29 16:31:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f7d46c07ea06e9b2def9a048c58d8f2608842d055f69515755e7fb5e5d9fdeab/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604048": [
        {
            "ioc_value": "expansiveuser.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-29 16:28:34",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/a395c3d88f4c72fa292b03df2693ea937cf370b24d84dd13143066eb24a0eb92/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1604045": [
        {
            "ioc_value": "nu.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 16:20:39",
            "last_seen_utc": "2025-09-29 16:38:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604031": [
        {
            "ioc_value": "ib.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 16:12:49",
            "last_seen_utc": "2025-09-29 15:53:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604040": [
        {
            "ioc_value": "ne.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 16:12:48",
            "last_seen_utc": "2025-09-29 16:07:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604042": [
        {
            "ioc_value": "no.xrhu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 16:12:46",
            "last_seen_utc": "2025-09-29 16:13:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604041": [
        {
            "ioc_value": "m7.r-54u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 16:07:06",
            "last_seen_utc": "2025-09-29 16:10:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604024": [
        {
            "ioc_value": "eq.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:49:25",
            "last_seen_utc": "2025-09-29 15:24:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604028": [
        {
            "ioc_value": "ev.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:49:24",
            "last_seen_utc": "2025-09-29 15:46:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604030": [
        {
            "ioc_value": "ez.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:49:24",
            "last_seen_utc": "2025-09-29 15:50:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604029": [
        {
            "ioc_value": "tq1.r-54u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:46:18",
            "last_seen_utc": "2025-09-29 15:53:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604025": [
        {
            "ioc_value": "b2.r-54u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:23:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604011": [
        {
            "ioc_value": "o.hwke4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:20:24",
            "last_seen_utc": "2025-09-29 14:27:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604012": [
        {
            "ioc_value": "aa.hwke4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:20:23",
            "last_seen_utc": "2025-09-29 14:40:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604017": [
        {
            "ioc_value": "ab.hwke4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:20:23",
            "last_seen_utc": "2025-09-29 15:01:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604023": [
        {
            "ioc_value": "ep.sqfe-6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604019": [
        {
            "ioc_value": "so.tgsi9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 15:01:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604018": [
        {
            "ioc_value": "x.r-54u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 14:59:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604016": [
        {
            "ioc_value": "asxiofnsiovsiocx.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-29 14:50:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.vmray.com/analyses/_vt/2771e4bb8df2/report/ioc.html",
            "tags": "c2,domain,Rhadamanthys,stealer,vmray",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604014": [
        {
            "ioc_value": "ox.tgsi9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 14:40:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604013": [
        {
            "ioc_value": "e1.m-57i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 14:39:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604010": [
        {
            "ioc_value": "or.tgsi9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 14:17:57",
            "last_seen_utc": "2025-09-29 16:40:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604007": [
        {
            "ioc_value": "he.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 14:13:57",
            "last_seen_utc": "2025-09-29 14:12:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604009": [
        {
            "ioc_value": "a.hwke4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 14:13:57",
            "last_seen_utc": "2025-09-29 14:22:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604008": [
        {
            "ioc_value": "qk2.m-57i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 14:12:21",
            "last_seen_utc": "2025-09-29 14:27:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604002": [
        {
            "ioc_value": "ha.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 14:08:46",
            "last_seen_utc": "2025-09-29 13:55:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1604005": [
        {
            "ioc_value": "u5.m-57i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 13:55:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1604003": [
        {
            "ioc_value": "spawnstars1.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-29 13:49:35",
            "last_seen_utc": "2025-10-24 07:39:30",
            "confidence_level": 100,
            "reference": "https://www.vmray.com/analyses/_vt/3a400df7b07c/report/ioc.html",
            "tags": "c2,domain,Rhadamanthys,stealer,vmray",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1604000": [
        {
            "ioc_value": "go.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 13:35:39",
            "last_seen_utc": "2025-09-29 13:38:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603995": [
        {
            "ioc_value": "ex.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 13:32:54",
            "last_seen_utc": "2025-09-29 13:21:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603999": [
        {
            "ioc_value": "fa.xrly8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 13:32:51",
            "last_seen_utc": "2025-09-29 13:32:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603998": [
        {
            "ioc_value": "con1.jiqubey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 13:26:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603996": [
        {
            "ioc_value": "r.m-57i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 13:20:35",
            "last_seen_utc": "2025-09-29 13:37:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603992": [
        {
            "ioc_value": "et.xrhu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 13:02:00",
            "last_seen_utc": "2025-09-29 12:59:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603993": [
        {
            "ioc_value": "k7.z-48y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 12:59:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603990": [
        {
            "ioc_value": "avenyamu.myaddr.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-29 12:49:21",
            "last_seen_utc": "2025-10-30 13:50:46",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1603902": [
        {
            "ioc_value": "eh.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 12:45:06",
            "last_seen_utc": "2025-09-29 08:05:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603910": [
        {
            "ioc_value": "el.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 12:45:05",
            "last_seen_utc": "2025-09-29 08:21:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603912": [
        {
            "ioc_value": "em.xrhu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 12:45:05",
            "last_seen_utc": "2025-09-29 08:51:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603935": [
        {
            "ioc_value": "er.xrhu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 12:45:03",
            "last_seen_utc": "2025-09-29 10:31:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603937": [
        {
            "ioc_value": "es.xrhu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 12:45:03",
            "last_seen_utc": "2025-09-29 10:44:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603962": [
        {
            "ioc_value": "elevatormagnet.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-29 12:00:40",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-jv3xrsytbx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603963": [
        {
            "ioc_value": "genesisloperalora09.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-29 12:00:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-hx7s3agn3t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603964": [
        {
            "ioc_value": "wllgore.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-29 12:00:40",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-hwq4xsgm61",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603960": [
        {
            "ioc_value": "during-substantial.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-29 12:00:33",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-lq19gsal2z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603961": [
        {
            "ioc_value": "blksssd.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-29 12:00:33",
            "last_seen_utc": "2025-10-03 09:02:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-hpwqtsxtht",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603938": [
        {
            "ioc_value": "aa9.z-48y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 10:44:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603936": [
        {
            "ioc_value": "v2.z-48y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 10:30:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603918": [
        {
            "ioc_value": "g.z-48y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 08:48:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603911": [
        {
            "ioc_value": "aa9.d-61o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 08:20:21",
            "last_seen_utc": "2025-09-29 08:33:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603906": [
        {
            "ioc_value": "xq0.d-61o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 08:05:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603900": [
        {
            "ioc_value": "ef.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:31:30",
            "last_seen_utc": "2025-09-29 07:33:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603901": [
        {
            "ioc_value": "c5.d-61o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:29:48",
            "last_seen_utc": "2025-09-29 07:33:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603872": [
        {
            "ioc_value": "do.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:23:40",
            "last_seen_utc": "2025-09-29 07:13:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603898": [
        {
            "ioc_value": "ed.wzhy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:23:39",
            "last_seen_utc": "2025-09-29 07:29:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603886": [
        {
            "ioc_value": "ff.liberatorpremiercompany.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603887": [
        {
            "ioc_value": "xp.liberatorpremiercompany.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603888": [
        {
            "ioc_value": "ez.liberatorpremiercompany.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603889": [
        {
            "ioc_value": "df.liberatorpremiercompany.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": "2025-09-30 05:55:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603890": [
        {
            "ioc_value": "xs.liberatorpremiercompany.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603891": [
        {
            "ioc_value": "pi.liberatorpremiercompany.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603892": [
        {
            "ioc_value": "ff.americanmusclecars.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603893": [
        {
            "ioc_value": "xp.americanmusclecars.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603894": [
        {
            "ioc_value": "ez.americanmusclecars.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603895": [
        {
            "ioc_value": "df.americanmusclecars.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603896": [
        {
            "ioc_value": "xs.alexandraparasca.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603897": [
        {
            "ioc_value": "pi.alexandraparasca.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-29 07:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1603873": [
        {
            "ioc_value": "l.d-61o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:09:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603263": [
        {
            "ioc_value": "r3.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:04:07",
            "last_seen_utc": "2025-09-28 15:46:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603871": [
        {
            "ioc_value": "da.vwjy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:04:04",
            "last_seen_utc": "2025-09-29 07:00:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603830": [
        {
            "ioc_value": "ay.txso1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:04:03",
            "last_seen_utc": "2025-09-29 05:14:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603832": [
        {
            "ioc_value": "ba.txso1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:04:02",
            "last_seen_utc": "2025-09-29 04:44:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603836": [
        {
            "ioc_value": "bi.vwjy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:04:01",
            "last_seen_utc": "2025-09-29 07:06:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603837": [
        {
            "ioc_value": "bo.vwjy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:04:01",
            "last_seen_utc": "2025-09-29 05:31:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603718": [
        {
            "ioc_value": "al.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:58",
            "last_seen_utc": "2025-09-29 00:37:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603719": [
        {
            "ioc_value": "am.tvti0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:57",
            "last_seen_utc": "2025-09-29 03:07:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603807": [
        {
            "ioc_value": "aw.txso1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:57",
            "last_seen_utc": "2025-09-29 03:27:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603723": [
        {
            "ioc_value": "ar.tvti0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603810": [
        {
            "ioc_value": "cyber-hawk.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-29 07:03:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "solostalking"
        }
    ],
    "1603809": [
        {
            "ioc_value": "ax.txso1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:54",
            "last_seen_utc": "2025-09-29 03:31:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603716": [
        {
            "ioc_value": "ai.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:53",
            "last_seen_utc": "2025-09-29 00:30:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603714": [
        {
            "ioc_value": "ah.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:52",
            "last_seen_utc": "2025-09-29 00:19:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603701": [
        {
            "ioc_value": "ae.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:51",
            "last_seen_utc": "2025-09-28 22:13:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603703": [
        {
            "ioc_value": "ag.tsqe2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:51",
            "last_seen_utc": "2025-09-28 22:37:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603697": [
        {
            "ioc_value": "ab.tfpe6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:50",
            "last_seen_utc": "2025-09-28 21:03:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603699": [
        {
            "ioc_value": "ad.tfpe6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603658": [
        {
            "ioc_value": "aa.tfpe6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:37",
            "last_seen_utc": "2025-09-28 18:34:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603641": [
        {
            "ioc_value": "cm.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:36",
            "last_seen_utc": "2025-09-28 17:29:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603643": [
        {
            "ioc_value": "a.tfpe6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:36",
            "last_seen_utc": "2025-09-28 18:16:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603636": [
        {
            "ioc_value": "u.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:35",
            "last_seen_utc": "2025-09-28 16:24:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603639": [
        {
            "ioc_value": "y7.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 07:03:35",
            "last_seen_utc": "2025-09-28 16:59:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603631": [
        {
            "ioc_value": "pancakewap.co.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-29 07:03:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "Pamparam"
        }
    ],
    "1603870": [
        {
            "ioc_value": "h1.w-57e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 06:53:39",
            "last_seen_utc": "2025-09-29 07:04:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603841": [
        {
            "ioc_value": "sigmaratohio-52009.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-29 06:00:34",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-b3nttacl9y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603842": [
        {
            "ioc_value": "hawifo-43198.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-29 06:00:34",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250929-btw4ts11ex",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603838": [
        {
            "ioc_value": "pz8.w-57e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 05:31:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603834": [
        {
            "ioc_value": "w4.w-57e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 04:44:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603831": [
        {
            "ioc_value": "d.w-57e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 04:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603811": [
        {
            "ioc_value": "www.micoestan.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-29 04:00:06",
            "last_seen_utc": "2025-10-07 04:00:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.71.22+www.micoestan.es",
            "tags": "AS401120,C2,censys,CHEAPY-HOST",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1603808": [
        {
            "ioc_value": "t1.t-20y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 03:27:46",
            "last_seen_utc": "2025-09-29 03:31:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603806": [
        {
            "ioc_value": "qz9.t-20y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 03:07:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603805": [
        {
            "ioc_value": "v2.t-20y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 02:11:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603721": [
        {
            "ioc_value": "k.t-20y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 01:47:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603720": [
        {
            "ioc_value": "t1.e-35w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 00:57:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603717": [
        {
            "ioc_value": "qz9.e-35w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 00:30:04",
            "last_seen_utc": "2025-09-29 00:33:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603715": [
        {
            "ioc_value": "v2.e-35w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-29 00:19:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603704": [
        {
            "ioc_value": "k.e-35w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 22:37:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603702": [
        {
            "ioc_value": "g4.e-09q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 22:13:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603698": [
        {
            "ioc_value": "pm7.e-09q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 21:03:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603682": [
        {
            "ioc_value": "neurold.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603683": [
        {
            "ioc_value": "smiliil.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603684": [
        {
            "ioc_value": "quicksp.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603685": [
        {
            "ioc_value": "cotswmr.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603686": [
        {
            "ioc_value": "punctmc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603687": [
        {
            "ioc_value": "schwakf.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603688": [
        {
            "ioc_value": "politoe.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603689": [
        {
            "ioc_value": "enterki.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603690": [
        {
            "ioc_value": "concudv.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603691": [
        {
            "ioc_value": "dabblmk.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603692": [
        {
            "ioc_value": "maniaqr.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-09-30 14:04:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603693": [
        {
            "ioc_value": "scallok.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603694": [
        {
            "ioc_value": "jocosoj.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-28 20:30:14",
            "last_seen_utc": "2025-10-09 08:45:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603659": [
        {
            "ioc_value": "k4.e-09q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 18:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603657": [
        {
            "ioc_value": "y.e-09q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 18:16:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603651": [
        {
            "ioc_value": "imeddtak.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-28 18:02:38",
            "last_seen_utc": "2025-10-03 09:02:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-vh8s2acl2x",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603652": [
        {
            "ioc_value": "amierdz.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-28 18:02:38",
            "last_seen_utc": "2025-10-03 09:02:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-s2b73aap91",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603648": [
        {
            "ioc_value": "batata123.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-28 18:01:44",
            "last_seen_utc": "2025-10-03 09:02:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-t2cdha1wh1",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603650": [
        {
            "ioc_value": "survey-treasurer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-28 18:01:44",
            "last_seen_utc": "2025-10-03 09:02:26",
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-p6a9safp9y",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603645": [
        {
            "ioc_value": "minimum-integrate.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-28 18:00:30",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-t33l3s1xfx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603646": [
        {
            "ioc_value": "availability-permalink.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-28 18:00:30",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-pdm3wafj81",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603644": [
        {
            "ioc_value": "z3.e-91m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 17:43:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603642": [
        {
            "ioc_value": "qm9.e-91m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 17:29:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603640": [
        {
            "ioc_value": "u1.e-91m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 16:59:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603637": [
        {
            "ioc_value": "h.e-91m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 16:24:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603264": [
        {
            "ioc_value": "r2.a-91n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 15:46:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603262": [
        {
            "ioc_value": "ve.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 15:37:55",
            "last_seen_utc": "2025-09-28 15:28:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603259": [
        {
            "ioc_value": "c1m.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 15:17:35",
            "last_seen_utc": "2025-09-28 14:29:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603260": [
        {
            "ioc_value": "p.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 15:17:35",
            "last_seen_utc": "2025-09-28 14:37:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603261": [
        {
            "ioc_value": "k8.bvqu-7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 15:17:34",
            "last_seen_utc": "2025-09-28 15:16:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603258": [
        {
            "ioc_value": "wz.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 14:18:03",
            "last_seen_utc": "2025-09-28 14:17:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603256": [
        {
            "ioc_value": "q.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 14:18:00",
            "last_seen_utc": "2025-09-28 13:58:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603257": [
        {
            "ioc_value": "h2.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 14:17:59",
            "last_seen_utc": "2025-09-28 14:07:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603253": [
        {
            "ioc_value": "n4.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 13:45:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603251": [
        {
            "ioc_value": "b.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 13:45:41",
            "last_seen_utc": "2025-09-28 13:08:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603254": [
        {
            "ioc_value": "xt.bpva-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 13:45:40",
            "last_seen_utc": "2025-09-28 13:45:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603255": [
        {
            "ioc_value": "wq9.a-91n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 13:45:17",
            "last_seen_utc": "2025-09-28 15:16:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603252": [
        {
            "ioc_value": "c7.a-91n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 13:08:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603215": [
        {
            "ioc_value": "x9.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 12:51:11",
            "last_seen_utc": "2025-09-28 12:02:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603238": [
        {
            "ioc_value": "hv.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 12:51:10",
            "last_seen_utc": "2025-09-28 12:13:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603240": [
        {
            "ioc_value": "c2n.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 12:51:10",
            "last_seen_utc": "2025-09-28 12:27:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603244": [
        {
            "ioc_value": "api.xn--coudflare-0sb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-28 12:48:53",
            "last_seen_utc": "2025-10-29 17:49:50",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1603241": [
        {
            "ioc_value": "n.a-91n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 12:27:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603239": [
        {
            "ioc_value": "m7.o-61x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 12:09:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603231": [
        {
            "ioc_value": "yvfei.253274554324.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-28 12:02:57",
            "last_seen_utc": "2025-10-10 11:35:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-l8p9yasvdt",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603229": [
        {
            "ioc_value": "frp-arm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-28 12:02:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-l96y3sdj6s",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603230": [
        {
            "ioc_value": "qq.yvfei7770.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-28 12:02:56",
            "last_seen_utc": "2025-10-10 11:35:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-l8p9yasvdt",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603220": [
        {
            "ioc_value": "skin-tenant.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-28 12:00:31",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250928-mtpkjadn31",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603214": [
        {
            "ioc_value": "t.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:55:43",
            "last_seen_utc": "2025-09-28 11:53:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603208": [
        {
            "ioc_value": "a.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:51:08",
            "last_seen_utc": "2025-09-28 11:11:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603212": [
        {
            "ioc_value": "pz.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:51:08",
            "last_seen_utc": "2025-09-28 11:48:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603210": [
        {
            "ioc_value": "m7.hlgy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:51:07",
            "last_seen_utc": "2025-09-28 11:30:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603213": [
        {
            "ioc_value": "tq1.o-61x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:48:33",
            "last_seen_utc": "2025-09-28 11:51:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603211": [
        {
            "ioc_value": "b2.o-61x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:30:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603209": [
        {
            "ioc_value": "x.o-61x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:11:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603199": [
        {
            "ioc_value": "pn.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:04:53",
            "last_seen_utc": "2025-09-28 09:18:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603205": [
        {
            "ioc_value": "z9m.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:04:53",
            "last_seen_utc": "2025-09-28 10:56:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603201": [
        {
            "ioc_value": "x.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:04:52",
            "last_seen_utc": "2025-09-28 10:13:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603203": [
        {
            "ioc_value": "m2.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:04:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603204": [
        {
            "ioc_value": "qb.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 11:04:51",
            "last_seen_utc": "2025-09-28 10:25:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603206": [
        {
            "ioc_value": "e1.a-67x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 10:50:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603202": [
        {
            "ioc_value": "qk2.a-67x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 10:13:27",
            "last_seen_utc": "2025-09-28 10:25:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603200": [
        {
            "ioc_value": "u5.a-67x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 09:18:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603197": [
        {
            "ioc_value": "h3.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 09:09:09",
            "last_seen_utc": "2025-09-28 09:08:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603198": [
        {
            "ioc_value": "r.a-67x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 09:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603196": [
        {
            "ioc_value": "c.loyaltyservices.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-28 09:05:02",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1603177": [
        {
            "ioc_value": "m2.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 08:59:35",
            "last_seen_utc": "2025-09-28 06:49:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603178": [
        {
            "ioc_value": "t1v.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 08:59:35",
            "last_seen_utc": "2025-09-28 07:28:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603183": [
        {
            "ioc_value": "s.gzva1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 08:59:34",
            "last_seen_utc": "2025-09-28 08:01:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603181": [
        {
            "ioc_value": "z.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 08:59:33",
            "last_seen_utc": "2025-09-28 07:54:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603193": [
        {
            "ioc_value": "ai.lendermac.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-09-28 08:01:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/69.167.182.119+ai.lendermac.com",
            "tags": "AS32244,C2,censys,Ermac,LIQUIDWEB,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1603182": [
        {
            "ioc_value": "k7.a-91p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 07:54:10",
            "last_seen_utc": "2025-09-28 08:01:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603179": [
        {
            "ioc_value": "aa9.a-91p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 07:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602879": [
        {
            "ioc_value": "animefastflux.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-28 06:39:24",
            "last_seen_utc": "2025-10-05 23:00:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1603174": [
        {
            "ioc_value": "q.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 06:36:52",
            "last_seen_utc": "2025-09-28 06:37:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603173": [
        {
            "ioc_value": "hx.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 06:16:23",
            "last_seen_utc": "2025-09-28 06:18:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603172": [
        {
            "ioc_value": "d4.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 06:05:35",
            "last_seen_utc": "2025-09-28 06:07:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603167": [
        {
            "ioc_value": "v2.a-91p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 05:36:15",
            "last_seen_utc": "2025-09-28 06:48:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603166": [
        {
            "ioc_value": "n.gbta9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 05:33:53",
            "last_seen_utc": "2025-09-28 05:36:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603165": [
        {
            "ioc_value": "no.xkqi8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 05:31:19",
            "last_seen_utc": "2025-09-28 06:49:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1603164": [
        {
            "ioc_value": "cm9.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 05:22:03",
            "last_seen_utc": "2025-09-28 05:31:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1603163": [
        {
            "ioc_value": "y.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 05:13:41",
            "last_seen_utc": "2025-09-28 05:14:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602963": [
        {
            "ioc_value": "u1.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 04:37:25",
            "last_seen_utc": "2025-09-28 04:39:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602962": [
        {
            "ioc_value": "r.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 04:16:27",
            "last_seen_utc": "2025-09-28 04:35:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602938": [
        {
            "ioc_value": "adrenaliteryhvx.dreliaslima.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-28 04:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/207.154.205.11+adrenaliteryhvx.dreliaslima.com.br",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1602933": [
        {
            "ioc_value": "ip2d56996a.ipv4.lyratris.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-28 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.86.153.106+ip2d56996a.ipv4.lyratris.net",
            "tags": "AS200950,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1602932": [
        {
            "ioc_value": "tr0ff3.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-28 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/152.32.251.78+tr0ff3.cn",
            "tags": "AS135377,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1602931": [
        {
            "ioc_value": "ve.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 03:52:49",
            "last_seen_utc": "2025-09-28 03:54:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602930": [
        {
            "ioc_value": "g.a-91p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 03:46:37",
            "last_seen_utc": "2025-09-28 05:22:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602929": [
        {
            "ioc_value": "my.xkqi8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 03:46:17",
            "last_seen_utc": "2025-09-28 04:38:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602928": [
        {
            "ioc_value": "k8.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 03:44:02",
            "last_seen_utc": "2025-09-28 03:46:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602927": [
        {
            "ioc_value": "me.xkqi8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 03:28:19",
            "last_seen_utc": "2025-09-29 14:12:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602926": [
        {
            "ioc_value": "aa9.e-99n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 03:27:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602925": [
        {
            "ioc_value": "p.fttu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 03:26:40",
            "last_seen_utc": "2025-09-28 03:28:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602924": [
        {
            "ioc_value": "xq0.e-99n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 00:51:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602923": [
        {
            "ioc_value": "x2m.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-28 00:49:59",
            "last_seen_utc": "2025-09-28 00:51:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602906": [
        {
            "ioc_value": "c5.e-99n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 23:59:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602905": [
        {
            "ioc_value": "h.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 23:58:11",
            "last_seen_utc": "2025-09-27 23:59:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602904": [
        {
            "ioc_value": "t7.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 23:23:52",
            "last_seen_utc": "2025-09-27 23:24:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602903": [
        {
            "ioc_value": "l.e-99n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 23:15:10",
            "last_seen_utc": "2025-09-27 23:24:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602901": [
        {
            "ioc_value": "z.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 23:12:55",
            "last_seen_utc": "2025-09-27 23:15:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602900": [
        {
            "ioc_value": "bd.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 23:01:36",
            "last_seen_utc": "2025-09-27 23:03:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602899": [
        {
            "ioc_value": "h1.e-72t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 22:54:15",
            "last_seen_utc": "2025-09-27 23:02:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602898": [
        {
            "ioc_value": "he.xmho3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 22:54:08",
            "last_seen_utc": "2025-09-28 00:51:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602897": [
        {
            "ioc_value": "q4.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 22:53:51",
            "last_seen_utc": "2025-09-27 22:57:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602895": [
        {
            "ioc_value": "g.ctze0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 22:44:35",
            "last_seen_utc": "2025-09-27 22:54:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602894": [
        {
            "ioc_value": "go.hmvu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 22:37:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602893": [
        {
            "ioc_value": "pz8.e-72t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 22:36:41",
            "last_seen_utc": "2025-09-27 22:46:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602892": [
        {
            "ioc_value": "x1.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 22:35:18",
            "last_seen_utc": "2025-09-27 22:37:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602890": [
        {
            "ioc_value": "w4.e-72t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 21:10:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602889": [
        {
            "ioc_value": "t.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 21:00:20",
            "last_seen_utc": "2025-09-27 21:10:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602877": [
        {
            "ioc_value": "d.e-72t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 20:16:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602876": [
        {
            "ioc_value": "zk.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 20:14:54",
            "last_seen_utc": "2025-09-27 20:16:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602863": [
        {
            "ioc_value": "m9.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 19:59:30",
            "last_seen_utc": "2025-09-27 20:01:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602862": [
        {
            "ioc_value": "t1.u-97w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 19:51:21",
            "last_seen_utc": "2025-09-27 20:01:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602861": [
        {
            "ioc_value": "a.cgty8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 19:50:45",
            "last_seen_utc": "2025-09-27 19:51:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602860": [
        {
            "ioc_value": "at.hmvu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 19:47:14",
            "last_seen_utc": "2025-09-27 21:10:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602859": [
        {
            "ioc_value": "q.bvqu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 19:45:30",
            "last_seen_utc": "2025-09-27 19:47:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602857": [
        {
            "ioc_value": "qz9.u-97w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 19:37:18",
            "last_seen_utc": "2025-09-27 19:46:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602856": [
        {
            "ioc_value": "xt.bvqu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 19:36:44",
            "last_seen_utc": "2025-09-27 19:37:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602855": [
        {
            "ioc_value": "n3.bvqu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 18:58:56",
            "last_seen_utc": "2025-09-27 19:00:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602854": [
        {
            "ioc_value": "v2.u-97w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 18:56:20",
            "last_seen_utc": "2025-09-27 18:59:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602853": [
        {
            "ioc_value": "b.bvqu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 18:54:06",
            "last_seen_utc": "2025-09-27 18:56:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602850": [
        {
            "ioc_value": "v2.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 18:46:21",
            "last_seen_utc": "2025-09-27 18:47:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602847": [
        {
            "ioc_value": "k.u-97w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 18:35:41",
            "last_seen_utc": "2025-09-27 18:47:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602846": [
        {
            "ioc_value": "tn.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 18:34:43",
            "last_seen_utc": "2025-09-27 18:36:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602845": [
        {
            "ioc_value": "x.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 18:21:18",
            "last_seen_utc": "2025-09-27 18:22:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602844": [
        {
            "ioc_value": "t1.a-311.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 18:17:21",
            "last_seen_utc": "2025-09-27 18:22:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602843": [
        {
            "ioc_value": "r1.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 18:15:36",
            "last_seen_utc": "2025-09-27 18:17:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602841": [
        {
            "ioc_value": "conference-plate.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-27 18:02:03",
            "last_seen_utc": "2025-10-10 11:34:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250927-wb67aswycz",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602839": [
        {
            "ioc_value": "kingstare-54289.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-27 18:00:58",
            "last_seen_utc": "2025-10-03 09:02:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/250927-r4xfcatsfx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602840": [
        {
            "ioc_value": "insurance-scuba.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-27 18:00:58",
            "last_seen_utc": "2025-10-03 09:02:26",
            "confidence_level": 100,
            "reference": "https://tria.ge/250927-pzznsscm21",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602837": [
        {
            "ioc_value": "qz9.a-311.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 17:58:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602836": [
        {
            "ioc_value": "qz.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 17:56:08",
            "last_seen_utc": "2025-09-27 17:58:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602835": [
        {
            "ioc_value": "am.dgzy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 17:35:58",
            "last_seen_utc": "2025-09-27 19:37:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602834": [
        {
            "ioc_value": "v2.a-311.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 17:00:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602832": [
        {
            "ioc_value": "m8.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 16:58:58",
            "last_seen_utc": "2025-09-27 17:35:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602828": [
        {
            "ioc_value": "k.a-311.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 16:35:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602827": [
        {
            "ioc_value": "a.bpva0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 16:33:53",
            "last_seen_utc": "2025-09-27 16:35:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602826": [
        {
            "ioc_value": "zt.kijx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 16:22:06",
            "last_seen_utc": "2025-09-27 16:22:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602823": [
        {
            "ioc_value": "g4.a-144.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 16:19:13",
            "last_seen_utc": "2025-09-27 16:22:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602822": [
        {
            "ioc_value": "a2.kijx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 16:13:16",
            "last_seen_utc": "2025-09-27 16:19:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602820": [
        {
            "ioc_value": "ov.kijx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 16:10:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602808": [
        {
            "ioc_value": "pm7.a-144.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 16:01:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602807": [
        {
            "ioc_value": "8r.kijx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 15:59:11",
            "last_seen_utc": "2025-09-27 16:01:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602806": [
        {
            "ioc_value": "nl.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 15:37:30",
            "last_seen_utc": "2025-09-27 15:38:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602805": [
        {
            "ioc_value": "k4.a-144.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 15:34:16",
            "last_seen_utc": "2025-09-27 15:38:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602804": [
        {
            "ioc_value": "1c.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 15:32:49",
            "last_seen_utc": "2025-09-27 15:34:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602803": [
        {
            "ioc_value": "y.a-144.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 15:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602802": [
        {
            "ioc_value": "mr.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 15:17:27",
            "last_seen_utc": "2025-09-27 15:18:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602801": [
        {
            "ioc_value": "ps.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 15:01:32",
            "last_seen_utc": "2025-09-27 15:02:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602800": [
        {
            "ioc_value": "z3.u-251.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:58:56",
            "last_seen_utc": "2025-09-27 15:02:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602799": [
        {
            "ioc_value": "m8.bejw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:57:22",
            "last_seen_utc": "2025-09-27 14:58:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602791": [
        {
            "ioc_value": "jo.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:54:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602789": [
        {
            "ioc_value": "g.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:54:12",
            "last_seen_utc": "2025-09-27 13:30:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602792": [
        {
            "ioc_value": "bx.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:54:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602793": [
        {
            "ioc_value": "jn.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:54:11",
            "last_seen_utc": "2025-09-27 14:21:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602795": [
        {
            "ioc_value": "ak.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:54:10",
            "last_seen_utc": "2025-09-27 14:37:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602797": [
        {
            "ioc_value": "er.qekz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:54:10",
            "last_seen_utc": "2025-09-27 14:50:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602798": [
        {
            "ioc_value": "qm9.u-251.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:50:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602796": [
        {
            "ioc_value": "u1.u-251.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602794": [
        {
            "ioc_value": "h.u-251.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 14:21:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602790": [
        {
            "ioc_value": "r2.o-096.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 13:30:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602787": [
        {
            "ioc_value": "n.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 13:20:03",
            "last_seen_utc": "2025-09-27 13:19:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602788": [
        {
            "ioc_value": "wq9.o-096.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 13:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602786": [
        {
            "ioc_value": "c7.o-096.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 13:07:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602785": [
        {
            "ioc_value": "wz.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 13:04:42",
            "last_seen_utc": "2025-09-27 13:07:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602784": [
        {
            "ioc_value": "sc.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 13:00:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602770": [
        {
            "ioc_value": "wl.xabz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:46:48",
            "last_seen_utc": "2025-09-27 12:19:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602777": [
        {
            "ioc_value": "wzlive.support",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-27 12:45:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1602774": [
        {
            "ioc_value": "koadbzmlqiyr.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-27 12:24:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1602772": [
        {
            "ioc_value": "hdwyebwfvjs.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-27 12:24:09",
            "last_seen_utc": "2025-09-27 12:24:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/bd637efb8b5d0d620e4dc9bcd3d596b8da685116dcd9ab122bedd369fb912a94/",
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1602771": [
        {
            "ioc_value": "n.o-096.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602769": [
        {
            "ioc_value": "m7.e-783.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:07:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602685": [
        {
            "ioc_value": "0b.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:35",
            "last_seen_utc": "2025-09-27 07:10:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602694": [
        {
            "ioc_value": "gz.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:34",
            "last_seen_utc": "2025-09-27 08:48:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602705": [
        {
            "ioc_value": "xq.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:34",
            "last_seen_utc": "2025-09-27 08:58:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602707": [
        {
            "ioc_value": "pc.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:34",
            "last_seen_utc": "2025-09-27 09:04:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602708": [
        {
            "ioc_value": "bm.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:33",
            "last_seen_utc": "2025-09-27 09:30:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602710": [
        {
            "ioc_value": "4j.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:33",
            "last_seen_utc": "2025-09-27 09:45:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602714": [
        {
            "ioc_value": "dn.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:32",
            "last_seen_utc": "2025-09-27 10:40:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602718": [
        {
            "ioc_value": "16.mynq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:32",
            "last_seen_utc": "2025-09-27 10:44:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602721": [
        {
            "ioc_value": "ts.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:31",
            "last_seen_utc": "2025-09-27 11:00:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602723": [
        {
            "ioc_value": "8f.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:30",
            "last_seen_utc": "2025-09-27 11:09:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602747": [
        {
            "ioc_value": "vl.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:30",
            "last_seen_utc": "2025-09-27 11:53:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602745": [
        {
            "ioc_value": "5q.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:29",
            "last_seen_utc": "2025-09-27 11:42:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602764": [
        {
            "ioc_value": "b5.lexz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 12:06:29",
            "last_seen_utc": "2025-09-27 12:07:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602758": [
        {
            "ioc_value": "maps-scoop.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-27 12:01:05",
            "last_seen_utc": "2025-10-03 09:02:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/250927-ha6x9afl2z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602746": [
        {
            "ioc_value": "tq1.e-783.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 11:42:00",
            "last_seen_utc": "2025-09-27 11:53:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602740": [
        {
            "ioc_value": "hyduwkvd.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602741": [
        {
            "ioc_value": "ydobniudivan.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602742": [
        {
            "ioc_value": "hatsalnm.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602743": [
        {
            "ioc_value": "ebuinwgs.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602744": [
        {
            "ioc_value": "synrxvtd.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602733": [
        {
            "ioc_value": "assalafuz.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602734": [
        {
            "ioc_value": "unshyqov.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602735": [
        {
            "ioc_value": "inchapxe.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602736": [
        {
            "ioc_value": "bloodydi.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602737": [
        {
            "ioc_value": "aegiqlfb.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602738": [
        {
            "ioc_value": "paleatgh.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602739": [
        {
            "ioc_value": "ligmfbx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602730": [
        {
            "ioc_value": "secrequ.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602731": [
        {
            "ioc_value": "delazvf.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602732": [
        {
            "ioc_value": "orinacg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602729": [
        {
            "ioc_value": "builie.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602726": [
        {
            "ioc_value": "gregmhy.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602727": [
        {
            "ioc_value": "sacrakyf.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602728": [
        {
            "ioc_value": "actmwtn.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602725": [
        {
            "ioc_value": "neighll.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-27 11:10:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602724": [
        {
            "ioc_value": "b2.e-783.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 11:09:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602722": [
        {
            "ioc_value": "x.e-783.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 11:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602719": [
        {
            "ioc_value": "e1.u-989.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 10:40:47",
            "last_seen_utc": "2025-09-27 10:44:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602716": [
        {
            "ioc_value": "bigstepix.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-27 10:36:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602713": [
        {
            "ioc_value": "lgbtmeme.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-27 10:29:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1784034/0/html",
            "tags": "c2,domain,joesandbox,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602709": [
        {
            "ioc_value": "qk2.u-989.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 09:30:43",
            "last_seen_utc": "2025-09-27 09:45:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602706": [
        {
            "ioc_value": "u5.u-989.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 08:58:28",
            "last_seen_utc": "2025-09-27 09:04:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602703": [
        {
            "ioc_value": "r.u-989.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 08:48:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602686": [
        {
            "ioc_value": "k7.u-885.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 07:10:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602331": [
        {
            "ioc_value": "media-kg.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-27 05:47:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-vpt88acp3z/behavioral1",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1602675": [
        {
            "ioc_value": "aa9.u-885.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 05:30:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602674": [
        {
            "ioc_value": "0.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 05:29:52",
            "last_seen_utc": "2025-09-27 05:30:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602673": [
        {
            "ioc_value": "g.u-885.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 05:20:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602672": [
        {
            "ioc_value": "o.nybk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 04:53:35",
            "last_seen_utc": "2025-09-27 05:20:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602670": [
        {
            "ioc_value": "t1.i-215.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 04:38:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602669": [
        {
            "ioc_value": "3.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 04:37:15",
            "last_seen_utc": "2025-09-27 04:38:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602625": [
        {
            "ioc_value": "5u.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 03:52:46",
            "last_seen_utc": "2025-09-27 03:54:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602624": [
        {
            "ioc_value": "gj.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 03:38:44",
            "last_seen_utc": "2025-09-27 03:40:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602621": [
        {
            "ioc_value": "4f.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 03:16:14",
            "last_seen_utc": "2025-09-27 03:16:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602620": [
        {
            "ioc_value": "clearate.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-27 02:48:08",
            "last_seen_utc": "2025-09-28 21:48:48",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1602619": [
        {
            "ioc_value": "q3n.i-215.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 02:35:24",
            "last_seen_utc": "2025-09-27 03:54:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602618": [
        {
            "ioc_value": "8a.tiqk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 02:34:46",
            "last_seen_utc": "2025-09-27 02:35:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602617": [
        {
            "ioc_value": "6v.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 02:13:47",
            "last_seen_utc": "2025-09-27 02:14:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602616": [
        {
            "ioc_value": "u0.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 01:58:23",
            "last_seen_utc": "2025-09-27 01:59:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602615": [
        {
            "ioc_value": "m8.i-215.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 01:53:09",
            "last_seen_utc": "2025-09-27 02:14:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602614": [
        {
            "ioc_value": "eq.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 01:52:41",
            "last_seen_utc": "2025-09-27 01:53:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602612": [
        {
            "ioc_value": "0m.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-27 00:09:33",
            "last_seen_utc": "2025-09-27 00:10:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602601": [
        {
            "ioc_value": "y2.jagc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 23:36:19",
            "last_seen_utc": "2025-09-26 23:46:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602412": [
        {
            "ioc_value": "zs.kunb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 23:26:02",
            "last_seen_utc": "2025-09-26 23:26:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602411": [
        {
            "ioc_value": "wq9.a-156.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 22:47:14",
            "last_seen_utc": "2025-09-27 00:10:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602410": [
        {
            "ioc_value": "3i.kunb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 22:44:39",
            "last_seen_utc": "2025-09-26 22:47:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602409": [
        {
            "ioc_value": "2.kunb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 22:16:01",
            "last_seen_utc": "2025-09-26 22:17:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602408": [
        {
            "ioc_value": "7.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 21:17:21",
            "last_seen_utc": "2025-09-26 21:18:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602407": [
        {
            "ioc_value": "6.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 21:07:04",
            "last_seen_utc": "2025-09-26 21:08:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602406": [
        {
            "ioc_value": "c7.a-156.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 21:04:44",
            "last_seen_utc": "2025-09-26 22:17:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602405": [
        {
            "ioc_value": "ik.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 20:55:12",
            "last_seen_utc": "2025-09-26 21:04:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602402": [
        {
            "ioc_value": "n.a-156.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 20:50:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602401": [
        {
            "ioc_value": "w6.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 20:49:25",
            "last_seen_utc": "2025-09-26 20:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602400": [
        {
            "ioc_value": "m7.o-279.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 20:29:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602399": [
        {
            "ioc_value": "79.nytk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 20:28:54",
            "last_seen_utc": "2025-09-26 20:29:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602360": [
        {
            "ioc_value": "s.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 19:44:20",
            "last_seen_utc": "2025-09-26 19:46:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602359": [
        {
            "ioc_value": "tq1.o-279.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 19:33:26",
            "last_seen_utc": "2025-09-26 19:46:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602358": [
        {
            "ioc_value": "di.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 19:32:32",
            "last_seen_utc": "2025-09-26 19:33:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602357": [
        {
            "ioc_value": "ax.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 19:24:12",
            "last_seen_utc": "2025-09-26 19:26:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602356": [
        {
            "ioc_value": "b2.o-279.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 19:22:08",
            "last_seen_utc": "2025-09-26 19:26:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602355": [
        {
            "ioc_value": "c.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 19:20:02",
            "last_seen_utc": "2025-09-26 19:22:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602343": [
        {
            "ioc_value": "x.o-279.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 18:08:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602342": [
        {
            "ioc_value": "np.xyqd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 18:08:09",
            "last_seen_utc": "2025-09-26 18:08:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602341": [
        {
            "ioc_value": "Iusefatalbtw-48418.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-26 18:00:52",
            "last_seen_utc": "2025-10-03 09:02:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-vkhdvs1yat",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602339": [
        {
            "ioc_value": "dcgerts.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-26 18:00:38",
            "last_seen_utc": "2025-10-03 09:02:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-qhq6rsvps8",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602340": [
        {
            "ioc_value": "startmenuexperiencehost.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-26 18:00:38",
            "last_seen_utc": "2025-10-03 09:02:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-pxhmhahk81",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602338": [
        {
            "ioc_value": "AseguramayoDC.casacam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-26 18:00:37",
            "last_seen_utc": "2025-10-03 09:02:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-rfwtxaal91",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602335": [
        {
            "ioc_value": "mean-airline.gl.at.ply",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-26 18:00:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-r9a5asbj91",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602336": [
        {
            "ioc_value": "original-fan.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-26 18:00:19",
            "last_seen_utc": "2025-10-03 09:02:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-s4kxzszzbs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602337": [
        {
            "ioc_value": "promole5.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-26 18:00:19",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-rghcxavqx9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602334": [
        {
            "ioc_value": "fr.wuhp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 17:55:17",
            "last_seen_utc": "2025-09-26 17:56:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602333": [
        {
            "ioc_value": "e1.a-342.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 17:42:03",
            "last_seen_utc": "2025-09-26 17:56:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602332": [
        {
            "ioc_value": "b3.wuhp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 17:40:04",
            "last_seen_utc": "2025-09-26 17:42:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602330": [
        {
            "ioc_value": "qk2.a-342.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 17:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602329": [
        {
            "ioc_value": "ix.wuhp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 17:07:57",
            "last_seen_utc": "2025-09-26 17:08:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602327": [
        {
            "ioc_value": "ia.wuhp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:57:27",
            "last_seen_utc": "2025-09-26 17:48:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602298": [
        {
            "ioc_value": "37.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:57:26",
            "last_seen_utc": "2025-09-26 13:19:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602301": [
        {
            "ioc_value": "lexypaster.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-26 16:57:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://tip.neiki.dev/file/459238815cef12916912d15825351651b6222161e9229e7ae66dbf40f733b589",
            "tags": "asyncrat,rat,sheetrat",
            "anonymous": "1",
            "reporter": "Neiki"
        }
    ],
    "1602304": [
        {
            "ioc_value": "5.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:57:23",
            "last_seen_utc": "2025-09-26 14:03:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602306": [
        {
            "ioc_value": "lc.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:57:23",
            "last_seen_utc": "2025-09-27 17:35:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602308": [
        {
            "ioc_value": "gq.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:57:22",
            "last_seen_utc": "2025-09-26 14:32:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602309": [
        {
            "ioc_value": "y3.pihp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:57:22",
            "last_seen_utc": "2025-09-26 15:12:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602311": [
        {
            "ioc_value": "0z.pihp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:57:22",
            "last_seen_utc": "2025-09-26 15:17:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602325": [
        {
            "ioc_value": "tl.pihp.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:57:21",
            "last_seen_utc": "2025-09-26 16:24:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602328": [
        {
            "ioc_value": "u5.a-342.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:36:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602326": [
        {
            "ioc_value": "r.a-342.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 16:24:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602321": [
        {
            "ioc_value": "update.00m-i.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-26 16:01:03",
            "last_seen_utc": "2025-09-27 04:01:03",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/20.169.181.39+update.00m-i.cloud",
            "tags": "AS8075,C2,censys,Havoc,MICROSOFT-CORP-MSN-AS-BLOCK",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602312": [
        {
            "ioc_value": "k7.i-661.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 15:17:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602310": [
        {
            "ioc_value": "aa9.i-661.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 15:12:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602307": [
        {
            "ioc_value": "v2.i-661.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 14:11:32",
            "last_seen_utc": "2025-09-26 14:32:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602305": [
        {
            "ioc_value": "g.i-661.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 14:02:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602300": [
        {
            "ioc_value": "aa9.i-574.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 13:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602299": [
        {
            "ioc_value": "qm8.j287y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 13:18:48",
            "last_seen_utc": "2025-09-27 17:35:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602277": [
        {
            "ioc_value": "e1.lobd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 13:13:48",
            "last_seen_utc": "2025-09-26 12:16:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602267": [
        {
            "ioc_value": "7w.lobd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 13:13:47",
            "last_seen_utc": "2025-09-26 11:50:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602289": [
        {
            "ioc_value": "4t.wugh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 13:13:46",
            "last_seen_utc": "2025-09-26 13:01:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602296": [
        {
            "ioc_value": "fx.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-26 13:11:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1602295": [
        {
            "ioc_value": "fx.alexandraparasca.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-26 13:11:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1602291": [
        {
            "ioc_value": "xq0.i-574.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 13:01:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602290": [
        {
            "ioc_value": "u1.j287y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 13:00:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602279": [
        {
            "ioc_value": "c5.i-574.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 12:16:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602278": [
        {
            "ioc_value": "h.j287y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 12:15:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602271": [
        {
            "ioc_value": "SHADOWii0000-45869.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-26 12:00:19",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-nzy7lagq6w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1602269": [
        {
            "ioc_value": "pq9.x874a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:50:00",
            "last_seen_utc": "2025-09-26 11:54:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602268": [
        {
            "ioc_value": "l.i-574.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:49:58",
            "last_seen_utc": "2025-09-26 11:56:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602240": [
        {
            "ioc_value": "15.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:40:46",
            "last_seen_utc": "2025-09-26 07:59:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602254": [
        {
            "ioc_value": "ol.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:40:46",
            "last_seen_utc": "2025-09-26 08:46:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602257": [
        {
            "ioc_value": "teams-download.buzz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-26 11:40:45",
            "last_seen_utc": "2025-10-03 14:29:18",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1602261": [
        {
            "ioc_value": "ap.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:40:45",
            "last_seen_utc": "2025-09-26 10:07:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602258": [
        {
            "ioc_value": "s5.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:40:44",
            "last_seen_utc": "2025-09-26 09:40:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602262": [
        {
            "ioc_value": "zc.lobd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:40:43",
            "last_seen_utc": "2025-09-26 11:56:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602264": [
        {
            "ioc_value": "rt.lobd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:40:43",
            "last_seen_utc": "2025-09-26 11:05:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1602266": [
        {
            "ioc_value": "h1.e-134.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:05:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602265": [
        {
            "ioc_value": "w3.x874a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 11:05:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602263": [
        {
            "ioc_value": "d.x874a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 10:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602260": [
        {
            "ioc_value": "pz8.e-134.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 09:38:06",
            "last_seen_utc": "2025-09-26 10:19:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602259": [
        {
            "ioc_value": "tm7.z413y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 09:35:38",
            "last_seen_utc": "2025-09-26 10:07:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602256": [
        {
            "ioc_value": "w4.e-134.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 08:46:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602255": [
        {
            "ioc_value": "x8.z413y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 08:45:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602242": [
        {
            "ioc_value": "n.z413y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 07:59:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602241": [
        {
            "ioc_value": "d.e-134.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 07:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1602239": [
        {
            "ioc_value": "was-rand.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-26 07:38:13",
            "last_seen_utc": "2025-10-05 16:26:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1602236": [
        {
            "ioc_value": "inversat.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-26 07:37:24",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1602235": [
        {
            "ioc_value": "hikylover.st",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-26 07:37:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1602234": [
        {
            "ioc_value": "football-confident.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-09-26 07:36:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1602233": [
        {
            "ioc_value": "x.cheapgylsale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bunitu",
            "malware_alias": null,
            "malware_printable": "Bunitu",
            "first_seen_utc": "2025-09-26 07:36:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "bunitu,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1602232": [
        {
            "ioc_value": "l.cheapgylsale.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bunitu",
            "malware_alias": null,
            "malware_printable": "Bunitu",
            "first_seen_utc": "2025-09-26 07:36:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "bunitu,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1601894": [
        {
            "ioc_value": "d0.alexandraparasca.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-26 06:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1601895": [
        {
            "ioc_value": "sfr.konebras.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-26 06:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1601896": [
        {
            "ioc_value": "icc.konebras.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-26 06:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1601897": [
        {
            "ioc_value": "d0.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-26 06:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1601898": [
        {
            "ioc_value": "sfr.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-26 06:49:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1601882": [
        {
            "ioc_value": "employment-memorabilia.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-26 06:01:24",
            "last_seen_utc": "2025-10-05 16:26:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-b5lr8sz1gy",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601883": [
        {
            "ioc_value": "mvps-remote.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-26 06:01:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-f3dq3atxes",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601878": [
        {
            "ioc_value": "nuz8o8.88933.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-26 06:00:51",
            "last_seen_utc": "2025-10-03 09:02:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-f1va2atxcw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601879": [
        {
            "ioc_value": "omfg131313.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-26 06:00:51",
            "last_seen_utc": "2025-10-03 09:02:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-etmf6sdm7t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601876": [
        {
            "ioc_value": "aaaxxx6.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-26 06:00:18",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250926-fzkefaej7z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601868": [
        {
            "ioc_value": "cnc.feds.gay",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-26 05:56:51",
            "last_seen_utc": "2025-10-10 11:34:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1601866": [
        {
            "ioc_value": "t1.o-554.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 04:12:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601865": [
        {
            "ioc_value": "m0.nybh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 04:10:59",
            "last_seen_utc": "2025-09-26 04:12:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601842": [
        {
            "ioc_value": "qz9.o-554.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 02:28:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601841": [
        {
            "ioc_value": "lq.pymh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 02:27:02",
            "last_seen_utc": "2025-09-26 02:28:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601840": [
        {
            "ioc_value": "v2.o-554.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 00:30:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601839": [
        {
            "ioc_value": "m3.3r7j7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 00:29:49",
            "last_seen_utc": "2025-09-26 04:11:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601838": [
        {
            "ioc_value": "hk.pymh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-26 00:29:46",
            "last_seen_utc": "2025-09-26 00:30:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601590": [
        {
            "ioc_value": "xq0.9t6p5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 22:34:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601589": [
        {
            "ioc_value": "k.o-554.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 22:33:47",
            "last_seen_utc": "2025-09-25 22:38:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601588": [
        {
            "ioc_value": "u.pymh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 22:32:31",
            "last_seen_utc": "2025-09-25 22:38:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601585": [
        {
            "ioc_value": "xq0.a-344.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 21:38:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601584": [
        {
            "ioc_value": "vd.padj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 21:37:54",
            "last_seen_utc": "2025-09-25 21:39:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601583": [
        {
            "ioc_value": "c5.9t6p5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 21:32:41",
            "last_seen_utc": "2025-09-25 21:39:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601582": [
        {
            "ioc_value": "0f.padj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 21:30:33",
            "last_seen_utc": "2025-09-25 21:32:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601581": [
        {
            "ioc_value": "c5.a-344.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 21:21:55",
            "last_seen_utc": "2025-09-25 21:32:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601580": [
        {
            "ioc_value": "h.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 21:19:41",
            "last_seen_utc": "2025-09-25 21:21:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601579": [
        {
            "ioc_value": "l.a-344.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 21:05:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601578": [
        {
            "ioc_value": "d.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 21:04:18",
            "last_seen_utc": "2025-09-25 21:05:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601577": [
        {
            "ioc_value": "tn.e-410.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 20:38:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601576": [
        {
            "ioc_value": "l.9t6p5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 20:36:55",
            "last_seen_utc": "2025-09-25 21:20:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601575": [
        {
            "ioc_value": "9.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 20:36:08",
            "last_seen_utc": "2025-09-25 20:38:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601574": [
        {
            "ioc_value": "qm9.z687a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 20:05:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601573": [
        {
            "ioc_value": "b2.e-410.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 20:04:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601572": [
        {
            "ioc_value": "x.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 20:03:44",
            "last_seen_utc": "2025-09-25 20:05:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601569": [
        {
            "ioc_value": "zenytio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-25 20:01:28",
            "last_seen_utc": "2025-10-04 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/37.59.108.112+zenytio.com",
            "tags": "AS16276,C2,censys,Havoc,OVH",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601555": [
        {
            "ioc_value": "u1.z687a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 19:11:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601554": [
        {
            "ioc_value": "wf.pymz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 19:09:40",
            "last_seen_utc": "2025-09-25 19:11:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601553": [
        {
            "ioc_value": "h.z687a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 18:57:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601552": [
        {
            "ioc_value": "vz.derl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 18:56:15",
            "last_seen_utc": "2025-09-25 18:57:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601550": [
        {
            "ioc_value": "ns2.huntressstudios.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-25 18:48:44",
            "last_seen_utc": "2025-12-14 11:48:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601549": [
        {
            "ioc_value": "ns1.huntressstudios.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-25 18:48:42",
            "last_seen_utc": "2025-12-14 11:48:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601539": [
        {
            "ioc_value": "4.derl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 18:42:50",
            "last_seen_utc": "2025-09-25 18:45:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601538": [
        {
            "ioc_value": "pz7.x331e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 18:38:54",
            "last_seen_utc": "2025-09-25 18:45:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601537": [
        {
            "ioc_value": "z.e-410.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 18:38:05",
            "last_seen_utc": "2025-09-25 19:11:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601536": [
        {
            "ioc_value": "8d.derl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 18:37:08",
            "last_seen_utc": "2025-09-25 18:38:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601535": [
        {
            "ioc_value": "w4.x331e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 18:10:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601534": [
        {
            "ioc_value": "99.derl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 18:05:41",
            "last_seen_utc": "2025-09-25 18:10:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601530": [
        {
            "ioc_value": "dckis.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-25 18:00:31",
            "last_seen_utc": "2025-10-03 09:02:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250925-sy2csacl3x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601529": [
        {
            "ioc_value": "some-cleveland.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-25 18:00:18",
            "last_seen_utc": "2025-10-05 16:26:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250925-rz57pazxbx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601528": [
        {
            "ioc_value": "jholycf100.ddns.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-25 18:00:17",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250925-vrf5daszbw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601527": [
        {
            "ioc_value": "d.x331e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 17:53:56",
            "last_seen_utc": "2025-09-25 18:06:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601526": [
        {
            "ioc_value": "tq.derl.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 17:51:41",
            "last_seen_utc": "2025-09-25 17:53:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601525": [
        {
            "ioc_value": "rk8.d597o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 17:48:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601524": [
        {
            "ioc_value": "y.mijk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 17:46:30",
            "last_seen_utc": "2025-09-25 17:48:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601523": [
        {
            "ioc_value": "treten.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-25 17:41:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1599102/",
            "tags": "c2,domain,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601521": [
        {
            "ioc_value": "trelev.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-25 17:39:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/ioc/1599101/",
            "tags": "c2,domain,Rhadamanthys,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601519": [
        {
            "ioc_value": "t.d597o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 17:17:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601518": [
        {
            "ioc_value": "dl.mijk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 17:17:17",
            "last_seen_utc": "2025-09-25 17:17:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601517": [
        {
            "ioc_value": "qk1.e-815.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 17:00:20",
            "last_seen_utc": "2025-09-25 18:08:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601516": [
        {
            "ioc_value": "v2.c646a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 16:59:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601515": [
        {
            "ioc_value": "ca.mijk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 16:58:50",
            "last_seen_utc": "2025-09-25 17:00:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601513": [
        {
            "ioc_value": "k.c646a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 16:14:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601512": [
        {
            "ioc_value": "8.mijk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 16:13:59",
            "last_seen_utc": "2025-09-25 16:15:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601508": [
        {
            "ioc_value": "boxoffice.forumreelz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-25 16:01:00",
            "last_seen_utc": "2025-09-26 04:00:45",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.104.206.108+boxoffice.forumreelz.com",
            "tags": "AKAMAI-LINODE-AP,AS63949,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601501": [
        {
            "ioc_value": "m7.e-815.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 15:53:00",
            "last_seen_utc": "2025-09-25 16:15:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601500": [
        {
            "ioc_value": "qm9.6q8v0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 15:52:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601499": [
        {
            "ioc_value": "1i.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 15:51:47",
            "last_seen_utc": "2025-09-25 15:53:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601496": [
        {
            "ioc_value": "u1.6q8v0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 15:30:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601493": [
        {
            "ioc_value": "x.e-815.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 15:18:48",
            "last_seen_utc": "2025-09-25 15:26:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601494": [
        {
            "ioc_value": "h.6q8v0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 15:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1601489": [
        {
            "ioc_value": "w.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 15:11:13",
            "last_seen_utc": "2025-09-25 15:30:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1601478": [
        {
            "ioc_value": "ionia74.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-25 14:58:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/cf948755dcc804a8a313bab2cebe0adf0532cace5b8c29a0738b2fed6a2ece50",
            "tags": "c2,domain,Rhadamanthys,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601479": [
        {
            "ioc_value": "lensdriver-us.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-25 14:58:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/cf948755dcc804a8a313bab2cebe0adf0532cace5b8c29a0738b2fed6a2ece50",
            "tags": "c2,domain,Rhadamanthys,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601480": [
        {
            "ioc_value": "slip345.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-25 14:58:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/cf948755dcc804a8a313bab2cebe0adf0532cace5b8c29a0738b2fed6a2ece50",
            "tags": "c2,domain,Rhadamanthys,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601440": [
        {
            "ioc_value": "raja000hack.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601441": [
        {
            "ioc_value": "akrqmfiestq.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601442": [
        {
            "ioc_value": "sparrowjagwar.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601443": [
        {
            "ioc_value": "mykeylogger.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601444": [
        {
            "ioc_value": "hackerbabel.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601445": [
        {
            "ioc_value": "hafedabdall.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601446": [
        {
            "ioc_value": "ipeasyassim.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601447": [
        {
            "ioc_value": "inicabedennot.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601448": [
        {
            "ioc_value": "utoboolusho2.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601449": [
        {
            "ioc_value": "yarwoahimujno.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601450": [
        {
            "ioc_value": "f3xbuildingfunforum.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601419": [
        {
            "ioc_value": "1magicalmage.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601420": [
        {
            "ioc_value": "4alternative.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601421": [
        {
            "ioc_value": "8alternative.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601422": [
        {
            "ioc_value": "hardenberger.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601423": [
        {
            "ioc_value": "magicalmage.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601424": [
        {
            "ioc_value": "7alternative.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601425": [
        {
            "ioc_value": "4magicalmage.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601426": [
        {
            "ioc_value": "6alternative.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601427": [
        {
            "ioc_value": "7magicalmage.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601428": [
        {
            "ioc_value": "1alternative.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601429": [
        {
            "ioc_value": "6magicalmage.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601430": [
        {
            "ioc_value": "2alternative.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601431": [
        {
            "ioc_value": "luizonsistemas.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601432": [
        {
            "ioc_value": "2magicalmage.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601433": [
        {
            "ioc_value": "superblyseax.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601434": [
        {
            "ioc_value": "5magicalmage.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601435": [
        {
            "ioc_value": "3magicalmage.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601436": [
        {
            "ioc_value": "birazsiradan.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601437": [
        {
            "ioc_value": "pointblank100.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601438": [
        {
            "ioc_value": "sniperoujda.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601439": [
        {
            "ioc_value": "divelhacker.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601397": [
        {
            "ioc_value": "necrotoxin2.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601398": [
        {
            "ioc_value": "3ellisburton.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601399": [
        {
            "ioc_value": "piratagemaroc.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601400": [
        {
            "ioc_value": "5ellisburton.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601401": [
        {
            "ioc_value": "hackuracyv2.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601402": [
        {
            "ioc_value": "tsunayoshisky.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601403": [
        {
            "ioc_value": "epicpbgloba.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601404": [
        {
            "ioc_value": "bkr33zysucksdick.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601405": [
        {
            "ioc_value": "xpussyassshitfuckx.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601406": [
        {
            "ioc_value": "trannybisexul.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601407": [
        {
            "ioc_value": "epicpbglobal.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601408": [
        {
            "ioc_value": "aboooooooooooooos.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601409": [
        {
            "ioc_value": "8magicalmage.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601410": [
        {
            "ioc_value": "myhostwin64.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601411": [
        {
            "ioc_value": "5alternative.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601412": [
        {
            "ioc_value": "alternative.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601413": [
        {
            "ioc_value": "hamzakraiyem.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601414": [
        {
            "ioc_value": "raremaster77.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601415": [
        {
            "ioc_value": "thisisnot24letters.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601416": [
        {
            "ioc_value": "grayhatgroupontop.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601417": [
        {
            "ioc_value": "3alternative.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601418": [
        {
            "ioc_value": "torrentpier.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601378": [
        {
            "ioc_value": "andyneroner.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601379": [
        {
            "ioc_value": "javastudios.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601380": [
        {
            "ioc_value": "lorenzo12321mn5.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601381": [
        {
            "ioc_value": "spynetkeylogger.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601382": [
        {
            "ioc_value": "chihebchipo.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601383": [
        {
            "ioc_value": "ragnarokmetal.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601384": [
        {
            "ioc_value": "freevpnguard.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601385": [
        {
            "ioc_value": "6ellisburton.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601386": [
        {
            "ioc_value": "2ellisburton.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601387": [
        {
            "ioc_value": "ellisburton.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601388": [
        {
            "ioc_value": "themrbadboy.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601389": [
        {
            "ioc_value": "7ellisburton.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601390": [
        {
            "ioc_value": "4ellisburton.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601391": [
        {
            "ioc_value": "1ellisburton.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601392": [
        {
            "ioc_value": "8ellisburton.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601393": [
        {
            "ioc_value": "ajayrajan80.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601394": [
        {
            "ioc_value": "j6j6ijhrwuj.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601395": [
        {
            "ioc_value": "softwaredev.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601396": [
        {
            "ioc_value": "hakerbolbol.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601366": [
        {
            "ioc_value": "0adolfhitlerwashere.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601367": [
        {
            "ioc_value": "adolfhitlerwashere.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601368": [
        {
            "ioc_value": "mindyourstep.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601369": [
        {
            "ioc_value": "youdontneedtoknow.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601370": [
        {
            "ioc_value": "infoupdator.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601371": [
        {
            "ioc_value": "sebiria1234.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601372": [
        {
            "ioc_value": "retrosniping.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601373": [
        {
            "ioc_value": "abdenour007.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601374": [
        {
            "ioc_value": "mohammad3badi.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601375": [
        {
            "ioc_value": "updatechecker0.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601376": [
        {
            "ioc_value": "windowssp22.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601377": [
        {
            "ioc_value": "samismsmsami.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latentbot",
            "malware_alias": null,
            "malware_printable": "LatentBot",
            "first_seen_utc": "2025-09-25 13:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601365": [
        {
            "ioc_value": "laxreal10.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-25 13:46:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "25September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1601362": [
        {
            "ioc_value": "projects.alternativesynergies.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-25 13:22:28",
            "last_seen_utc": "2025-10-16 13:25:15",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115265138362452385",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1601339": [
        {
            "ioc_value": "manage.cloudservtech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-25 12:49:20",
            "last_seen_utc": "2025-12-13 13:49:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601338": [
        {
            "ioc_value": "cs.lyphahaha.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-25 12:49:16",
            "last_seen_utc": "2025-11-11 15:48:53",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601337": [
        {
            "ioc_value": "app.cloudservtech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-25 12:49:14",
            "last_seen_utc": "2025-12-13 13:49:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601336": [
        {
            "ioc_value": "analytics.cloudservtech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-25 12:49:13",
            "last_seen_utc": "2025-12-13 13:49:05",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601335": [
        {
            "ioc_value": "pesacux.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-25 12:17:30",
            "last_seen_utc": "2025-09-30 14:04:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601324": [
        {
            "ioc_value": "up2025.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-25 12:00:36",
            "last_seen_utc": "2025-10-03 09:02:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250925-m6kgcawyat",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601323": [
        {
            "ioc_value": "resources-formerly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-25 12:00:21",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250925-h5tw6ssyfs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1601316": [
        {
            "ioc_value": "gclouds.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-25 09:09:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1601189": [
        {
            "ioc_value": "tip.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-25 08:09:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1601190": [
        {
            "ioc_value": "kis.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-25 08:09:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1601191": [
        {
            "ioc_value": "tip.konebras.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-25 08:09:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1601192": [
        {
            "ioc_value": "kis.konebras.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-25 08:09:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1601169": [
        {
            "ioc_value": "mail.honesty-shippings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.agent_tesla",
            "malware_alias": "AgenTesla,AgentTesla,Negasteal",
            "malware_printable": "Agent Tesla",
            "first_seen_utc": "2025-09-25 07:49:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/4044d855baa6bb2633fcfa8d489c2e6a06e2923f545b94be7768cdcfba857b89/",
            "tags": "AgentTesla",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601165": [
        {
            "ioc_value": "horseswatch.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-25 06:43:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601166": [
        {
            "ioc_value": "spaderock.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-25 06:43:58",
            "last_seen_utc": "2025-10-07 18:24:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601164": [
        {
            "ioc_value": "fview.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-25 06:43:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601163": [
        {
            "ioc_value": "shamefrog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-25 06:28:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601162": [
        {
            "ioc_value": "zoomdocmentdownloader.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-25 06:26:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f8b84aa39497ac8b32a2dce40815199fa16dadde8b2162e45939b8a16f97c539/",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601158": [
        {
            "ioc_value": "queuedbyn.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-25 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1601159": [
        {
            "ioc_value": "fosteryehnit.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-25 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1601160": [
        {
            "ioc_value": "arrowxrayboldyeowps.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-25 06:17:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1601157": [
        {
            "ioc_value": "noticedseuh.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-25 06:17:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1601156": [
        {
            "ioc_value": "oega.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-25 06:17:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601153": [
        {
            "ioc_value": "v7rpejh04.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-25 06:15:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1601145": [
        {
            "ioc_value": "helpwud.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-25 06:12:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1601140": [
        {
            "ioc_value": "dimemilk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-25 06:09:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1600147": [
        {
            "ioc_value": "single-routers.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-25 06:00:14",
            "last_seen_utc": "2025-10-05 16:26:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250925-a691saep6z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1600021": [
        {
            "ioc_value": "bullxneo.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-25 05:49:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRipRip"
        }
    ],
    "1600145": [
        {
            "ioc_value": "pz8.1z2p9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 04:51:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600144": [
        {
            "ioc_value": "m7.bw-06.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 04:50:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600143": [
        {
            "ioc_value": "q.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 04:49:52",
            "last_seen_utc": "2025-09-25 04:51:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600142": [
        {
            "ioc_value": "w4.1z2p9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 04:31:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600141": [
        {
            "ioc_value": "tq1.bw-06.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 04:29:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600140": [
        {
            "ioc_value": "dc.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 04:29:26",
            "last_seen_utc": "2025-09-25 04:31:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600100": [
        {
            "ioc_value": "b2.bw-06.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 03:27:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600099": [
        {
            "ioc_value": "d.1z2p9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 03:26:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600098": [
        {
            "ioc_value": "hu.myzj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 03:26:39",
            "last_seen_utc": "2025-09-25 03:27:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600097": [
        {
            "ioc_value": "t.6n2q7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 02:41:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600096": [
        {
            "ioc_value": "b.wehv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 02:40:43",
            "last_seen_utc": "2025-09-25 02:41:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600095": [
        {
            "ioc_value": "x.bw-06.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 02:30:31",
            "last_seen_utc": "2025-09-25 02:41:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600094": [
        {
            "ioc_value": "qz9.9s4g2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 02:23:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600093": [
        {
            "ioc_value": "sq.mizx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 02:21:46",
            "last_seen_utc": "2025-09-25 02:30:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600092": [
        {
            "ioc_value": "m7.9s4g2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 02:06:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600091": [
        {
            "ioc_value": "s8.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 02:04:27",
            "last_seen_utc": "2025-09-25 02:06:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600090": [
        {
            "ioc_value": "za.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 01:25:35",
            "last_seen_utc": "2025-09-25 01:26:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600089": [
        {
            "ioc_value": "we.6h1p7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 01:16:48",
            "last_seen_utc": "2025-09-25 01:26:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600088": [
        {
            "ioc_value": "t.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 01:15:19",
            "last_seen_utc": "2025-09-25 01:17:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600086": [
        {
            "ioc_value": "us.6h1p7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 00:29:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600085": [
        {
            "ioc_value": "vw.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 00:27:51",
            "last_seen_utc": "2025-09-25 00:29:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600073": [
        {
            "ioc_value": "up.6h1p7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 00:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1600071": [
        {
            "ioc_value": "e.xavv.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-25 00:00:20",
            "last_seen_utc": "2025-09-25 00:02:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600069": [
        {
            "ioc_value": "v.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 23:24:31",
            "last_seen_utc": "2025-09-24 23:26:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600068": [
        {
            "ioc_value": "qg.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 23:06:35",
            "last_seen_utc": "2025-09-24 23:08:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600067": [
        {
            "ioc_value": "z.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 22:58:51",
            "last_seen_utc": "2025-09-24 23:02:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600066": [
        {
            "ioc_value": "p.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 22:31:10",
            "last_seen_utc": "2025-09-24 22:32:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1600065": [
        {
            "ioc_value": "zz.jeml.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 22:06:36",
            "last_seen_utc": "2025-09-24 22:24:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599907": [
        {
            "ioc_value": "m2n.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 21:49:12",
            "last_seen_utc": "2025-09-24 21:59:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599906": [
        {
            "ioc_value": "e1.cr-65.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 21:46:34",
            "last_seen_utc": "2025-09-25 02:05:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599905": [
        {
            "ioc_value": "hv.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 21:46:03",
            "last_seen_utc": "2025-09-24 21:47:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599676": [
        {
            "ioc_value": "b5.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 21:18:29",
            "last_seen_utc": "2025-09-24 21:20:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599675": [
        {
            "ioc_value": "x.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 20:52:23",
            "last_seen_utc": "2025-09-24 20:52:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599670": [
        {
            "ioc_value": "qt.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 20:44:10",
            "last_seen_utc": "2025-09-24 20:45:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599669": [
        {
            "ioc_value": "qk2.cr-65.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 20:06:38",
            "last_seen_utc": "2025-09-24 21:20:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599668": [
        {
            "ioc_value": "n4.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 20:05:52",
            "last_seen_utc": "2025-09-24 20:06:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599649": [
        {
            "ioc_value": "so.6h1p7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 19:51:49",
            "last_seen_utc": "2025-09-24 23:26:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599648": [
        {
            "ioc_value": "e.0u7y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 19:46:55",
            "last_seen_utc": "2025-09-24 22:59:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599647": [
        {
            "ioc_value": "t.3u1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 19:45:49",
            "last_seen_utc": "2025-09-24 19:46:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599646": [
        {
            "ioc_value": "me.9f4s4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 19:42:38",
            "last_seen_utc": "2025-09-24 19:46:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599645": [
        {
            "ioc_value": "rb.3u1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 19:41:09",
            "last_seen_utc": "2025-09-24 19:42:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599644": [
        {
            "ioc_value": "u5.cr-65.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 19:33:05",
            "last_seen_utc": "2025-09-24 19:49:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599643": [
        {
            "ioc_value": "k9.3u1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 19:31:24",
            "last_seen_utc": "2025-09-24 19:33:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599634": [
        {
            "ioc_value": "g.3u1y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 18:21:32",
            "last_seen_utc": "2025-09-24 18:23:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599633": [
        {
            "ioc_value": "r.cr-65.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 18:14:44",
            "last_seen_utc": "2025-09-24 18:22:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599632": [
        {
            "ioc_value": "hm.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 18:13:47",
            "last_seen_utc": "2025-09-24 18:14:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599630": [
        {
            "ioc_value": "njcolombia8590.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-24 18:01:08",
            "last_seen_utc": "2025-10-03 09:02:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-t5x5dazybw",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599629": [
        {
            "ioc_value": "mwq-52537.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 18:00:46",
            "last_seen_utc": "2025-10-03 09:02:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-qe95gax1dt",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599628": [
        {
            "ioc_value": "sdasdsaasdas-62497.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 18:00:45",
            "last_seen_utc": "2025-10-03 09:02:27",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-qmjx9ahl9w",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599626": [
        {
            "ioc_value": "windowsupdateserver.ddnsgeek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 18:00:36",
            "last_seen_utc": "2025-10-03 09:02:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-pdgabsxthw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599627": [
        {
            "ioc_value": "alexsv2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 18:00:36",
            "last_seen_utc": "2025-10-03 09:02:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-n953wsgp3w",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599625": [
        {
            "ioc_value": "dcgrettz.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 18:00:35",
            "last_seen_utc": "2025-10-03 09:02:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-rr5wysy1bs",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599623": [
        {
            "ioc_value": "verybestfuckingpersonieseeninmylifetrulystupidmanwhoaorundon.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-24 18:00:29",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-vmbn4axky2",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599622": [
        {
            "ioc_value": "Shadow2sas-22639.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 18:00:23",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-rhxh8ahr71",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599619": [
        {
            "ioc_value": "rest-tub.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 18:00:22",
            "last_seen_utc": "2025-10-03 09:02:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-sdn7qazscw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599620": [
        {
            "ioc_value": "sponsored-background.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 18:00:22",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-sdn7qazscw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599621": [
        {
            "ioc_value": "san-acceptance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 18:00:22",
            "last_seen_utc": "2025-10-03 09:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-rmh7dsyzcw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599618": [
        {
            "ioc_value": "special-practice.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 18:00:21",
            "last_seen_utc": "2025-10-05 16:26:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-wjjqza1sgy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599616": [
        {
            "ioc_value": "baronby.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-24 17:51:02",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599617": [
        {
            "ioc_value": "melambn.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-24 17:51:02",
            "last_seen_utc": "2025-09-30 14:04:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599614": [
        {
            "ioc_value": "x1.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 17:22:46",
            "last_seen_utc": "2025-09-24 17:24:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599613": [
        {
            "ioc_value": "if.9f4s4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 17:20:55",
            "last_seen_utc": "2025-09-24 22:08:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599612": [
        {
            "ioc_value": "c6.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 17:19:36",
            "last_seen_utc": "2025-09-24 17:21:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599611": [
        {
            "ioc_value": "go.4f7m3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:58:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599610": [
        {
            "ioc_value": "y.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:57:36",
            "last_seen_utc": "2025-09-24 16:58:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599608": [
        {
            "ioc_value": "vq.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:48:23",
            "last_seen_utc": "2025-09-24 16:48:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599609": [
        {
            "ioc_value": "do.4f7m3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:48:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599607": [
        {
            "ioc_value": "d7.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:36:18",
            "last_seen_utc": "2025-09-24 16:33:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599588": [
        {
            "ioc_value": "h5.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:27:51",
            "last_seen_utc": "2025-09-24 15:52:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599595": [
        {
            "ioc_value": "qx.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:27:50",
            "last_seen_utc": "2025-09-24 16:03:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599605": [
        {
            "ioc_value": "m1n.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:27:50",
            "last_seen_utc": "2025-09-24 16:13:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599606": [
        {
            "ioc_value": "s.0y2i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:27:49",
            "last_seen_utc": "2025-09-24 16:19:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599604": [
        {
            "ioc_value": "likemore-go.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-24 16:04:24",
            "last_seen_utc": "2025-09-25 04:01:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+likemore-go.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599603": [
        {
            "ioc_value": "aadcdn.airday.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-24 16:04:23",
            "last_seen_utc": "2025-09-25 04:01:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.39.79.58+aadcdn.airday.beer",
            "tags": "AMAZON-02,AS16509,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599602": [
        {
            "ioc_value": "k7.kd-50.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 16:03:20",
            "last_seen_utc": "2025-09-24 17:24:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599597": [
        {
            "ioc_value": "mail.wholesalecharitysupply.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 16:02:23",
            "last_seen_utc": "2025-09-25 04:00:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.74.8.8+mail.wholesalecharitysupply.com",
            "tags": "AS3223,AsyncRAT,C2,censys,RAT,VOXILITY",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599580": [
        {
            "ioc_value": "z2.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 15:35:00",
            "last_seen_utc": "2025-09-24 14:39:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599581": [
        {
            "ioc_value": "pv.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 15:34:59",
            "last_seen_utc": "2025-09-24 15:17:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599584": [
        {
            "ioc_value": "t.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 15:34:58",
            "last_seen_utc": "2025-09-24 15:23:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599582": [
        {
            "ioc_value": "m0.kd-50.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 15:16:03",
            "last_seen_utc": "2025-09-24 15:49:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599576": [
        {
            "ioc_value": "k1m.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 14:23:12",
            "last_seen_utc": "2025-09-24 13:45:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599577": [
        {
            "ioc_value": "edmund-car.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-24 14:23:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1599578": [
        {
            "ioc_value": "statswpmy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-24 14:23:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1599579": [
        {
            "ioc_value": "a.3e7u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 14:23:10",
            "last_seen_utc": "2025-09-24 13:58:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599575": [
        {
            "ioc_value": "v4.kd-50.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 13:39:29",
            "last_seen_utc": "2025-09-24 14:38:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599574": [
        {
            "ioc_value": "w2.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 13:39:11",
            "last_seen_utc": "2025-09-24 13:39:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599573": [
        {
            "ioc_value": "n8.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 13:34:33",
            "last_seen_utc": "2025-09-24 13:33:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599567": [
        {
            "ioc_value": "x.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 13:27:40",
            "last_seen_utc": "2025-09-24 13:21:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599570": [
        {
            "ioc_value": "members.aielloscigarbar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-24 13:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115259492120550087",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1599549": [
        {
            "ioc_value": "g1.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 13:12:05",
            "last_seen_utc": "2025-09-24 12:38:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599553": [
        {
            "ioc_value": "r9m.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 13:12:04",
            "last_seen_utc": "2025-09-24 12:47:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599563": [
        {
            "ioc_value": "j.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 13:12:03",
            "last_seen_utc": "2025-09-24 13:01:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599564": [
        {
            "ioc_value": "f3.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 13:12:03",
            "last_seen_utc": "2025-09-24 13:08:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599565": [
        {
            "ioc_value": "tc.5i0a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 13:12:02",
            "last_seen_utc": "2025-09-24 13:13:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599550": [
        {
            "ioc_value": "g.kd-50.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 12:38:19",
            "last_seen_utc": "2025-09-24 13:33:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599540": [
        {
            "ioc_value": "x2.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 12:31:25",
            "last_seen_utc": "2025-09-24 12:10:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599543": [
        {
            "ioc_value": "pomofight.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-24 12:31:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115259257437114546",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1599545": [
        {
            "ioc_value": "h.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 12:31:24",
            "last_seen_utc": "2025-09-24 12:29:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599546": [
        {
            "ioc_value": "aa9.gt-70.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 12:28:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599541": [
        {
            "ioc_value": "xq0.gt-70.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 12:10:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599536": [
        {
            "ioc_value": "adssdasdaasd875654-30380.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-24 12:02:17",
            "last_seen_utc": "2025-10-03 09:02:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-jp94wsslt9",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599531": [
        {
            "ioc_value": "asdasdas32332-32639.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 12:00:57",
            "last_seen_utc": "2025-10-03 09:02:26",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-hde9ps1qv3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599529": [
        {
            "ioc_value": "sheismybestgirlbabyangelmylovLg.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-24 12:00:30",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-lgrnpawvez",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599516": [
        {
            "ioc_value": "vetmen.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-24 11:56:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599517": [
        {
            "ioc_value": "divixupdate.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-24 11:56:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599503": [
        {
            "ioc_value": "fee-capabilities.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 11:56:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599504": [
        {
            "ioc_value": "ddnsservice01.theworkpc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 11:56:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599505": [
        {
            "ioc_value": "billiondollarbank.minhacasa.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 11:56:09",
            "last_seen_utc": "2025-09-24 12:00:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599506": [
        {
            "ioc_value": "fnbyo-84-84-38-102.a.free.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 11:56:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599501": [
        {
            "ioc_value": "eeee1231243-40898.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 11:56:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599502": [
        {
            "ioc_value": "responsible-owners.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-24 11:56:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599484": [
        {
            "ioc_value": "s0.z100.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 11:56:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599485": [
        {
            "ioc_value": "dcgretts.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 11:56:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599486": [
        {
            "ioc_value": "medellin7777.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 11:56:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599487": [
        {
            "ioc_value": "cr748129.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 11:56:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599488": [
        {
            "ioc_value": "envio15.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 11:56:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599489": [
        {
            "ioc_value": "dcoctubre15.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 11:56:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599483": [
        {
            "ioc_value": "dcgrezzt.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 11:56:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599478": [
        {
            "ioc_value": "foundation-trying.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 11:56:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599479": [
        {
            "ioc_value": "iusefatalbtw-34401.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 11:56:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599480": [
        {
            "ioc_value": "government-suggesting.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 11:56:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599474": [
        {
            "ioc_value": "indian-occupational.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 11:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599475": [
        {
            "ioc_value": "yayiged372-26061.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 11:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599476": [
        {
            "ioc_value": "zen1thblkhat-64408.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 11:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599477": [
        {
            "ioc_value": "zen1thblkhat-64927.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 11:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "24September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1599467": [
        {
            "ioc_value": "vq.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:52:36",
            "last_seen_utc": "2025-09-24 11:48:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599462": [
        {
            "ioc_value": "z.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:46:19",
            "last_seen_utc": "2025-09-24 11:13:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599464": [
        {
            "ioc_value": "s.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:46:18",
            "last_seen_utc": "2025-09-24 11:18:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599465": [
        {
            "ioc_value": "b8.5e6a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:46:17",
            "last_seen_utc": "2025-09-24 11:41:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599466": [
        {
            "ioc_value": "c5.gt-70.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:41:04",
            "last_seen_utc": "2025-09-24 11:48:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599463": [
        {
            "ioc_value": "l.gt-70.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:13:33",
            "last_seen_utc": "2025-09-24 11:17:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599433": [
        {
            "ioc_value": "hx.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:08:11",
            "last_seen_utc": "2025-09-24 08:02:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599455": [
        {
            "ioc_value": "m2.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:08:11",
            "last_seen_utc": "2025-09-24 10:34:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599447": [
        {
            "ioc_value": "q.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:08:10",
            "last_seen_utc": "2025-09-24 09:03:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599457": [
        {
            "ioc_value": "t1v.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 11:08:09",
            "last_seen_utc": "2025-09-24 10:43:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599456": [
        {
            "ioc_value": "n2.wd-79.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 10:34:29",
            "last_seen_utc": "2025-09-24 10:42:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599452": [
        {
            "ioc_value": "phrupmv.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-24 10:02:50",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599449": [
        {
            "ioc_value": "thujaii.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-24 10:02:49",
            "last_seen_utc": "2025-09-30 14:04:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599450": [
        {
            "ioc_value": "fixatmu.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-24 10:02:49",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599451": [
        {
            "ioc_value": "boustrn.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-24 10:02:49",
            "last_seen_utc": "2025-12-12 12:55:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599448": [
        {
            "ioc_value": "z7.wd-79.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 09:03:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599437": [
        {
            "ioc_value": "b.wd-79.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 08:00:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599434": [
        {
            "ioc_value": "be.4f7m3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 07:57:45",
            "last_seen_utc": "2025-09-24 16:33:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599431": [
        {
            "ioc_value": "d4.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 07:41:37",
            "last_seen_utc": "2025-09-24 07:11:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599429": [
        {
            "ioc_value": "n.3o5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 06:58:22",
            "last_seen_utc": "2025-09-24 06:57:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599430": [
        {
            "ioc_value": "t.nq-52.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 06:47:01",
            "last_seen_utc": "2025-09-24 07:11:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599428": [
        {
            "ioc_value": "tls.psigestioncomercial.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-24 06:38:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1599214": [
        {
            "ioc_value": "sh.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 06:34:39",
            "last_seen_utc": "2025-09-24 06:34:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599426": [
        {
            "ioc_value": "t1.q210u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 06:34:10",
            "last_seen_utc": "2025-09-24 07:11:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599424": [
        {
            "ioc_value": "decrexd.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-24 06:31:04",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599425": [
        {
            "ioc_value": "extemzd.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-24 06:31:04",
            "last_seen_utc": "2025-10-05 14:27:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599422": [
        {
            "ioc_value": "colombiaeslibre9889.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-24 06:30:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599421": [
        {
            "ioc_value": "ars1t.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-24 06:30:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599420": [
        {
            "ioc_value": "southgangfree.ooguy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-09-24 06:29:48",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599419": [
        {
            "ioc_value": "dasilva.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 06:29:31",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1599215": [
        {
            "ioc_value": "xr9.nq-52.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 06:10:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599212": [
        {
            "ioc_value": "names-thrown.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-24 06:01:04",
            "last_seen_utc": "2025-09-24 11:56:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-b6wntsaj6t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599211": [
        {
            "ioc_value": "2209sep25.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-24 06:00:50",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250924-btlyvshq81",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599203": [
        {
            "ioc_value": "uh.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 05:52:45",
            "last_seen_utc": "2025-09-24 04:39:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599205": [
        {
            "ioc_value": "m5.nq-52.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 04:39:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599204": [
        {
            "ioc_value": "qz9.q210u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 04:29:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599174": [
        {
            "ioc_value": "mayikt.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-24 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/43.155.143.29+mayikt.xyz",
            "tags": "AS132203,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1599171": [
        {
            "ioc_value": "v2.q210u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 03:49:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599170": [
        {
            "ioc_value": "ti.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 03:29:14",
            "last_seen_utc": "2025-09-24 03:49:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599169": [
        {
            "ioc_value": "j.nq-52.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 03:23:34",
            "last_seen_utc": "2025-09-24 03:30:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599168": [
        {
            "ioc_value": "fa.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 03:13:52",
            "last_seen_utc": "2025-09-24 03:23:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599166": [
        {
            "ioc_value": "t1.cdn-748.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 02:59:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599165": [
        {
            "ioc_value": "k.q210u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 02:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599163": [
        {
            "ioc_value": "qz9.cdn-748.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 02:33:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599162": [
        {
            "ioc_value": "pa.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 02:18:10",
            "last_seen_utc": "2025-09-24 02:33:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599161": [
        {
            "ioc_value": "ma.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 02:07:55",
            "last_seen_utc": "2025-09-24 02:09:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599160": [
        {
            "ioc_value": "v2.cdn-748.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 01:46:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599159": [
        {
            "ioc_value": "ex.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 01:41:20",
            "last_seen_utc": "2025-09-24 01:51:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599158": [
        {
            "ioc_value": "g4.r852o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 01:38:14",
            "last_seen_utc": "2025-09-24 02:19:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599157": [
        {
            "ioc_value": "re.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 01:37:47",
            "last_seen_utc": "2025-09-24 01:38:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599156": [
        {
            "ioc_value": "pi.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 01:27:50",
            "last_seen_utc": "2025-09-24 01:30:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599155": [
        {
            "ioc_value": "k.cdn-748.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 01:25:41",
            "last_seen_utc": "2025-09-24 01:30:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599154": [
        {
            "ioc_value": "ho.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 01:15:00",
            "last_seen_utc": "2025-09-24 01:25:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599153": [
        {
            "ioc_value": "hi.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 00:42:50",
            "last_seen_utc": "2025-09-24 00:46:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599152": [
        {
            "ioc_value": "yo.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 00:39:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599151": [
        {
            "ioc_value": "u1.r852o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 00:36:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599150": [
        {
            "ioc_value": "ya.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 00:21:47",
            "last_seen_utc": "2025-09-24 00:36:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599149": [
        {
            "ioc_value": "ok.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 00:19:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599148": [
        {
            "ioc_value": "bi.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 00:16:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599147": [
        {
            "ioc_value": "aw.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 00:11:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599146": [
        {
            "ioc_value": "ad.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 00:10:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599143": [
        {
            "ioc_value": "ye.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-24 00:03:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599122": [
        {
            "ioc_value": "pm7.cdn-325.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 23:37:46",
            "last_seen_utc": "2025-09-24 00:46:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599121": [
        {
            "ioc_value": "we.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 23:37:14",
            "last_seen_utc": "2025-09-23 23:37:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599120": [
        {
            "ioc_value": "u1.cdn-325.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 23:09:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599114": [
        {
            "ioc_value": "us.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 22:22:17",
            "last_seen_utc": "2025-09-23 23:09:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599113": [
        {
            "ioc_value": "up.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 22:17:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599112": [
        {
            "ioc_value": "y.cdn-325.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 21:48:18",
            "last_seen_utc": "2025-09-23 21:52:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599111": [
        {
            "ioc_value": "so.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 21:29:32",
            "last_seen_utc": "2025-09-23 21:48:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599110": [
        {
            "ioc_value": "z3.cdn-123.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 21:23:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599109": [
        {
            "ioc_value": "z3.q463a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 21:23:17",
            "last_seen_utc": "2025-09-23 22:27:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599107": [
        {
            "ioc_value": "ox.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 21:21:47",
            "last_seen_utc": "2025-09-23 21:23:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599104": [
        {
            "ioc_value": "u1.q463a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 20:40:21",
            "last_seen_utc": "2025-09-23 21:15:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599100": [
        {
            "ioc_value": "kausjdhfasdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 20:25:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599099": [
        {
            "ioc_value": "skldfjgsldkmfgsdfg.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 20:25:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599098": [
        {
            "ioc_value": "qm9.cdn-123.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 20:22:17",
            "last_seen_utc": "2025-09-23 20:32:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599097": [
        {
            "ioc_value": "if.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 20:11:01",
            "last_seen_utc": "2025-09-23 20:14:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599096": [
        {
            "ioc_value": "u1.cdn-123.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 20:09:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599095": [
        {
            "ioc_value": "he.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 20:08:27",
            "last_seen_utc": "2025-09-23 20:09:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599094": [
        {
            "ioc_value": "do.gyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 20:06:47",
            "last_seen_utc": "2025-09-23 20:08:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599087": [
        {
            "ioc_value": "h.q463a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 20:01:53",
            "last_seen_utc": "2025-09-23 20:21:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599083": [
        {
            "ioc_value": "threwindowsunderdevices.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-23 20:01:27",
            "last_seen_utc": "2025-09-24 04:00:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/181.174.164.116+threwindowsunderdevices.xyz",
            "tags": "AS52469,C2,censys,Havoc,Offshore",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599065": [
        {
            "ioc_value": "defender-telemerty.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-23 19:10:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/f8735125bde9396b8aba244bd75f0dc1331a6ba0b5bc4741ac6a83531dd58003",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599062": [
        {
            "ioc_value": "am.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 18:49:17",
            "last_seen_utc": "2025-09-23 18:59:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599058": [
        {
            "ioc_value": "craser-36950.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-23 18:03:45",
            "last_seen_utc": "2025-10-10 11:34:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250923-tyxv2attdy",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599055": [
        {
            "ioc_value": "solarbee.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-23 18:00:42",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250923-q643jaslz9",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599052": [
        {
            "ioc_value": "received-lovely.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-23 18:00:36",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250923-tyf8aattcz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599053": [
        {
            "ioc_value": "chucks.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-23 18:00:36",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250923-rbrz6abn7s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599054": [
        {
            "ioc_value": "hot-pens.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-23 18:00:36",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250923-pfrtvaxyav",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599051": [
        {
            "ioc_value": "cm.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:52:20",
            "last_seen_utc": "2025-09-23 17:53:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599018": [
        {
            "ioc_value": "tq.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:50:13",
            "last_seen_utc": "2025-09-23 16:01:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599037": [
        {
            "ioc_value": "h9m.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:50:13",
            "last_seen_utc": "2025-09-23 16:10:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599038": [
        {
            "ioc_value": "x.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:50:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599040": [
        {
            "ioc_value": "p.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:50:12",
            "last_seen_utc": "2025-09-23 16:29:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599044": [
        {
            "ioc_value": "ve.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:50:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599042": [
        {
            "ioc_value": "k8.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:50:11",
            "last_seen_utc": "2025-09-23 16:37:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599047": [
        {
            "ioc_value": "u.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:50:10",
            "last_seen_utc": "2025-09-23 17:27:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599045": [
        {
            "ioc_value": "r3.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:50:09",
            "last_seen_utc": "2025-09-23 16:53:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599050": [
        {
            "ioc_value": "y7.1i5i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:50:08",
            "last_seen_utc": "2025-09-23 17:44:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599048": [
        {
            "ioc_value": "h.cdn-123.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 17:27:28",
            "last_seen_utc": "2025-09-23 19:55:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599046": [
        {
            "ioc_value": "r2.cdn-357.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 16:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599043": [
        {
            "ioc_value": "a.1v4r4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 16:37:41",
            "last_seen_utc": "2025-09-23 19:57:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599041": [
        {
            "ioc_value": "wq9.cdn-357.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 16:29:26",
            "last_seen_utc": "2025-09-23 16:33:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599034": [
        {
            "ioc_value": "ityfrdftghujiokpiuytfrfg.tierzerosecurity.co.nz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-23 16:01:59",
            "last_seen_utc": "2025-09-24 04:02:11",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.27.140.57+ityfrdftghujiokpiuytfrfg.tierzerosecurity.co.nz",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1599028": [
        {
            "ioc_value": "wq9.k625e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 16:01:35",
            "last_seen_utc": "2025-09-23 16:09:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599021": [
        {
            "ioc_value": "c7.cdn-357.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 16:01:22",
            "last_seen_utc": "2025-09-23 16:10:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598931": [
        {
            "ioc_value": "li.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:28",
            "last_seen_utc": "2025-09-23 11:30:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598934": [
        {
            "ioc_value": "xq.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:26",
            "last_seen_utc": "2025-09-23 11:40:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598937": [
        {
            "ioc_value": "yy.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:26",
            "last_seen_utc": "2025-09-23 11:52:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598936": [
        {
            "ioc_value": "js.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:25",
            "last_seen_utc": "2025-09-23 11:43:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598943": [
        {
            "ioc_value": "gd.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:25",
            "last_seen_utc": "2025-09-23 12:08:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598966": [
        {
            "ioc_value": "iv.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:24",
            "last_seen_utc": "2025-09-23 12:38:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598970": [
        {
            "ioc_value": "id.nyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:24",
            "last_seen_utc": "2025-09-23 12:52:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598973": [
        {
            "ioc_value": "ao.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:23",
            "last_seen_utc": "2025-09-23 13:05:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598977": [
        {
            "ioc_value": "ek.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:23",
            "last_seen_utc": "2025-09-23 13:14:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598974": [
        {
            "ioc_value": "sd.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:22",
            "last_seen_utc": "2025-09-23 13:10:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598981": [
        {
            "ioc_value": "f.nyfk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:22",
            "last_seen_utc": "2025-09-23 13:23:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598983": [
        {
            "ioc_value": "vd.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:21",
            "last_seen_utc": "2025-09-23 13:31:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598988": [
        {
            "ioc_value": "aq.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:21",
            "last_seen_utc": "2025-09-23 13:53:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598992": [
        {
            "ioc_value": "xb.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:21",
            "last_seen_utc": "2025-09-24 02:59:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598993": [
        {
            "ioc_value": "gw.nyps.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598995": [
        {
            "ioc_value": "m9.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:19",
            "last_seen_utc": "2025-09-23 14:23:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598997": [
        {
            "ioc_value": "courchellin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-23 15:46:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115254064627888228",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1598999": [
        {
            "ioc_value": "zp.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:17",
            "last_seen_utc": "2025-09-23 14:37:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599003": [
        {
            "ioc_value": "r.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599004": [
        {
            "ioc_value": "x1.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:16",
            "last_seen_utc": "2025-09-23 18:06:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599006": [
        {
            "ioc_value": "kt.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:15",
            "last_seen_utc": "2025-09-23 14:55:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599008": [
        {
            "ioc_value": "v2n.5y4a.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:15",
            "last_seen_utc": "2025-09-23 14:59:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599009": [
        {
            "ioc_value": "g.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:14",
            "last_seen_utc": "2025-09-23 15:10:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599011": [
        {
            "ioc_value": "q7.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:14",
            "last_seen_utc": "2025-09-23 15:24:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599014": [
        {
            "ioc_value": "bd.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:13",
            "last_seen_utc": "2025-09-23 15:33:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599016": [
        {
            "ioc_value": "z1.6i4u.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:46:13",
            "last_seen_utc": "2025-09-23 15:41:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1599012": [
        {
            "ioc_value": "box.kiwisandblasting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-23 15:46:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115254300029311239",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1599017": [
        {
            "ioc_value": "c7.k625e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599015": [
        {
            "ioc_value": "n.cdn-357.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:33:09",
            "last_seen_utc": "2025-09-23 15:37:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599013": [
        {
            "ioc_value": "m7.cdn-659.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:24:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599010": [
        {
            "ioc_value": "tq1.cdn-659.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 15:10:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599007": [
        {
            "ioc_value": "b2.cdn-659.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 14:53:51",
            "last_seen_utc": "2025-09-23 14:59:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599005": [
        {
            "ioc_value": "n.k625e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 14:51:55",
            "last_seen_utc": "2025-09-23 15:15:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599002": [
        {
            "ioc_value": "x.cdn-659.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 14:37:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1599000": [
        {
            "ioc_value": "m7.r219i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 14:29:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598994": [
        {
            "ioc_value": "tq1.r219i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 14:12:05",
            "last_seen_utc": "2025-09-23 14:23:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598990": [
        {
            "ioc_value": "e1.cdn-626.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 13:53:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598989": [
        {
            "ioc_value": "b2.r219i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 13:52:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598985": [
        {
            "ioc_value": "qk2.cdn-626.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 13:31:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598984": [
        {
            "ioc_value": "x.r219i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 13:31:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598976": [
        {
            "ioc_value": "u5.cdn-626.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 13:10:33",
            "last_seen_utc": "2025-09-23 13:23:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598975": [
        {
            "ioc_value": "e1.v354y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 13:09:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598972": [
        {
            "ioc_value": "qk2.v354y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 12:52:35",
            "last_seen_utc": "2025-09-23 13:05:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598971": [
        {
            "ioc_value": "r.cdn-626.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 12:52:14",
            "last_seen_utc": "2025-09-23 13:04:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598968": [
        {
            "ioc_value": "k7.cdn-568.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 12:38:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598967": [
        {
            "ioc_value": "u5.v354y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 12:30:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598965": [
        {
            "ioc_value": "aa9.cdn-568.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 12:08:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598962": [
        {
            "ioc_value": "r.v354y.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 12:02:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598949": [
        {
            "ioc_value": "faris552-36484.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-23 12:00:35",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250923-nhcbhadj71",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598941": [
        {
            "ioc_value": "upa.uwintech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-23 11:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1598942": [
        {
            "ioc_value": "upa.psigestioncomercial.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-23 11:58:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1598938": [
        {
            "ioc_value": "v2.cdn-568.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:52:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598935": [
        {
            "ioc_value": "aa9.n278o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:39:41",
            "last_seen_utc": "2025-09-23 11:44:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598933": [
        {
            "ioc_value": "g.cdn-568.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:30:09",
            "last_seen_utc": "2025-09-23 11:40:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598932": [
        {
            "ioc_value": "v2.n278o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:28:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598911": [
        {
            "ioc_value": "y.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:11:22",
            "last_seen_utc": "2025-09-23 21:52:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598914": [
        {
            "ioc_value": "qm.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:11:22",
            "last_seen_utc": "2025-09-23 09:31:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598917": [
        {
            "ioc_value": "mw.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:11:22",
            "last_seen_utc": "2025-09-23 09:51:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598919": [
        {
            "ioc_value": "fo.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:11:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598920": [
        {
            "ioc_value": "tc.kokq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:11:21",
            "last_seen_utc": "2025-09-23 10:28:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598923": [
        {
            "ioc_value": "eu.lalz.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 11:11:21",
            "last_seen_utc": "2025-09-23 10:41:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598925": [
        {
            "ioc_value": "aa9.cdn-779.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 10:41:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598924": [
        {
            "ioc_value": "g.n278o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 10:40:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598922": [
        {
            "ioc_value": "aa9.h924i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 10:28:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598921": [
        {
            "ioc_value": "xq0.cdn-779.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 10:28:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598918": [
        {
            "ioc_value": "c5.cdn-779.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 09:51:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598916": [
        {
            "ioc_value": "xq0.h924i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 09:31:40",
            "last_seen_utc": "2025-09-23 09:43:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598915": [
        {
            "ioc_value": "l.cdn-779.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 09:30:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598912": [
        {
            "ioc_value": "c5.h924i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 09:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598913": [
        {
            "ioc_value": "n0.cdn-886.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 09:18:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598910": [
        {
            "ioc_value": "ay.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 09:06:00",
            "last_seen_utc": "2025-09-23 21:15:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598909": [
        {
            "ioc_value": "rq8.cdn-886.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 08:59:21",
            "last_seen_utc": "2025-09-23 09:05:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598353": [
        {
            "ioc_value": "ct.jorx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 08:58:21",
            "last_seen_utc": "2025-09-23 07:35:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598369": [
        {
            "ioc_value": "rg.jorx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 08:58:20",
            "last_seen_utc": "2025-09-23 08:15:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598904": [
        {
            "ioc_value": "zs.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 08:58:20",
            "last_seen_utc": "2025-09-23 08:48:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598908": [
        {
            "ioc_value": "tr.kocq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 08:58:20",
            "last_seen_utc": "2025-09-23 09:02:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598907": [
        {
            "ioc_value": "l.h924i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 08:48:16",
            "last_seen_utc": "2025-09-23 09:06:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598905": [
        {
            "ioc_value": "b2.cdn-886.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 08:47:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598902": [
        {
            "ioc_value": "commonloamprojects.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-23 08:39:31",
            "last_seen_utc": "2025-10-29 13:19:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2726",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1598900": [
        {
            "ioc_value": "00704ae865ee.ngrok.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-23 08:38:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2727",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1598901": [
        {
            "ioc_value": "meshsorterio.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-23 08:38:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2727",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1598355": [
        {
            "ioc_value": "rq8.f342i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 07:35:17",
            "last_seen_utc": "2025-09-23 08:14:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598354": [
        {
            "ioc_value": "z.cdn-886.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 07:20:52",
            "last_seen_utc": "2025-09-23 08:15:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598339": [
        {
            "ioc_value": "n.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 07:01:57",
            "last_seen_utc": "2025-09-23 20:50:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598342": [
        {
            "ioc_value": "uy.jorx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 07:01:57",
            "last_seen_utc": "2025-09-23 06:14:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598343": [
        {
            "ioc_value": "wx.jorx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 07:01:57",
            "last_seen_utc": "2025-09-23 06:27:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598348": [
        {
            "ioc_value": "ity.uwintech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-23 06:54:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1598349": [
        {
            "ioc_value": "ity.psigestioncomercial.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-23 06:54:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1598345": [
        {
            "ioc_value": "b2.f342i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 06:27:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598344": [
        {
            "ioc_value": "t1.cdn-175.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 06:18:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598341": [
        {
            "ioc_value": "qk2.cdn-175.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 06:08:24",
            "last_seen_utc": "2025-09-23 06:14:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598340": [
        {
            "ioc_value": "z.f342i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 06:08:15",
            "last_seen_utc": "2025-09-23 06:14:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598123": [
        {
            "ioc_value": "coursedillema.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-23 06:04:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115248817408873955",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1598125": [
        {
            "ioc_value": "founderevo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-23 06:04:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115248817408873955",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1598137": [
        {
            "ioc_value": "storage.westinsinsurance.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-23 06:04:19",
            "last_seen_utc": "2025-09-23 08:40:10",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115249093922288690",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1598161": [
        {
            "ioc_value": "vps.denissalazar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-23 06:04:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SocGholish,TDS",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1598274": [
        {
            "ioc_value": "gitcoin-fund.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-23 06:04:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "icybear"
        }
    ],
    "1598334": [
        {
            "ioc_value": "operation-rent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-23 06:03:51",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250923-atpt3szzas",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598333": [
        {
            "ioc_value": "zen1thblkhat-48437.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-23 06:01:21",
            "last_seen_utc": "2025-09-24 11:56:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250923-egw5vawrz2",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598332": [
        {
            "ioc_value": "p1streetsira-36072.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-23 06:00:33",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250923-exs35axkx5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598331": [
        {
            "ioc_value": "m7.cdn-175.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:59:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598329": [
        {
            "ioc_value": "zx.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:59:46",
            "last_seen_utc": "2025-09-23 05:59:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598330": [
        {
            "ioc_value": "t1.p556i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:59:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598328": [
        {
            "ioc_value": "qk2.p556i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:49:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598327": [
        {
            "ioc_value": "ld.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:49:43",
            "last_seen_utc": "2025-09-23 05:49:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598326": [
        {
            "ioc_value": "m7.p556i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:39:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598324": [
        {
            "ioc_value": "x.cdn-175.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:38:58",
            "last_seen_utc": "2025-09-23 05:49:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598325": [
        {
            "ioc_value": "bm.jolm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:38:58",
            "last_seen_utc": "2025-09-23 05:39:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598323": [
        {
            "ioc_value": "g4.hu-50.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:30:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598321": [
        {
            "ioc_value": "gs.gyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:28:34",
            "last_seen_utc": "2025-09-23 05:30:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598320": [
        {
            "ioc_value": "x.p556i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:22:40",
            "last_seen_utc": "2025-09-23 05:28:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598318": [
        {
            "ioc_value": "ue.gyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:13:36",
            "last_seen_utc": "2025-09-23 05:22:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598319": [
        {
            "ioc_value": "pm7.hu-50.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 05:13:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598317": [
        {
            "ioc_value": "u1.hu-50.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 04:28:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598315": [
        {
            "ioc_value": "y.hu-50.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 04:20:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598316": [
        {
            "ioc_value": "pk.gyfc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 04:20:04",
            "last_seen_utc": "2025-09-23 20:01:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598313": [
        {
            "ioc_value": "z3.dy-77.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 04:09:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598314": [
        {
            "ioc_value": "pe.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 04:09:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598294": [
        {
            "ioc_value": "vizz.tail088e6a.ts.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-23 04:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.84.155.153+vizz.tail088e6a.ts.net",
            "tags": "AS36236,C2,censys,Mythic,NETACTUATE",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1598292": [
        {
            "ioc_value": "patch.updatesapi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-09-23 04:00:27",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": "https://search.censys.io/hosts/103.85.252.170+patch.updatesapi.com",
            "tags": "AS59371,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1598286": [
        {
            "ioc_value": "tv.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:58:41",
            "last_seen_utc": "2025-09-23 19:30:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598287": [
        {
            "ioc_value": "qm9.dy-77.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:58:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598285": [
        {
            "ioc_value": "u1.dy-77.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:49:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598283": [
        {
            "ioc_value": "g4.q642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:49:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598284": [
        {
            "ioc_value": "cr.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:49:15",
            "last_seen_utc": "2025-09-23 03:49:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598281": [
        {
            "ioc_value": "dz.dumx.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:38:56",
            "last_seen_utc": "2025-09-23 03:41:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598282": [
        {
            "ioc_value": "pm7.q642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:38:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598279": [
        {
            "ioc_value": "fv.xx-os.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:29:30",
            "last_seen_utc": "2025-09-23 03:37:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598280": [
        {
            "ioc_value": "u1.q642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:29:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598277": [
        {
            "ioc_value": "y.q642.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:18:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598278": [
        {
            "ioc_value": "tw.xx-os.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:18:39",
            "last_seen_utc": "2025-09-23 03:19:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598275": [
        {
            "ioc_value": "fe.xx-os.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:08:45",
            "last_seen_utc": "2025-09-23 03:08:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598276": [
        {
            "ioc_value": "z3.k807.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 03:08:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598273": [
        {
            "ioc_value": "fs.xx-os.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 02:56:30",
            "last_seen_utc": "2025-09-23 03:03:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598272": [
        {
            "ioc_value": "re.xxos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 02:51:50",
            "last_seen_utc": "2025-09-23 02:51:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598271": [
        {
            "ioc_value": "4aqsbhe9vh44.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-23 02:48:35",
            "last_seen_utc": "2025-10-29 09:49:10",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1598270": [
        {
            "ioc_value": "qm9.k807.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 02:40:59",
            "last_seen_utc": "2025-09-23 02:56:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598269": [
        {
            "ioc_value": "h.dy-77.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 02:40:43",
            "last_seen_utc": "2025-09-23 03:41:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598268": [
        {
            "ioc_value": "n.xxos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 02:40:42",
            "last_seen_utc": "2025-09-23 02:40:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598266": [
        {
            "ioc_value": "r2.dy-53.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 01:28:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598265": [
        {
            "ioc_value": "u1.k807.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 01:26:40",
            "last_seen_utc": "2025-09-23 01:30:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598264": [
        {
            "ioc_value": "xb.xxos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 01:26:30",
            "last_seen_utc": "2025-09-23 01:30:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598263": [
        {
            "ioc_value": "h.k807.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 01:05:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598262": [
        {
            "ioc_value": "wq9.dy-53.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 01:05:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598261": [
        {
            "ioc_value": "mn.xxos.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 01:04:00",
            "last_seen_utc": "2025-09-23 01:05:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598260": [
        {
            "ioc_value": "r2.t940.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 00:18:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598259": [
        {
            "ioc_value": "c7.dy-53.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 00:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598258": [
        {
            "ioc_value": "i.xqix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-23 00:17:02",
            "last_seen_utc": "2025-09-23 00:18:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598244": [
        {
            "ioc_value": "n.dy-53.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 23:52:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598243": [
        {
            "ioc_value": "wq9.t940.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 23:51:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598242": [
        {
            "ioc_value": "yw.wtan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 23:50:58",
            "last_seen_utc": "2025-09-22 23:52:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598241": [
        {
            "ioc_value": "c7.t940.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 23:25:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598240": [
        {
            "ioc_value": "ts.wtan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 23:24:54",
            "last_seen_utc": "2025-09-22 23:26:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598239": [
        {
            "ioc_value": "m7.mo-49.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 23:15:54",
            "last_seen_utc": "2025-09-22 23:26:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598238": [
        {
            "ioc_value": "jb.wtan.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 23:15:14",
            "last_seen_utc": "2025-09-22 23:15:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598236": [
        {
            "ioc_value": "tq1.mo-49.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 22:49:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598235": [
        {
            "ioc_value": "zv.wqix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 22:47:33",
            "last_seen_utc": "2025-09-22 22:49:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598234": [
        {
            "ioc_value": "b2.mo-49.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 22:01:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598233": [
        {
            "ioc_value": "sh.wqix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 21:59:04",
            "last_seen_utc": "2025-09-22 22:08:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598232": [
        {
            "ioc_value": "n.t940.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 21:42:30",
            "last_seen_utc": "2025-09-22 22:48:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598231": [
        {
            "ioc_value": "hg.wqix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 21:31:59",
            "last_seen_utc": "2025-09-22 21:42:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598230": [
        {
            "ioc_value": "x.mo-49.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 21:22:52",
            "last_seen_utc": "2025-09-22 21:32:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598229": [
        {
            "ioc_value": "vn.wqix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 21:20:41",
            "last_seen_utc": "2025-09-22 21:22:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598228": [
        {
            "ioc_value": "m7.k987.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 21:17:42",
            "last_seen_utc": "2025-09-22 21:21:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598227": [
        {
            "ioc_value": "e1.ja-02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 21:09:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598226": [
        {
            "ioc_value": "wm.vxof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 21:08:53",
            "last_seen_utc": "2025-09-22 21:17:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598222": [
        {
            "ioc_value": "tq1.k987.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 20:46:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598220": [
        {
            "ioc_value": "y.vxof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 20:44:19",
            "last_seen_utc": "2025-09-22 20:46:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598218": [
        {
            "ioc_value": "nsgatetest1.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-22 20:42:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1969078281656733860",
            "tags": "c2,domain,NetSupport,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598203": [
        {
            "ioc_value": "qk2.ja-02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 20:03:10",
            "last_seen_utc": "2025-09-22 20:45:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598201": [
        {
            "ioc_value": "b2.k987.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 20:02:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598182": [
        {
            "ioc_value": "be.vxof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 19:54:53",
            "last_seen_utc": "2025-09-22 20:03:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598174": [
        {
            "ioc_value": "x.k987.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 19:24:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598166": [
        {
            "ioc_value": "narroxp.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-22 19:19:00",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598167": [
        {
            "ioc_value": "squeaue.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-22 19:19:00",
            "last_seen_utc": "2025-12-13 12:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598168": [
        {
            "ioc_value": "vicareu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-22 19:19:00",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598169": [
        {
            "ioc_value": "ozonelf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-22 19:19:00",
            "last_seen_utc": "2025-12-13 12:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598170": [
        {
            "ioc_value": "squatje.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-22 19:19:00",
            "last_seen_utc": "2025-12-13 12:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598171": [
        {
            "ioc_value": "exposqw.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-22 19:19:00",
            "last_seen_utc": "2025-12-13 12:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598172": [
        {
            "ioc_value": "bendavo.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-22 19:19:00",
            "last_seen_utc": "2025-12-13 12:00:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598173": [
        {
            "ioc_value": "conxmsw.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-22 19:19:00",
            "last_seen_utc": "2025-12-12 12:55:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598164": [
        {
            "ioc_value": "u5.ja-02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 19:11:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598165": [
        {
            "ioc_value": "vh.vwof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 19:11:22",
            "last_seen_utc": "2025-09-22 19:24:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598163": [
        {
            "ioc_value": "e1.s951.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 18:53:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598162": [
        {
            "ioc_value": "pn.vwof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 18:53:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598159": [
        {
            "ioc_value": "neutralmarlservices.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-22 18:17:40",
            "last_seen_utc": "2025-09-23 08:39:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1598158": [
        {
            "ioc_value": "qk2.s951.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 18:13:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598156": [
        {
            "ioc_value": "qc.vwof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 18:12:23",
            "last_seen_utc": "2025-09-22 18:13:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598157": [
        {
            "ioc_value": "r.ja-02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 18:12:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598144": [
        {
            "ioc_value": "turn-janet.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-22 18:01:03",
            "last_seen_utc": "2025-09-24 11:56:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-wdymyagl8w",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598145": [
        {
            "ioc_value": "omniz-57501.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-22 18:01:03",
            "last_seen_utc": "2025-09-24 11:56:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-vq7kyasmt9",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598143": [
        {
            "ioc_value": "00kla.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-22 18:00:40",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-q61p4szrs4",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598142": [
        {
            "ioc_value": "nnamoograce.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-22 18:00:39",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-r66rsstxet",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1598139": [
        {
            "ioc_value": "u.vjef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 17:30:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598138": [
        {
            "ioc_value": "k7.me-71.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 17:30:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598135": [
        {
            "ioc_value": "aa9.me-71.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 17:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598136": [
        {
            "ioc_value": "nq.vjef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 17:18:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598134": [
        {
            "ioc_value": "oi.vgof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 16:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598133": [
        {
            "ioc_value": "v2.me-71.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 16:59:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598132": [
        {
            "ioc_value": "r.s951.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 16:52:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598131": [
        {
            "ioc_value": "vps.lonk-fort.ts.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 16:50:07",
            "last_seen_utc": "2025-11-01 07:49:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1598128": [
        {
            "ioc_value": "g.me-71.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 16:44:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598129": [
        {
            "ioc_value": "rh.vgof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 16:44:25",
            "last_seen_utc": "2025-09-22 16:52:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598127": [
        {
            "ioc_value": "q.ny-54.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 16:15:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598120": [
        {
            "ioc_value": "cg.vgof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 16:08:38",
            "last_seen_utc": "2025-09-22 16:15:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598121": [
        {
            "ioc_value": "aa9.q277.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 16:08:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598114": [
        {
            "ioc_value": "spt.boosoo.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-22 16:01:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1598115": [
        {
            "ioc_value": "spt.proksen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-22 16:01:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1598108": [
        {
            "ioc_value": "v2.q277.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 15:58:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598107": [
        {
            "ioc_value": "fb.vbof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 15:58:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598105": [
        {
            "ioc_value": "bt7.ny-54.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 15:46:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598106": [
        {
            "ioc_value": "kp.vbof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 15:46:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598104": [
        {
            "ioc_value": "rd.vbof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 15:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598100": [
        {
            "ioc_value": "cstest.mucfc.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 14:49:30",
            "last_seen_utc": "2025-12-14 11:48:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1598098": [
        {
            "ioc_value": "m3.ny-54.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:47:43",
            "last_seen_utc": "2025-09-22 15:18:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598099": [
        {
            "ioc_value": "rj.ttif.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:47:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598086": [
        {
            "ioc_value": "phpmyadmin.westinsinsurance.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-22 14:36:06",
            "last_seen_utc": "2025-09-23 08:40:10",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115248382453184747",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1598089": [
        {
            "ioc_value": "zo.ttif.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:34:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598087": [
        {
            "ioc_value": "yg.sjoh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:29:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598088": [
        {
            "ioc_value": "z.ny-54.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:29:56",
            "last_seen_utc": "2025-09-22 14:34:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598085": [
        {
            "ioc_value": "l.by-64.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:16:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598084": [
        {
            "ioc_value": "xp.sjef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:16:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598083": [
        {
            "ioc_value": "bc.pxys.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:14:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598081": [
        {
            "ioc_value": "d.xe-96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:12:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598082": [
        {
            "ioc_value": "ov.pxys.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:12:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598079": [
        {
            "ioc_value": "z.s167.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:10:10",
            "last_seen_utc": "2025-09-22 14:14:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1598080": [
        {
            "ioc_value": "pt.pqix.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:10:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597955": [
        {
            "ioc_value": "of.nxys.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:06:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597954": [
        {
            "ioc_value": "l.c267.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 14:06:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597951": [
        {
            "ioc_value": "k.ve-27.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 13:44:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597950": [
        {
            "ioc_value": "am.nwyk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 13:44:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597948": [
        {
            "ioc_value": "ki.nd-ox.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 13:35:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597949": [
        {
            "ioc_value": "d.k645.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 13:35:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597944": [
        {
            "ioc_value": "k.n791.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 12:51:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597943": [
        {
            "ioc_value": "q.mwop.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 12:51:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597939": [
        {
            "ioc_value": "c5.3i6i4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 12:15:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597940": [
        {
            "ioc_value": "qg.mjef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 12:15:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597927": [
        {
            "ioc_value": "krakas.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-22 12:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-jwg2paywdz",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1597926": [
        {
            "ioc_value": "sungito.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-22 12:00:30",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-j2ll3agm4z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1597923": [
        {
            "ioc_value": "l.3i6i4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 11:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597924": [
        {
            "ioc_value": "sd.mjef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 11:59:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597921": [
        {
            "ioc_value": "qy6.5u0i4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 11:52:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597920": [
        {
            "ioc_value": "um.mjef.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 11:52:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597919": [
        {
            "ioc_value": "u1.5u0i4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 11:33:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597918": [
        {
            "ioc_value": "pf.ljat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 11:33:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597916": [
        {
            "ioc_value": "p.ljat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 11:04:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597917": [
        {
            "ioc_value": "h.5u0i4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 11:04:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597915": [
        {
            "ioc_value": "lq.ljat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 10:49:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597914": [
        {
            "ioc_value": "pm7.5i4u8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 10:26:49",
            "last_seen_utc": "2025-09-22 10:49:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597913": [
        {
            "ioc_value": "si.ljat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 10:26:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597910": [
        {
            "ioc_value": "od.jzak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 09:34:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597911": [
        {
            "ioc_value": "w4.5i4u8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 09:34:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597908": [
        {
            "ioc_value": "xt.jzak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 09:14:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597909": [
        {
            "ioc_value": "d.5i4u8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 09:14:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597905": [
        {
            "ioc_value": "rq8.7i7y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 08:51:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597906": [
        {
            "ioc_value": "bj.jzak.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 08:51:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597902": [
        {
            "ioc_value": "supp.desktop.wales",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:42",
            "last_seen_utc": "2025-10-25 07:49:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597901": [
        {
            "ioc_value": "ns3.duoo.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:40",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597900": [
        {
            "ioc_value": "ns2.jszwfw.com.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:39",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597898": [
        {
            "ioc_value": "ns2.cryptwechat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:38",
            "last_seen_utc": "2025-10-25 07:49:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597899": [
        {
            "ioc_value": "ns2.duoo.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:38",
            "last_seen_utc": "2025-12-14 11:48:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597897": [
        {
            "ioc_value": "ns2.boccfc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:37",
            "last_seen_utc": "2025-11-27 09:49:57",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597895": [
        {
            "ioc_value": "ns1.duoo.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:36",
            "last_seen_utc": "2025-12-14 11:48:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597896": [
        {
            "ioc_value": "ns1.jszwfw.com.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:36",
            "last_seen_utc": "2025-12-14 11:48:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597893": [
        {
            "ioc_value": "ns1.boccfc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:35",
            "last_seen_utc": "2025-11-27 09:49:54",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597894": [
        {
            "ioc_value": "ns1.cryptwechat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 08:49:35",
            "last_seen_utc": "2025-10-25 07:49:27",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1597856": [
        {
            "ioc_value": "b2.7i7y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 08:04:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597857": [
        {
            "ioc_value": "iu.ht-if.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 08:04:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597848": [
        {
            "ioc_value": "z.7i7y5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 07:44:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597845": [
        {
            "ioc_value": "xq9.0e0y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 07:25:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597846": [
        {
            "ioc_value": "tk.ht-if.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 07:25:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597844": [
        {
            "ioc_value": "pl.ht-if.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 07:13:38",
            "last_seen_utc": "2025-09-22 07:44:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597840": [
        {
            "ioc_value": "r0.ttx.boosoo.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-22 07:08:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1597841": [
        {
            "ioc_value": "r0.ttx.proksen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-22 07:08:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1597834": [
        {
            "ioc_value": "sp.htif.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 07:02:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597835": [
        {
            "ioc_value": "t3.0e0y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 07:02:05",
            "last_seen_utc": "2025-09-22 07:13:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1597833": [
        {
            "ioc_value": "cmb8k1nbj000008l1api07o0n.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-22 06:56:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Filch",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597831": [
        {
            "ioc_value": "jtcipher.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-22 06:54:19",
            "last_seen_utc": "2025-09-23 08:39:31",
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2726",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597832": [
        {
            "ioc_value": "modestknollpartners.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-22 06:54:19",
            "last_seen_utc": "2025-12-05 15:01:18",
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2726",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597828": [
        {
            "ioc_value": "00704ae865ee.ngrok.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-22 06:53:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2727",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597829": [
        {
            "ioc_value": "plainfenassociates.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-22 06:53:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2727",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597830": [
        {
            "ioc_value": "meshsorterio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-22 06:53:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2727",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597825": [
        {
            "ioc_value": "karina2bento-com.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-22 06:52:12",
            "last_seen_utc": "2025-10-14 14:34:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597813": [
        {
            "ioc_value": "vqrsxslnbqt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597814": [
        {
            "ioc_value": "wgpvglbadxo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597815": [
        {
            "ioc_value": "wwteytsfaiyrrg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597816": [
        {
            "ioc_value": "wxrbiscgahcnxq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597817": [
        {
            "ioc_value": "wxxlrbjfyauvrpqfuv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597818": [
        {
            "ioc_value": "xkrndqbrwnayscq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597819": [
        {
            "ioc_value": "xynixjxxkgmxs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597820": [
        {
            "ioc_value": "ybhiodxwwmoymuv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597821": [
        {
            "ioc_value": "yipxgadyonkkdjqoraa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597822": [
        {
            "ioc_value": "ykvhpxixrqgid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597823": [
        {
            "ioc_value": "ynnwhiuoxqyjxrfqa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597824": [
        {
            "ioc_value": "ypairkaitcljoq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597791": [
        {
            "ioc_value": "iwdellebhavmei.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597792": [
        {
            "ioc_value": "jhapjgvatltxunklfwk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597793": [
        {
            "ioc_value": "ju37yebdhf72938.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597794": [
        {
            "ioc_value": "kntkuamkkrwaknrusx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597795": [
        {
            "ioc_value": "mbtseiltigrijncw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597796": [
        {
            "ioc_value": "mfdpeurxwcevjrp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597797": [
        {
            "ioc_value": "mfvgfeqskjbdvgbk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597798": [
        {
            "ioc_value": "mwqgwqcbllxhchd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597799": [
        {
            "ioc_value": "nfyetostisllhlm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597800": [
        {
            "ioc_value": "nmcnknfccghddndnil.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597801": [
        {
            "ioc_value": "nmrdnovjmcd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597802": [
        {
            "ioc_value": "ntqchcmoegeif.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597803": [
        {
            "ioc_value": "qdvmstrtkslghpmunuk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597804": [
        {
            "ioc_value": "qmbmbyqkltqfbbtxxc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597805": [
        {
            "ioc_value": "rghwarmlxmqivfmcs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597806": [
        {
            "ioc_value": "rmprupuvboixif.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597807": [
        {
            "ioc_value": "saqjrigpkuins.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597808": [
        {
            "ioc_value": "tswgqcseq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597809": [
        {
            "ioc_value": "uacwwgvrdgqscbwb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597810": [
        {
            "ioc_value": "uclrmwkfanhh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597811": [
        {
            "ioc_value": "uegkbhbacte.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597812": [
        {
            "ioc_value": "venexqliewgrpyaai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597774": [
        {
            "ioc_value": "atfpjouljn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597775": [
        {
            "ioc_value": "bphnopydih.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597776": [
        {
            "ioc_value": "brluetauvqpyjlmwr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597777": [
        {
            "ioc_value": "bwnkdjlesbf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597778": [
        {
            "ioc_value": "cqvtvnxtqsosfed.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597779": [
        {
            "ioc_value": "dlkorrtundbuov.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597780": [
        {
            "ioc_value": "echrepdvcd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597781": [
        {
            "ioc_value": "esxfrepgcyyvoim.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597782": [
        {
            "ioc_value": "fbhtsymefdwstuivosx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597783": [
        {
            "ioc_value": "fcvyvvbtdcswh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597784": [
        {
            "ioc_value": "ffdjiuvufw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597785": [
        {
            "ioc_value": "fownspjlwlwinayk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597786": [
        {
            "ioc_value": "gwlqggasgcluo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597787": [
        {
            "ioc_value": "haqcdkwtukdegysigtv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597788": [
        {
            "ioc_value": "hivlcjcvux.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597789": [
        {
            "ioc_value": "htiobrofuirwkgn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597790": [
        {
            "ioc_value": "isbwlnfiyevmi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-09-22 06:51:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597772": [
        {
            "ioc_value": "rat.apakbilisim.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-22 06:51:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597773": [
        {
            "ioc_value": "throughout-regarding.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-22 06:51:33",
            "last_seen_utc": "2025-09-24 11:56:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597771": [
        {
            "ioc_value": "havemercy.mooo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-09-22 06:51:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,netwire",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597766": [
        {
            "ioc_value": "botnet.turtle12-iz.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-22 06:50:59",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597767": [
        {
            "ioc_value": "doxxingservices.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-22 06:50:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597768": [
        {
            "ioc_value": "morte.qzz.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-22 06:50:59",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597769": [
        {
            "ioc_value": "sjnm.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-22 06:50:59",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597770": [
        {
            "ioc_value": "sopflgg.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-22 06:50:59",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597755": [
        {
            "ioc_value": "server4.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597756": [
        {
            "ioc_value": "server5.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597757": [
        {
            "ioc_value": "server6.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597758": [
        {
            "ioc_value": "server7.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597759": [
        {
            "ioc_value": "server8.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597760": [
        {
            "ioc_value": "server9.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597750": [
        {
            "ioc_value": "runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597751": [
        {
            "ioc_value": "server1.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597752": [
        {
            "ioc_value": "server10.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597753": [
        {
            "ioc_value": "server2.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597754": [
        {
            "ioc_value": "server3.runmodes.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-09-22 06:49:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597749": [
        {
            "ioc_value": "sep1809.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-09-22 06:49:31",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597748": [
        {
            "ioc_value": "fmvgtfsjh.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-22 06:49:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597746": [
        {
            "ioc_value": "americanfinancialassistance.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 06:48:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597747": [
        {
            "ioc_value": "jprklawfirm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-22 06:48:53",
            "last_seen_utc": "2025-09-22 06:48:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597744": [
        {
            "ioc_value": "i.goklobtogether.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bunitu",
            "malware_alias": null,
            "malware_printable": "Bunitu",
            "first_seen_utc": "2025-09-22 06:48:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "bunitu,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597745": [
        {
            "ioc_value": "p.goklobtogether.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bunitu",
            "malware_alias": null,
            "malware_printable": "Bunitu",
            "first_seen_utc": "2025-09-22 06:48:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "bunitu,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597739": [
        {
            "ioc_value": "aamcik.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-22 06:47:51",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1597740": [
        {
            "ioc_value": "southern201-28469.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-22 06:47:51",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1596829": [
        {
            "ioc_value": "le.htif.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 06:25:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596828": [
        {
            "ioc_value": "c5.c-080.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596827": [
        {
            "ioc_value": "dm.htif.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 06:14:52",
            "last_seen_utc": "2025-09-22 06:19:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596826": [
        {
            "ioc_value": "ve.htif.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 06:03:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596821": [
        {
            "ioc_value": "lol.htp.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-22 06:01:37",
            "last_seen_utc": "2025-09-24 11:56:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-fmgg1swvft",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596822": [
        {
            "ioc_value": "restrict.restrict.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-22 06:01:37",
            "last_seen_utc": "2025-09-24 11:56:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-fmgg1swvft",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596819": [
        {
            "ioc_value": "hjasfhajf.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-22 06:00:58",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-er4yfawtav",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596820": [
        {
            "ioc_value": "hdfuaihfia.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-22 06:00:58",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-er4yfawtav",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596818": [
        {
            "ioc_value": "confa89128.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-22 06:00:57",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-er4yfawtav",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596817": [
        {
            "ioc_value": "instruments-dev.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-22 06:00:39",
            "last_seen_utc": "2025-09-24 11:56:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250922-c7t23avxcy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596816": [
        {
            "ioc_value": "a.0e0y6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 05:22:24",
            "last_seen_utc": "2025-09-22 06:25:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596814": [
        {
            "ioc_value": "ff.gwut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 05:13:02",
            "last_seen_utc": "2025-09-22 05:22:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596815": [
        {
            "ioc_value": "w4.h-214.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 05:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596812": [
        {
            "ioc_value": "r.gwut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 04:58:33",
            "last_seen_utc": "2025-09-22 05:01:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596813": [
        {
            "ioc_value": "d.h-214.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 04:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596810": [
        {
            "ioc_value": "rk8.q-083.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 04:32:25",
            "last_seen_utc": "2025-09-22 05:01:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596811": [
        {
            "ioc_value": "kz.gwut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 04:32:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596809": [
        {
            "ioc_value": "qz9.m-754.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 04:05:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596807": [
        {
            "ioc_value": "xq0.7o3u8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 04:04:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596808": [
        {
            "ioc_value": "dd.gwut.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 04:04:10",
            "last_seen_utc": "2025-09-22 04:05:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596781": [
        {
            "ioc_value": "jd.gjat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 03:33:19",
            "last_seen_utc": "2025-09-22 03:33:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596780": [
        {
            "ioc_value": "c5.7o3u8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 03:14:02",
            "last_seen_utc": "2025-09-22 03:33:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596779": [
        {
            "ioc_value": "hz.gjat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 03:04:58",
            "last_seen_utc": "2025-09-22 03:14:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596774": [
        {
            "ioc_value": "pm.gjat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 02:44:29",
            "last_seen_utc": "2025-09-22 02:52:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596773": [
        {
            "ioc_value": "l.7o3u8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 02:32:19",
            "last_seen_utc": "2025-09-22 02:52:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596771": [
        {
            "ioc_value": "yh.gjat.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 02:22:03",
            "last_seen_utc": "2025-09-22 02:32:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596772": [
        {
            "ioc_value": "v2.m-754.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 02:22:03",
            "last_seen_utc": "2025-09-22 03:33:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596769": [
        {
            "ioc_value": "qm9.6y0u1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 02:00:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596770": [
        {
            "ioc_value": "sb.fjot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 02:00:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596683": [
        {
            "ioc_value": "xm.fjot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 01:39:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596682": [
        {
            "ioc_value": "u1.6y0u1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 01:30:26",
            "last_seen_utc": "2025-09-22 01:39:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596681": [
        {
            "ioc_value": "zr.fjot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 01:29:36",
            "last_seen_utc": "2025-09-22 01:30:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596680": [
        {
            "ioc_value": "ia.fjot.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 01:11:49",
            "last_seen_utc": "2025-09-22 01:12:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596679": [
        {
            "ioc_value": "h.6y0u1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 01:07:41",
            "last_seen_utc": "2025-09-22 01:11:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596678": [
        {
            "ioc_value": "ag.dgod.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 00:58:30",
            "last_seen_utc": "2025-09-22 01:07:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596677": [
        {
            "ioc_value": "pz8.9a9o8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 00:30:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596676": [
        {
            "ioc_value": "ed.dgod.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 00:30:21",
            "last_seen_utc": "2025-09-22 00:30:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596675": [
        {
            "ioc_value": "w4.9a9o8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 00:12:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596674": [
        {
            "ioc_value": "vi.dgod.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-22 00:12:06",
            "last_seen_utc": "2025-09-22 00:12:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596661": [
        {
            "ioc_value": "k.m-754.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 23:54:47",
            "last_seen_utc": "2025-09-22 01:29:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596659": [
        {
            "ioc_value": "pe.dgod.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 23:54:03",
            "last_seen_utc": "2025-09-21 23:54:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596660": [
        {
            "ioc_value": "d.9a9o8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 23:54:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596657": [
        {
            "ioc_value": "rk1.6u3o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 23:37:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596658": [
        {
            "ioc_value": "dl.bxof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 23:37:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596655": [
        {
            "ioc_value": "jm.bxof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 23:20:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596653": [
        {
            "ioc_value": "a2.6u3o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 23:17:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596651": [
        {
            "ioc_value": "eg.bxof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 23:09:24",
            "last_seen_utc": "2025-09-21 23:17:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596652": [
        {
            "ioc_value": "v5.k-342.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 23:09:24",
            "last_seen_utc": "2025-09-21 23:20:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596649": [
        {
            "ioc_value": "t.6u3o9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 22:49:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596650": [
        {
            "ioc_value": "ll.bxof.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 22:49:46",
            "last_seen_utc": "2025-09-21 22:49:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596647": [
        {
            "ioc_value": "xq7.9i1e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 22:37:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596645": [
        {
            "ioc_value": "hl.bwag.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 22:29:56",
            "last_seen_utc": "2025-09-21 22:37:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596646": [
        {
            "ioc_value": "k3x.s-537.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 22:29:56",
            "last_seen_utc": "2025-09-21 22:49:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596644": [
        {
            "ioc_value": "uo.bwag.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 22:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596643": [
        {
            "ioc_value": "r.s-537.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 22:16:49",
            "last_seen_utc": "2025-09-21 22:21:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596640": [
        {
            "ioc_value": "ml.n-44-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 22:10:16",
            "last_seen_utc": "2025-09-21 22:16:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596641": [
        {
            "ioc_value": "m9.9i1e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 22:10:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596639": [
        {
            "ioc_value": "hd.n-44-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:59:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596638": [
        {
            "ioc_value": "k.9i1e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:49:18",
            "last_seen_utc": "2025-09-21 21:59:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596636": [
        {
            "ioc_value": "wq9.n-585.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:49:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596637": [
        {
            "ioc_value": "vu.n-44-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:49:14",
            "last_seen_utc": "2025-09-21 21:49:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596634": [
        {
            "ioc_value": "ty3.62xm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:30:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596632": [
        {
            "ioc_value": "mz.n-44-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:28:53",
            "last_seen_utc": "2025-09-21 21:30:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596633": [
        {
            "ioc_value": "c7.n-585.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:28:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596630": [
        {
            "ioc_value": "p0.62xm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:10:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596629": [
        {
            "ioc_value": "kw.h-73-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:10:29",
            "last_seen_utc": "2025-09-21 21:10:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596627": [
        {
            "ioc_value": "th.h-73-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:02:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596628": [
        {
            "ioc_value": "tq1.s-819.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 21:02:23",
            "last_seen_utc": "2025-09-21 21:10:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596626": [
        {
            "ioc_value": "e.62xm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:51:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596624": [
        {
            "ioc_value": "yr.h-73-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:51:02",
            "last_seen_utc": "2025-09-21 20:51:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596625": [
        {
            "ioc_value": "b2.s-819.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:51:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596619": [
        {
            "ioc_value": "wz8.06hm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:41:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596618": [
        {
            "ioc_value": "rv.h-73-n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:40:14",
            "last_seen_utc": "2025-09-21 20:41:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596616": [
        {
            "ioc_value": "eq.g-69-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:31:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596617": [
        {
            "ioc_value": "x.s-819.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:31:12",
            "last_seen_utc": "2025-09-21 20:40:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596615": [
        {
            "ioc_value": "bn.g-69-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:22:20",
            "last_seen_utc": "2025-09-21 20:29:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596614": [
        {
            "ioc_value": "h1.06hm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:17:12",
            "last_seen_utc": "2025-09-21 20:29:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596612": [
        {
            "ioc_value": "pb.g-69-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:07:51",
            "last_seen_utc": "2025-09-21 20:17:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596613": [
        {
            "ioc_value": "aq3.b-395.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 20:07:51",
            "last_seen_utc": "2025-09-21 20:22:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596596": [
        {
            "ioc_value": "ny.g-04-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 19:44:15",
            "last_seen_utc": "2025-09-21 19:44:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596595": [
        {
            "ioc_value": "k.06hm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 19:40:02",
            "last_seen_utc": "2025-09-21 19:44:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596594": [
        {
            "ioc_value": "cu.g-04-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 19:38:47",
            "last_seen_utc": "2025-09-21 19:40:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596593": [
        {
            "ioc_value": "openai-pidor-with-ai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-21 19:36:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/782d945be43b46dedb60f89adb37aaca49029db39dc62ea2613d3937a7e5851f",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596592": [
        {
            "ioc_value": "november-surgeon.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-21 19:31:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250921-xz1vvs1l15",
            "tags": "c2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596591": [
        {
            "ioc_value": "qd.g-04-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 19:31:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596589": [
        {
            "ioc_value": "aa9.23df.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 19:27:16",
            "last_seen_utc": "2025-09-21 19:31:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596587": [
        {
            "ioc_value": "m8.b-395.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 19:27:15",
            "last_seen_utc": "2025-09-21 19:44:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596588": [
        {
            "ioc_value": "uk.g-04-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 19:27:15",
            "last_seen_utc": "2025-09-21 19:27:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596575": [
        {
            "ioc_value": "snaifre.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-21 19:19:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/04e9bc673319f3c8b5916f79733ac0651bb3c34b16cdb4ac141fc8c1b956ee69",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596576": [
        {
            "ioc_value": "wieish.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-21 19:19:43",
            "last_seen_utc": "2025-10-06 21:20:25",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/04e9bc673319f3c8b5916f79733ac0651bb3c34b16cdb4ac141fc8c1b956ee69",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596577": [
        {
            "ioc_value": "wisev.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-21 19:19:43",
            "last_seen_utc": "2025-10-06 21:20:25",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/04e9bc673319f3c8b5916f79733ac0651bb3c34b16cdb4ac141fc8c1b956ee69",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596573": [
        {
            "ioc_value": "ma.f-42-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 18:50:52",
            "last_seen_utc": "2025-09-21 18:51:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596571": [
        {
            "ioc_value": "oc.f-42-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 18:35:54",
            "last_seen_utc": "2025-09-21 18:43:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596572": [
        {
            "ioc_value": "v2.23df.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 18:35:54",
            "last_seen_utc": "2025-09-21 18:50:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596569": [
        {
            "ioc_value": "gs.f-42-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 18:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596567": [
        {
            "ioc_value": "g.23df.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 18:04:34",
            "last_seen_utc": "2025-09-21 18:18:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596565": [
        {
            "ioc_value": "z.b-395.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 18:04:18",
            "last_seen_utc": "2025-09-21 18:51:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596566": [
        {
            "ioc_value": "ic.f-42-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 18:04:18",
            "last_seen_utc": "2025-09-21 18:04:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596548": [
        {
            "ioc_value": "door-generates.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-21 18:00:27",
            "last_seen_utc": "2025-09-24 11:56:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250921-sjev8symz7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596547": [
        {
            "ioc_value": "control-spent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-21 18:00:26",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250921-v778sszns6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596546": [
        {
            "ioc_value": "my.f-05-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 17:43:51",
            "last_seen_utc": "2025-09-21 17:45:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596544": [
        {
            "ioc_value": "bt7.10tw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 17:33:14",
            "last_seen_utc": "2025-09-21 17:43:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596543": [
        {
            "ioc_value": "sj.f-05-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 17:24:47",
            "last_seen_utc": "2025-09-21 17:33:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596541": [
        {
            "ioc_value": "m3.10tw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 17:04:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596542": [
        {
            "ioc_value": "wc.f-05-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 17:04:27",
            "last_seen_utc": "2025-09-21 17:05:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596540": [
        {
            "ioc_value": "ag.f-05-t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 16:44:15",
            "last_seen_utc": "2025-09-21 17:01:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596539": [
        {
            "ioc_value": "z.10tw.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 16:36:28",
            "last_seen_utc": "2025-09-21 16:44:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596538": [
        {
            "ioc_value": "qk2.08jm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 16:19:55",
            "last_seen_utc": "2025-09-21 17:45:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596537": [
        {
            "ioc_value": "sq.d-09-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 16:19:54",
            "last_seen_utc": "2025-09-21 16:36:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596536": [
        {
            "ioc_value": "amapanel.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-21 16:01:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.63.238+amapanel.sbs",
            "tags": "Amatera,AS13335,C2,censys,CLOUDFLARENET,Panel,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596534": [
        {
            "ioc_value": "outsystem.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-21 16:01:21",
            "last_seen_utc": "2025-09-22 04:00:48",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/198.54.115.227+outsystem.online",
            "tags": "AS22612,C2,censys,NAMECHEAP-NET,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596530": [
        {
            "ioc_value": "wholesalecharitysupply.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-21 16:00:56",
            "last_seen_utc": "2025-09-26 04:00:29",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.74.8.8+wholesalecharitysupply.com",
            "tags": "AS3223,AsyncRAT,C2,censys,RAT,VOXILITY",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596525": [
        {
            "ioc_value": "u5.08jm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 15:46:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596523": [
        {
            "ioc_value": "gr.d-09-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 15:44:56",
            "last_seen_utc": "2025-09-21 15:46:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596524": [
        {
            "ioc_value": "c5.22jk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 15:44:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596521": [
        {
            "ioc_value": "kz.d-09-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 15:23:49",
            "last_seen_utc": "2025-09-21 15:23:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596522": [
        {
            "ioc_value": "l.22jk.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 15:23:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596519": [
        {
            "ioc_value": "ai.d-09-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 15:05:46",
            "last_seen_utc": "2025-09-21 15:13:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596520": [
        {
            "ioc_value": "qm9.03mr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 15:05:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596468": [
        {
            "ioc_value": "u1.03mr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 14:38:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596467": [
        {
            "ioc_value": "kp.z99l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 14:38:54",
            "last_seen_utc": "2025-09-21 14:38:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596465": [
        {
            "ioc_value": "h.03mr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 14:20:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596464": [
        {
            "ioc_value": "zj.z99l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 14:20:45",
            "last_seen_utc": "2025-09-21 14:20:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596462": [
        {
            "ioc_value": "uv.z99l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 14:11:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596463": [
        {
            "ioc_value": "pz8.99jn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 14:11:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596461": [
        {
            "ioc_value": "w4.99jn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 14:01:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596460": [
        {
            "ioc_value": "mq.z99l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 14:01:34",
            "last_seen_utc": "2025-09-21 14:02:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596459": [
        {
            "ioc_value": "fx.z15d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 13:52:32",
            "last_seen_utc": "2025-09-21 13:57:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596457": [
        {
            "ioc_value": "gg.z15d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 13:48:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596458": [
        {
            "ioc_value": "d.99jn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 13:48:33",
            "last_seen_utc": "2025-09-21 13:52:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596456": [
        {
            "ioc_value": "rk1.42wd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 13:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596455": [
        {
            "ioc_value": "dy.z15d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 13:25:08",
            "last_seen_utc": "2025-09-21 13:25:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596454": [
        {
            "ioc_value": "r.08jm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 13:21:31",
            "last_seen_utc": "2025-09-21 15:24:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596453": [
        {
            "ioc_value": "kh.z15d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 12:53:22",
            "last_seen_utc": "2025-09-21 13:21:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596451": [
        {
            "ioc_value": "rd.x73r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 12:43:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596450": [
        {
            "ioc_value": "a2.42wd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 12:43:35",
            "last_seen_utc": "2025-09-21 12:53:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596448": [
        {
            "ioc_value": "xn.x73r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 12:24:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596449": [
        {
            "ioc_value": "t.42wd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 12:24:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596446": [
        {
            "ioc_value": "lg.x73r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 12:05:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596447": [
        {
            "ioc_value": "xq7.08jj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 12:05:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596436": [
        {
            "ioc_value": "m9.08jj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 11:43:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596437": [
        {
            "ioc_value": "te.x73r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 11:43:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596435": [
        {
            "ioc_value": "n.w30g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 11:23:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596434": [
        {
            "ioc_value": "k.08jj.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 11:23:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596433": [
        {
            "ioc_value": "qk2.4m99.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 10:56:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596432": [
        {
            "ioc_value": "gl.w30g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 10:56:39",
            "last_seen_utc": "2025-09-21 10:56:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596431": [
        {
            "ioc_value": "lv.w30g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 10:43:45",
            "last_seen_utc": "2025-09-21 10:44:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596430": [
        {
            "ioc_value": "u5.4m99.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 10:39:12",
            "last_seen_utc": "2025-09-21 10:44:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596429": [
        {
            "ioc_value": "qz.w30g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 10:24:15",
            "last_seen_utc": "2025-09-21 10:39:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596428": [
        {
            "ioc_value": "r.4m99.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 10:03:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596427": [
        {
            "ioc_value": "zd.w20s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 10:03:25",
            "last_seen_utc": "2025-09-21 10:20:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596426": [
        {
            "ioc_value": "vj.w20s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 09:44:09",
            "last_seen_utc": "2025-09-21 09:52:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596425": [
        {
            "ioc_value": "ty3.8c80.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 09:33:18",
            "last_seen_utc": "2025-09-21 09:52:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596424": [
        {
            "ioc_value": "yb.w20s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 09:24:56",
            "last_seen_utc": "2025-09-21 09:33:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596420": [
        {
            "ioc_value": "quapfi.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596421": [
        {
            "ioc_value": "sirjosd.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596422": [
        {
            "ioc_value": "sorbiru.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596423": [
        {
            "ioc_value": "tailfcw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596419": [
        {
            "ioc_value": "implczf.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:35",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596417": [
        {
            "ioc_value": "cleistg.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596418": [
        {
            "ioc_value": "genushf.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596413": [
        {
            "ioc_value": "artejbs.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596414": [
        {
            "ioc_value": "asceniz.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596415": [
        {
            "ioc_value": "bodylne.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596416": [
        {
            "ioc_value": "cannujv.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 09:16:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,lumma,lummastealer",
            "anonymous": "0",
            "reporter": "abus3reports"
        }
    ],
    "1596351": [
        {
            "ioc_value": "bw.w20s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 08:26:02",
            "last_seen_utc": "2025-09-21 08:32:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596350": [
        {
            "ioc_value": "p0.8c80.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 08:05:15",
            "last_seen_utc": "2025-09-21 08:32:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596349": [
        {
            "ioc_value": "ax.v96g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 08:04:28",
            "last_seen_utc": "2025-09-21 08:05:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596342": [
        {
            "ioc_value": "aa.v96g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 07:45:38",
            "last_seen_utc": "2025-09-21 07:50:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596341": [
        {
            "ioc_value": "ep.v96g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 07:24:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596340": [
        {
            "ioc_value": "e.8c80.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 07:12:05",
            "last_seen_utc": "2025-09-21 07:50:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596339": [
        {
            "ioc_value": "bj.v96g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 07:04:42",
            "last_seen_utc": "2025-09-21 07:12:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596338": [
        {
            "ioc_value": "wz8.6n47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 06:45:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596337": [
        {
            "ioc_value": "os.t65p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 06:44:06",
            "last_seen_utc": "2025-09-21 06:45:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596006": [
        {
            "ioc_value": "ftp.smashingboss.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-21 06:28:57",
            "last_seen_utc": "2025-09-23 08:40:10",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115238238722372282",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1596008": [
        {
            "ioc_value": "docker.smashingboss.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-21 06:28:55",
            "last_seen_utc": "2025-09-23 08:40:10",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115238356146948178",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1596296": [
        {
            "ioc_value": "myamiii.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-21 06:28:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "lumma",
            "anonymous": "0",
            "reporter": "stopransom"
        }
    ],
    "1596334": [
        {
            "ioc_value": "h1.6n47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 06:24:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596333": [
        {
            "ioc_value": "sm.t65p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 06:24:21",
            "last_seen_utc": "2025-09-21 06:24:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596332": [
        {
            "ioc_value": "bc.t65p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 06:04:50",
            "last_seen_utc": "2025-09-21 06:12:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596327": [
        {
            "ioc_value": "results-affordable.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-21 06:00:22",
            "last_seen_utc": "2025-09-24 11:56:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250921-fe312ssvdw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596328": [
        {
            "ioc_value": "ip-politicians.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-21 06:00:22",
            "last_seen_utc": "2025-09-24 11:56:02",
            "confidence_level": 100,
            "reference": "https://tria.ge/250921-dnxvaasrv9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596329": [
        {
            "ioc_value": "said-up.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-21 06:00:22",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250921-a1zmvsaq81",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596325": [
        {
            "ioc_value": "k.6n47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 05:44:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596326": [
        {
            "ioc_value": "ex.t65p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 05:44:36",
            "last_seen_utc": "2025-09-21 05:53:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596324": [
        {
            "ioc_value": "eu.p93z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 05:24:22",
            "last_seen_utc": "2025-09-21 05:24:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596323": [
        {
            "ioc_value": "aa9.6s95.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 05:24:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596322": [
        {
            "ioc_value": "gu.p93z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 04:44:51",
            "last_seen_utc": "2025-09-21 04:44:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596321": [
        {
            "ioc_value": "v2.6s95.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 04:41:40",
            "last_seen_utc": "2025-09-21 04:44:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596320": [
        {
            "ioc_value": "uc.p93z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 04:24:56",
            "last_seen_utc": "2025-09-21 04:41:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596319": [
        {
            "ioc_value": "g.6s95.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 04:05:52",
            "last_seen_utc": "2025-09-21 06:04:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596318": [
        {
            "ioc_value": "yl.p93z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 04:04:41",
            "last_seen_utc": "2025-09-21 04:05:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596294": [
        {
            "ioc_value": "bt7.8h66.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 03:43:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596295": [
        {
            "ioc_value": "jt.n96f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 03:43:35",
            "last_seen_utc": "2025-09-21 03:44:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596290": [
        {
            "ioc_value": "m3.8h66.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 03:24:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596291": [
        {
            "ioc_value": "yh.n96f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 03:24:44",
            "last_seen_utc": "2025-09-21 03:25:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596287": [
        {
            "ioc_value": "pg.n96f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 02:44:34",
            "last_seen_utc": "2025-09-21 02:52:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596286": [
        {
            "ioc_value": "z.8h66.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 02:33:39",
            "last_seen_utc": "2025-09-21 02:44:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596285": [
        {
            "ioc_value": "wk.n96f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 02:24:49",
            "last_seen_utc": "2025-09-21 02:33:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596284": [
        {
            "ioc_value": "yc.n44s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 02:09:11",
            "last_seen_utc": "2025-09-21 02:09:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596070": [
        {
            "ioc_value": "xq0.6k47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 01:53:43",
            "last_seen_utc": "2025-09-21 02:09:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596069": [
        {
            "ioc_value": "ki.n44s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 01:44:36",
            "last_seen_utc": "2025-09-21 01:53:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596068": [
        {
            "ioc_value": "c5.6k47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 01:24:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596067": [
        {
            "ioc_value": "af.n44s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 01:24:06",
            "last_seen_utc": "2025-09-21 01:24:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596065": [
        {
            "ioc_value": "l.6k47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 01:03:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596066": [
        {
            "ioc_value": "ea.n44s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 01:03:06",
            "last_seen_utc": "2025-09-21 01:04:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596064": [
        {
            "ioc_value": "qq.m33h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 00:44:56",
            "last_seen_utc": "2025-09-21 00:45:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596063": [
        {
            "ioc_value": "qm9.2p62.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 00:32:41",
            "last_seen_utc": "2025-09-21 00:45:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596062": [
        {
            "ioc_value": "mv.m33h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-21 00:24:41",
            "last_seen_utc": "2025-09-21 00:32:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596053": [
        {
            "ioc_value": "u1.2p62.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 23:55:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596052": [
        {
            "ioc_value": "hq.m33h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 23:54:39",
            "last_seen_utc": "2025-09-20 23:55:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596051": [
        {
            "ioc_value": "h.2p62.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 23:32:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596050": [
        {
            "ioc_value": "rg.m33h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 23:31:38",
            "last_seen_utc": "2025-09-20 23:32:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596049": [
        {
            "ioc_value": "bo.k25q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 23:24:05",
            "last_seen_utc": "2025-09-20 23:25:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596048": [
        {
            "ioc_value": "pz8.9n75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 23:13:58",
            "last_seen_utc": "2025-09-20 23:24:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596047": [
        {
            "ioc_value": "er.k25q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 23:05:05",
            "last_seen_utc": "2025-09-20 23:13:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596046": [
        {
            "ioc_value": "w4.9n75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 22:44:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596045": [
        {
            "ioc_value": "lq.k25q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 22:44:08",
            "last_seen_utc": "2025-09-20 22:44:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596044": [
        {
            "ioc_value": "d.9n75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 22:24:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596043": [
        {
            "ioc_value": "jb.k25q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 22:24:40",
            "last_seen_utc": "2025-09-20 22:24:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596042": [
        {
            "ioc_value": "rk1.6b96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 22:04:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596041": [
        {
            "ioc_value": "ne.h73n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 22:04:25",
            "last_seen_utc": "2025-09-20 22:04:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596040": [
        {
            "ioc_value": "a2.6b96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 21:49:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596039": [
        {
            "ioc_value": "st.h73n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 21:44:28",
            "last_seen_utc": "2025-09-20 21:49:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596038": [
        {
            "ioc_value": "in.ditchibuprofen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 21:34:52",
            "last_seen_utc": "2025-09-21 10:56:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596037": [
        {
            "ioc_value": "fl.h73n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 21:24:33",
            "last_seen_utc": "2025-09-20 21:34:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596034": [
        {
            "ioc_value": "rm.h73n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 21:04:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596035": [
        {
            "ioc_value": "t.6b96.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 21:04:50",
            "last_seen_utc": "2025-09-20 21:30:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596032": [
        {
            "ioc_value": "cdn.mailinfo.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-20 20:49:08",
            "last_seen_utc": "2025-10-22 13:51:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1596027": [
        {
            "ioc_value": "iu.g69p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 20:43:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596028": [
        {
            "ioc_value": "xq7.1v47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 20:43:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596025": [
        {
            "ioc_value": "m9.1v47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 20:25:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596026": [
        {
            "ioc_value": "z.g69p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 20:25:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596018": [
        {
            "ioc_value": "host0.tikmaps.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-20 20:01:54",
            "last_seen_utc": "2025-09-21 04:00:23",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.27+host0.tikmaps.com",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596005": [
        {
            "ioc_value": "q.1v47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 18:55:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1596000": [
        {
            "ioc_value": "chillornet.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-20 18:03:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-qe95gawjv9",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1596001": [
        {
            "ioc_value": "chillorbackup.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-20 18:03:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-qe95gawjv9",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595998": [
        {
            "ioc_value": "design-represented.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-20 18:02:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-qf1x7aal7t",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595999": [
        {
            "ioc_value": "click-figured.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-20 18:02:13",
            "last_seen_utc": "2025-10-10 11:34:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-pfzvfshn7t",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595997": [
        {
            "ioc_value": "211.ip.gl.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-20 18:02:12",
            "last_seen_utc": "2025-10-10 11:34:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-qjkqdaam4s",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595994": [
        {
            "ioc_value": "materials-plant.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-20 18:01:29",
            "last_seen_utc": "2025-10-03 09:02:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-vv41lswths",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595995": [
        {
            "ioc_value": "round-failing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-20 18:01:29",
            "last_seen_utc": "2025-10-03 09:02:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-vxy75sxrx7",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595991": [
        {
            "ioc_value": "8msv1-23655.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-20 18:00:49",
            "last_seen_utc": "2025-09-24 11:56:02",
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-vzksjaxr15",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595989": [
        {
            "ioc_value": "hmvr4u61p.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-20 18:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-pne51ss1az",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595990": [
        {
            "ioc_value": "enjoy-silent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-20 18:00:22",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-pcwnmahn4s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595987": [
        {
            "ioc_value": "ever-rx.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-20 18:00:20",
            "last_seen_utc": "2025-09-24 11:56:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-vwpmbaxrv6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595979": [
        {
            "ioc_value": "host4.thebookcult.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-20 16:00:52",
            "last_seen_utc": "2025-09-21 04:00:22",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.27+host4.thebookcult.com",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595974": [
        {
            "ioc_value": "hp.f42s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 15:17:32",
            "last_seen_utc": "2025-09-20 14:17:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595976": [
        {
            "ioc_value": "wg.f42s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 15:17:30",
            "last_seen_utc": "2025-09-20 14:22:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595975": [
        {
            "ioc_value": "u1.333-f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 14:17:58",
            "last_seen_utc": "2025-09-20 14:22:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595972": [
        {
            "ioc_value": "tb.f42s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:43:19",
            "last_seen_utc": "2025-09-20 13:41:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595973": [
        {
            "ioc_value": "y.333-f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:41:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595935": [
        {
            "ioc_value": "fr.d42n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:30:35",
            "last_seen_utc": "2025-09-20 07:53:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595942": [
        {
            "ioc_value": "nn.d42n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:30:34",
            "last_seen_utc": "2025-09-20 08:13:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595946": [
        {
            "ioc_value": "bf.d42n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:30:34",
            "last_seen_utc": "2025-09-20 09:34:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595948": [
        {
            "ioc_value": "db.f05t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:30:34",
            "last_seen_utc": "2025-09-20 10:41:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595950": [
        {
            "ioc_value": "wt.f05t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:30:34",
            "last_seen_utc": "2025-09-20 11:20:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595952": [
        {
            "ioc_value": "bg.f05t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:30:33",
            "last_seen_utc": "2025-09-20 12:02:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595970": [
        {
            "ioc_value": "oj.f05t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:30:33",
            "last_seen_utc": "2025-09-20 13:09:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595971": [
        {
            "ioc_value": "wz8.212-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 13:09:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595957": [
        {
            "ioc_value": "p0.212-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 12:01:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595956": [
        {
            "ioc_value": "mwq-47258.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-20 12:00:46",
            "last_seen_utc": "2025-09-24 11:56:02",
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-m21b1aswb1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595951": [
        {
            "ioc_value": "k.212-q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 11:20:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595949": [
        {
            "ioc_value": "x0r.465-w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 10:40:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595947": [
        {
            "ioc_value": "d1.465-w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 09:34:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595943": [
        {
            "ioc_value": "l.465-w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 08:13:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595936": [
        {
            "ioc_value": "cm0.759-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 07:53:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595934": [
        {
            "ioc_value": "rb.d42n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 07:33:09",
            "last_seen_utc": "2025-09-20 07:27:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595932": [
        {
            "ioc_value": "uz.d09r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 07:33:08",
            "last_seen_utc": "2025-09-20 07:13:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595933": [
        {
            "ioc_value": "v5.759-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 07:13:30",
            "last_seen_utc": "2025-09-20 07:26:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595927": [
        {
            "ioc_value": "market-lumma.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-20 06:54:40",
            "last_seen_utc": "2025-10-10 22:24:49",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1595924": [
        {
            "ioc_value": "anton-chehov.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-20 06:54:39",
            "last_seen_utc": "2025-10-10 22:24:49",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1595925": [
        {
            "ioc_value": "korney-chukovsky.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-20 06:54:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1595926": [
        {
            "ioc_value": "lumma-market.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-20 06:54:37",
            "last_seen_utc": "2025-10-17 21:50:45",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1595928": [
        {
            "ioc_value": "rustore.anton-chehov.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-20 06:54:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1595929": [
        {
            "ioc_value": "rustore.iosif-brodskiy.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-20 06:54:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1595930": [
        {
            "ioc_value": "rustore.korney-chukovsky.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-20 06:54:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1595931": [
        {
            "ioc_value": "trachyw.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-20 06:54:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1595854": [
        {
            "ioc_value": "bilibili.osfc.org.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-20 06:39:33",
            "last_seen_utc": "2025-11-08 09:40:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1595916": [
        {
            "ioc_value": "kardan35.3utilities.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-20 06:01:02",
            "last_seen_utc": "2025-10-03 09:02:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250920-fptv5adk3v",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595914": [
        {
            "ioc_value": "z.759-s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 05:48:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595913": [
        {
            "ioc_value": "xu.d09r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 05:47:05",
            "last_seen_utc": "2025-09-20 05:48:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595912": [
        {
            "ioc_value": "k3x.246-b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 05:20:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595911": [
        {
            "ioc_value": "va.d09r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 05:11:59",
            "last_seen_utc": "2025-09-20 05:20:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595910": [
        {
            "ioc_value": "a1.246-b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 04:31:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595909": [
        {
            "ioc_value": "zh.d09r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 04:30:45",
            "last_seen_utc": "2025-09-20 04:32:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595855": [
        {
            "ioc_value": "urpwnd.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-20 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/217.154.212.25+urpwnd.site",
            "tags": "AS8560,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1595852": [
        {
            "ioc_value": "b.4dl.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 03:32:10",
            "last_seen_utc": "2025-09-20 03:33:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595851": [
        {
            "ioc_value": "x2j.2se.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 03:13:18",
            "last_seen_utc": "2025-09-20 03:21:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595850": [
        {
            "ioc_value": "r.246-b.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 03:08:50",
            "last_seen_utc": "2025-09-20 03:33:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595849": [
        {
            "ioc_value": "pc.2se.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 03:00:36",
            "last_seen_utc": "2025-09-20 03:08:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595847": [
        {
            "ioc_value": "wq9.227-m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 02:50:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595846": [
        {
            "ioc_value": "m8.2se.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 02:43:53",
            "last_seen_utc": "2025-09-20 02:50:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595845": [
        {
            "ioc_value": "n.227-m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 02:13:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595844": [
        {
            "ioc_value": "e.g0s1f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 02:12:13",
            "last_seen_utc": "2025-09-20 02:13:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595842": [
        {
            "ioc_value": "xq8.340-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 01:48:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595841": [
        {
            "ioc_value": "ak.g7r7s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 01:47:21",
            "last_seen_utc": "2025-09-20 01:48:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595840": [
        {
            "ioc_value": "b9c.340-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 01:13:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595839": [
        {
            "ioc_value": "ax.r3l1x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 01:12:08",
            "last_seen_utc": "2025-09-20 01:13:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595838": [
        {
            "ioc_value": "t.340-k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 00:57:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595837": [
        {
            "ioc_value": "qz7.391-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 00:32:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595836": [
        {
            "ioc_value": "q.n9t6m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 00:31:52",
            "last_seen_utc": "2025-09-20 00:32:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595835": [
        {
            "ioc_value": "m2.391-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 00:17:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595834": [
        {
            "ioc_value": "xo.v-96-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 00:15:35",
            "last_seen_utc": "2025-09-20 00:17:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595833": [
        {
            "ioc_value": "k.391-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-20 00:13:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595818": [
        {
            "ioc_value": "xq0.tbkh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 22:50:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595817": [
        {
            "ioc_value": "nv.v-96-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 22:41:54",
            "last_seen_utc": "2025-09-19 22:50:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595816": [
        {
            "ioc_value": "no.v-96-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 22:20:00",
            "last_seen_utc": "2025-09-20 00:13:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595814": [
        {
            "ioc_value": "u5.tbkh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 22:12:01",
            "last_seen_utc": "2025-09-19 22:22:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595813": [
        {
            "ioc_value": "xd.t-65-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 22:10:49",
            "last_seen_utc": "2025-09-19 22:12:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595812": [
        {
            "ioc_value": "le.t-65-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 22:00:13",
            "last_seen_utc": "2025-09-19 22:02:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595811": [
        {
            "ioc_value": "d.tbkh.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 21:55:34",
            "last_seen_utc": "2025-09-19 22:02:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595810": [
        {
            "ioc_value": "gb.t-65-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 21:54:01",
            "last_seen_utc": "2025-09-19 21:55:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595808": [
        {
            "ioc_value": "fck.wnkc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 21:13:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595807": [
        {
            "ioc_value": "vi.t-65-p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 21:11:46",
            "last_seen_utc": "2025-09-19 21:13:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595805": [
        {
            "ioc_value": "fikysandroisder.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-09-19 21:04:26",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595799": [
        {
            "ioc_value": "m.wnkc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 20:38:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595798": [
        {
            "ioc_value": "xf.p-93-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 20:37:38",
            "last_seen_utc": "2025-09-19 20:39:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595797": [
        {
            "ioc_value": "b.wnkc.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 20:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595796": [
        {
            "ioc_value": "oq.p-93-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 20:12:11",
            "last_seen_utc": "2025-09-19 20:13:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595788": [
        {
            "ioc_value": "hvc.llamarama.fail",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-19 20:00:58",
            "last_seen_utc": "2025-09-20 04:00:34",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.49.221+hvc.llamarama.fail",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595786": [
        {
            "ioc_value": "server.tikmaps.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-19 20:00:49",
            "last_seen_utc": "2025-09-24 04:01:30",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.27+server.tikmaps.com",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595777": [
        {
            "ioc_value": "wh.p-93-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 19:51:49",
            "last_seen_utc": "2025-09-19 19:53:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595776": [
        {
            "ioc_value": "qz7.twgr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 19:40:53",
            "last_seen_utc": "2025-09-19 19:53:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595774": [
        {
            "ioc_value": "ol.p-93-z.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 19:31:58",
            "last_seen_utc": "2025-09-19 19:40:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595763": [
        {
            "ioc_value": "m2.twgr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 18:52:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595762": [
        {
            "ioc_value": "pn.n-96-f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 18:51:44",
            "last_seen_utc": "2025-09-19 18:53:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595726": [
        {
            "ioc_value": "sz.n-96-f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 18:12:02",
            "last_seen_utc": "2025-09-19 18:13:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595725": [
        {
            "ioc_value": "t.twgr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 18:08:57",
            "last_seen_utc": "2025-09-19 18:13:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595724": [
        {
            "ioc_value": "ydbao6.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-19 18:01:54",
            "last_seen_utc": "2025-10-10 11:35:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250919-rgcses1sgz",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595720": [
        {
            "ioc_value": "tipsept.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-19 18:00:24",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250919-p5aa4aan9v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595722": [
        {
            "ioc_value": "ikechukwugrace.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-19 18:00:24",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250919-pzznsstmz7",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595719": [
        {
            "ioc_value": "krusty-krab.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-19 18:00:16",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250919-pw4hkstmx5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595717": [
        {
            "ioc_value": "ub.n-96-f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 17:52:12",
            "last_seen_utc": "2025-09-19 18:08:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595714": [
        {
            "ioc_value": "qx8.mmwf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 17:32:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595713": [
        {
            "ioc_value": "zt.n-96-f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 17:31:47",
            "last_seen_utc": "2025-09-19 17:32:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595712": [
        {
            "ioc_value": "z7.mmwf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 17:19:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595711": [
        {
            "ioc_value": "y0s.hap7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 17:18:02",
            "last_seen_utc": "2025-09-19 17:19:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595710": [
        {
            "ioc_value": "qq.hap7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 16:52:04",
            "last_seen_utc": "2025-09-19 16:53:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595709": [
        {
            "ioc_value": "k.mmwf.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 16:47:24",
            "last_seen_utc": "2025-09-19 16:53:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595708": [
        {
            "ioc_value": "m2.hap7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 16:46:58",
            "last_seen_utc": "2025-09-19 16:47:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595707": [
        {
            "ioc_value": "pm7.pyp3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 16:21:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595706": [
        {
            "ioc_value": "e.hap7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 16:20:01",
            "last_seen_utc": "2025-09-19 16:21:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595701": [
        {
            "ioc_value": "www.barefootidaho.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.venom",
            "malware_alias": null,
            "malware_printable": "Venom RAT",
            "first_seen_utc": "2025-09-19 16:00:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/206.188.196.228+www.barefootidaho.com",
            "tags": "AS399629,BLNWX,C2,censys,RAT,Venom",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595702": [
        {
            "ioc_value": "unitedchemicalsco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.venom",
            "malware_alias": null,
            "malware_printable": "Venom RAT",
            "first_seen_utc": "2025-09-19 16:00:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/206.188.196.228+unitedchemicalsco.com",
            "tags": "AS399629,BLNWX,C2,censys,RAT,Venom",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595700": [
        {
            "ioc_value": "mail.centraloregonmortgages.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.venom",
            "malware_alias": null,
            "malware_printable": "Venom RAT",
            "first_seen_utc": "2025-09-19 16:00:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/206.188.196.228+mail.centraloregonmortgages.com",
            "tags": "AS399629,BLNWX,C2,censys,RAT,Venom",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595699": [
        {
            "ioc_value": "schoolcloud.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-09-19 16:00:52",
            "last_seen_utc": "2025-09-20 04:00:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/147.93.121.104+schoolcloud.tech",
            "tags": "AS-HOSTINGER,AS47583,C2,censys,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595689": [
        {
            "ioc_value": "u1.pyp3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 15:32:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595688": [
        {
            "ioc_value": "c9a.vem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 15:32:06",
            "last_seen_utc": "2025-09-19 15:34:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595686": [
        {
            "ioc_value": "y.pyp3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 15:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595685": [
        {
            "ioc_value": "zx.vem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 15:18:20",
            "last_seen_utc": "2025-09-19 15:20:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595676": [
        {
            "ioc_value": "maksgofile.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-19 14:43:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "domain,MaksRAT,MavenRAT,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595675": [
        {
            "ioc_value": "mavenrat.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-19 14:40:33",
            "last_seen_utc": "2025-12-08 15:38:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "domain,MaksRAT,MavenRAT,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595674": [
        {
            "ioc_value": "wz8.qej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 14:39:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595673": [
        {
            "ioc_value": "h5.vem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 14:38:07",
            "last_seen_utc": "2025-09-19 14:39:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595669": [
        {
            "ioc_value": "olbanha.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-19 14:33:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1968264739873812849",
            "tags": "c2,domain,NetSupport,NetSupportManager,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595670": [
        {
            "ioc_value": "ghostrio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-19 14:33:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1968264739873812849",
            "tags": "c2,domain,NetSupport,NetSupportManager,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595671": [
        {
            "ioc_value": "cassandpool2.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-19 14:33:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1968264739873812849",
            "tags": "c2,domain,NetSupport,NetSupportManager,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595662": [
        {
            "ioc_value": "dodge2me.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-19 14:29:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115231411672482421",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1595664": [
        {
            "ioc_value": "yungndcrazy.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-19 14:29:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115231411672482421",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1595666": [
        {
            "ioc_value": "w.vem4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 14:29:38",
            "last_seen_utc": "2025-09-19 14:29:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595668": [
        {
            "ioc_value": "p0.qej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 14:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595652": [
        {
            "ioc_value": "m1s.van1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 14:21:49",
            "last_seen_utc": "2025-09-19 14:05:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595654": [
        {
            "ioc_value": "thetavaluemetrics.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-19 14:21:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "netsupport",
            "anonymous": "0",
            "reporter": "Aura"
        }
    ],
    "1595655": [
        {
            "ioc_value": "emballeplus.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-19 14:21:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "netsupport",
            "anonymous": "0",
            "reporter": "Aura"
        }
    ],
    "1595651": [
        {
            "ioc_value": "g.qej9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:52:19",
            "last_seen_utc": "2025-09-19 14:05:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595645": [
        {
            "ioc_value": "once-controller.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-19 13:50:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-zxvl6swmv7",
            "tags": "office04,quasar,triage",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1595646": [
        {
            "ioc_value": "k0n.xyc0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:50:35",
            "last_seen_utc": "2025-09-19 13:27:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595648": [
        {
            "ioc_value": "p.van1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:50:35",
            "last_seen_utc": "2025-09-19 13:31:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595649": [
        {
            "ioc_value": "7m.van1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:50:33",
            "last_seen_utc": "2025-09-19 13:36:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595650": [
        {
            "ioc_value": "va.van1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:50:33",
            "last_seen_utc": "2025-09-19 13:52:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595647": [
        {
            "ioc_value": "t1z.qeh5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:27:10",
            "last_seen_utc": "2025-09-19 13:30:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595612": [
        {
            "ioc_value": "qf.byq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:19:07",
            "last_seen_utc": "2025-09-19 11:20:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595615": [
        {
            "ioc_value": "x8d.byq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:19:06",
            "last_seen_utc": "2025-09-19 11:36:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595632": [
        {
            "ioc_value": "d.xyc0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:19:04",
            "last_seen_utc": "2025-09-19 12:08:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595634": [
        {
            "ioc_value": "r8.xyc0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:19:03",
            "last_seen_utc": "2025-09-19 12:30:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595643": [
        {
            "ioc_value": "ta.xyc0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:19:00",
            "last_seen_utc": "2025-09-19 13:05:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595644": [
        {
            "ioc_value": "b3.qeh5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 13:05:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595636": [
        {
            "ioc_value": "savuyascas.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-19 12:49:43",
            "last_seen_utc": "2025-10-20 11:48:54",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595635": [
        {
            "ioc_value": "r1q.kot9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 12:30:28",
            "last_seen_utc": "2025-09-19 12:30:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595633": [
        {
            "ioc_value": "z.kot9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 12:08:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595631": [
        {
            "ioc_value": "havij.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-19 12:03:08",
            "last_seen_utc": "2025-10-10 11:34:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250919-lq6tzagq2y",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595624": [
        {
            "ioc_value": "eepaulisblessed.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-19 12:00:27",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250919-hx2baaen9w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595622": [
        {
            "ioc_value": "wish-license.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-19 12:00:12",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250919-kbx3vaxzev",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595623": [
        {
            "ioc_value": "xworm0106.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-19 12:00:12",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250919-hcmx6aej5w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595613": [
        {
            "ioc_value": "q2.jod6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 11:20:17",
            "last_seen_utc": "2025-09-19 11:36:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595608": [
        {
            "ioc_value": "s.byq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 10:58:56",
            "last_seen_utc": "2025-09-19 10:33:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595610": [
        {
            "ioc_value": "h1.byq3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 10:58:55",
            "last_seen_utc": "2025-09-19 10:52:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595604": [
        {
            "ioc_value": "eg.z-99-l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 10:58:54",
            "last_seen_utc": "2025-09-19 09:33:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595606": [
        {
            "ioc_value": "vk.z-99-l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 10:58:54",
            "last_seen_utc": "2025-09-19 10:12:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595611": [
        {
            "ioc_value": "j.jod6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 10:52:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595609": [
        {
            "ioc_value": "qa9.pav3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 10:33:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595607": [
        {
            "ioc_value": "v4.pav3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 10:11:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595605": [
        {
            "ioc_value": "c.pav3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 09:33:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595588": [
        {
            "ioc_value": "wd.z-99-l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 09:07:26",
            "last_seen_utc": "2025-09-19 09:03:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595589": [
        {
            "ioc_value": "bt.fag5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 09:00:07",
            "last_seen_utc": "2025-09-19 09:03:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595583": [
        {
            "ioc_value": "xi.z-99-l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 08:47:55",
            "last_seen_utc": "2025-09-19 08:34:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595584": [
        {
            "ioc_value": "n7.fag5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 08:34:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595581": [
        {
            "ioc_value": "tr.x-73-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 08:23:13",
            "last_seen_utc": "2025-09-19 08:19:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595580": [
        {
            "ioc_value": "ext.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-19 08:10:25",
            "last_seen_utc": "2025-09-23 10:10:42",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595578": [
        {
            "ioc_value": "ext.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-19 08:10:24",
            "last_seen_utc": "2025-12-14 12:10:20",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595575": [
        {
            "ioc_value": "w.x-73-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 08:04:42",
            "last_seen_utc": "2025-09-19 08:04:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595576": [
        {
            "ioc_value": "a.fag5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 08:04:38",
            "last_seen_utc": "2025-09-19 08:19:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595559": [
        {
            "ioc_value": "ts.x-73-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 07:36:31",
            "last_seen_utc": "2025-09-19 07:34:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595560": [
        {
            "ioc_value": "lm3.cup7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 07:34:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595557": [
        {
            "ioc_value": "pt.x-73-r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 07:17:01",
            "last_seen_utc": "2025-09-19 07:07:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595558": [
        {
            "ioc_value": "d2.cup7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 07:07:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595555": [
        {
            "ioc_value": "gz.w-30-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 06:52:38",
            "last_seen_utc": "2025-09-19 06:35:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595556": [
        {
            "ioc_value": "w.cup7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 06:35:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595553": [
        {
            "ioc_value": "l.w-30-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 06:23:47",
            "last_seen_utc": "2025-09-19 06:21:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595554": [
        {
            "ioc_value": "ltbcare.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-19 06:21:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595551": [
        {
            "ioc_value": "theoryfood.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-19 06:18:26",
            "last_seen_utc": "2025-09-23 11:20:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595552": [
        {
            "ioc_value": "popcornvolcano.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-19 06:18:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595546": [
        {
            "ioc_value": "em.w-30-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 06:08:19",
            "last_seen_utc": "2025-09-19 06:02:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595548": [
        {
            "ioc_value": "360news2.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-19 06:04:14",
            "last_seen_utc": "2025-10-10 11:35:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250919-d113gavxhw",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595547": [
        {
            "ioc_value": "zr.zik9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 06:02:22",
            "last_seen_utc": "2025-09-19 06:21:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595096": [
        {
            "ioc_value": "y.h8y0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 05:44:04",
            "last_seen_utc": "2025-09-18 18:00:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595106": [
        {
            "ioc_value": "b.h8y0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 05:44:03",
            "last_seen_utc": "2025-09-18 18:25:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595108": [
        {
            "ioc_value": "schedule.eliteworkxmarketing.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-19 05:44:03",
            "last_seen_utc": "2025-09-23 08:40:10",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115226700553773430",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1595109": [
        {
            "ioc_value": "ar.q8e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 05:44:03",
            "last_seen_utc": "2025-09-18 18:54:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595544": [
        {
            "ioc_value": "ii.w-30-g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 05:20:06",
            "last_seen_utc": "2025-09-19 05:21:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595543": [
        {
            "ioc_value": "z0v.gug7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 05:00:14",
            "last_seen_utc": "2025-09-19 05:01:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595542": [
        {
            "ioc_value": "h1.zik9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 04:38:15",
            "last_seen_utc": "2025-09-19 05:20:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595541": [
        {
            "ioc_value": "mi.gug7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 04:36:21",
            "last_seen_utc": "2025-09-19 04:38:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595503": [
        {
            "ioc_value": "dnscs.xinzyun.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-19 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.207.193.76+dnscs.xinzyun.cn",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1595501": [
        {
            "ioc_value": "4x.gug7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 03:59:38",
            "last_seen_utc": "2025-09-19 04:01:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595500": [
        {
            "ioc_value": "t.gug7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 03:39:48",
            "last_seen_utc": "2025-09-19 03:41:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595499": [
        {
            "ioc_value": "a9m.wuk0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 03:20:27",
            "last_seen_utc": "2025-09-19 03:21:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595498": [
        {
            "ioc_value": "vp.wuk0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 02:59:34",
            "last_seen_utc": "2025-09-19 03:01:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595495": [
        {
            "ioc_value": "k3.wuk0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 02:39:43",
            "last_seen_utc": "2025-09-19 02:47:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595275": [
        {
            "ioc_value": "t.zik9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 01:39:36",
            "last_seen_utc": "2025-09-19 04:00:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595274": [
        {
            "ioc_value": "n.wuk0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 01:38:10",
            "last_seen_utc": "2025-09-19 01:39:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595273": [
        {
            "ioc_value": "xq8.juq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 00:19:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595272": [
        {
            "ioc_value": "u1r.ror6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-19 00:18:39",
            "last_seen_utc": "2025-09-19 00:20:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595262": [
        {
            "ioc_value": "p9.juq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 23:41:43",
            "last_seen_utc": "2025-09-19 00:01:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595261": [
        {
            "ioc_value": "q7.ror6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 23:39:56",
            "last_seen_utc": "2025-09-18 23:41:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595260": [
        {
            "ioc_value": "z.ror6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 23:25:11",
            "last_seen_utc": "2025-09-19 00:01:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595257": [
        {
            "ioc_value": "otr.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-18 23:10:26",
            "last_seen_utc": "2025-09-19 07:10:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595259": [
        {
            "ioc_value": "otr.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-18 23:10:26",
            "last_seen_utc": "2025-09-19 07:10:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595255": [
        {
            "ioc_value": "k.juq0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 23:01:36",
            "last_seen_utc": "2025-09-18 23:25:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595254": [
        {
            "ioc_value": "m1f.fid1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 23:00:19",
            "last_seen_utc": "2025-09-18 23:01:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595253": [
        {
            "ioc_value": "qw2.n-98.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 22:37:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595252": [
        {
            "ioc_value": "tx.fid1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 22:35:16",
            "last_seen_utc": "2025-09-18 22:37:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595251": [
        {
            "ioc_value": "h4.n-98.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 22:18:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595250": [
        {
            "ioc_value": "2q.fid1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 22:17:57",
            "last_seen_utc": "2025-09-18 22:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595249": [
        {
            "ioc_value": "g.fid1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 22:00:13",
            "last_seen_utc": "2025-09-18 22:01:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595248": [
        {
            "ioc_value": "l.n-98.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 21:37:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595247": [
        {
            "ioc_value": "x2n.tem5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 21:36:42",
            "last_seen_utc": "2025-09-18 21:38:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595245": [
        {
            "ioc_value": "ty3.z-67.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 21:00:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595244": [
        {
            "ioc_value": "qk.tem5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 20:59:31",
            "last_seen_utc": "2025-09-18 21:00:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595241": [
        {
            "ioc_value": "m9.tem5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 20:32:33",
            "last_seen_utc": "2025-09-18 20:34:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595239": [
        {
            "ioc_value": "k2.z-67.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 20:17:37",
            "last_seen_utc": "2025-09-18 20:32:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595238": [
        {
            "ioc_value": "a.tem5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 20:16:45",
            "last_seen_utc": "2025-09-18 20:18:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595237": [
        {
            "ioc_value": "xboxtelemetry-defender.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-09-18 20:15:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-wkgm1ay1cv",
            "tags": "amadey,c2,domain,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595235": [
        {
            "ioc_value": "polyglotik.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-18 20:11:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-epjvgshr4y",
            "tags": "c2,domain,NetSupport,RAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595212": [
        {
            "ioc_value": "r.q8e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 19:59:27",
            "last_seen_utc": "2025-09-18 20:01:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595211": [
        {
            "ioc_value": "e.z-67.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 19:41:17",
            "last_seen_utc": "2025-09-18 20:01:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595210": [
        {
            "ioc_value": "bs.q8e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 19:40:05",
            "last_seen_utc": "2025-09-18 19:41:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595209": [
        {
            "ioc_value": "ad.q8e5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 19:23:47",
            "last_seen_utc": "2025-09-18 19:25:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595206": [
        {
            "ioc_value": "pq5.x-05.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 18:54:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595107": [
        {
            "ioc_value": "u3.x-05.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 18:25:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595105": [
        {
            "ioc_value": "sp2.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-18 18:10:26",
            "last_seen_utc": "2025-09-18 22:10:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595102": [
        {
            "ioc_value": "re-vic.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-18 18:04:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-t6lsqstkw4",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595101": [
        {
            "ioc_value": "el2rhabybh-61907.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-18 18:03:24",
            "last_seen_utc": "2025-10-03 09:02:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-tx8adabm5x",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595097": [
        {
            "ioc_value": "daciw98636-36752.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-18 18:02:15",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-vsm93syxcs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595098": [
        {
            "ioc_value": "copy-victor.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-18 18:02:15",
            "last_seen_utc": "2025-09-24 11:56:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-q1btsswvdz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595099": [
        {
            "ioc_value": "j-mere.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-18 18:02:15",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-qmnw7sgp8v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595095": [
        {
            "ioc_value": "bo.h8y0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 17:42:37",
            "last_seen_utc": "2025-09-18 17:40:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595061": [
        {
            "ioc_value": "bc.k9u1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 17:33:11",
            "last_seen_utc": "2025-09-18 15:21:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595059": [
        {
            "ioc_value": "ae.k9u1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 17:33:10",
            "last_seen_utc": "2025-09-18 15:00:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595063": [
        {
            "ioc_value": "l.k9u1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 17:33:09",
            "last_seen_utc": "2025-09-18 15:39:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595065": [
        {
            "ioc_value": "g.l9a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 17:33:09",
            "last_seen_utc": "2025-09-18 17:16:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595085": [
        {
            "ioc_value": "al.l9a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 17:33:08",
            "last_seen_utc": "2025-09-18 16:21:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595087": [
        {
            "ioc_value": "bu.l9a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 17:33:08",
            "last_seen_utc": "2025-09-18 16:41:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595090": [
        {
            "ioc_value": "t.h8y0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 17:33:07",
            "last_seen_utc": "2025-09-18 17:20:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595092": [
        {
            "ioc_value": "numberpold.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-18 17:33:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115226454981386519",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1595094": [
        {
            "ioc_value": "fortiseadon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-18 17:33:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115226454981386519",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1595089": [
        {
            "ioc_value": "d.x-05.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 17:15:48",
            "last_seen_utc": "2025-09-18 18:00:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595086": [
        {
            "ioc_value": "m1.p-81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 16:21:40",
            "last_seen_utc": "2025-09-18 16:40:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595082": [
        {
            "ioc_value": "zas.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-18 16:10:26",
            "last_seen_utc": "2025-09-18 17:10:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595080": [
        {
            "ioc_value": "zas.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-18 16:10:25",
            "last_seen_utc": "2025-09-18 22:10:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1595078": [
        {
            "ioc_value": "amprox.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-18 16:03:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.175.41+amprox.click",
            "tags": "Amatera,AS13335,C2,censys,CLOUDFLARENET,Panel,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1595064": [
        {
            "ioc_value": "j.p-81.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 15:37:59",
            "last_seen_utc": "2025-09-18 16:00:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595062": [
        {
            "ioc_value": "zr3.f-11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 15:19:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595054": [
        {
            "ioc_value": "chrome1update.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-09-18 14:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1595057": [
        {
            "ioc_value": "aq.k9u1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 14:54:38",
            "last_seen_utc": "2025-09-18 14:53:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595058": [
        {
            "ioc_value": "q5.f-11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 14:53:02",
            "last_seen_utc": "2025-09-18 15:00:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595049": [
        {
            "ioc_value": "ag.d1a8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 14:42:23",
            "last_seen_utc": "2025-09-18 14:41:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595050": [
        {
            "ioc_value": "sjwuy.cyou",
            "ioc_type": "domain",
            "threat_type": "cc_skimming",
            "malware": "win.unidentified_058",
            "malware_alias": null,
            "malware_printable": "Unidentified 058",
            "first_seen_utc": "2025-09-18 14:42:22",
            "last_seen_utc": null,
            "confidence_level": 25,
            "reference": "",
            "tags": "Phishing",
            "anonymous": "1",
            "reporter": "NiamonX"
        }
    ],
    "1595052": [
        {
            "ioc_value": "c.f-11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 14:41:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595047": [
        {
            "ioc_value": "v.d1a8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 14:32:28",
            "last_seen_utc": "2025-09-18 14:20:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595048": [
        {
            "ioc_value": "external.eliteworkxmarketing.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-18 14:32:27",
            "last_seen_utc": "2025-09-23 08:40:10",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115225756727368393",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1595046": [
        {
            "ioc_value": "wm9.z-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 14:08:15",
            "last_seen_utc": "2025-09-18 14:20:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1595045": [
        {
            "ioc_value": "bf.d1a8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 14:07:28",
            "last_seen_utc": "2025-09-18 14:08:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1594588": [
        {
            "ioc_value": "aw.g6i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 13:57:14",
            "last_seen_utc": "2025-09-18 13:27:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595043": [
        {
            "ioc_value": "q.d1a8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 13:57:10",
            "last_seen_utc": "2025-09-18 13:48:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1595040": [
        {
            "ioc_value": "api3.samsungcareers.work",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-18 13:45:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "BatShadow",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595041": [
        {
            "ioc_value": "jobs-marriott.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-18 13:45:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "BatShadow",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595042": [
        {
            "ioc_value": "samsung-work.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-18 13:45:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "BatShadow",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595038": [
        {
            "ioc_value": "eventdelegationhq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-18 13:44:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2727",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595039": [
        {
            "ioc_value": "plainfenassociates.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-18 13:44:37",
            "last_seen_utc": "2025-09-23 08:38:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "TA2727",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595037": [
        {
            "ioc_value": "czvum-84-84-38-102.a.free.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-18 13:43:36",
            "last_seen_utc": "2025-09-24 11:56:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595036": [
        {
            "ioc_value": "xsopflgg.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-18 13:42:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595034": [
        {
            "ioc_value": "atttp123.pwns.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-18 13:41:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595035": [
        {
            "ioc_value": "www.mlcrosoft.ninth.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-18 13:41:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595032": [
        {
            "ioc_value": "aiopal.giize.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-18 13:40:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1595033": [
        {
            "ioc_value": "wolverinlogan2025.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-18 13:40:50",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1594781": [
        {
            "ioc_value": "t7.z-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 13:27:56",
            "last_seen_utc": "2025-09-18 13:48:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593935": [
        {
            "ioc_value": "poundas.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-18 13:20:18",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593936": [
        {
            "ioc_value": "luxozqa.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-18 13:20:18",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593932": [
        {
            "ioc_value": "am.g6i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 13:17:33",
            "last_seen_utc": "2025-09-18 13:08:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593933": [
        {
            "ioc_value": "h.z-72.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 13:08:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593928": [
        {
            "ioc_value": "bl.g6i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 12:47:33",
            "last_seen_utc": "2025-09-18 12:47:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593927": [
        {
            "ioc_value": "bn.g6i2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 12:20:30",
            "last_seen_utc": "2025-09-18 12:20:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593926": [
        {
            "ioc_value": "pir.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-18 12:10:29",
            "last_seen_utc": "2025-09-18 15:10:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593924": [
        {
            "ioc_value": "pir.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-18 12:10:28",
            "last_seen_utc": "2025-09-18 15:10:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593911": [
        {
            "ioc_value": "bi.w9a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 12:08:07",
            "last_seen_utc": "2025-09-18 11:44:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593922": [
        {
            "ioc_value": "au.w9a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 12:08:06",
            "last_seen_utc": "2025-09-18 12:08:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593824": [
        {
            "ioc_value": "j.c8i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 11:33:37",
            "last_seen_utc": "2025-09-18 07:44:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593836": [
        {
            "ioc_value": "porsasystem.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-18 11:33:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1593893": [
        {
            "ioc_value": "ap.c8i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 11:33:35",
            "last_seen_utc": "2025-09-18 08:47:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593907": [
        {
            "ioc_value": "az.b8a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 11:33:33",
            "last_seen_utc": "2025-09-18 10:24:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593904": [
        {
            "ioc_value": "trannynet.adgods.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-18 11:33:32",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1593906": [
        {
            "ioc_value": "bp.b8a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 11:33:31",
            "last_seen_utc": "2025-09-18 10:06:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593909": [
        {
            "ioc_value": "h.b8a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 11:33:30",
            "last_seen_utc": "2025-09-18 11:25:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593910": [
        {
            "ioc_value": "ah.w9a5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 11:33:29",
            "last_seen_utc": "2025-09-18 11:59:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593905": [
        {
            "ioc_value": "at.b8a2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 09:43:24",
            "last_seen_utc": "2025-09-18 09:43:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593823": [
        {
            "ioc_value": "bh.c8i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 07:27:42",
            "last_seen_utc": "2025-09-18 07:23:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593821": [
        {
            "ioc_value": "as.c8i0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 07:20:07",
            "last_seen_utc": "2025-09-18 07:06:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593819": [
        {
            "ioc_value": "bt.q6o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 06:47:14",
            "last_seen_utc": "2025-09-18 06:27:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593808": [
        {
            "ioc_value": "cb.q6o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 06:12:07",
            "last_seen_utc": "2025-09-18 05:48:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593816": [
        {
            "ioc_value": "carexie.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-18 06:04:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593815": [
        {
            "ioc_value": "verserun.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-18 06:04:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593812": [
        {
            "ioc_value": "Twealthybillionaireman.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-18 06:02:19",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-f72cxsar4x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593813": [
        {
            "ioc_value": "sweet1617181920.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-18 06:02:19",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-dt7axazxg1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593811": [
        {
            "ioc_value": "Fnontoplowk-29437.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-18 06:02:12",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-bjtkysvnz2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593810": [
        {
            "ioc_value": "said-spam.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-18 06:02:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250918-c25llszvcv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593806": [
        {
            "ioc_value": "ab.q6o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 05:26:56",
            "last_seen_utc": "2025-09-18 05:26:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593689": [
        {
            "ioc_value": "retiregenz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-18 05:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115221976993094231",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1593803": [
        {
            "ioc_value": "an.q6o4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 04:46:25",
            "last_seen_utc": "2025-09-18 04:46:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593802": [
        {
            "ioc_value": "k.j2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 04:26:36",
            "last_seen_utc": "2025-09-18 04:26:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593714": [
        {
            "ioc_value": "sanercat.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-18 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/43.139.146.100+sanercat.com",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1593713": [
        {
            "ioc_value": "bb.j2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 03:46:20",
            "last_seen_utc": "2025-09-18 03:46:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593712": [
        {
            "ioc_value": "m.j2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 03:27:05",
            "last_seen_utc": "2025-09-18 03:28:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593711": [
        {
            "ioc_value": "zoe.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-18 03:10:29",
            "last_seen_utc": "2025-09-18 11:10:27",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593709": [
        {
            "ioc_value": "zoe.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-18 03:10:28",
            "last_seen_utc": "2025-09-18 11:10:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593706": [
        {
            "ioc_value": "safecs.iqiyi.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-18 02:48:49",
            "last_seen_utc": "2025-12-01 11:50:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593705": [
        {
            "ioc_value": "bd.j2e6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 01:06:27",
            "last_seen_utc": "2025-09-18 01:07:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593704": [
        {
            "ioc_value": "c.l8o6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-18 00:41:30",
            "last_seen_utc": "2025-09-18 00:41:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593693": [
        {
            "ioc_value": "bw.l8o6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 23:26:38",
            "last_seen_utc": "2025-09-17 23:28:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593687": [
        {
            "ioc_value": "z.l8o6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 21:46:20",
            "last_seen_utc": "2025-09-17 21:46:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593686": [
        {
            "ioc_value": "yyi.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-17 21:10:31",
            "last_seen_utc": "2025-09-18 02:10:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593684": [
        {
            "ioc_value": "yyi.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-17 21:10:30",
            "last_seen_utc": "2025-09-18 02:10:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593678": [
        {
            "ioc_value": "f.l8o6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 20:46:14",
            "last_seen_utc": "2025-09-17 20:47:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593511": [
        {
            "ioc_value": "ba.c2y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 20:26:23",
            "last_seen_utc": "2025-09-17 20:28:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593508": [
        {
            "ioc_value": "s.c2y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 20:06:32",
            "last_seen_utc": "2025-09-17 20:06:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593476": [
        {
            "ioc_value": "n.c2y8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 19:07:38",
            "last_seen_utc": "2025-09-17 19:26:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593475": [
        {
            "ioc_value": "ao.x0a3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 18:46:34",
            "last_seen_utc": "2025-09-17 18:46:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593474": [
        {
            "ioc_value": "d.x0a3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 18:18:04",
            "last_seen_utc": "2025-09-17 18:18:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593469": [
        {
            "ioc_value": "qp.cnmnmb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-17 18:04:30",
            "last_seen_utc": "2025-10-10 11:35:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-skgq8ayly7",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593466": [
        {
            "ioc_value": "ca.x0a3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 18:03:48",
            "last_seen_utc": "2025-09-17 18:05:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593465": [
        {
            "ioc_value": "most-la.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-17 18:02:32",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-qbse9adp3x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593464": [
        {
            "ioc_value": "soblessedagain.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-17 18:02:24",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-n8836adj9s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593461": [
        {
            "ioc_value": "www.ammsaue.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-17 18:02:23",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-qhj3fsdq2w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593462": [
        {
            "ioc_value": "www.desalator.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-17 18:02:23",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-qhj3fsdq2w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593463": [
        {
            "ioc_value": "www.treemmesrl-eu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-17 18:02:23",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-qhj3fsdq2w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593457": [
        {
            "ioc_value": "dvd-oxygen.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 18:02:14",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-v4xb5aal3w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593458": [
        {
            "ioc_value": "mountain-percent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 18:02:14",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-tl5p4sgm31",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593459": [
        {
            "ioc_value": "skin-literary.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 18:02:14",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-tjzq3sgk7v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593455": [
        {
            "ioc_value": "bg.x0a3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 17:45:29",
            "last_seen_utc": "2025-09-17 17:46:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593454": [
        {
            "ioc_value": "ak.r1a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 17:31:12",
            "last_seen_utc": "2025-09-17 17:32:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593453": [
        {
            "ioc_value": "av.r1a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 17:06:15",
            "last_seen_utc": "2025-09-17 17:06:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593451": [
        {
            "ioc_value": "af.r1a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 16:36:44",
            "last_seen_utc": "2025-09-17 16:38:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593435": [
        {
            "ioc_value": "famixsk.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-17 16:03:19",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593436": [
        {
            "ioc_value": "sirtpwv.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-17 16:03:19",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593437": [
        {
            "ioc_value": "chirkqa.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-17 16:03:19",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593438": [
        {
            "ioc_value": "chimxik.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-17 16:03:19",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593439": [
        {
            "ioc_value": "unapjjh.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-17 16:03:19",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593440": [
        {
            "ioc_value": "undutayx.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-17 16:03:19",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593441": [
        {
            "ioc_value": "subdvivw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-17 16:03:19",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593442": [
        {
            "ioc_value": "bouncuid.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-17 16:03:19",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593434": [
        {
            "ioc_value": "houshan.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-17 16:03:18",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593428": [
        {
            "ioc_value": "ay.r1a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 15:59:34",
            "last_seen_utc": "2025-09-17 16:00:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593426": [
        {
            "ioc_value": "o.t4a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 15:26:34",
            "last_seen_utc": "2025-09-17 15:28:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593423": [
        {
            "ioc_value": "pis.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-17 15:10:27",
            "last_seen_utc": "2025-09-17 20:10:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593421": [
        {
            "ioc_value": "pis.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-17 15:10:26",
            "last_seen_utc": "2025-09-17 20:10:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593418": [
        {
            "ioc_value": "aj.t4a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 15:09:38",
            "last_seen_utc": "2025-09-17 15:09:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593417": [
        {
            "ioc_value": "bx.t4a4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 14:47:14",
            "last_seen_utc": "2025-09-17 14:48:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593414": [
        {
            "ioc_value": "bv.m7e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 14:38:01",
            "last_seen_utc": "2025-09-17 14:38:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593412": [
        {
            "ioc_value": "bj.m7e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 14:30:02",
            "last_seen_utc": "2025-09-17 13:59:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593413": [
        {
            "ioc_value": "edge.lugerd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-17 14:30:02",
            "last_seen_utc": "2025-09-23 08:40:10",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115220077607025583",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1593409": [
        {
            "ioc_value": "p.m7e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 13:43:56",
            "last_seen_utc": "2025-09-17 13:27:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593408": [
        {
            "ioc_value": "alpha.lugerd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-17 13:25:01",
            "last_seen_utc": "2025-09-23 08:40:10",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115219831512621062",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1593406": [
        {
            "ioc_value": "bm.m7e4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 12:52:08",
            "last_seen_utc": "2025-09-17 12:47:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593382": [
        {
            "ioc_value": "promiseallrace.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-17 12:23:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593383": [
        {
            "ioc_value": "br.x0e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 12:23:57",
            "last_seen_utc": "2025-09-17 11:52:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593399": [
        {
            "ioc_value": "x.x0e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 12:23:57",
            "last_seen_utc": "2025-09-17 12:16:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593402": [
        {
            "ioc_value": "ray2me.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-17 12:23:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115219598162012978",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1593404": [
        {
            "ioc_value": "everyday2gether.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-17 12:23:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115219598162012978",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1593400": [
        {
            "ioc_value": "r.h-18.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 12:16:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593387": [
        {
            "ioc_value": "iyruuv6.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-17 12:02:18",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-nlt1qacq5w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593388": [
        {
            "ioc_value": "greatguru1985.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-17 12:02:18",
            "last_seen_utc": "2025-12-12 18:39:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-ls3v4abm5s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593386": [
        {
            "ioc_value": "deo.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-17 12:02:17",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-nlt1qacq5w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593319": [
        {
            "ioc_value": "joebesser.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-17 11:39:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1593324": [
        {
            "ioc_value": "asdkasdjakjsdmd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-17 11:39:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1593325": [
        {
            "ioc_value": "mifirental.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-17 11:39:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1593381": [
        {
            "ioc_value": "aa.x0e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 10:42:23",
            "last_seen_utc": "2025-09-17 10:42:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593380": [
        {
            "ioc_value": "abanghmf.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-09-17 10:27:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593378": [
        {
            "ioc_value": "taxacts.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-17 10:27:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593377": [
        {
            "ioc_value": "n26a4ekqvqxd5fsq3k6bau7lrlikiczgnuny5v3vtgef4fw5gq24deyd.onion",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bit_rat",
            "malware_alias": null,
            "malware_printable": "BitRAT",
            "first_seen_utc": "2025-09-17 10:27:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593366": [
        {
            "ioc_value": "xhost-27542.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593367": [
        {
            "ioc_value": "operation-integrating.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593368": [
        {
            "ioc_value": "llnmu2y78-35554.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593369": [
        {
            "ioc_value": "wednesday-keyword.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593370": [
        {
            "ioc_value": "investment-calendar.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593371": [
        {
            "ioc_value": "zczxczx-37792.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593372": [
        {
            "ioc_value": "mhzl2wy-36319.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593373": [
        {
            "ioc_value": "fish-shake.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593374": [
        {
            "ioc_value": "century-shirt.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593375": [
        {
            "ioc_value": "topic-florists.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593376": [
        {
            "ioc_value": "cash-architects.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593365": [
        {
            "ioc_value": "works-amounts.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 10:27:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593353": [
        {
            "ioc_value": "envio1009.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-17 10:27:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593354": [
        {
            "ioc_value": "dcoctubre9.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-17 10:27:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593355": [
        {
            "ioc_value": "kikiik3.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-17 10:27:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593356": [
        {
            "ioc_value": "dcgazt.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-17 10:27:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593357": [
        {
            "ioc_value": "envio08.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-17 10:27:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593342": [
        {
            "ioc_value": "johnpeterson123-48596.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-17 10:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593343": [
        {
            "ioc_value": "cahol33666-24962.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-17 10:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593344": [
        {
            "ioc_value": "koolkiddoj999987654-59833.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-17 10:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593345": [
        {
            "ioc_value": "jomegi9539-58684.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-17 10:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593346": [
        {
            "ioc_value": "andrewandre428.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-17 10:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593347": [
        {
            "ioc_value": "friend-brisbane.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-17 10:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593348": [
        {
            "ioc_value": "adamdk12-53145.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-17 10:27:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "17September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1593332": [
        {
            "ioc_value": "bk.x0e8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 10:19:57",
            "last_seen_utc": "2025-09-17 10:20:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593331": [
        {
            "ioc_value": "duz.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-17 10:11:14",
            "last_seen_utc": "2025-09-17 14:11:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593329": [
        {
            "ioc_value": "duz.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-17 10:11:13",
            "last_seen_utc": "2025-09-17 14:11:37",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593327": [
        {
            "ioc_value": "qz7.g-22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 10:02:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593326": [
        {
            "ioc_value": "e.s3i1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 10:00:49",
            "last_seen_utc": "2025-09-17 10:02:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593323": [
        {
            "ioc_value": "m3.g-22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 09:36:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593322": [
        {
            "ioc_value": "w.s3i1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 09:35:38",
            "last_seen_utc": "2025-09-17 09:37:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593318": [
        {
            "ioc_value": "v.g-22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 08:56:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593317": [
        {
            "ioc_value": "ax.s3i1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 08:55:27",
            "last_seen_utc": "2025-09-17 08:56:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593312": [
        {
            "ioc_value": "ac.s3i1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 08:34:35",
            "last_seen_utc": "2025-09-17 08:35:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593311": [
        {
            "ioc_value": "ab2.z-20.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 08:31:14",
            "last_seen_utc": "2025-09-17 08:35:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593300": [
        {
            "ioc_value": "k.z-20.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 08:01:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593299": [
        {
            "ioc_value": "ai.s9i1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 07:59:57",
            "last_seen_utc": "2025-09-17 08:01:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593296": [
        {
            "ioc_value": "u.s9i1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 07:43:31",
            "last_seen_utc": "2025-09-17 07:44:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593291": [
        {
            "ioc_value": "rxe.526r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 07:17:21",
            "last_seen_utc": "2025-09-17 07:06:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593295": [
        {
            "ioc_value": "bq.s9i1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 07:17:20",
            "last_seen_utc": "2025-09-17 08:31:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593293": [
        {
            "ioc_value": "x0r.v51o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 07:05:33",
            "last_seen_utc": "2025-09-17 07:43:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593289": [
        {
            "ioc_value": "1m.526r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 06:58:18",
            "last_seen_utc": "2025-09-17 07:00:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593286": [
        {
            "ioc_value": "c8.526r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 06:33:44",
            "last_seen_utc": "2025-09-17 06:25:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593287": [
        {
            "ioc_value": "d1.v51o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 06:25:46",
            "last_seen_utc": "2025-09-17 07:00:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592557": [
        {
            "ioc_value": "mkt.97jt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 06:09:41",
            "last_seen_utc": "2025-09-16 22:12:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592559": [
        {
            "ioc_value": "g.527w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 06:09:41",
            "last_seen_utc": "2025-09-16 22:32:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593284": [
        {
            "ioc_value": "p.526r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 06:05:57",
            "last_seen_utc": "2025-09-17 06:08:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593282": [
        {
            "ioc_value": "l.v51o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 06:04:54",
            "last_seen_utc": "2025-09-17 06:08:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593280": [
        {
            "ioc_value": "gift.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-17 06:03:12",
            "last_seen_utc": "2025-09-24 11:56:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-gpgfgagp9s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593277": [
        {
            "ioc_value": "989jsdbty.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-17 06:02:46",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-dqyvcsel3t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593278": [
        {
            "ioc_value": "4802jkshdp.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-17 06:02:46",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-dqyvcsel3t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593279": [
        {
            "ioc_value": "74yanadh.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-17 06:02:46",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-dqyvcsel3t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593276": [
        {
            "ioc_value": "paygateme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-17 06:02:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-fh2mdsfq4y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593274": [
        {
            "ioc_value": "exim111.casacam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 06:02:14",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-e36amssn17",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593275": [
        {
            "ioc_value": "you-gaps.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-17 06:02:14",
            "last_seen_utc": "2025-09-24 11:56:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250917-bmpq6scr5z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1593273": [
        {
            "ioc_value": "0zq.802d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 05:46:35",
            "last_seen_utc": "2025-09-17 06:04:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593233": [
        {
            "ioc_value": "fastfoodnewyorkcity.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-17 04:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/35.222.81.7+fastfoodnewyorkcity.com",
            "tags": "AS396982,C2,censys,GOOGLE-CLOUD-PLATFORM,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1593229": [
        {
            "ioc_value": "ret.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-17 02:10:24",
            "last_seen_utc": "2025-09-17 09:10:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593227": [
        {
            "ioc_value": "ret.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-17 02:10:23",
            "last_seen_utc": "2025-09-17 09:10:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1593225": [
        {
            "ioc_value": "v3.802d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 01:59:02",
            "last_seen_utc": "2025-09-17 02:00:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593224": [
        {
            "ioc_value": "cm0.s57o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 01:55:05",
            "last_seen_utc": "2025-09-17 01:59:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593223": [
        {
            "ioc_value": "h1.802d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 01:45:53",
            "last_seen_utc": "2025-09-17 01:55:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593221": [
        {
            "ioc_value": "s.802d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 00:45:45",
            "last_seen_utc": "2025-09-17 00:46:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593220": [
        {
            "ioc_value": "2w1.527w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 00:25:54",
            "last_seen_utc": "2025-09-17 00:28:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593219": [
        {
            "ioc_value": "v5.s57o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 00:06:21",
            "last_seen_utc": "2025-09-17 00:46:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593218": [
        {
            "ioc_value": "tc.527w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-17 00:05:32",
            "last_seen_utc": "2025-09-17 00:06:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1593206": [
        {
            "ioc_value": "z.s57o.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 23:35:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1593204": [
        {
            "ioc_value": "n9.527w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 23:25:51",
            "last_seen_utc": "2025-09-16 23:35:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592562": [
        {
            "ioc_value": "ctu.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 23:10:25",
            "last_seen_utc": "2025-09-17 01:10:22",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592560": [
        {
            "ioc_value": "k3x.k26i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 22:32:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592558": [
        {
            "ioc_value": "a1.k26i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 22:12:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592463": [
        {
            "ioc_value": "4h.97jt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 21:25:42",
            "last_seen_utc": "2025-09-16 21:25:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592462": [
        {
            "ioc_value": "dsu.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 21:10:25",
            "last_seen_utc": "2025-09-17 01:10:22",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592456": [
        {
            "ioc_value": "e2.97jt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 20:33:48",
            "last_seen_utc": "2025-09-16 20:35:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592454": [
        {
            "ioc_value": "y.97jt.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 20:17:01",
            "last_seen_utc": "2025-09-16 20:18:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592453": [
        {
            "ioc_value": "r.k26i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 20:11:33",
            "last_seen_utc": "2025-09-16 21:25:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592452": [
        {
            "ioc_value": "md.jaxusoo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 20:11:08",
            "last_seen_utc": "2025-09-17 10:02:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592451": [
        {
            "ioc_value": "dsu.demoserviciopcmendoza.com.ar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 20:10:24",
            "last_seen_utc": "2025-09-16 22:10:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592449": [
        {
            "ioc_value": "bzr.29rs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 20:05:49",
            "last_seen_utc": "2025-09-16 20:11:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592430": [
        {
            "ioc_value": "0k.29rs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 19:53:35",
            "last_seen_utc": "2025-09-16 19:55:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592429": [
        {
            "ioc_value": "a5.29rs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 19:45:57",
            "last_seen_utc": "2025-09-16 19:46:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592426": [
        {
            "ioc_value": "j.29rs.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 19:10:49",
            "last_seen_utc": "2025-09-16 19:12:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592424": [
        {
            "ioc_value": "wq9.l48i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 19:05:26",
            "last_seen_utc": "2025-09-16 19:12:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592423": [
        {
            "ioc_value": "z1.97qm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 19:04:12",
            "last_seen_utc": "2025-09-16 19:05:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592420": [
        {
            "ioc_value": "k.97qm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 18:38:49",
            "last_seen_utc": "2025-09-16 18:27:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592422": [
        {
            "ioc_value": "5n.97qm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 18:38:49",
            "last_seen_utc": "2025-09-16 18:35:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592419": [
        {
            "ioc_value": "n.l48i.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 18:19:50",
            "last_seen_utc": "2025-09-16 18:35:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592418": [
        {
            "ioc_value": "tf.hecynya.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 18:19:49",
            "last_seen_utc": "2025-09-16 19:12:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592414": [
        {
            "ioc_value": "resolution-during.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-16 18:02:38",
            "last_seen_utc": "2025-09-24 11:56:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250916-wcehnsgl8s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592412": [
        {
            "ioc_value": "ablelifepurp.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-16 18:02:09",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250916-q28j6atq19",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592413": [
        {
            "ioc_value": "k8uh0-bfc.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-16 18:02:09",
            "last_seen_utc": "2025-09-25 13:46:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/250916-pftnfavyby",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592372": [
        {
            "ioc_value": "9c.81dm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 17:57:18",
            "last_seen_utc": "2025-09-16 16:06:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592373": [
        {
            "ioc_value": "uspeh888.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-16 17:57:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1592404": [
        {
            "ioc_value": "a1x.81dm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 17:57:16",
            "last_seen_utc": "2025-09-16 18:19:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592410": [
        {
            "ioc_value": "swifew.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 17:48:47",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592402": [
        {
            "ioc_value": "studygrowknow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-16 16:49:08",
            "last_seen_utc": "2025-10-23 09:49:56",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592400": [
        {
            "ioc_value": "forbeseditions.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-16 16:48:58",
            "last_seen_utc": "2025-09-21 21:48:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592401": [
        {
            "ioc_value": "l.x-ai.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-16 16:48:58",
            "last_seen_utc": "2025-12-14 11:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592382": [
        {
            "ioc_value": "weafrc.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592383": [
        {
            "ioc_value": "greued.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592384": [
        {
            "ioc_value": "stozft.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592385": [
        {
            "ioc_value": "haleyzq.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592386": [
        {
            "ioc_value": "labiali.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592387": [
        {
            "ioc_value": "maiwau.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592388": [
        {
            "ioc_value": "strmuc.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592389": [
        {
            "ioc_value": "faspub.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592390": [
        {
            "ioc_value": "reformd.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592391": [
        {
            "ioc_value": "rosajd.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:18",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592374": [
        {
            "ioc_value": "resplem.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:17",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592375": [
        {
            "ioc_value": "hitwaze.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:17",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592376": [
        {
            "ioc_value": "reptlc.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:17",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592377": [
        {
            "ioc_value": "lectola.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:17",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592378": [
        {
            "ioc_value": "poloxj.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:17",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592379": [
        {
            "ioc_value": "tadolq.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:17",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592380": [
        {
            "ioc_value": "malfln.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:17",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592381": [
        {
            "ioc_value": "scruuj.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 16:25:17",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592368": [
        {
            "ioc_value": "www.rootshift.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-16 16:02:48",
            "last_seen_utc": "2025-09-17 04:00:35",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/5.129.197.185+www.rootshift.ru",
            "tags": "AS9123,C2,censys,Havoc,TIMEWEB-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592348": [
        {
            "ioc_value": "www.pussyserver.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-16 15:51:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0664cb2604dc2c6da4c43af1891f5c7f05ca786174a742dd1ddf51ca9ac9eb08/",
            "tags": "MaksRAT,MaksStealer,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592336": [
        {
            "ioc_value": "d.7-gb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 15:47:44",
            "last_seen_utc": "2025-09-16 13:40:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592339": [
        {
            "ioc_value": "z7.7-gb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 15:47:43",
            "last_seen_utc": "2025-09-16 14:26:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592340": [
        {
            "ioc_value": "qf.7-gb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 15:47:43",
            "last_seen_utc": "2025-09-16 14:46:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592344": [
        {
            "ioc_value": "8u2.7-gb.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 15:47:42",
            "last_seen_utc": "2025-09-16 15:25:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592345": [
        {
            "ioc_value": "r.81dm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 15:47:42",
            "last_seen_utc": "2025-09-16 15:35:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592347": [
        {
            "ioc_value": "t6.81dm.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 15:47:42",
            "last_seen_utc": "2025-09-16 15:47:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592338": [
        {
            "ioc_value": "pa1.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 14:10:24",
            "last_seen_utc": "2025-09-16 20:10:23",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592335": [
        {
            "ioc_value": "geartopciklorek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-09-16 13:32:19",
            "last_seen_utc": "2025-10-11 20:31:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592330": [
        {
            "ioc_value": "milder-go.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-16 13:27:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115214165100981830",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1592332": [
        {
            "ioc_value": "4reverinmymind.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-16 13:27:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115214165100981830",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1592333": [
        {
            "ioc_value": "kiwisandblasters.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-16 13:27:10",
            "last_seen_utc": "2025-09-22 06:56:11",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115214167242686784",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1592334": [
        {
            "ioc_value": "0e.8-fr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 13:27:09",
            "last_seen_utc": "2025-09-16 13:26:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592328": [
        {
            "ioc_value": "hp.8-fr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 13:16:15",
            "last_seen_utc": "2025-09-16 13:16:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592327": [
        {
            "ioc_value": "pas.margencymedia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 13:10:26",
            "last_seen_utc": "2025-09-16 19:10:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592325": [
        {
            "ioc_value": "pas.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 13:10:25",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592303": [
        {
            "ioc_value": "x9d.7-fd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 13:01:38",
            "last_seen_utc": "2025-09-16 11:59:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592318": [
        {
            "ioc_value": "m.8-fr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 13:01:37",
            "last_seen_utc": "2025-09-16 12:10:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592320": [
        {
            "ioc_value": "v1.8-fr.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 13:01:36",
            "last_seen_utc": "2025-09-16 12:21:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592310": [
        {
            "ioc_value": "xperiencehostwindows.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-16 12:02:22",
            "last_seen_utc": "2025-09-24 11:56:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250916-jznzeahp7s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592308": [
        {
            "ioc_value": "tooblessed2bcursed.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-16 12:02:06",
            "last_seen_utc": "2025-09-25 13:46:03",
            "confidence_level": 100,
            "reference": "https://tria.ge/250916-nsgnzatkw9",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592301": [
        {
            "ioc_value": "kt.7-fd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 11:46:08",
            "last_seen_utc": "2025-09-16 11:47:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592300": [
        {
            "ioc_value": "3z.7-fd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 11:19:03",
            "last_seen_utc": "2025-09-16 11:05:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592292": [
        {
            "ioc_value": "u.w6n2t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 10:53:11",
            "last_seen_utc": "2025-09-16 10:05:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592295": [
        {
            "ioc_value": "a.7-fd.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 10:53:11",
            "last_seen_utc": "2025-09-16 10:46:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592296": [
        {
            "ioc_value": "mersinet.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-16 10:53:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1592294": [
        {
            "ioc_value": "dot.margencymedia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 10:10:43",
            "last_seen_utc": "2025-09-16 15:24:44",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592291": [
        {
            "ioc_value": "j.w6n2t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 09:46:53",
            "last_seen_utc": "2025-09-16 09:51:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592290": [
        {
            "ioc_value": "ar.w6n2t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 09:26:04",
            "last_seen_utc": "2025-09-16 09:49:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592289": [
        {
            "ioc_value": "dot.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 09:10:25",
            "last_seen_utc": "2025-09-16 15:24:44",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592287": [
        {
            "ioc_value": "aj.w6n2t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 09:06:44",
            "last_seen_utc": "2025-09-16 09:44:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592282": [
        {
            "ioc_value": "bm.w3h8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 08:39:58",
            "last_seen_utc": "2025-09-16 09:35:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592281": [
        {
            "ioc_value": "bk.w3h8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 08:26:16",
            "last_seen_utc": "2025-09-16 09:31:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1592279": [
        {
            "ioc_value": "ah.w3h8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 08:22:24",
            "last_seen_utc": "2025-09-16 08:07:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592271": [
        {
            "ioc_value": "iskcare.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-16 07:46:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1592270": [
        {
            "ioc_value": "ab.w3h8j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 07:41:11",
            "last_seen_utc": "2025-09-16 07:27:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592269": [
        {
            "ioc_value": "q.v4h3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 07:17:01",
            "last_seen_utc": "2025-09-16 07:05:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590632": [
        {
            "ioc_value": "aa.k0v1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:48:45",
            "last_seen_utc": "2025-09-15 14:34:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590633": [
        {
            "ioc_value": "ai.k0v1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:48:45",
            "last_seen_utc": "2025-09-15 14:25:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590643": [
        {
            "ioc_value": "bf.k0v1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:48:44",
            "last_seen_utc": "2025-09-15 14:45:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590644": [
        {
            "ioc_value": "ak.m5k1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:48:44",
            "last_seen_utc": "2025-09-15 15:23:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590646": [
        {
            "ioc_value": "bn.m5k1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:48:43",
            "last_seen_utc": "2025-09-15 15:55:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590659": [
        {
            "ioc_value": "bw.m5k1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:48:42",
            "last_seen_utc": "2025-09-15 16:12:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590660": [
        {
            "ioc_value": "bz.m5k1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:48:42",
            "last_seen_utc": "2025-09-15 16:26:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590661": [
        {
            "ioc_value": "ba.n6p5j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:48:41",
            "last_seen_utc": "2025-09-15 16:46:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590685": [
        {
            "ioc_value": "lachcnf.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-16 06:48:31",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1592265": [
        {
            "ioc_value": "bo.v4h3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:44:12",
            "last_seen_utc": "2025-09-16 06:44:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592261": [
        {
            "ioc_value": "ax.v4h3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:26:26",
            "last_seen_utc": "2025-09-16 06:27:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592260": [
        {
            "ioc_value": "songs-travel.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-09-16 06:05:58",
            "last_seen_utc": "2025-09-16 06:05:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250916-e1ed5szjt6",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592259": [
        {
            "ioc_value": "au.v4h3t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 06:05:30",
            "last_seen_utc": "2025-09-16 06:06:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592251": [
        {
            "ioc_value": "WormLeboss-48015.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-16 06:02:03",
            "last_seen_utc": "2025-09-24 11:56:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250916-d9ewlazwhv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1592242": [
        {
            "ioc_value": "bjxqd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592243": [
        {
            "ioc_value": "funkyfirmware.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592244": [
        {
            "ioc_value": "daringdatadaredevils.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592245": [
        {
            "ioc_value": "putty.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592246": [
        {
            "ioc_value": "microsoft-teams-download.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592247": [
        {
            "ioc_value": "cyberneticodyssey.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592248": [
        {
            "ioc_value": "datadrivendreamers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592249": [
        {
            "ioc_value": "ruben.findinit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592250": [
        {
            "ioc_value": "putty.us.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592241": [
        {
            "ioc_value": "daniellaurel.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.broomstick",
            "malware_alias": "CLEANBOOST,CleanUp,CleanUpLoader,Oyster",
            "malware_printable": "Broomstick",
            "first_seen_utc": "2025-09-16 05:46:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oyster",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592240": [
        {
            "ioc_value": "patrickhicks.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-16 05:45:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "phantom",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592239": [
        {
            "ioc_value": "n.v1n4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 05:45:43",
            "last_seen_utc": "2025-09-16 05:46:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1592236": [
        {
            "ioc_value": "among-mug.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-16 05:44:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592237": [
        {
            "ioc_value": "k22dmvbyiextMetaHost-24499.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-16 05:44:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592231": [
        {
            "ioc_value": "super-italic.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xenorat",
            "malware_alias": null,
            "malware_printable": "XenoRAT",
            "first_seen_utc": "2025-09-16 05:42:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xenorat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592226": [
        {
            "ioc_value": "shee.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-16 05:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592227": [
        {
            "ioc_value": "suzhuomate.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-16 05:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592225": [
        {
            "ioc_value": "shrek-50283.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-16 05:40:51",
            "last_seen_utc": "2025-09-24 11:56:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592221": [
        {
            "ioc_value": "lm.mutao.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-16 05:40:23",
            "last_seen_utc": "2025-10-10 11:34:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592222": [
        {
            "ioc_value": "voxelnodes.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-16 05:40:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592223": [
        {
            "ioc_value": "wither-xmr.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-16 05:40:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592224": [
        {
            "ioc_value": "xc355.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-16 05:40:23",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592219": [
        {
            "ioc_value": "ajnetwork.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-16 05:40:22",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592220": [
        {
            "ioc_value": "daimao.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-16 05:40:22",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592193": [
        {
            "ioc_value": "yuluo6.f3322.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-16 05:38:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,elknot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592183": [
        {
            "ioc_value": "clashbred999-32728.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-16 05:37:21",
            "last_seen_utc": "2025-09-17 10:27:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592184": [
        {
            "ioc_value": "komicalkalo-46737.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-16 05:37:21",
            "last_seen_utc": "2025-09-17 10:27:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1592185": [
        {
            "ioc_value": "paddymaddy.ddnsfree.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-16 05:37:21",
            "last_seen_utc": "2025-09-17 10:27:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1591015": [
        {
            "ioc_value": "c.v1n4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 05:02:28",
            "last_seen_utc": "2025-09-16 05:03:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1591014": [
        {
            "ioc_value": "az.v1n4n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 04:05:23",
            "last_seen_utc": "2025-09-16 04:06:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590990": [
        {
            "ioc_value": "812331-cb01023.tmweb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-16 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.225.11.79+812331-cb01023.tmweb.ru",
            "tags": "AS9123,C2,censys,TIMEWEB-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1590989": [
        {
            "ioc_value": "e.t8g2w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 03:05:21",
            "last_seen_utc": "2025-09-16 03:07:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590986": [
        {
            "ioc_value": "ad.t8g2w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 02:45:31",
            "last_seen_utc": "2025-09-16 02:45:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590985": [
        {
            "ioc_value": "pdf.margencymedia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 02:10:34",
            "last_seen_utc": "2025-09-16 15:24:44",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590983": [
        {
            "ioc_value": "pdf.aztu.edu.az",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-16 02:10:32",
            "last_seen_utc": "2025-09-16 08:10:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590981": [
        {
            "ioc_value": "g.t4g9w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 02:05:16",
            "last_seen_utc": "2025-09-16 02:05:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590980": [
        {
            "ioc_value": "d.t4g9w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 01:46:01",
            "last_seen_utc": "2025-09-16 01:46:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590977": [
        {
            "ioc_value": "ay.t4g9w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 01:05:45",
            "last_seen_utc": "2025-09-16 01:13:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590976": [
        {
            "ioc_value": "x.t3m3d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 00:35:41",
            "last_seen_utc": "2025-09-16 00:36:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590787": [
        {
            "ioc_value": "r.t3m3d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-16 00:09:47",
            "last_seen_utc": "2025-09-16 00:09:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590775": [
        {
            "ioc_value": "bd.t3m3d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 23:45:18",
            "last_seen_utc": "2025-09-15 23:46:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590774": [
        {
            "ioc_value": "an.t3m3d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 23:21:22",
            "last_seen_utc": "2025-09-15 23:21:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590767": [
        {
            "ioc_value": "datacalls.azure-api.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-15 22:48:53",
            "last_seen_utc": "2025-10-22 07:49:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590766": [
        {
            "ioc_value": "microsoft-telemetry.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-09-15 22:36:02",
            "last_seen_utc": "2025-10-14 23:48:04",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=microsoft-telemetry.at",
            "tags": "Amadey,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590765": [
        {
            "ioc_value": "p.t2w3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 22:34:32",
            "last_seen_utc": "2025-09-15 22:35:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590763": [
        {
            "ioc_value": "a.t2w3v.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 22:05:03",
            "last_seen_utc": "2025-09-15 23:07:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590761": [
        {
            "ioc_value": "t.r3j5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 21:25:20",
            "last_seen_utc": "2025-09-15 21:26:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590735": [
        {
            "ioc_value": "k.r3j5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 20:58:52",
            "last_seen_utc": "2025-09-15 21:00:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590734": [
        {
            "ioc_value": "ssl.gamesen.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-15 20:49:04",
            "last_seen_utc": "2025-11-30 13:48:22",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590733": [
        {
            "ioc_value": "abcd.gamesen.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-15 20:48:50",
            "last_seen_utc": "2025-11-30 13:48:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590727": [
        {
            "ioc_value": "cb.r3j5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 20:25:29",
            "last_seen_utc": "2025-09-15 20:26:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590726": [
        {
            "ioc_value": "ac.r3j5c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 20:10:31",
            "last_seen_utc": "2025-09-15 20:11:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590722": [
        {
            "ioc_value": "corsapi.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-15 20:03:01",
            "last_seen_utc": "2025-09-16 04:01:00",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+corsapi.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590723": [
        {
            "ioc_value": "outlook.microsoft-account-security.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-15 20:03:01",
            "last_seen_utc": "2025-09-16 04:01:01",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/195.133.74.93+outlook.microsoft-account-security.com",
            "tags": "AS48314,censys,EvilGinx,IP-PROJECTS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590721": [
        {
            "ioc_value": "storage.microsoft-account-security.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-15 20:03:00",
            "last_seen_utc": "2025-09-16 04:01:01",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/195.133.74.93+storage.microsoft-account-security.com",
            "tags": "AS48314,censys,EvilGinx,IP-PROJECTS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590716": [
        {
            "ioc_value": "admin.jhaexpress.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-15 20:02:44",
            "last_seen_utc": "2025-09-16 04:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/149.28.157.225+admin.jhaexpress.com",
            "tags": "AS-VULTR,AS20473,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590715": [
        {
            "ioc_value": "74-48-140-110.nip.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-09-15 20:02:42",
            "last_seen_utc": "2025-09-16 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/74.48.140.110+74-48-140-110.nip.io",
            "tags": "AS35916,C2,censys,Hookbot,MULTA-ASN1",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590701": [
        {
            "ioc_value": "bx.r2h7m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 20:01:42",
            "last_seen_utc": "2025-09-15 20:02:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590699": [
        {
            "ioc_value": "l.r2h7m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 19:32:52",
            "last_seen_utc": "2025-09-15 19:34:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590698": [
        {
            "ioc_value": "f.r2h7m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 19:24:41",
            "last_seen_utc": "2025-09-15 19:26:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590697": [
        {
            "ioc_value": "aw.r2h7m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 19:14:01",
            "last_seen_utc": "2025-09-15 19:16:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590694": [
        {
            "ioc_value": "w.q5z9s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 19:06:22",
            "last_seen_utc": "2025-09-15 19:08:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590693": [
        {
            "ioc_value": "bu.q5z9s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 18:51:38",
            "last_seen_utc": "2025-09-15 18:53:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590692": [
        {
            "ioc_value": "bq.q5z9s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 18:39:55",
            "last_seen_utc": "2025-09-15 18:41:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590691": [
        {
            "ioc_value": "ag.q5z9s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 18:18:03",
            "last_seen_utc": "2025-09-15 18:19:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590690": [
        {
            "ioc_value": "z.p9v7g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 18:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590689": [
        {
            "ioc_value": "y.p9v7g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 18:11:55",
            "last_seen_utc": "2025-09-15 18:13:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590683": [
        {
            "ioc_value": "Iusefatalbtw-63960.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-15 18:02:28",
            "last_seen_utc": "2025-09-17 10:27:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250915-rz6hfscn21",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590681": [
        {
            "ioc_value": "bt.p9v7g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 18:02:15",
            "last_seen_utc": "2025-09-15 18:03:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590680": [
        {
            "ioc_value": "instantaoprime.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-15 18:02:12",
            "last_seen_utc": "2025-09-17 10:27:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250915-q58dkabq8y",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590679": [
        {
            "ioc_value": "winsrvc.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-15 18:02:05",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250915-vqg1aael8x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590677": [
        {
            "ioc_value": "industrial-vegetation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-15 18:01:58",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250915-vwv44aszet",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590678": [
        {
            "ioc_value": "remdefrem.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-15 18:01:58",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250915-qesv7aykz6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590676": [
        {
            "ioc_value": "av.p9v7g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 17:42:54",
            "last_seen_utc": "2025-09-15 17:44:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590675": [
        {
            "ioc_value": "v.n6p5j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 17:30:12",
            "last_seen_utc": "2025-09-15 17:31:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590674": [
        {
            "ioc_value": "ca.n6p5j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 17:20:31",
            "last_seen_utc": "2025-09-15 17:20:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590673": [
        {
            "ioc_value": "bp.n6p5j.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 17:04:12",
            "last_seen_utc": "2025-09-15 17:05:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590657": [
        {
            "ioc_value": "www.qqq.qweqq.p-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-15 16:02:56",
            "last_seen_utc": "2025-09-16 04:01:00",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/198.12.73.227+www.qqq.qweqq.p-e.kr",
            "tags": "AS-COLOCROSSING,AS36352,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590654": [
        {
            "ioc_value": "glibbixzorptweezleprang.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-15 16:02:40",
            "last_seen_utc": "2025-09-16 04:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/149.28.157.225+glibbixzorptweezleprang.top",
            "tags": "AS-VULTR,AS20473,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590653": [
        {
            "ioc_value": "cpcontacts.146-190-137-132.cprapid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-09-15 16:02:38",
            "last_seen_utc": "2025-09-16 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/146.190.137.132+cpcontacts.146-190-137-132.cprapid.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590645": [
        {
            "ioc_value": "yunded.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-15 15:33:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250915-nvm9jaan9t",
            "tags": "c2,domain,lumma,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590630": [
        {
            "ioc_value": "ae.j1g3k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 13:46:54",
            "last_seen_utc": "2025-09-15 13:43:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590631": [
        {
            "ioc_value": "iskiddedapythonratfromgithubandmadeitwebbased.xyzlol.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-15 13:46:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/70bc14cf-ed56-4f69-9bae-77837b709372",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1590629": [
        {
            "ioc_value": "wopu.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-15 13:35:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590623": [
        {
            "ioc_value": "o.j1g3k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 13:25:40",
            "last_seen_utc": "2025-09-15 13:12:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590625": [
        {
            "ioc_value": "math1st.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-15 13:25:39",
            "last_seen_utc": "2025-09-15 13:17:49",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115208504275211727",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1590628": [
        {
            "ioc_value": "cpanel.trailsyamahamotor.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-15 13:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115208510036295335",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1590612": [
        {
            "ioc_value": "h.g3w2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 12:58:35",
            "last_seen_utc": "2025-09-15 12:06:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590614": [
        {
            "ioc_value": "m.g3w2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 12:58:34",
            "last_seen_utc": "2025-09-15 12:33:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590615": [
        {
            "ioc_value": "bs.j1g3k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 12:58:34",
            "last_seen_utc": "2025-09-15 12:37:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590616": [
        {
            "ioc_value": "bb.j1g3k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 12:58:32",
            "last_seen_utc": "2025-09-15 12:46:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590599": [
        {
            "ioc_value": "generatoryieldlab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-15 12:01:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590596": [
        {
            "ioc_value": "b.g3w2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:54:21",
            "last_seen_utc": "2025-09-15 11:38:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590598": [
        {
            "ioc_value": "br.g3w2p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:54:19",
            "last_seen_utc": "2025-09-15 11:46:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590584": [
        {
            "ioc_value": "al.f8t6m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:35:34",
            "last_seen_utc": "2025-09-15 11:02:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590587": [
        {
            "ioc_value": "ao.f8t6m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:35:32",
            "last_seen_utc": "2025-09-15 11:13:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590590": [
        {
            "ioc_value": "bg.f8t6m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:35:32",
            "last_seen_utc": "2025-09-15 11:23:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590594": [
        {
            "ioc_value": "bl.f8t6m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:35:30",
            "last_seen_utc": "2025-09-15 11:34:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590595": [
        {
            "ioc_value": "lst.n50e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:34:03",
            "last_seen_utc": "2025-09-15 11:46:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590591": [
        {
            "ioc_value": "fcx.n50e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:23:42",
            "last_seen_utc": "2025-09-15 11:23:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590588": [
        {
            "ioc_value": "fck.n50e.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:13:46",
            "last_seen_utc": "2025-09-15 11:13:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590586": [
        {
            "ioc_value": "u.b704.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 11:02:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590564": [
        {
            "ioc_value": "aq.b5x1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:59:14",
            "last_seen_utc": "2025-09-15 09:42:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590567": [
        {
            "ioc_value": "bc.b5x1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:59:13",
            "last_seen_utc": "2025-09-15 10:03:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590572": [
        {
            "ioc_value": "bh.f0z1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:59:12",
            "last_seen_utc": "2025-09-15 10:26:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590576": [
        {
            "ioc_value": "bi.f0z1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:59:11",
            "last_seen_utc": "2025-09-15 10:40:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590578": [
        {
            "ioc_value": "bv.f0z1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:59:11",
            "last_seen_utc": "2025-09-15 10:50:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590582": [
        {
            "ioc_value": "s.f0z1n.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:59:11",
            "last_seen_utc": "2025-09-15 10:57:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590583": [
        {
            "ioc_value": "g5.f969.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:57:23",
            "last_seen_utc": "2025-09-15 11:01:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590579": [
        {
            "ioc_value": "md.hecynya.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:50:09",
            "last_seen_utc": "2025-09-15 11:46:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590580": [
        {
            "ioc_value": "m9.r274.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:50:09",
            "last_seen_utc": "2025-09-15 10:50:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590577": [
        {
            "ioc_value": "d.r274.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:39:58",
            "last_seen_utc": "2025-09-15 10:40:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590575": [
        {
            "ioc_value": "aa1.l134.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:26:40",
            "last_seen_utc": "2025-09-15 10:26:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590568": [
        {
            "ioc_value": "p7.l134.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 10:02:03",
            "last_seen_utc": "2025-09-15 10:03:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590565": [
        {
            "ioc_value": "s6.b340.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 09:41:36",
            "last_seen_utc": "2025-09-15 09:42:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590561": [
        {
            "ioc_value": "dropphef.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-15 09:34:56",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590562": [
        {
            "ioc_value": "wasxhawg.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-15 09:34:56",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590559": [
        {
            "ioc_value": "ap.b5x1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 09:29:32",
            "last_seen_utc": "2025-09-15 09:26:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590560": [
        {
            "ioc_value": "e.b340.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 09:25:59",
            "last_seen_utc": "2025-09-15 09:26:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590551": [
        {
            "ioc_value": "af.b5x1g.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 09:20:03",
            "last_seen_utc": "2025-09-15 09:06:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590556": [
        {
            "ioc_value": "dll.schermgebroken.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-15 09:10:45",
            "last_seen_utc": "2025-09-16 01:10:34",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590554": [
        {
            "ioc_value": "dll.amajed.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-15 09:10:43",
            "last_seen_utc": "2025-09-16 01:10:34",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590552": [
        {
            "ioc_value": "k3p.j220.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 09:04:40",
            "last_seen_utc": "2025-09-15 09:06:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590487": [
        {
            "ioc_value": "z.h934.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 09:03:27",
            "last_seen_utc": "2025-09-15 08:14:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590491": [
        {
            "ioc_value": "d1.h934.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 09:03:27",
            "last_seen_utc": "2025-09-15 08:40:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590550": [
        {
            "ioc_value": "maidtin.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-15 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590549": [
        {
            "ioc_value": "liveiiu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-15 08:56:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590548": [
        {
            "ioc_value": "shameairport.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-15 08:55:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590492": [
        {
            "ioc_value": "n.j220.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 08:40:01",
            "last_seen_utc": "2025-09-15 08:40:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590490": [
        {
            "ioc_value": "distributionguitar.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-15 08:36:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590472": [
        {
            "ioc_value": "zclouds.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-15 08:06:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1590473": [
        {
            "ioc_value": "4m.v-9542.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 08:06:38",
            "last_seen_utc": "2025-09-15 07:06:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590476": [
        {
            "ioc_value": "c2.kdesu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 08:06:37",
            "last_seen_utc": "2025-09-15 07:19:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590477": [
        {
            "ioc_value": "m.kdesu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 08:06:34",
            "last_seen_utc": "2025-09-15 07:51:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590478": [
        {
            "ioc_value": "t.k002.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 07:50:46",
            "last_seen_utc": "2025-09-15 08:14:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590474": [
        {
            "ioc_value": "r5.k002.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 07:06:11",
            "last_seen_utc": "2025-09-15 07:19:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590461": [
        {
            "ioc_value": "b.t408.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 06:53:01",
            "last_seen_utc": "2025-09-15 05:51:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590468": [
        {
            "ioc_value": "y7.t408.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 06:53:01",
            "last_seen_utc": "2025-09-15 06:27:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590470": [
        {
            "ioc_value": "u.v-9542.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 06:53:01",
            "last_seen_utc": "2025-09-15 06:46:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590469": [
        {
            "ioc_value": "b9c.m074.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 06:27:45",
            "last_seen_utc": "2025-09-15 06:46:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590460": [
        {
            "ioc_value": "q.m074.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 05:48:16",
            "last_seen_utc": "2025-09-15 05:51:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1590452": [
        {
            "ioc_value": "x.l-5228.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 05:36:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590454": [
        {
            "ioc_value": "r3v.v9542.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 05:36:16",
            "last_seen_utc": "2025-09-15 05:48:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590431": [
        {
            "ioc_value": "buriallifeinsurancepolicies.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-15 04:00:35",
            "last_seen_utc": "2025-09-15 04:02:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.131.94.175+buriallifeinsurancepolicies.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1590423": [
        {
            "ioc_value": "static.198.219.245.188.clients.your-server.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-15 04:00:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.245.219.198+static.198.219.245.188.clients.your-server.de",
            "tags": "AS24940,C2,censys,HETZNER-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1590289": [
        {
            "ioc_value": "9.v9542.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 03:04:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590287": [
        {
            "ioc_value": "h8.l-5228.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 02:20:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590286": [
        {
            "ioc_value": "w.q780.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 02:04:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590285": [
        {
            "ioc_value": "v1.q780.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 01:40:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590082": [
        {
            "ioc_value": "2m.s836.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-15 00:04:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590067": [
        {
            "ioc_value": "k.s836.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 23:44:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590066": [
        {
            "ioc_value": "fz7.zpozu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 23:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590064": [
        {
            "ioc_value": "q9.zpozu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 22:44:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590063": [
        {
            "ioc_value": "7z.l5228.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 22:33:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590062": [
        {
            "ioc_value": "a.l5228.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 22:16:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590061": [
        {
            "ioc_value": "aj.g0s1f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 22:10:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590060": [
        {
            "ioc_value": "bf.k5b2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 22:06:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590059": [
        {
            "ioc_value": "m.k5b2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 22:01:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590057": [
        {
            "ioc_value": "r.p2j4k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 21:56:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590056": [
        {
            "ioc_value": "v.d3g7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 21:43:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590055": [
        {
            "ioc_value": "ai.w2r1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 21:37:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590054": [
        {
            "ioc_value": "bb.n5m4t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 21:18:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590053": [
        {
            "ioc_value": "am.n5m4t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 21:13:36",
            "last_seen_utc": "2025-09-20 00:58:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590050": [
        {
            "ioc_value": "dpi.amajed.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-14 21:10:26",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590052": [
        {
            "ioc_value": "dpi.schermgebroken.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-14 21:10:26",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1590048": [
        {
            "ioc_value": "af.g7r7s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 20:54:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590047": [
        {
            "ioc_value": "x.d8w6l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 20:52:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590043": [
        {
            "ioc_value": "f.p2j4k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 20:46:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590039": [
        {
            "ioc_value": "n.p2j4k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 20:24:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590038": [
        {
            "ioc_value": "z.t4c5d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 20:02:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590033": [
        {
            "ioc_value": "webmail.146-190-137-132.cprapid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-09-14 20:02:34",
            "last_seen_utc": "2025-09-15 04:00:32",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/146.190.137.132+webmail.146-190-137-132.cprapid.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590016": [
        {
            "ioc_value": "ao.n9t6m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 19:53:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590015": [
        {
            "ioc_value": "bc.d3l4d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 19:44:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590014": [
        {
            "ioc_value": "ab.b3x1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 19:10:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590013": [
        {
            "ioc_value": "bh.d3l4d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 19:03:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590012": [
        {
            "ioc_value": "y.q1s6c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 19:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590011": [
        {
            "ioc_value": "ar.x8q0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 18:43:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1590006": [
        {
            "ioc_value": "rhusdniw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:56",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590007": [
        {
            "ioc_value": "flnsyfb.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:56",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590008": [
        {
            "ioc_value": "blackrz.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:56",
            "last_seen_utc": "2025-09-21 09:16:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590009": [
        {
            "ioc_value": "fissiklo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:56",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590010": [
        {
            "ioc_value": "scombxu.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:56",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590001": [
        {
            "ioc_value": "incocrrm.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:55",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590002": [
        {
            "ioc_value": "constkj.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:55",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590003": [
        {
            "ioc_value": "mannewd.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:55",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590004": [
        {
            "ioc_value": "vitambio.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:55",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590005": [
        {
            "ioc_value": "bazttlew.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 18:27:55",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1590000": [
        {
            "ioc_value": "b.f2g5q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 18:11:24",
            "last_seen_utc": "2025-09-14 22:16:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589999": [
        {
            "ioc_value": "t.d8w6l.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 18:04:14",
            "last_seen_utc": "2025-09-14 19:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589994": [
        {
            "ioc_value": "costs-na.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-14 18:02:16",
            "last_seen_utc": "2025-09-17 10:27:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250914-v6ly6sdq21",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589995": [
        {
            "ioc_value": "gta5.servegame.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-14 18:02:16",
            "last_seen_utc": "2025-09-17 10:27:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250914-sqmjnacl4t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589991": [
        {
            "ioc_value": "wso-50081.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-14 18:01:52",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250914-thm1wscq2z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589989": [
        {
            "ioc_value": "ay.c0h9w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 17:44:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589987": [
        {
            "ioc_value": "ac.s7z7r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 17:20:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589986": [
        {
            "ioc_value": "s.n9t6m.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 17:20:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589984": [
        {
            "ioc_value": "w.d3l4d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 17:13:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589983": [
        {
            "ioc_value": "d.b3x1p.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 16:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589982": [
        {
            "ioc_value": "h.w2r1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 16:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589981": [
        {
            "ioc_value": "al.c0h9w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 16:45:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589980": [
        {
            "ioc_value": "ad.c0h9w.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 16:36:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589978": [
        {
            "ioc_value": "l.r0z8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 16:21:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589977": [
        {
            "ioc_value": "tra.schermgebroken.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-14 16:10:26",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589975": [
        {
            "ioc_value": "tra.amajed.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-14 16:10:25",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589972": [
        {
            "ioc_value": "g.x8q0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 16:04:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589968": [
        {
            "ioc_value": "jeu60.dedyn.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-14 16:02:29",
            "last_seen_utc": "2025-09-15 04:00:35",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.60.68.235+jeu60.dedyn.io",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589964": [
        {
            "ioc_value": "az.g0s1f.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 15:44:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589963": [
        {
            "ioc_value": "ah.w2r1k.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 15:16:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589954": [
        {
            "ioc_value": "ae.g7r7s.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 14:56:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589955": [
        {
            "ioc_value": "bd.r3l1x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 14:56:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589957": [
        {
            "ioc_value": "k.r3l1x.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 14:56:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589958": [
        {
            "ioc_value": "bg.t4c5d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 14:56:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589941": [
        {
            "ioc_value": "au.d3g7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 13:29:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589950": [
        {
            "ioc_value": "p.t4c5d.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 13:29:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589942": [
        {
            "ioc_value": "madibase.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-14 12:50:50",
            "last_seen_utc": "2025-11-14 18:09:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589939": [
        {
            "ioc_value": "u.r0z8r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 12:30:52",
            "last_seen_utc": "2025-09-14 17:17:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589940": [
        {
            "ioc_value": "aa.q1s6c.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 12:30:24",
            "last_seen_utc": "2025-09-14 13:59:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589920": [
        {
            "ioc_value": "pick.cewyzui61.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 12:14:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589936": [
        {
            "ioc_value": "year.cewyzui61.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 12:14:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589937": [
        {
            "ioc_value": "pin.cewyzui61.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 12:14:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589938": [
        {
            "ioc_value": "an.k5b2q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 12:14:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589926": [
        {
            "ioc_value": "cnn9001.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-14 12:01:56",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250914-l68nhatzft",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589924": [
        {
            "ioc_value": "223.ip.gl.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-14 12:01:50",
            "last_seen_utc": "2025-09-17 10:27:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250914-nyplrsvxfw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589925": [
        {
            "ioc_value": "killkill.myftp.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-14 12:01:50",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250914-kva3estwfz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589811": [
        {
            "ioc_value": "mix.cofidyu58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:31",
            "last_seen_utc": "2025-09-14 07:13:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589815": [
        {
            "ioc_value": "star.cofidyu58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589817": [
        {
            "ioc_value": "full.cofidyu58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:30",
            "last_seen_utc": "2025-09-14 09:55:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589823": [
        {
            "ioc_value": "rat.vudujiu33.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589895": [
        {
            "ioc_value": "gold.vudujiu33.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589901": [
        {
            "ioc_value": "lot.cofidyu58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589905": [
        {
            "ioc_value": "pool.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589907": [
        {
            "ioc_value": "root.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589913": [
        {
            "ioc_value": "past.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589908": [
        {
            "ioc_value": "let.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589909": [
        {
            "ioc_value": "us.qilaliy87.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589914": [
        {
            "ioc_value": "hope.cewyzui61.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 11:23:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589916": [
        {
            "ioc_value": "xbm.amajed.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-14 11:10:23",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589918": [
        {
            "ioc_value": "xbm.schermgebroken.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-14 11:10:23",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589899": [
        {
            "ioc_value": "openai-diversifies-with-ai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-14 09:38:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/14b91ed2158b2f711a8c75fa12a5a53552e7920c534fafd413df9d79ed91d2ac",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589896": [
        {
            "ioc_value": "genpyb.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 09:24:03",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589825": [
        {
            "ioc_value": "pancred.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-14 08:42:11",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589813": [
        {
            "ioc_value": "cover-drove.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-14 06:01:50",
            "last_seen_utc": "2025-09-17 10:27:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250914-a1zymawny8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589683": [
        {
            "ioc_value": "wow.kuvuboa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589702": [
        {
            "ioc_value": "left.kuvuboa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589704": [
        {
            "ioc_value": "wear.kuvuboa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589703": [
        {
            "ioc_value": "pit.kuvuboa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589705": [
        {
            "ioc_value": "1-password.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-14 05:32:22",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1589707": [
        {
            "ioc_value": "clickstime.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-14 05:32:21",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1589706": [
        {
            "ioc_value": "adspower.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-14 05:32:20",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1589708": [
        {
            "ioc_value": "ssn-verify.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-14 05:32:19",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1589709": [
        {
            "ioc_value": "make.nugawye78.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589711": [
        {
            "ioc_value": "he.nugawye78.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589713": [
        {
            "ioc_value": "club.nugawye78.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:18",
            "last_seen_utc": "2025-09-13 21:28:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589714": [
        {
            "ioc_value": "m.nugawye78.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589715": [
        {
            "ioc_value": "l.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589718": [
        {
            "ioc_value": "ll.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589719": [
        {
            "ioc_value": "o.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589720": [
        {
            "ioc_value": "sew.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589725": [
        {
            "ioc_value": "made.gofumoo29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589722": [
        {
            "ioc_value": "y.zowyzyi62.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589728": [
        {
            "ioc_value": "ring.gofumoo29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589743": [
        {
            "ioc_value": "o.s7z7r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589744": [
        {
            "ioc_value": "c.v6z1q.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589747": [
        {
            "ioc_value": "ba.d3g7t.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589748": [
        {
            "ioc_value": "av.x8q0h.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589749": [
        {
            "ioc_value": "aw.s7z7r.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589750": [
        {
            "ioc_value": "hand.gofumoo29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589807": [
        {
            "ioc_value": "shy.vudujiu33.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589777": [
        {
            "ioc_value": "farm.gofumoo29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589810": [
        {
            "ioc_value": "but.vudujiu33.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:32:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589615": [
        {
            "ioc_value": "good.tatyziu58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-14 05:29:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589786": [
        {
            "ioc_value": "whonixgateway.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nimplant",
            "malware_alias": null,
            "malware_printable": "Nimplant",
            "first_seen_utc": "2025-09-14 04:01:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/159.69.214.72+whonixgateway.online",
            "tags": "AS24940,C2,censys,HETZNER-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1589785": [
        {
            "ioc_value": "static.72.214.69.159.clients.your-server.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nimplant",
            "malware_alias": null,
            "malware_printable": "Nimplant",
            "first_seen_utc": "2025-09-14 04:01:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/159.69.214.72+static.72.214.69.159.clients.your-server.de",
            "tags": "AS24940,C2,censys,HETZNER-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1589742": [
        {
            "ioc_value": "wbm.schermgebroken.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-14 00:10:30",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589740": [
        {
            "ioc_value": "wbm.amajed.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-14 00:10:28",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589733": [
        {
            "ioc_value": "ec2-3-123-17-149.eu-central-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-14 00:02:31",
            "last_seen_utc": "2025-09-14 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.123.17.149+ec2-3-123-17-149.eu-central-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589614": [
        {
            "ioc_value": "suit.tatyziu58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:24:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589380": [
        {
            "ioc_value": "banabmw.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:21",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589378": [
        {
            "ioc_value": "archlnr.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:20",
            "last_seen_utc": "2025-09-21 09:16:33",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589379": [
        {
            "ioc_value": "atalozv.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:20",
            "last_seen_utc": "2025-09-21 09:16:33",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589381": [
        {
            "ioc_value": "basehce.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:18",
            "last_seen_utc": "2025-09-21 09:16:33",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589382": [
        {
            "ioc_value": "finikoa.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:18",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589383": [
        {
            "ioc_value": "fiobmzv.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:17",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589385": [
        {
            "ioc_value": "herwdwy.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:17",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589384": [
        {
            "ioc_value": "heothjg.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:16",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589387": [
        {
            "ioc_value": "legisld.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:16",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589386": [
        {
            "ioc_value": "lamboey.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:15",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589388": [
        {
            "ioc_value": "nudismh.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:15",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589389": [
        {
            "ioc_value": "outfiqh.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:14",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589390": [
        {
            "ioc_value": "routemate.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:14",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589418": [
        {
            "ioc_value": "gazecoe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,Lumma,Lumma Stealer,stealer",
            "anonymous": "0",
            "reporter": "w4tson"
        }
    ],
    "1589419": [
        {
            "ioc_value": "md.gazecoe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:13:13",
            "last_seen_utc": "2025-09-15 10:40:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,Lumma,Lumma Stealer,stealer",
            "anonymous": "0",
            "reporter": "w4tson"
        }
    ],
    "1589571": [
        {
            "ioc_value": "bwe.myga3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589572": [
        {
            "ioc_value": "y.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589574": [
        {
            "ioc_value": "h.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589573": [
        {
            "ioc_value": "dwo.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589576": [
        {
            "ioc_value": "12if.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589577": [
        {
            "ioc_value": "in.qute3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589578": [
        {
            "ioc_value": "jjis.qute3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589580": [
        {
            "ioc_value": "me1.qute3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589579": [
        {
            "ioc_value": "t.qute3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589581": [
        {
            "ioc_value": "48o.qute3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589584": [
        {
            "ioc_value": "of2.qute-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:03",
            "last_seen_utc": "2025-09-13 16:28:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589590": [
        {
            "ioc_value": "o97r.qute-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589595": [
        {
            "ioc_value": "s9555o.qute-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589596": [
        {
            "ioc_value": "up.raha1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:01",
            "last_seen_utc": "2025-09-13 17:09:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589597": [
        {
            "ioc_value": "we.raha1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:13:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589133": [
        {
            "ioc_value": "no.muqu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589134": [
        {
            "ioc_value": "or.myda4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:58",
            "last_seen_utc": "2025-09-13 11:51:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589376": [
        {
            "ioc_value": "so.myda4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589377": [
        {
            "ioc_value": "am.myga3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:57",
            "last_seen_utc": "2025-09-13 14:58:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589599": [
        {
            "ioc_value": "at.v7h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:56",
            "last_seen_utc": "2025-09-13 17:40:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589598": [
        {
            "ioc_value": "am.raha1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589569": [
        {
            "ioc_value": "a1t.myga3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589471": [
        {
            "ioc_value": "we.myda4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589568": [
        {
            "ioc_value": "proxyreflecttools.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-13 19:12:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589434": [
        {
            "ioc_value": "up.myda4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589431": [
        {
            "ioc_value": "if.lage-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589429": [
        {
            "ioc_value": "g.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589425": [
        {
            "ioc_value": "do.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589417": [
        {
            "ioc_value": "by.pejy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589131": [
        {
            "ioc_value": "it.muqu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:44",
            "last_seen_utc": "2025-09-13 14:21:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589132": [
        {
            "ioc_value": "me.muqu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589130": [
        {
            "ioc_value": "he.lage-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589129": [
        {
            "ioc_value": "go.lage-2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:42",
            "last_seen_utc": "2025-09-13 13:23:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589125": [
        {
            "ioc_value": "as.lage2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:41",
            "last_seen_utc": "2025-09-13 11:06:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589128": [
        {
            "ioc_value": "do.lage2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589391": [
        {
            "ioc_value": "stepvss.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:12:30",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589392": [
        {
            "ioc_value": "veicqxq.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:12:30",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589393": [
        {
            "ioc_value": "whwwthi.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:12:30",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589394": [
        {
            "ioc_value": "fishfunfun.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 19:12:29",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1589601": [
        {
            "ioc_value": "do.v7h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589602": [
        {
            "ioc_value": "go.v7h3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589611": [
        {
            "ioc_value": "he.visa-8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589612": [
        {
            "ioc_value": "cook.tatyziu58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589613": [
        {
            "ioc_value": "net.tatyziu58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 19:12:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589609": [
        {
            "ioc_value": "than.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-13 18:03:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250913-wh2v6atns2",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589610": [
        {
            "ioc_value": "jonny21.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-13 18:03:47",
            "last_seen_utc": "2025-09-13 18:03:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250913-s4zq5sdj6y",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589606": [
        {
            "ioc_value": "civil-directories.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 18:02:11",
            "last_seen_utc": "2025-09-17 10:27:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250913-qvyflsbn9w",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589604": [
        {
            "ioc_value": "business-expired.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 18:01:45",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250913-tshh6asqv4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589605": [
        {
            "ioc_value": "allow-blast.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 18:01:45",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250913-qdrlqstwex",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589594": [
        {
            "ioc_value": "dre.schermgebroken.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-13 16:10:41",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589592": [
        {
            "ioc_value": "sls.amajed.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-13 16:10:40",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589589": [
        {
            "ioc_value": "ruiner.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-13 16:05:16",
            "last_seen_utc": "2025-09-18 04:01:47",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.154.251+ruiner.pro",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589587": [
        {
            "ioc_value": "ec2-13-37-220-47.eu-west-3.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-13 16:05:00",
            "last_seen_utc": "2025-09-14 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.37.220.47+ec2-13-37-220-47.eu-west-3.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589421": [
        {
            "ioc_value": "jocospt.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 12:31:38",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589422": [
        {
            "ioc_value": "sulphuc.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 12:31:38",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589423": [
        {
            "ioc_value": "autoezx.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-13 12:31:38",
            "last_seen_utc": "2025-09-21 09:16:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589408": [
        {
            "ioc_value": "xcx.vumarifa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-13 12:10:51",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589405": [
        {
            "ioc_value": "lol1-53210.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 12:05:26",
            "last_seen_utc": "2025-10-10 11:34:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250913-le39pshk91",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589406": [
        {
            "ioc_value": "spy72-45493.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 12:05:26",
            "last_seen_utc": "2025-10-10 11:34:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250913-levmkahk9y",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589395": [
        {
            "ioc_value": "senior-forever.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 12:01:46",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250913-mem36ahq3v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1589366": [
        {
            "ioc_value": "azurebrief.gleeze.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589367": [
        {
            "ioc_value": "effective-appointment.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589368": [
        {
            "ioc_value": "555host.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589369": [
        {
            "ioc_value": "specific-dolls.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589370": [
        {
            "ioc_value": "samiba.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589371": [
        {
            "ioc_value": "states-typing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589372": [
        {
            "ioc_value": "categories-invest.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589373": [
        {
            "ioc_value": "cnet-risk.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589374": [
        {
            "ioc_value": "author-dis.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589375": [
        {
            "ioc_value": "tirat4ck-41260.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-09-13 11:44:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589339": [
        {
            "ioc_value": "mong666.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589340": [
        {
            "ioc_value": "scan.sombras.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589341": [
        {
            "ioc_value": "wifi.nigger-from.africa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589342": [
        {
            "ioc_value": "scan.504.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589343": [
        {
            "ioc_value": "cnc2.bottingstation.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589344": [
        {
            "ioc_value": "www.pljslt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589345": [
        {
            "ioc_value": "cnc.bottingstation.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589332": [
        {
            "ioc_value": "snoopdmoneybkup.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-09-13 11:44:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589333": [
        {
            "ioc_value": "snoopdmoney2018.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-09-13 11:44:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589334": [
        {
            "ioc_value": "nzekanze2013.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-09-13 11:44:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589335": [
        {
            "ioc_value": "dyarkaka.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.extreme_rat",
            "malware_alias": "ExtRat",
            "malware_printable": "Xtreme RAT",
            "first_seen_utc": "2025-09-13 11:44:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589336": [
        {
            "ioc_value": "report.datasurge.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589337": [
        {
            "ioc_value": "bot.9257.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589338": [
        {
            "ioc_value": "test.datasurge.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-13 11:44:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589324": [
        {
            "ioc_value": "aliyazd.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589325": [
        {
            "ioc_value": "asdf0815.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589315": [
        {
            "ioc_value": "kylesdark.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589316": [
        {
            "ioc_value": "aliyazd.myftp.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589317": [
        {
            "ioc_value": "habbtunes.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589318": [
        {
            "ioc_value": "mrowx.ddnsgeek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589319": [
        {
            "ioc_value": "jakuza.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589320": [
        {
            "ioc_value": "k4zi.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589321": [
        {
            "ioc_value": "dexternity.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589322": [
        {
            "ioc_value": "hussproject.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589323": [
        {
            "ioc_value": "mrowx.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-13 11:44:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589298": [
        {
            "ioc_value": "baypars1907.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-13 11:44:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589289": [
        {
            "ioc_value": "tristanatt.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-09-13 11:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589290": [
        {
            "ioc_value": "tristandns.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-09-13 11:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589291": [
        {
            "ioc_value": "mcity.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-09-13 11:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589292": [
        {
            "ioc_value": "mcity.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-09-13 11:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589293": [
        {
            "ioc_value": "t11vincenzauuzw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-09-13 11:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589294": [
        {
            "ioc_value": "qisqholden.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-09-13 11:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589295": [
        {
            "ioc_value": "caoamelieoohildegard.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-09-13 11:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589283": [
        {
            "ioc_value": "tisucs44.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-09-13 11:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589284": [
        {
            "ioc_value": "wymeja52.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-09-13 11:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589285": [
        {
            "ioc_value": "morbom05.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-09-13 11:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589278": [
        {
            "ioc_value": "just-rss.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-13 11:44:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589279": [
        {
            "ioc_value": "mortaza1-33942.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-13 11:44:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589280": [
        {
            "ioc_value": "transfer-hero.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-13 11:44:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589281": [
        {
            "ioc_value": "center-kate.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-13 11:44:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589282": [
        {
            "ioc_value": "robloxvithor.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-13 11:44:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589273": [
        {
            "ioc_value": "seguroagost21.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-13 11:43:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589274": [
        {
            "ioc_value": "bobo101.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-13 11:43:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589272": [
        {
            "ioc_value": "educational-intelligent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-13 11:43:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589246": [
        {
            "ioc_value": "startnw54.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589247": [
        {
            "ioc_value": "most-fourth.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589248": [
        {
            "ioc_value": "mon-journal.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589237": [
        {
            "ioc_value": "machine-vitamin.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589238": [
        {
            "ioc_value": "corporate-surely.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589239": [
        {
            "ioc_value": "almiighty-62420.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589240": [
        {
            "ioc_value": "vnjxj-34736.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589241": [
        {
            "ioc_value": "dodle54.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589242": [
        {
            "ioc_value": "cities-bang.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589243": [
        {
            "ioc_value": "legal-trend.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589244": [
        {
            "ioc_value": "and-alot.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589245": [
        {
            "ioc_value": "submitted-mortality.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589235": [
        {
            "ioc_value": "usb-occasionally.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589236": [
        {
            "ioc_value": "is-grams.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589231": [
        {
            "ioc_value": "region-bleeding.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589232": [
        {
            "ioc_value": "london-different.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589233": [
        {
            "ioc_value": "songs-seen.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589234": [
        {
            "ioc_value": "male-curious.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589222": [
        {
            "ioc_value": "card-myers.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589223": [
        {
            "ioc_value": "introduction-africa.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589224": [
        {
            "ioc_value": "construction-mix.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589225": [
        {
            "ioc_value": "senior-affordable.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589226": [
        {
            "ioc_value": "april-duration.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589227": [
        {
            "ioc_value": "dollarman102.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589228": [
        {
            "ioc_value": "father-smell.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589229": [
        {
            "ioc_value": "seystem32.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589230": [
        {
            "ioc_value": "maxfor22-47328.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589221": [
        {
            "ioc_value": "anything-newcastle.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-13 11:43:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589190": [
        {
            "ioc_value": "brucebaner2029.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589191": [
        {
            "ioc_value": "dcgast9.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589192": [
        {
            "ioc_value": "done-indians.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589193": [
        {
            "ioc_value": "deals-vista.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589184": [
        {
            "ioc_value": "voice-offensive.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589185": [
        {
            "ioc_value": "dcgast3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589186": [
        {
            "ioc_value": "furioso1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589187": [
        {
            "ioc_value": "track-marble.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589188": [
        {
            "ioc_value": "agostodc20.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589189": [
        {
            "ioc_value": "association-og.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-13 11:43:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589180": [
        {
            "ioc_value": "amirfifi-32775.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589181": [
        {
            "ioc_value": "airport-navigation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589182": [
        {
            "ioc_value": "european-door.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589173": [
        {
            "ioc_value": "usb-macedonia.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589174": [
        {
            "ioc_value": "slotmaus246-64506.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589175": [
        {
            "ioc_value": "jobs-hacker.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589176": [
        {
            "ioc_value": "disease-romance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589177": [
        {
            "ioc_value": "paypal-cape.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589178": [
        {
            "ioc_value": "usermanagementserver.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589179": [
        {
            "ioc_value": "harpygt-43879.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 11:43:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "13September2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1589122": [
        {
            "ioc_value": "up.jiky7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:19:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589082": [
        {
            "ioc_value": "be.devy-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:16:46",
            "last_seen_utc": "2025-09-13 07:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589088": [
        {
            "ioc_value": "do.devy-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:16:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589099": [
        {
            "ioc_value": "go.devy-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:16:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589111": [
        {
            "ioc_value": "he.devy-3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:16:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589112": [
        {
            "ioc_value": "if.gify1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:16:42",
            "last_seen_utc": "2025-09-13 09:45:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589113": [
        {
            "ioc_value": "me.gify1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:16:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589114": [
        {
            "ioc_value": "no.ixy9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:16:41",
            "last_seen_utc": "2025-09-13 10:12:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589115": [
        {
            "ioc_value": "so.ixy9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:16:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589116": [
        {
            "ioc_value": "to.jiky7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 10:16:41",
            "last_seen_utc": "2025-09-13 10:18:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589107": [
        {
            "ioc_value": "client.defenderblt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-13 08:48:20",
            "last_seen_utc": "2025-10-13 07:50:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1589087": [
        {
            "ioc_value": "m.zo1ah.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 07:18:03",
            "last_seen_utc": "2025-09-13 07:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1589083": [
        {
            "ioc_value": "mlcrosoft.v6.navy",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-13 07:05:21",
            "last_seen_utc": "2025-09-17 10:27:41",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/b95360f091412669760e7a6d01981eb192cc1582cf6fdfe51bc25a6bb8edbe29/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588697": [
        {
            "ioc_value": "cllcktlme.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-13 06:19:25",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1588698": [
        {
            "ioc_value": "if.boku-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 06:19:25",
            "last_seen_utc": "2025-09-12 17:05:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588730": [
        {
            "ioc_value": "is.buno8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 06:19:24",
            "last_seen_utc": "2025-09-12 22:24:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588744": [
        {
            "ioc_value": "cmqsqomiwwksmcsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-09-13 06:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "s1dhy"
        }
    ],
    "1588770": [
        {
            "ioc_value": "me.buno8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 06:19:21",
            "last_seen_utc": "2025-09-12 20:04:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588777": [
        {
            "ioc_value": "no.buno8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 06:19:21",
            "last_seen_utc": "2025-09-12 21:05:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588781": [
        {
            "ioc_value": "on.ciqe8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 06:19:20",
            "last_seen_utc": "2025-09-13 00:55:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588806": [
        {
            "ioc_value": "so.ciqe8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 06:19:19",
            "last_seen_utc": "2025-09-13 00:25:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588810": [
        {
            "ioc_value": "up.ciqe8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 06:19:18",
            "last_seen_utc": "2025-09-13 02:25:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589031": [
        {
            "ioc_value": "we.devy3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 06:19:17",
            "last_seen_utc": "2025-09-13 06:17:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1589080": [
        {
            "ioc_value": "hv.bi0ic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 06:16:48",
            "last_seen_utc": "2025-09-13 06:57:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1589073": [
        {
            "ioc_value": "q.bi0ic.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 05:34:23",
            "last_seen_utc": "2025-09-13 05:35:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1589072": [
        {
            "ioc_value": "am.devy3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 04:23:21",
            "last_seen_utc": "2025-09-13 04:24:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1589035": [
        {
            "ioc_value": "enyxma.diegosr.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-13 04:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.16.1+enyxma.diegosr.es",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1589032": [
        {
            "ioc_value": "cheyipiao.hello4am.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-13 04:00:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/114.132.169.168+cheyipiao.hello4am.com",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1589025": [
        {
            "ioc_value": "ypk.sechub.com.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-13 02:48:38",
            "last_seen_utc": "2025-11-02 07:48:48",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588807": [
        {
            "ioc_value": "1.fe1it.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-13 00:55:15",
            "last_seen_utc": "2025-09-13 05:25:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588805": [
        {
            "ioc_value": "hap.vumarifa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-13 00:10:27",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588782": [
        {
            "ioc_value": "go.fe1it.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 23:03:41",
            "last_seen_utc": "2025-09-13 00:25:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588771": [
        {
            "ioc_value": "md.cykugeu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 20:04:25",
            "last_seen_utc": "2025-09-13 07:19:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588763": [
        {
            "ioc_value": "microupdater.ignorelist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-12 20:02:30",
            "last_seen_utc": "2025-09-13 04:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.197.133.28+microupdater.ignorelist.com",
            "tags": "AS57043,C2,censys,Havoc,HOSTKEY-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588734": [
        {
            "ioc_value": "xml-suggestions.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-12 18:01:39",
            "last_seen_utc": "2025-09-17 10:27:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250912-vywteabq2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588735": [
        {
            "ioc_value": "yassinea-24570.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-12 18:01:39",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250912-vywteabq2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588733": [
        {
            "ioc_value": "yassinea2-47754.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-12 18:01:38",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250912-vywteabq2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588729": [
        {
            "ioc_value": "as.ty1un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 17:54:33",
            "last_seen_utc": "2025-09-12 22:24:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588714": [
        {
            "ioc_value": "shiporitoy.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-12 17:47:25",
            "last_seen_utc": "2025-10-06 21:20:25",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/cac7b5e6cdd5bf4fdcd9017dd1e23837cfb4b67a9568a70bb6a6525a0f313438",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588715": [
        {
            "ioc_value": "shiteafirs.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-12 17:47:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/cac7b5e6cdd5bf4fdcd9017dd1e23837cfb4b67a9568a70bb6a6525a0f313438",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588716": [
        {
            "ioc_value": "shiteathre.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-12 17:47:25",
            "last_seen_utc": "2025-09-21 19:19:43",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/cac7b5e6cdd5bf4fdcd9017dd1e23837cfb4b67a9568a70bb6a6525a0f313438",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588717": [
        {
            "ioc_value": "shiteatwop.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-12 17:47:25",
            "last_seen_utc": "2025-09-21 19:19:43",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/cac7b5e6cdd5bf4fdcd9017dd1e23837cfb4b67a9568a70bb6a6525a0f313438",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588718": [
        {
            "ioc_value": "qsetshi.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-12 17:47:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/cac7b5e6cdd5bf4fdcd9017dd1e23837cfb4b67a9568a70bb6a6525a0f313438",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588719": [
        {
            "ioc_value": "shiwa.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-09-12 17:47:25",
            "last_seen_utc": "2025-10-06 21:20:25",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/cac7b5e6cdd5bf4fdcd9017dd1e23837cfb4b67a9568a70bb6a6525a0f313438",
            "tags": "c2,domain,Rhadamanthys,stealer,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588705": [
        {
            "ioc_value": "ntv.vumarifa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-12 17:10:23",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588699": [
        {
            "ioc_value": "masmbv.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 17:09:55",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588700": [
        {
            "ioc_value": "repzzm.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 17:09:55",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588701": [
        {
            "ioc_value": "fladiw.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 17:09:55",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588702": [
        {
            "ioc_value": "bucrew.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 17:09:55",
            "last_seen_utc": "2025-09-21 09:16:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588679": [
        {
            "ioc_value": "do.boku-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 16:51:56",
            "last_seen_utc": "2025-09-12 16:05:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588683": [
        {
            "ioc_value": "go.boku-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 16:51:55",
            "last_seen_utc": "2025-09-12 16:24:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588688": [
        {
            "ioc_value": "he.boku-0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 16:51:54",
            "last_seen_utc": "2025-09-12 17:54:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588695": [
        {
            "ioc_value": "1308344827-4bya137jfj.ap-guangzhou.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-12 16:48:46",
            "last_seen_utc": "2025-10-16 07:50:42",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588677": [
        {
            "ioc_value": "www.lastsentinelflock.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.venom",
            "malware_alias": null,
            "malware_printable": "Venom RAT",
            "first_seen_utc": "2025-09-12 16:02:23",
            "last_seen_utc": "2025-09-12 16:02:23",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.208.159.38+www.lastsentinelflock.org",
            "tags": "AS42624,C2,censys,RAT,SWISSNETWORK02,Venom",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588674": [
        {
            "ioc_value": "titan.tail922ba4.ts.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-12 16:02:21",
            "last_seen_utc": "2025-09-13 04:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/176.58.88.82+titan.tail922ba4.ts.net",
            "tags": "AS36236,C2,censys,Havoc,NETACTUATE",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588675": [
        {
            "ioc_value": "updater-internal.mooo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-12 16:02:21",
            "last_seen_utc": "2025-09-13 04:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.197.133.28+updater-internal.mooo.com",
            "tags": "AS57043,C2,censys,Havoc,HOSTKEY-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588676": [
        {
            "ioc_value": "news.heix-energietechnik.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-12 16:02:21",
            "last_seen_utc": "2025-09-13 04:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.123.17.149+news.heix-energietechnik.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588665": [
        {
            "ioc_value": "webdisk.umathurman.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-12 15:06:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1588664": [
        {
            "ioc_value": "wo.by3iq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 14:51:12",
            "last_seen_utc": "2025-09-12 17:05:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588661": [
        {
            "ioc_value": "teachingbutter.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-12 14:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588660": [
        {
            "ioc_value": "weatherforce.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-12 14:44:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588658": [
        {
            "ioc_value": "l.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 14:43:17",
            "last_seen_utc": "2025-09-12 14:41:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588659": [
        {
            "ioc_value": "an.boku0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 14:43:17",
            "last_seen_utc": "2025-09-12 15:46:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588655": [
        {
            "ioc_value": "qv.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 14:33:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588656": [
        {
            "ioc_value": "zpa.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 14:33:06",
            "last_seen_utc": "2025-09-12 14:28:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588657": [
        {
            "ioc_value": "kj.by3iq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 14:28:36",
            "last_seen_utc": "2025-09-12 14:45:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588649": [
        {
            "ioc_value": "secure.happyhatterreviews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-12 14:17:16",
            "last_seen_utc": "2025-09-12 15:03:49",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115191515148314932",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1588651": [
        {
            "ioc_value": "nl.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 14:17:15",
            "last_seen_utc": "2025-09-12 13:23:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588652": [
        {
            "ioc_value": "ha.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 14:17:14",
            "last_seen_utc": "2025-09-12 13:36:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588654": [
        {
            "ioc_value": "mri.bi3ux.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 14:17:13",
            "last_seen_utc": "2025-09-12 14:13:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588653": [
        {
            "ioc_value": "zu.wi9ik.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 13:36:50",
            "last_seen_utc": "2025-09-12 14:13:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588644": [
        {
            "ioc_value": "prinscibuck.s3.us-east-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.houdini",
            "malware_alias": "Hworm,Jenxcus,Kognito,Njw0rm,WSHRAT,dinihou,dunihi",
            "malware_printable": "Houdini",
            "first_seen_utc": "2025-09-12 13:02:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Aura"
        }
    ],
    "1588645": [
        {
            "ioc_value": "nectixboost.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.houdini",
            "malware_alias": "Hworm,Jenxcus,Kognito,Njw0rm,WSHRAT,dinihou,dunihi",
            "malware_printable": "Houdini",
            "first_seen_utc": "2025-09-12 13:02:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Aura"
        }
    ],
    "1588646": [
        {
            "ioc_value": "nectixboost.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.houdini",
            "malware_alias": "Hworm,Jenxcus,Kognito,Njw0rm,WSHRAT,dinihou,dunihi",
            "malware_printable": "Houdini",
            "first_seen_utc": "2025-09-12 13:02:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "Aura"
        }
    ],
    "1588641": [
        {
            "ioc_value": "manageengine.su",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-12 13:00:58",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1588600": [
        {
            "ioc_value": "rq.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 12:58:20",
            "last_seen_utc": "2025-09-12 09:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588602": [
        {
            "ioc_value": "bti.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 12:58:19",
            "last_seen_utc": "2025-09-12 10:09:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588606": [
        {
            "ioc_value": "cy.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 12:58:18",
            "last_seen_utc": "2025-09-12 11:22:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588608": [
        {
            "ioc_value": "jo.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 12:58:18",
            "last_seen_utc": "2025-09-12 11:44:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588621": [
        {
            "ioc_value": "vex.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 12:58:18",
            "last_seen_utc": "2025-09-12 12:04:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588625": [
        {
            "ioc_value": "webcre8.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-12 12:58:17",
            "last_seen_utc": "2025-09-12 12:19:53",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115191289592881425",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1588629": [
        {
            "ioc_value": "4revergreen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-12 12:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115191295782232626",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1588631": [
        {
            "ioc_value": "pokelv.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-12 12:58:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115191295782232626",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1588632": [
        {
            "ioc_value": "ta.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 12:58:14",
            "last_seen_utc": "2025-09-12 12:23:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588633": [
        {
            "ioc_value": "pru.qe3yn.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 12:58:13",
            "last_seen_utc": "2025-09-12 12:31:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588640": [
        {
            "ioc_value": "avapmpvegyw0c.cfc-execute.su.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-12 12:49:09",
            "last_seen_utc": "2025-10-15 07:51:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588634": [
        {
            "ioc_value": "hb.wi9ik.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 12:30:59",
            "last_seen_utc": "2025-09-12 13:23:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588623": [
        {
            "ioc_value": "tht.vumarifa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-12 12:10:24",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588612": [
        {
            "ioc_value": "htgeruyukwhyj.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-12 12:01:43",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250912-nna1mafn2x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588613": [
        {
            "ioc_value": "bigpappa.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-12 12:01:43",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250912-lssecsdq8s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588611": [
        {
            "ioc_value": "function-assembled.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-12 12:01:37",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250912-nw6r9sxtay",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588607": [
        {
            "ioc_value": "pc.mo5un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 11:21:43",
            "last_seen_utc": "2025-09-12 12:23:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588605": [
        {
            "ioc_value": "ura.vumarifa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-12 10:10:30",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588603": [
        {
            "ioc_value": "mv.mo5un.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 10:08:56",
            "last_seen_utc": "2025-09-12 10:09:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588597": [
        {
            "ioc_value": "me.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 09:33:38",
            "last_seen_utc": "2025-09-12 09:29:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588598": [
        {
            "ioc_value": "xal.fo1od.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 09:33:37",
            "last_seen_utc": "2025-09-12 09:34:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588599": [
        {
            "ioc_value": "tr.ji1im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 09:33:27",
            "last_seen_utc": "2025-09-12 09:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588596": [
        {
            "ioc_value": "lx.ji1im.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 09:09:57",
            "last_seen_utc": "2025-09-12 09:29:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588581": [
        {
            "ioc_value": "pne.xe3ax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 08:55:39",
            "last_seen_utc": "2025-09-12 08:49:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588583": [
        {
            "ioc_value": "notebanin.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588584": [
        {
            "ioc_value": "notebanjo.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588585": [
        {
            "ioc_value": "notebanae.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588586": [
        {
            "ioc_value": "aeseclink.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588587": [
        {
            "ioc_value": "joseclink.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588588": [
        {
            "ioc_value": "inweblink.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588589": [
        {
            "ioc_value": "onegodae.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588590": [
        {
            "ioc_value": "onegodin.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:53:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588582": [
        {
            "ioc_value": "starexs.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:53:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588580": [
        {
            "ioc_value": "unknownhk1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-12 08:48:15",
            "last_seen_utc": "2025-09-17 10:27:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250912-hty2raaq41",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588555": [
        {
            "ioc_value": "va.xe3ax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 08:36:12",
            "last_seen_utc": "2025-09-12 09:09:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588574": [
        {
            "ioc_value": "nonsazv.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:23:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588567": [
        {
            "ioc_value": "caressv.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:10:30",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588568": [
        {
            "ioc_value": "provaiy.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:10:30",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588569": [
        {
            "ioc_value": "convysj.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:10:30",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588570": [
        {
            "ioc_value": "lifsnbu.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:10:30",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588571": [
        {
            "ioc_value": "clafvom.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:10:30",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588572": [
        {
            "ioc_value": "hfteozo.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 08:10:30",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588556": [
        {
            "ioc_value": "grewbix.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:50:55",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588546": [
        {
            "ioc_value": "hurdln.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:10",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588547": [
        {
            "ioc_value": "manticu.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:10",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588548": [
        {
            "ioc_value": "runjhb.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:10",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588549": [
        {
            "ioc_value": "bouyeit.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:10",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588550": [
        {
            "ioc_value": "antiaix.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:10",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588551": [
        {
            "ioc_value": "jargonx.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:10",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588552": [
        {
            "ioc_value": "bellmnk.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:10",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588553": [
        {
            "ioc_value": "poisono.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:10",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588554": [
        {
            "ioc_value": "mysidak.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:10",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588533": [
        {
            "ioc_value": "nerlzi.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588534": [
        {
            "ioc_value": "suctso.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588535": [
        {
            "ioc_value": "jackaw.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588536": [
        {
            "ioc_value": "revolxh.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588537": [
        {
            "ioc_value": "hoobow.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588538": [
        {
            "ioc_value": "commum.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588539": [
        {
            "ioc_value": "setqvax.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588540": [
        {
            "ioc_value": "abbeys.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588541": [
        {
            "ioc_value": "selfcmi.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588542": [
        {
            "ioc_value": "plembo.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588543": [
        {
            "ioc_value": "cloqfw.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588544": [
        {
            "ioc_value": "familef.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588545": [
        {
            "ioc_value": "purplde.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:09",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588527": [
        {
            "ioc_value": "leauab.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:08",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588528": [
        {
            "ioc_value": "lepidry.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:08",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588529": [
        {
            "ioc_value": "quavevd.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:08",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588530": [
        {
            "ioc_value": "soyabhn.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:08",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588531": [
        {
            "ioc_value": "tarakmb.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:08",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588532": [
        {
            "ioc_value": "enfeepy.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-12 07:48:08",
            "last_seen_utc": "2025-10-12 11:21:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588509": [
        {
            "ioc_value": "du.xe3ax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 07:35:20",
            "last_seen_utc": "2025-09-12 05:49:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588517": [
        {
            "ioc_value": "kri.xe3ax.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 07:35:20",
            "last_seen_utc": "2025-09-12 07:11:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588518": [
        {
            "ioc_value": "yn.fa6eq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 07:11:09",
            "last_seen_utc": "2025-09-12 08:49:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588515": [
        {
            "ioc_value": "zevsol.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-12 06:52:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588516": [
        {
            "ioc_value": "helppqb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-12 06:52:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588514": [
        {
            "ioc_value": "sn.fhelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-12 06:52:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588464": [
        {
            "ioc_value": "mox.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:53",
            "last_seen_utc": "2025-09-12 02:09:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588470": [
        {
            "ioc_value": "tne.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:53",
            "last_seen_utc": "2025-09-12 03:30:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588454": [
        {
            "ioc_value": "lv.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:52",
            "last_seen_utc": "2025-09-12 01:09:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588453": [
        {
            "ioc_value": "www.gxh191.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-09-12 05:27:50",
            "last_seen_utc": "2025-10-01 07:28:27",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1588451": [
        {
            "ioc_value": "qra.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:49",
            "last_seen_utc": "2025-09-12 00:49:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588452": [
        {
            "ioc_value": "www.4kdownload.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-12 05:27:49",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1588448": [
        {
            "ioc_value": "keen.vudeh0ae3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:48",
            "last_seen_utc": "2025-09-12 00:18:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588449": [
        {
            "ioc_value": "zi.we4ex.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:47",
            "last_seen_utc": "2025-09-12 00:31:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588434": [
        {
            "ioc_value": "wise.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:46",
            "last_seen_utc": "2025-09-11 23:34:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588447": [
        {
            "ioc_value": "calm.vudeh0ae3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:46",
            "last_seen_utc": "2025-09-12 00:10:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588433": [
        {
            "ioc_value": "tall.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:45",
            "last_seen_utc": "2025-09-11 23:29:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588186": [
        {
            "ioc_value": "rich.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:44",
            "last_seen_utc": "2025-09-11 22:10:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588187": [
        {
            "ioc_value": "cute.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:44",
            "last_seen_utc": "2025-09-11 22:14:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588188": [
        {
            "ioc_value": "lean.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:44",
            "last_seen_utc": "2025-09-11 22:50:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588184": [
        {
            "ioc_value": "dear.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:43",
            "last_seen_utc": "2025-09-11 22:04:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588122": [
        {
            "ioc_value": "vast.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:40",
            "last_seen_utc": "2025-09-11 19:11:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588175": [
        {
            "ioc_value": "neat.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:40",
            "last_seen_utc": "2025-09-11 20:50:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588177": [
        {
            "ioc_value": "ftifiles.work.gd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-12 05:27:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "APK,Fake Software",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1588114": [
        {
            "ioc_value": "pink.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:33",
            "last_seen_utc": "2025-09-11 18:29:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588115": [
        {
            "ioc_value": "tiny.kuryc7yy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:33",
            "last_seen_utc": "2025-09-11 18:34:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588098": [
        {
            "ioc_value": "g.kilut4ou8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 05:27:31",
            "last_seen_utc": "2025-09-11 17:29:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588504": [
        {
            "ioc_value": "optisigns.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-12 05:26:54",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1588506": [
        {
            "ioc_value": "tot.vumarifa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-12 05:10:29",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588479": [
        {
            "ioc_value": "home.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-12 04:01:00",
            "last_seen_utc": "2025-09-12 04:02:32",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+home.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1588472": [
        {
            "ioc_value": "c4.b1o.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-12 04:00:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.220.79.189+c4.b1o.it",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1588465": [
        {
            "ioc_value": "www.aliyunupdate.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-12 02:48:49",
            "last_seen_utc": "2025-10-22 07:49:44",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588450": [
        {
            "ioc_value": "qd.fa6eq.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-12 00:31:06",
            "last_seen_utc": "2025-09-12 05:49:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588435": [
        {
            "ioc_value": "mro.cubaqay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 23:32:53",
            "last_seen_utc": "2025-09-12 00:18:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588185": [
        {
            "ioc_value": "za.cubaqay.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 22:04:39",
            "last_seen_utc": "2025-09-11 23:29:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588157": [
        {
            "ioc_value": "stp.vumarifa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-11 20:10:38",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588153": [
        {
            "ioc_value": "gifted-swirles.41-216-188-199.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-11 20:02:44",
            "last_seen_utc": "2025-09-12 04:00:54",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/41.216.188.199+gifted-swirles.41-216-188-199.plesk.page",
            "tags": "AS211138,C2,censys,panel,PRIVATEHOSTING-NET,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588116": [
        {
            "ioc_value": "kli.sojokiy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 18:33:03",
            "last_seen_utc": "2025-09-11 20:50:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588111": [
        {
            "ioc_value": "new1novermber12.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-09-11 18:03:15",
            "last_seen_utc": "2025-09-17 10:27:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-t6ygja1rv2",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588109": [
        {
            "ioc_value": "ou841944.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-11 18:01:48",
            "last_seen_utc": "2025-09-13 11:43:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-pts9tsszcs",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588108": [
        {
            "ioc_value": "envio1111.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-11 18:01:47",
            "last_seen_utc": "2025-09-17 10:27:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-sqeh2s1mv9",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588106": [
        {
            "ioc_value": "verynicejourencywithbetterbabygirloftheb.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-11 18:01:39",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-tqa2asvwfv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588107": [
        {
            "ioc_value": "iwantmyangelevaalwaysbehappylovesugirlth.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-11 18:01:39",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-tp9hgavwe1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588105": [
        {
            "ioc_value": "rozm12345678-28404.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-11 18:01:32",
            "last_seen_utc": "2025-09-17 10:27:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-rpbkbszq12",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588104": [
        {
            "ioc_value": "qm.sojokiy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 17:57:37",
            "last_seen_utc": "2025-09-11 18:29:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588103": [
        {
            "ioc_value": "l.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 17:50:47",
            "last_seen_utc": "2025-09-11 18:01:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588100": [
        {
            "ioc_value": "vex.naberui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 17:38:57",
            "last_seen_utc": "2025-09-11 17:50:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588099": [
        {
            "ioc_value": "n.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 17:37:34",
            "last_seen_utc": "2025-09-11 17:38:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588097": [
        {
            "ioc_value": "dps.vumarifa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-11 17:10:25",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1588095": [
        {
            "ioc_value": "hl.naberui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 17:09:53",
            "last_seen_utc": "2025-09-11 17:37:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588094": [
        {
            "ioc_value": "e.kilut4ou8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 17:09:13",
            "last_seen_utc": "2025-09-11 17:10:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588073": [
        {
            "ioc_value": "pe.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 16:51:53",
            "last_seen_utc": "2025-09-11 15:17:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588075": [
        {
            "ioc_value": "bo.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 16:51:53",
            "last_seen_utc": "2025-09-11 15:50:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588087": [
        {
            "ioc_value": "on.kilut4ou8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 16:51:52",
            "last_seen_utc": "2025-09-11 16:09:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588090": [
        {
            "ioc_value": "s.kilut4ou8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 16:51:52",
            "last_seen_utc": "2025-09-11 16:41:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588088": [
        {
            "ioc_value": "t.kilut4ou8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 16:51:51",
            "last_seen_utc": "2025-09-11 16:37:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588091": [
        {
            "ioc_value": "rka.qisytui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 16:41:05",
            "last_seen_utc": "2025-09-11 16:41:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588082": [
        {
            "ioc_value": "aexis-medicai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-11 16:02:15",
            "last_seen_utc": "2025-09-12 04:00:35",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.201.216.161+aexis-medicai.com",
            "tags": "AS8075,C2,censys,Havoc,MICROSOFT-CORP-MSN-AS-BLOCK",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1588076": [
        {
            "ioc_value": "yn.qisytui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 15:49:42",
            "last_seen_utc": "2025-09-11 16:37:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588074": [
        {
            "ioc_value": "mta.sapafou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 15:16:33",
            "last_seen_utc": "2025-09-11 15:17:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1588072": [
        {
            "ioc_value": "wd.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 15:10:54",
            "last_seen_utc": "2025-09-11 15:09:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588070": [
        {
            "ioc_value": "lexenorf.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-11 15:06:11",
            "last_seen_utc": "2025-11-04 13:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1588071": [
        {
            "ioc_value": "newflux75.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-11 15:06:11",
            "last_seen_utc": "2025-11-04 13:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1588061": [
        {
            "ioc_value": "star.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 14:28:58",
            "last_seen_utc": "2025-09-11 14:12:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588060": [
        {
            "ioc_value": "free.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 14:28:57",
            "last_seen_utc": "2025-09-11 14:08:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588066": [
        {
            "ioc_value": "te.gunim5yi8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 14:28:55",
            "last_seen_utc": "2025-09-11 14:28:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1588067": [
        {
            "ioc_value": "dr.sapafou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 14:28:06",
            "last_seen_utc": "2025-09-11 15:09:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587861": [
        {
            "ioc_value": "realty.yourpgcountyliving.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-11 13:39:47",
            "last_seen_utc": "2025-09-11 17:40:26",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115185863899398082",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1587831": [
        {
            "ioc_value": "balancedgrowthhub.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587832": [
        {
            "ioc_value": "capitalflowpanel.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587833": [
        {
            "ioc_value": "capitalroadmap.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587834": [
        {
            "ioc_value": "clockhouse.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587835": [
        {
            "ioc_value": "financialplanningzone.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587836": [
        {
            "ioc_value": "financialtrackway.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587837": [
        {
            "ioc_value": "financialwaypoint.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587838": [
        {
            "ioc_value": "fundbridgegroup.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587839": [
        {
            "ioc_value": "growthvalueengine.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587840": [
        {
            "ioc_value": "insightwealthplan.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587842": [
        {
            "ioc_value": "nextlevelfunding.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587843": [
        {
            "ioc_value": "optimizedinvestmenthub.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587841": [
        {
            "ioc_value": "investplannerhub.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587845": [
        {
            "ioc_value": "strategicassetlane.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587846": [
        {
            "ioc_value": "trustedfundcircle.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587829": [
        {
            "ioc_value": "assetvisiondeck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587830": [
        {
            "ioc_value": "balancedassetline.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587826": [
        {
            "ioc_value": "nextstepinvest.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587827": [
        {
            "ioc_value": "advancedfundmanagement.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587828": [
        {
            "ioc_value": "assetgrowthgrid.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587821": [
        {
            "ioc_value": "also.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 13:39:35",
            "last_seen_utc": "2025-09-11 12:09:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587825": [
        {
            "ioc_value": "fancycloud.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:35",
            "last_seen_utc": "2025-10-25 10:38:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587844": [
        {
            "ioc_value": "smartfinancialvision.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587847": [
        {
            "ioc_value": "valuegaincircle.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587848": [
        {
            "ioc_value": "wealthscope.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587849": [
        {
            "ioc_value": "wealthstrategyflow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 13:39:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1587851": [
        {
            "ioc_value": "bet.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 13:39:31",
            "last_seen_utc": "2025-09-11 12:49:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587852": [
        {
            "ioc_value": "luck.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 13:39:30",
            "last_seen_utc": "2025-09-11 12:55:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587855": [
        {
            "ioc_value": "deep.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 13:39:30",
            "last_seen_utc": "2025-09-11 13:16:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587858": [
        {
            "ioc_value": "foundationforever.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-11 13:39:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115185861782868248",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1587860": [
        {
            "ioc_value": "poem2-jos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-11 13:39:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115185861782868248",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1587856": [
        {
            "ioc_value": "piv.laqygye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 13:15:10",
            "last_seen_utc": "2025-09-11 14:12:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587854": [
        {
            "ioc_value": "gx.laqygye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 12:55:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587853": [
        {
            "ioc_value": "zod.wofelee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 12:54:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587823": [
        {
            "ioc_value": "px.vumarifa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-11 12:10:56",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1587816": [
        {
            "ioc_value": "americanos2000.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-11 12:01:48",
            "last_seen_utc": "2025-09-17 10:27:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-gymzlshm81",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587814": [
        {
            "ioc_value": "northsalls.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-11 12:01:36",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-n2ynvasxcs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587815": [
        {
            "ioc_value": "goodangelgivenbestbabygirlevacamebackbea.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-11 12:01:36",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-hwzq3azwcw",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587810": [
        {
            "ioc_value": "md.rexykye2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 11:53:55",
            "last_seen_utc": "2025-09-12 18:44:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587806": [
        {
            "ioc_value": "xrp.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 11:30:20",
            "last_seen_utc": "2025-09-11 18:01:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587809": [
        {
            "ioc_value": "srf.sed-i.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-11 11:10:25",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1587807": [
        {
            "ioc_value": "fj.wofelee.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 11:10:05",
            "last_seen_utc": "2025-09-11 12:49:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587787": [
        {
            "ioc_value": "then.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 10:49:46",
            "last_seen_utc": "2025-09-11 08:51:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587789": [
        {
            "ioc_value": "they.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 10:49:45",
            "last_seen_utc": "2025-09-11 09:09:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587791": [
        {
            "ioc_value": "moon.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 10:49:43",
            "last_seen_utc": "2025-09-11 09:29:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587799": [
        {
            "ioc_value": "mon.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 10:49:39",
            "last_seen_utc": "2025-09-11 09:49:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587800": [
        {
            "ioc_value": "best.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 10:49:38",
            "last_seen_utc": "2025-09-11 10:08:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587801": [
        {
            "ioc_value": "mtmra.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-11 10:49:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1587804": [
        {
            "ioc_value": "lot.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 10:49:36",
            "last_seen_utc": "2025-09-11 10:28:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587805": [
        {
            "ioc_value": "most.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 10:49:35",
            "last_seen_utc": "2025-09-11 10:49:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587777": [
        {
            "ioc_value": "laid.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 08:50:47",
            "last_seen_utc": "2025-09-11 07:29:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587784": [
        {
            "ioc_value": "deal.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 08:50:47",
            "last_seen_utc": "2025-09-11 08:28:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587765": [
        {
            "ioc_value": "voyagecelery.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-11 06:33:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1587764": [
        {
            "ioc_value": "ppzr.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-11 06:33:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1587763": [
        {
            "ioc_value": "home.wofaraa29.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 06:29:02",
            "last_seen_utc": "2025-09-11 06:29:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587762": [
        {
            "ioc_value": "sea.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 06:19:06",
            "last_seen_utc": "2025-09-11 06:09:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587760": [
        {
            "ioc_value": "2024.123hack.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-11 06:01:39",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-aaxqkscr5z",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587757": [
        {
            "ioc_value": "us.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 05:55:44",
            "last_seen_utc": "2025-09-11 05:49:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587756": [
        {
            "ioc_value": "my-project.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-11 05:46:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250911-gahpzsyzex/behavioral2",
            "tags": "FixStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1587755": [
        {
            "ioc_value": "sun.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 05:12:10",
            "last_seen_utc": "2025-09-11 05:09:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587697": [
        {
            "ioc_value": "me.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:55",
            "last_seen_utc": "2025-09-11 03:08:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587698": [
        {
            "ioc_value": "run.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:54",
            "last_seen_utc": "2025-09-11 03:28:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587742": [
        {
            "ioc_value": "it.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:54",
            "last_seen_utc": "2025-09-11 04:09:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587754": [
        {
            "ioc_value": "no.gytogii12.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:52",
            "last_seen_utc": "2025-09-11 04:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587438": [
        {
            "ioc_value": "joy.sacyzie58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:45",
            "last_seen_utc": "2025-09-10 19:07:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587439": [
        {
            "ioc_value": "up.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:44",
            "last_seen_utc": "2025-09-10 21:38:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587470": [
        {
            "ioc_value": "fun.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:41",
            "last_seen_utc": "2025-09-10 21:09:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587478": [
        {
            "ioc_value": "way.dasurie36.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:41",
            "last_seen_utc": "2025-09-10 21:46:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587479": [
        {
            "ioc_value": "do.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:40",
            "last_seen_utc": "2025-09-10 22:00:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587679": [
        {
            "ioc_value": "so.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:39",
            "last_seen_utc": "2025-09-11 00:09:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587684": [
        {
            "ioc_value": "air.pykokiu43.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:38",
            "last_seen_utc": "2025-09-11 01:49:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587244": [
        {
            "ioc_value": "hi.sacyzie58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:36",
            "last_seen_utc": "2025-09-10 17:29:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587263": [
        {
            "ioc_value": "day.sacyzie58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-11 04:59:35",
            "last_seen_utc": "2025-09-10 18:09:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587716": [
        {
            "ioc_value": "login.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-11 04:01:11",
            "last_seen_utc": "2025-09-11 04:02:20",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+login.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1587712": [
        {
            "ioc_value": "ec2-44-194-109-35.compute-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nimplant",
            "malware_alias": null,
            "malware_printable": "Nimplant",
            "first_seen_utc": "2025-09-11 04:00:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/44.194.109.35+ec2-44-194-109-35.compute-1.amazonaws.com",
            "tags": "AMAZON-AES,AS14618,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1587699": [
        {
            "ioc_value": "ec2-3-17-216-79.us-east-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-11 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.17.216.79+ec2-3-17-216-79.us-east-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1587681": [
        {
            "ioc_value": "suu.sed-i.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-11 01:10:27",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1587480": [
        {
            "ioc_value": "ks.rawimoi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 22:00:11",
            "last_seen_utc": "2025-09-11 10:49:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587475": [
        {
            "ioc_value": "laputau.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 21:41:48",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587476": [
        {
            "ioc_value": "syapboc.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 21:41:48",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587474": [
        {
            "ioc_value": "ql.dapusey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 21:38:51",
            "last_seen_utc": "2025-09-10 21:46:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587471": [
        {
            "ioc_value": "jambzkb.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 21:08:45",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587472": [
        {
            "ioc_value": "highwas.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 21:08:45",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587473": [
        {
            "ioc_value": "cadqdwk.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 21:08:45",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587468": [
        {
            "ioc_value": "vid.sed-i.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-10 20:10:31",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1587261": [
        {
            "ioc_value": "ydbao8.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-10 18:02:21",
            "last_seen_utc": "2025-10-10 11:35:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-jq4nhafr4x",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587255": [
        {
            "ioc_value": "asesorarcolom.crabdance.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-10 18:01:45",
            "last_seen_utc": "2025-09-30 05:53:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-gj89aswtg1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587254": [
        {
            "ioc_value": "onanothertry.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-10 18:01:44",
            "last_seen_utc": "2025-09-17 10:27:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-gj89aswtg1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587251": [
        {
            "ioc_value": "sfave8ojurshe3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-10 18:01:33",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-mdc7kaytfv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587252": [
        {
            "ioc_value": "sfave8ojurshe4.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-10 18:01:33",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-mdc7kaytfv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587253": [
        {
            "ioc_value": "sfave8ojurshe5.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-10 18:01:33",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-mdc7kaytfv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587248": [
        {
            "ioc_value": "nicegoodkidsevaangelsheismygirlsoir.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-10 18:01:32",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-k3t59sxydw",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587249": [
        {
            "ioc_value": "sfave8ojurshe1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-10 18:01:32",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-mdc7kaytfv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587250": [
        {
            "ioc_value": "sfave8ojurshe2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-10 18:01:32",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-mdc7kaytfv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587243": [
        {
            "ioc_value": "vop.sed-i.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-10 17:10:25",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1587241": [
        {
            "ioc_value": "1.netbots.africa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.moobot",
            "malware_alias": null,
            "malware_printable": "MooBot",
            "first_seen_utc": "2025-09-10 16:58:32",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f2a36187a53e4ab42b99f1b21adfbe3850daefa24e0d4f9614fd17b0723770df/",
            "tags": "MooBot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1587234": [
        {
            "ioc_value": "sea.nylykuu40.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 16:55:26",
            "last_seen_utc": "2025-09-10 16:09:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587236": [
        {
            "ioc_value": "go.sacyzie58.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 16:55:25",
            "last_seen_utc": "2025-09-10 18:48:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587237": [
        {
            "ioc_value": "vk.denumeu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 16:31:17",
            "last_seen_utc": "2025-09-10 21:09:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587220": [
        {
            "ioc_value": "aftermaths-attraction.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-10 16:03:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115180731792855034",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1587222": [
        {
            "ioc_value": "ink-approval.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-10 16:03:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115180731792855034",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1587216": [
        {
            "ioc_value": "sky.nylykuu40.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 15:28:51",
            "last_seen_utc": "2025-09-10 14:34:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587217": [
        {
            "ioc_value": "best.zyrupoe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 14:34:54",
            "last_seen_utc": "2025-09-10 16:09:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587210": [
        {
            "ioc_value": "chat.pgcountyliving.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-10 13:46:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115180206908855037",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1587211": [
        {
            "ioc_value": "to.nylykuu40.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 13:46:57",
            "last_seen_utc": "2025-09-10 15:48:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587212": [
        {
            "ioc_value": "dd.aass654.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-09-10 13:31:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://threatfox.abuse.ch/downloads/misp/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1586675": [
        {
            "ioc_value": "me.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 13:15:24",
            "last_seen_utc": "2025-09-10 10:14:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1586678": [
        {
            "ioc_value": "way.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 13:15:23",
            "last_seen_utc": "2025-09-10 10:25:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1586680": [
        {
            "ioc_value": "it.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 13:15:23",
            "last_seen_utc": "2025-09-10 10:49:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587190": [
        {
            "ioc_value": "run.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 13:15:22",
            "last_seen_utc": "2025-09-10 12:49:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587194": [
        {
            "ioc_value": "protoflint.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:22",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587195": [
        {
            "ioc_value": "novelumbsasa.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:21",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587196": [
        {
            "ioc_value": "picasosoftai.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:21",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587197": [
        {
            "ioc_value": "moldostonesupplies.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:21",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587198": [
        {
            "ioc_value": "x6iye.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:20",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587199": [
        {
            "ioc_value": "buenohuy.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:20",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587201": [
        {
            "ioc_value": "lokipoki.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:20",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587200": [
        {
            "ioc_value": "firetrue.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:19",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587202": [
        {
            "ioc_value": "veryspec.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:19",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587203": [
        {
            "ioc_value": "mautau.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:18",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587204": [
        {
            "ioc_value": "muatay.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:18",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587205": [
        {
            "ioc_value": "nicepliced.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:18",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587206": [
        {
            "ioc_value": "nissi.bg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.adaptix_c2",
            "malware_alias": null,
            "malware_printable": "AdaptixC2",
            "first_seen_utc": "2025-09-10 13:15:18",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1587208": [
        {
            "ioc_value": "sff.sed-i.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-10 13:10:28",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1586499": [
        {
            "ioc_value": "air.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 12:31:45",
            "last_seen_utc": "2025-09-10 09:23:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587174": [
        {
            "ioc_value": "sun.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 12:31:43",
            "last_seen_utc": "2025-09-10 11:47:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587172": [
        {
            "ioc_value": "no.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 12:31:41",
            "last_seen_utc": "2025-09-10 11:24:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587184": [
        {
            "ioc_value": "us.quladao75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 12:31:40",
            "last_seen_utc": "2025-09-10 12:08:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1587187": [
        {
            "ioc_value": "rfwklaw.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-10 12:31:39",
            "last_seen_utc": "2025-09-10 12:16:28",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115179951534869477",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1587182": [
        {
            "ioc_value": "dmoneii.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-10 12:02:42",
            "last_seen_utc": "2025-10-10 11:35:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-le4v8sgq61",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1587175": [
        {
            "ioc_value": "hs.fypufea.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 11:47:35",
            "last_seen_utc": "2025-09-10 14:08:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1587173": [
        {
            "ioc_value": "tiv.lizusey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 11:24:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1586679": [
        {
            "ioc_value": "ym.lizusey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 10:25:13",
            "last_seen_utc": "2025-09-10 10:49:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1586676": [
        {
            "ioc_value": "lup.gowuhei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 10:14:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1586500": [
        {
            "ioc_value": "dr.gowuhei.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 09:23:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1586458": [
        {
            "ioc_value": "two.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 09:00:39",
            "last_seen_utc": "2025-09-10 08:29:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1586497": [
        {
            "ioc_value": "so.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 09:00:39",
            "last_seen_utc": "2025-09-10 08:58:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1586498": [
        {
            "ioc_value": "vex.zyrupoe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 08:58:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1586494": [
        {
            "ioc_value": "commgxm.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:36:17",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586495": [
        {
            "ioc_value": "neticex.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:36:17",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586496": [
        {
            "ioc_value": "descroej.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:36:17",
            "last_seen_utc": "2025-10-05 14:32:29",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586491": [
        {
            "ioc_value": "permanz.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:33:43",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586492": [
        {
            "ioc_value": "unimzfs.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:33:43",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586493": [
        {
            "ioc_value": "conbjao.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:33:43",
            "last_seen_utc": "2025-09-27 10:53:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586490": [
        {
            "ioc_value": "do.feryfoi88.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 08:32:15",
            "last_seen_utc": "2025-09-10 08:32:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1586488": [
        {
            "ioc_value": "iliafmoj.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:35",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586489": [
        {
            "ioc_value": "pictuqyr.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:35",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586484": [
        {
            "ioc_value": "stisfmye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:34",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586485": [
        {
            "ioc_value": "flirtn.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586486": [
        {
            "ioc_value": "suomuj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586487": [
        {
            "ioc_value": "aqaibak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:34",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586478": [
        {
            "ioc_value": "apothfya.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586479": [
        {
            "ioc_value": "brunsmmv.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:33",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586480": [
        {
            "ioc_value": "danglaz.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:33",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586481": [
        {
            "ioc_value": "danglyu.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:33",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586482": [
        {
            "ioc_value": "prolare.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:33",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586483": [
        {
            "ioc_value": "ghogqcav.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:33",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586474": [
        {
            "ioc_value": "mensfjb.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:30",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586475": [
        {
            "ioc_value": "sourjpa.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:30",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586476": [
        {
            "ioc_value": "briznu.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586477": [
        {
            "ioc_value": "peouuhv.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586467": [
        {
            "ioc_value": "woodvuqb.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:29",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586468": [
        {
            "ioc_value": "lutraqdb.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586469": [
        {
            "ioc_value": "serexvo.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586470": [
        {
            "ioc_value": "sulvtmap.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:29",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586471": [
        {
            "ioc_value": "yunniuwr.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586472": [
        {
            "ioc_value": "upwanpdx.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:29",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586473": [
        {
            "ioc_value": "arraeyg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586466": [
        {
            "ioc_value": "omertaza.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:28",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586462": [
        {
            "ioc_value": "fruiunp.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:27",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586463": [
        {
            "ioc_value": "wilddbgh.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:27",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586464": [
        {
            "ioc_value": "vergimh.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586465": [
        {
            "ioc_value": "asseppn.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586460": [
        {
            "ioc_value": "tticopn.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:25",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586461": [
        {
            "ioc_value": "koubmjm.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:25",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586459": [
        {
            "ioc_value": "sirwimdw.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:31:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1586302": [
        {
            "ioc_value": "new.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 08:20:43",
            "last_seen_utc": "2025-09-10 08:07:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1586456": [
        {
            "ioc_value": "kafkashaliyikama.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-10 08:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "oauth,stealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586455": [
        {
            "ioc_value": "504ec1c95.host.njalla.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-10 08:18:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Betruger,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586454": [
        {
            "ioc_value": "iuh234.medianewsonline.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.kimsuky",
            "malware_alias": null,
            "malware_printable": "Kimsuky",
            "first_seen_utc": "2025-09-10 08:18:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,kimsuky",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586451": [
        {
            "ioc_value": "pristid.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:18:00",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586452": [
        {
            "ioc_value": "bluyypff.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:18:00",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586453": [
        {
            "ioc_value": "leafleg.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-10 08:18:00",
            "last_seen_utc": "2025-11-20 09:25:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586450": [
        {
            "ioc_value": "forums-objectives.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-10 08:17:26",
            "last_seen_utc": "2025-09-17 10:27:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586448": [
        {
            "ioc_value": "erfffxz.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-10 08:16:24",
            "last_seen_utc": "2025-10-10 11:34:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586437": [
        {
            "ioc_value": "www.tzay.realtor",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586438": [
        {
            "ioc_value": "www.uartzxenialpingrun.christmas",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586439": [
        {
            "ioc_value": "www.ujitegemea.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586440": [
        {
            "ioc_value": "www.ulta.city",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586441": [
        {
            "ioc_value": "www.ummervibezonly.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586442": [
        {
            "ioc_value": "www.uritdinismailov.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586443": [
        {
            "ioc_value": "www.us230.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586444": [
        {
            "ioc_value": "www.uynta.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586445": [
        {
            "ioc_value": "www.vmdia7.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586446": [
        {
            "ioc_value": "www.xbet-ajpr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586447": [
        {
            "ioc_value": "www.z23.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586422": [
        {
            "ioc_value": "www.orenewullc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586423": [
        {
            "ioc_value": "www.ork-law-9s10s5.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586424": [
        {
            "ioc_value": "www.orklift-jobs-78023.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586425": [
        {
            "ioc_value": "www.ormiimpal.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586426": [
        {
            "ioc_value": "www.ostbet-4ff8.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586427": [
        {
            "ioc_value": "www.pcj.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586428": [
        {
            "ioc_value": "www.pple-podcast-connect.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586429": [
        {
            "ioc_value": "www.rabuslot777win.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586430": [
        {
            "ioc_value": "www.raedenwhitten.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586431": [
        {
            "ioc_value": "www.ri6hw.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586432": [
        {
            "ioc_value": "www.ristinvaneetvelt.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586433": [
        {
            "ioc_value": "www.rsmdr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586434": [
        {
            "ioc_value": "www.smaticoferoz.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586435": [
        {
            "ioc_value": "www.stiar.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586436": [
        {
            "ioc_value": "www.tlantida-sh.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586406": [
        {
            "ioc_value": "www.etlemonlightapp.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586407": [
        {
            "ioc_value": "www.euenviiodiigiital.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586408": [
        {
            "ioc_value": "www.fhomesolutions.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586409": [
        {
            "ioc_value": "www.g299.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586410": [
        {
            "ioc_value": "www.gpi185.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586411": [
        {
            "ioc_value": "www.h8klb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586412": [
        {
            "ioc_value": "www.ikilo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586413": [
        {
            "ioc_value": "www.ikmomk.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586414": [
        {
            "ioc_value": "www.iyabet.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586415": [
        {
            "ioc_value": "www.k2y7bcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586416": [
        {
            "ioc_value": "www.ldgfq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586417": [
        {
            "ioc_value": "www.learnotion.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586418": [
        {
            "ioc_value": "www.mfdoc.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586419": [
        {
            "ioc_value": "www.ndiana.vote",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586420": [
        {
            "ioc_value": "www.niquetouchsweets.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586421": [
        {
            "ioc_value": "www.oinpurple.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586392": [
        {
            "ioc_value": "www.arinsoft.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586393": [
        {
            "ioc_value": "www.athanielross.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586394": [
        {
            "ioc_value": "www.btt.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586395": [
        {
            "ioc_value": "www.btzk.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586396": [
        {
            "ioc_value": "www.c0571.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586397": [
        {
            "ioc_value": "www.c2507.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586398": [
        {
            "ioc_value": "www.c3974.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586399": [
        {
            "ioc_value": "www.dbookstore-1.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586400": [
        {
            "ioc_value": "www.eil.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586401": [
        {
            "ioc_value": "www.elcuksozluk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586402": [
        {
            "ioc_value": "www.entry.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586403": [
        {
            "ioc_value": "www.erchantiindustry.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586404": [
        {
            "ioc_value": "www.eroysane.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586405": [
        {
            "ioc_value": "www.esale-server.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586384": [
        {
            "ioc_value": "www.00hu05.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586385": [
        {
            "ioc_value": "www.4047.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586386": [
        {
            "ioc_value": "www.4615.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586387": [
        {
            "ioc_value": "www.4742.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586388": [
        {
            "ioc_value": "www.6237871.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586389": [
        {
            "ioc_value": "www.7648419.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586390": [
        {
            "ioc_value": "www.816hd1.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586391": [
        {
            "ioc_value": "www.alishka.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-10 08:15:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586315": [
        {
            "ioc_value": "lavern123.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-10 08:14:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586316": [
        {
            "ioc_value": "cyberwashere.is-a-lawyer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-10 08:14:12",
            "last_seen_utc": "2025-09-17 10:27:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1586308": [
        {
            "ioc_value": "10.9.jami.bio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-10 08:10:57",
            "last_seen_utc": "2025-09-15 14:24:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "op74rh,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585747": [
        {
            "ioc_value": "ip213-165-80-114.pbiaas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-10 08:02:07",
            "last_seen_utc": "2025-09-11 04:00:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/213.165.80.114+ip213-165-80-114.pbiaas.com",
            "tags": "AS8560,C2,censys,Havoc,IONOS-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585742": [
        {
            "ioc_value": "good.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 07:50:21",
            "last_seen_utc": "2025-09-10 07:46:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585743": [
        {
            "ioc_value": "kl.zyrupoe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 07:46:53",
            "last_seen_utc": "2025-09-10 08:32:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585737": [
        {
            "ioc_value": "watt.fucirai75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 07:36:10",
            "last_seen_utc": "2025-09-10 07:08:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585740": [
        {
            "ioc_value": "free.homohay31.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 07:36:09",
            "last_seen_utc": "2025-09-10 07:27:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585741": [
        {
            "ioc_value": "mri.jozotea.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 07:27:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585738": [
        {
            "ioc_value": "qx.jozotea.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 07:08:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585735": [
        {
            "ioc_value": "warm.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 06:31:47",
            "last_seen_utc": "2025-09-10 06:28:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585729": [
        {
            "ioc_value": "9.9.jami.bio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-10 06:06:42",
            "last_seen_utc": "2025-09-10 07:10:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1585722": [
        {
            "ioc_value": "laurent-kefere.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-10 06:01:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-a7ew2ahp7t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585720": [
        {
            "ioc_value": "padrisosr25.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-10 06:01:32",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250910-d1l9bazmv6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585718": [
        {
            "ioc_value": "slow.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:57:25",
            "last_seen_utc": "2025-09-10 05:48:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585709": [
        {
            "ioc_value": "high.lilek4au2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:20",
            "last_seen_utc": "2025-09-10 04:48:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585615": [
        {
            "ioc_value": "sec.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:18",
            "last_seen_utc": "2025-09-09 18:47:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585647": [
        {
            "ioc_value": "get.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:17",
            "last_seen_utc": "2025-09-09 20:28:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585618": [
        {
            "ioc_value": "let.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:16",
            "last_seen_utc": "2025-09-09 19:47:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585649": [
        {
            "ioc_value": "best.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:15",
            "last_seen_utc": "2025-09-09 21:27:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585651": [
        {
            "ioc_value": "add.homohay31.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:15",
            "last_seen_utc": "2025-09-09 22:07:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585653": [
        {
            "ioc_value": "doll.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:14",
            "last_seen_utc": "2025-09-09 22:26:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585657": [
        {
            "ioc_value": "cool.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:13",
            "last_seen_utc": "2025-09-09 23:28:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585670": [
        {
            "ioc_value": "dvrxpert.tiananmensquare1989.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.aisuru",
            "malware_alias": null,
            "malware_printable": "Aisuru",
            "first_seen_utc": "2025-09-10 05:27:13",
            "last_seen_utc": "2025-10-14 20:37:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "Aisuru,Mirai,RRDNS",
            "anonymous": "1",
            "reporter": "thaoht"
        }
    ],
    "1585655": [
        {
            "ioc_value": "soft.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:12",
            "last_seen_utc": "2025-09-09 23:00:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585672": [
        {
            "ioc_value": "coerece.ilovegaysex.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-10 05:27:11",
            "last_seen_utc": "2025-10-09 06:56:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "Mirai,RRDNS,TXT",
            "anonymous": "0",
            "reporter": "thaoht"
        }
    ],
    "1585673": [
        {
            "ioc_value": "6mv1eyr328y6due83u3js6whtzuxfyhw.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-10 05:27:11",
            "last_seen_utc": "2025-09-10 03:10:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "Mirai,RRDNS,TXT",
            "anonymous": "0",
            "reporter": "thaoht"
        }
    ],
    "1585674": [
        {
            "ioc_value": "nice.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-10 05:27:10",
            "last_seen_utc": "2025-09-10 03:49:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585667": [
        {
            "ioc_value": "sanhao-th.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-10 00:02:39",
            "last_seen_utc": "2025-09-13 00:02:47",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/43.139.159.252+sanhao-th.com",
            "tags": "AS45090,c2,c2-redirector,censys,RedGuard,TENCENT-NET-AP",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585666": [
        {
            "ioc_value": "files.colin001.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-10 00:02:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.108.187.9+files.colin001.top",
            "tags": "ALIBABA-CN-NET,AS37963,c2,c2-redirector,censys,RedGuard",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585656": [
        {
            "ioc_value": "go.pemi9cai6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 23:00:15",
            "last_seen_utc": "2025-09-10 06:28:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585650": [
        {
            "ioc_value": "gla.niwunae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 21:27:21",
            "last_seen_utc": "2025-09-09 22:26:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585619": [
        {
            "ioc_value": "zu.niwunae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 19:47:32",
            "last_seen_utc": "2025-09-09 20:28:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585608": [
        {
            "ioc_value": "cc.aass654.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-09-09 18:23:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69f17c943d7b5f987095d3c288e2e6e5e3f940ae2ce4c35cec24cde07695e977/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585609": [
        {
            "ioc_value": "cc.xxcc789.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-09-09 18:23:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69f17c943d7b5f987095d3c288e2e6e5e3f940ae2ce4c35cec24cde07695e977/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585610": [
        {
            "ioc_value": "cc.vvbb321.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-09-09 18:23:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69f17c943d7b5f987095d3c288e2e6e5e3f940ae2ce4c35cec24cde07695e977/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585611": [
        {
            "ioc_value": "cc.jjkk567.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-09-09 18:23:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69f17c943d7b5f987095d3c288e2e6e5e3f940ae2ce4c35cec24cde07695e977/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585612": [
        {
            "ioc_value": "cc.nnmm234.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-09-09 18:23:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69f17c943d7b5f987095d3c288e2e6e5e3f940ae2ce4c35cec24cde07695e977/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585586": [
        {
            "ioc_value": "fun.fucirai75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 18:17:15",
            "last_seen_utc": "2025-09-09 16:09:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585589": [
        {
            "ioc_value": "joy.fucirai75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 18:17:13",
            "last_seen_utc": "2025-09-09 16:47:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585596": [
        {
            "ioc_value": "live.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 18:17:13",
            "last_seen_utc": "2025-09-09 17:47:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585606": [
        {
            "ioc_value": "dark.zanax6aa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 18:17:13",
            "last_seen_utc": "2025-09-09 18:09:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585607": [
        {
            "ioc_value": "kro.sehamyu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 18:09:16",
            "last_seen_utc": "2025-09-09 18:47:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585603": [
        {
            "ioc_value": "manoc36864-60376.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-09 18:01:50",
            "last_seen_utc": "2025-09-17 10:27:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-s1cgfasr19",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585600": [
        {
            "ioc_value": "smartcorporation.theworkpc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-09 18:01:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-vmm25acq9t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585601": [
        {
            "ioc_value": "thought-write.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-09 18:01:22",
            "last_seen_utc": "2025-09-17 10:27:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-skzxssck9w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585599": [
        {
            "ioc_value": "windowsupdate.loseyourip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-09 18:01:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-vmm25acq9t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585590": [
        {
            "ioc_value": "cloud.amazoncdn.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-09 16:49:12",
            "last_seen_utc": "2025-10-13 07:50:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585588": [
        {
            "ioc_value": "va.sehamyu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 16:27:08",
            "last_seen_utc": "2025-09-09 17:47:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585587": [
        {
            "ioc_value": "sne.dovagua.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 16:09:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585574": [
        {
            "ioc_value": "up.fucirai75.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 15:21:17",
            "last_seen_utc": "2025-09-09 16:27:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585569": [
        {
            "ioc_value": "iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-09 15:04:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-qre5vsslv2/behavioral2",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1585570": [
        {
            "ioc_value": "root.iloveanimals.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-09 15:04:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-qre5vsslv2/behavioral2",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1585571": [
        {
            "ioc_value": "day.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 15:04:20",
            "last_seen_utc": "2025-09-09 14:08:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585573": [
        {
            "ioc_value": "order.assuredpestcontrolutah.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-09 15:04:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115174753240633615",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1585568": [
        {
            "ioc_value": "sky.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 13:27:00",
            "last_seen_utc": "2025-09-09 13:36:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585555": [
        {
            "ioc_value": "go.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 13:05:47",
            "last_seen_utc": "2025-09-09 13:48:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585557": [
        {
            "ioc_value": "ffclive.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-09 13:05:45",
            "last_seen_utc": "2025-09-09 12:13:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115174276430020655",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1585559": [
        {
            "ioc_value": "hi.jytoceo30.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 13:05:44",
            "last_seen_utc": "2025-09-09 12:29:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585550": [
        {
            "ioc_value": "hidra991.hldns.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-09 12:02:17",
            "last_seen_utc": "2025-09-17 10:27:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-mw3vyaap7s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585545": [
        {
            "ioc_value": "stachi.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-09 12:01:26",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-man5naam9y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585543": [
        {
            "ioc_value": "quick-portion.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-09 12:01:21",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-l6k77sv1gz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585544": [
        {
            "ioc_value": "enter-dayton.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-09 12:01:21",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-g1bpcshj8v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585512": [
        {
            "ioc_value": "run.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 11:08:57",
            "last_seen_utc": "2025-09-09 07:27:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585523": [
        {
            "ioc_value": "sea.homohay31.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 11:08:56",
            "last_seen_utc": "2025-09-09 11:47:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585528": [
        {
            "ioc_value": "qg.jibiw8aa5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 11:08:56",
            "last_seen_utc": "2025-09-09 08:46:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585541": [
        {
            "ioc_value": "sun.homohay31.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 11:08:50",
            "last_seen_utc": "2025-09-09 11:07:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585507": [
        {
            "ioc_value": "us.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:54:07",
            "last_seen_utc": "2025-09-09 06:48:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585503": [
        {
            "ioc_value": "sec.b.granivit.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-09 06:34:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1585502": [
        {
            "ioc_value": "inoffek.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-09 06:34:20",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585496": [
        {
            "ioc_value": "voando.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-09 06:34:19",
            "last_seen_utc": "2025-09-12 08:54:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585497": [
        {
            "ioc_value": "mandmqq.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-09 06:34:19",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585498": [
        {
            "ioc_value": "trimoeb.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-09 06:34:19",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585499": [
        {
            "ioc_value": "polypef.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-09 06:34:19",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585500": [
        {
            "ioc_value": "openlkn.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-09 06:34:19",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585501": [
        {
            "ioc_value": "pulluoj.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-09 06:34:19",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585144": [
        {
            "ioc_value": "up.tydubyo66.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:16",
            "last_seen_utc": "2025-09-08 18:32:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585152": [
        {
            "ioc_value": "day.tydubyo66.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:14",
            "last_seen_utc": "2025-09-08 17:47:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585269": [
        {
            "ioc_value": "do.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:14",
            "last_seen_utc": "2025-09-08 20:07:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585234": [
        {
            "ioc_value": "joy.tydubyo66.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:13",
            "last_seen_utc": "2025-09-08 19:55:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585276": [
        {
            "ioc_value": "cabunca.mypets.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.janela_rat",
            "malware_alias": null,
            "malware_printable": "JanelaRAT",
            "first_seen_utc": "2025-09-09 06:33:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://sidequest-lab.com/2025/09/08/janelarat-reversing/",
            "tags": "c2,JanelaRat",
            "anonymous": "0",
            "reporter": "R4ruk"
        }
    ],
    "1585278": [
        {
            "ioc_value": "so.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:11",
            "last_seen_utc": "2025-09-08 20:46:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585282": [
        {
            "ioc_value": "fun.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:09",
            "last_seen_utc": "2025-09-08 21:27:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585283": [
        {
            "ioc_value": "me.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:09",
            "last_seen_utc": "2025-09-08 21:48:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585285": [
        {
            "ioc_value": "way.xudofiu02.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:08",
            "last_seen_utc": "2025-09-08 22:07:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585441": [
        {
            "ioc_value": "it.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:08",
            "last_seen_utc": "2025-09-09 01:27:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585487": [
        {
            "ioc_value": "air.gesybue11.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 06:33:06",
            "last_seen_utc": "2025-09-09 04:27:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585493": [
        {
            "ioc_value": "smeartj.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-09 06:26:05",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585492": [
        {
            "ioc_value": "decuioz.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-09 06:24:18",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585490": [
        {
            "ioc_value": "pow.s.xifuhalim.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-09 06:10:48",
            "last_seen_utc": "2025-09-18 17:10:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585488": [
        {
            "ioc_value": "egi0of8.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-09 06:02:04",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250909-b7rq9sfq7v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585461": [
        {
            "ioc_value": "srv649721.hstgr.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-09 04:00:56",
            "last_seen_utc": "2025-09-09 04:02:14",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/148.135.138.44+srv649721.hstgr.cloud",
            "tags": "AS-HOSTINGER,AS47583,C2,censys,Unam",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1585456": [
        {
            "ioc_value": "ec2-18-184-8-83.eu-central-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-09 04:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.184.8.83+ec2-18-184-8-83.eu-central-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1585452": [
        {
            "ioc_value": "2152761d.langcdn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-09 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/154.204.181.184+2152761d.langcdn.top",
            "tags": "AROSS-AS,AS400619,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1585450": [
        {
            "ioc_value": "pow.t.xifuhalim.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-09 02:10:56",
            "last_seen_utc": "2025-09-09 06:34:23",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585442": [
        {
            "ioc_value": "jl.dovagua.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-09 01:27:05",
            "last_seen_utc": "2025-09-09 15:28:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585284": [
        {
            "ioc_value": "dmybfje.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 22:01:13",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585271": [
        {
            "ioc_value": "sec.b.xifuhalim.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-08 20:10:39",
            "last_seen_utc": "2025-09-09 06:34:23",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1585235": [
        {
            "ioc_value": "bp.muzodoa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 19:55:34",
            "last_seen_utc": "2025-09-08 22:07:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585227": [
        {
            "ioc_value": "disloef.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:27:00",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585228": [
        {
            "ioc_value": "explodd.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:27:00",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585229": [
        {
            "ioc_value": "keoghvg.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:27:00",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585230": [
        {
            "ioc_value": "lactoxn.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:27:00",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585231": [
        {
            "ioc_value": "leasebu.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:27:00",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585232": [
        {
            "ioc_value": "mugbool.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:27:00",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585233": [
        {
            "ioc_value": "neutray.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:27:00",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585218": [
        {
            "ioc_value": "slipxzx.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:26:59",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585219": [
        {
            "ioc_value": "helltlt.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:26:59",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585220": [
        {
            "ioc_value": "genuysf.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:26:59",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585221": [
        {
            "ioc_value": "innervn.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:26:59",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585222": [
        {
            "ioc_value": "islamil.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:26:59",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585223": [
        {
            "ioc_value": "kennetk.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:26:59",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585224": [
        {
            "ioc_value": "polytgh.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:26:59",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585225": [
        {
            "ioc_value": "radialz.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:26:59",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585226": [
        {
            "ioc_value": "roomysc.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:26:59",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585209": [
        {
            "ioc_value": "ideofvb.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:29",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585210": [
        {
            "ioc_value": "lapsqyq.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:29",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585211": [
        {
            "ioc_value": "setbnhy.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:29",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585212": [
        {
            "ioc_value": "trichcd.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:29",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585213": [
        {
            "ioc_value": "turrgql.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:29",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585214": [
        {
            "ioc_value": "genulop.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:29",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585215": [
        {
            "ioc_value": "numeqci.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:29",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585216": [
        {
            "ioc_value": "scepxmo.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:29",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585217": [
        {
            "ioc_value": "lustmms.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:29",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585206": [
        {
            "ioc_value": "spacoai.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:28",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585207": [
        {
            "ioc_value": "backfvb.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:28",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585208": [
        {
            "ioc_value": "dalocoz.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:25:28",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585203": [
        {
            "ioc_value": "bondixa.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:44",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585204": [
        {
            "ioc_value": "denimmi.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:44",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585205": [
        {
            "ioc_value": "smashaj.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:44",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585188": [
        {
            "ioc_value": "anticlk.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585189": [
        {
            "ioc_value": "facilin.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585190": [
        {
            "ioc_value": "batonra.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585191": [
        {
            "ioc_value": "burkeax.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-09-21 09:16:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585192": [
        {
            "ioc_value": "detachs.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585193": [
        {
            "ioc_value": "subtehi.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585194": [
        {
            "ioc_value": "takepdq.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-09-21 09:16:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585195": [
        {
            "ioc_value": "zairezb.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-09-21 09:16:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585196": [
        {
            "ioc_value": "easybqy.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585197": [
        {
            "ioc_value": "mindhlo.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585198": [
        {
            "ioc_value": "sculcib.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585199": [
        {
            "ioc_value": "persrbj.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585200": [
        {
            "ioc_value": "realist.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585201": [
        {
            "ioc_value": "glibtof.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585202": [
        {
            "ioc_value": "falsapa.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:43",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585171": [
        {
            "ioc_value": "damagex.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585172": [
        {
            "ioc_value": "dishine.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585173": [
        {
            "ioc_value": "enthrqe.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585174": [
        {
            "ioc_value": "hingexr.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585175": [
        {
            "ioc_value": "orienlc.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585176": [
        {
            "ioc_value": "ravishl.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585177": [
        {
            "ioc_value": "stupide.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585178": [
        {
            "ioc_value": "unitkgt.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585179": [
        {
            "ioc_value": "unregun.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585180": [
        {
            "ioc_value": "threahg.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585181": [
        {
            "ioc_value": "excesso.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585182": [
        {
            "ioc_value": "silverk.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585183": [
        {
            "ioc_value": "novellv.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585184": [
        {
            "ioc_value": "natione.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585185": [
        {
            "ioc_value": "winslmk.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585186": [
        {
            "ioc_value": "icerinh.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:42",
            "last_seen_utc": "2025-09-21 09:16:34",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585166": [
        {
            "ioc_value": "proscns.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:41",
            "last_seen_utc": "2025-09-21 09:16:36",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585167": [
        {
            "ioc_value": "octanzn.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:41",
            "last_seen_utc": "2025-09-21 09:16:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585168": [
        {
            "ioc_value": "bluejwh.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:41",
            "last_seen_utc": "2025-09-21 09:16:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585169": [
        {
            "ioc_value": "capitam.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:41",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585170": [
        {
            "ioc_value": "curdlep.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-08 18:22:41",
            "last_seen_utc": "2025-11-20 09:25:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585163": [
        {
            "ioc_value": "kejishashasha.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-08 18:02:23",
            "last_seen_utc": "2025-10-10 11:35:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-rzf8kawms5",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585158": [
        {
            "ioc_value": "sharjahaquarium.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-08 18:01:19",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-qkz7fscl6v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585159": [
        {
            "ioc_value": "evaultbuzzfix.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-08 18:01:19",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-qdjwwsvnz8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585154": [
        {
            "ioc_value": "faq-samuel.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-08 18:01:18",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-tkf1csyzfz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585155": [
        {
            "ioc_value": "saqir.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-08 18:01:18",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-tcrf5axpt5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585156": [
        {
            "ioc_value": "due-involvement.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-08 18:01:18",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-sa6btswpz3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585157": [
        {
            "ioc_value": "welcome-lewis.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-08 18:01:18",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-qvlf2svqv5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1585150": [
        {
            "ioc_value": "zod.fypufea.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 17:04:06",
            "last_seen_utc": "2025-09-08 18:32:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585145": [
        {
            "ioc_value": "tma.penodoa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 16:47:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585141": [
        {
            "ioc_value": "sky.badejie69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 16:17:42",
            "last_seen_utc": "2025-09-08 16:06:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585131": [
        {
            "ioc_value": "ctu.poxyway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 15:48:24",
            "last_seen_utc": "2025-09-08 16:06:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585129": [
        {
            "ioc_value": "sea.badejie69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 15:15:33",
            "last_seen_utc": "2025-09-08 15:08:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585127": [
        {
            "ioc_value": "go.badejie69.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 15:15:32",
            "last_seen_utc": "2025-09-08 15:48:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585130": [
        {
            "ioc_value": "ve.penodoa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 15:08:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585128": [
        {
            "ioc_value": "wa.poxyway.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 14:28:37",
            "last_seen_utc": "2025-09-08 14:47:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1585118": [
        {
            "ioc_value": "top.harekae65.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 12:27:39",
            "last_seen_utc": "2025-09-08 12:28:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1585115": [
        {
            "ioc_value": "868id.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 12:23:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,GhostRedirector",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585116": [
        {
            "ioc_value": "cs01.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 12:23:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,GhostRedirector",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585117": [
        {
            "ioc_value": "881vn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 12:23:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,GhostRedirector",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585114": [
        {
            "ioc_value": "custpub.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-08 12:22:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "landupdate808",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585111": [
        {
            "ioc_value": "jayw8724-39348.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-08 12:21:36",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585110": [
        {
            "ioc_value": "microsoft-graphics.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-08 12:21:18",
            "last_seen_utc": "2025-10-03 09:02:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585109": [
        {
            "ioc_value": "modam3r.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-09-08 12:21:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,netwire",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585107": [
        {
            "ioc_value": "evelynnrank1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-08 12:20:46",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585108": [
        {
            "ioc_value": "uraniumc2.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-08 12:20:46",
            "last_seen_utc": "2025-10-10 11:34:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585101": [
        {
            "ioc_value": "www.sy124.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585102": [
        {
            "ioc_value": "www.uhma.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585103": [
        {
            "ioc_value": "www.usjy.town",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585104": [
        {
            "ioc_value": "www.utomation-tools-78123.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585105": [
        {
            "ioc_value": "www.vd-global.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585106": [
        {
            "ioc_value": "www.yushe.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585087": [
        {
            "ioc_value": "www.otalbalans.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585088": [
        {
            "ioc_value": "www.otculua.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585089": [
        {
            "ioc_value": "www.ou-meme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585090": [
        {
            "ioc_value": "www.ovbns.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585091": [
        {
            "ioc_value": "www.ovesaint.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585092": [
        {
            "ioc_value": "www.p7s5272.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585093": [
        {
            "ioc_value": "www.qyqima0.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585094": [
        {
            "ioc_value": "www.raceora.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585095": [
        {
            "ioc_value": "www.rchitectseo.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585096": [
        {
            "ioc_value": "www.rownmt.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585097": [
        {
            "ioc_value": "www.rumpwif.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585098": [
        {
            "ioc_value": "www.rvkoae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585099": [
        {
            "ioc_value": "www.rygreentechrenewables.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585100": [
        {
            "ioc_value": "www.stanbulcidot.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585074": [
        {
            "ioc_value": "www.loatingdragon.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585075": [
        {
            "ioc_value": "www.loe-consulting.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585076": [
        {
            "ioc_value": "www.lohaadvantage.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585077": [
        {
            "ioc_value": "www.nstructify.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585078": [
        {
            "ioc_value": "www.nviodigitaloficial.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585079": [
        {
            "ioc_value": "www.oastalweddingsandeventsca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585080": [
        {
            "ioc_value": "www.odegashift.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585081": [
        {
            "ioc_value": "www.odhiwaters.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585082": [
        {
            "ioc_value": "www.odydocai.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585083": [
        {
            "ioc_value": "www.om-ezpeug.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585084": [
        {
            "ioc_value": "www.oncrete-companies-near-me.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585085": [
        {
            "ioc_value": "www.onstruction-management-klm.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585086": [
        {
            "ioc_value": "www.osteo-aups.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585059": [
        {
            "ioc_value": "www.efinn.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585060": [
        {
            "ioc_value": "www.ehrrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585061": [
        {
            "ioc_value": "www.eiegrmkzp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585062": [
        {
            "ioc_value": "www.ennisritchie.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585063": [
        {
            "ioc_value": "www.eomines.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585064": [
        {
            "ioc_value": "www.extgenfargo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585065": [
        {
            "ioc_value": "www.gq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585066": [
        {
            "ioc_value": "www.hirtwillle.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585067": [
        {
            "ioc_value": "www.hoenixance.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585068": [
        {
            "ioc_value": "www.hy-is-linzess-dangerous.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585069": [
        {
            "ioc_value": "www.icole484.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585070": [
        {
            "ioc_value": "www.ighllight.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585071": [
        {
            "ioc_value": "www.iolinoddlinkopen.christmas",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585072": [
        {
            "ioc_value": "www.latformliga8etongame.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585073": [
        {
            "ioc_value": "www.lberta-mortgagebrokers.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585046": [
        {
            "ioc_value": "www.ailamericabailbonds.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585047": [
        {
            "ioc_value": "www.aimao42.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585048": [
        {
            "ioc_value": "www.alk7.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585049": [
        {
            "ioc_value": "www.alwaonline.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585050": [
        {
            "ioc_value": "www.angdachui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585051": [
        {
            "ioc_value": "www.aohang9838-2-11.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585052": [
        {
            "ioc_value": "www.artyislandrentals.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585053": [
        {
            "ioc_value": "www.atevideo-call-service-in13.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585054": [
        {
            "ioc_value": "www.bbvps.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585055": [
        {
            "ioc_value": "www.bcxot.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585056": [
        {
            "ioc_value": "www.bwb41c.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585057": [
        {
            "ioc_value": "www.c36669.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585058": [
        {
            "ioc_value": "www.c5421.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585042": [
        {
            "ioc_value": "www.30311.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585043": [
        {
            "ioc_value": "www.568yn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585044": [
        {
            "ioc_value": "www.73jvs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1585045": [
        {
            "ioc_value": "www.8484.town",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-08 12:20:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1584975": [
        {
            "ioc_value": "jfl4kvbv6.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-08 12:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1584053": [
        {
            "ioc_value": "he.harekae65.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 12:14:04",
            "last_seen_utc": "2025-09-08 11:47:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1584943": [
        {
            "ioc_value": "ndlive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-08 12:12:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1584060": [
        {
            "ioc_value": "sicher-de.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-09-08 12:01:57",
            "last_seen_utc": "2025-09-09 04:00:35",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.66.177+sicher-de.click",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1584057": [
        {
            "ioc_value": "days-announce.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-08 12:01:17",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-kkx47shp4s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1584055": [
        {
            "ioc_value": "move-did.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-08 12:01:16",
            "last_seen_utc": "2025-09-13 11:43:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-kn6kravtbw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1584051": [
        {
            "ioc_value": "dasrilkosdirosado.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-09-08 11:37:41",
            "last_seen_utc": "2025-11-18 16:17:06",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,Latrodectus",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1584046": [
        {
            "ioc_value": "to.harekae65.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 11:16:32",
            "last_seen_utc": "2025-09-08 12:47:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1584047": [
        {
            "ioc_value": "cpanel.destroythebrainonline.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-08 11:16:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115168366065583901",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1584045": [
        {
            "ioc_value": "run.bavyzeo47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 10:44:08",
            "last_seen_utc": "2025-09-08 10:28:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1584044": [
        {
            "ioc_value": "us.bavyzeo47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 10:06:52",
            "last_seen_utc": "2025-09-08 10:07:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1584026": [
        {
            "ioc_value": "way.cawyfie51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 09:48:21",
            "last_seen_utc": "2025-09-08 06:46:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1584027": [
        {
            "ioc_value": "it.bavyzeo47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 09:48:21",
            "last_seen_utc": "2025-09-08 07:47:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1584037": [
        {
            "ioc_value": "no.bavyzeo47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 09:48:20",
            "last_seen_utc": "2025-09-08 08:08:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1584041": [
        {
            "ioc_value": "air.bavyzeo47.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 09:48:20",
            "last_seen_utc": "2025-09-08 08:47:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1584025": [
        {
            "ioc_value": "rock-in-rio-statetments-fil3945489pdf.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 06:37:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "phishing",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1583571": [
        {
            "ioc_value": "not-bloom.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-08 06:03:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-bz5cdsdq4x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583570": [
        {
            "ioc_value": "method-attendance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-08 06:02:06",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250908-fefwhsfj9v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583569": [
        {
            "ioc_value": "fun.cawyfie51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:54:59",
            "last_seen_utc": "2025-09-08 05:47:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583402": [
        {
            "ioc_value": "eotoatotlasldkd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 05:16:10",
            "last_seen_utc": "2025-09-17 09:38:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583403": [
        {
            "ioc_value": "oaszasktktaktl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 05:16:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583404": [
        {
            "ioc_value": "soinpharmaceuticals.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 05:16:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583405": [
        {
            "ioc_value": "levonpharma.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 05:16:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583406": [
        {
            "ioc_value": "rst.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:07",
            "last_seen_utc": "2025-09-07 17:25:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583408": [
        {
            "ioc_value": "ncloud.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 05:16:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583412": [
        {
            "ioc_value": "to.pobinei39.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:06",
            "last_seen_utc": "2025-09-07 17:57:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583422": [
        {
            "ioc_value": "csp.jocijyu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583423": [
        {
            "ioc_value": "dtc.jocijyu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583424": [
        {
            "ioc_value": "me.pobinei39.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:05",
            "last_seen_utc": "2025-09-07 18:27:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583427": [
        {
            "ioc_value": "ausral.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 05:16:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583428": [
        {
            "ioc_value": "meditean.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 05:16:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583429": [
        {
            "ioc_value": "windowshost.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 05:16:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1583430": [
        {
            "ioc_value": "ray.pobinei39.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:03",
            "last_seen_utc": "2025-09-07 18:46:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583433": [
        {
            "ioc_value": "go.dihijio22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:03",
            "last_seen_utc": "2025-09-07 20:46:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583517": [
        {
            "ioc_value": "day.sypyguu85.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:02",
            "last_seen_utc": "2025-09-07 23:47:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583435": [
        {
            "ioc_value": "hi.dihijio22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:01",
            "last_seen_utc": "2025-09-07 19:35:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583507": [
        {
            "ioc_value": "sky.dihijio22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:00",
            "last_seen_utc": "2025-09-07 20:07:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583509": [
        {
            "ioc_value": "sea.dihijio22.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:16:00",
            "last_seen_utc": "2025-09-07 21:49:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583535": [
        {
            "ioc_value": "joy.sypyguu85.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:15:59",
            "last_seen_utc": "2025-09-08 02:47:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583537": [
        {
            "ioc_value": "do.cawyfie51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:15:59",
            "last_seen_utc": "2025-09-08 06:07:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583540": [
        {
            "ioc_value": "so.cawyfie51.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-08 05:15:58",
            "last_seen_utc": "2025-09-08 03:47:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583541": [
        {
            "ioc_value": "bms.tld56.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-08 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/129.28.180.115+bms.tld56.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1583539": [
        {
            "ioc_value": "db.vm.masterclasstonewow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-08 03:10:25",
            "last_seen_utc": "2025-09-08 19:10:27",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1583527": [
        {
            "ioc_value": "bs.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 00:02:13",
            "last_seen_utc": "2025-09-08 04:01:15",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+bs.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583528": [
        {
            "ioc_value": "kws1-1.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-08 00:02:13",
            "last_seen_utc": "2025-09-08 04:01:15",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+kws1-1.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583514": [
        {
            "ioc_value": "sno.pubarey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 23:06:12",
            "last_seen_utc": "2025-09-08 12:47:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583513": [
        {
            "ioc_value": "up.sypyguu85.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 23:06:11",
            "last_seen_utc": "2025-09-08 02:06:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583510": [
        {
            "ioc_value": "jl.pubarey.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 21:49:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583500": [
        {
            "ioc_value": "club.pornclubnight.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-07 20:02:15",
            "last_seen_utc": "2025-09-08 04:00:49",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/86.106.85.80+club.pornclubnight.com",
            "tags": "AS9009,C2,censys,Havoc,M247",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583436": [
        {
            "ioc_value": "mra.teziriy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 19:35:53",
            "last_seen_utc": "2025-09-07 20:46:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583431": [
        {
            "ioc_value": "pk.teziriy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 18:46:55",
            "last_seen_utc": "2025-09-07 19:07:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583421": [
        {
            "ioc_value": "sun.pobinei39.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 18:05:53",
            "last_seen_utc": "2025-09-07 18:05:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583419": [
        {
            "ioc_value": "hacker-metline.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-07 18:02:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-tglrfacm8y",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583420": [
        {
            "ioc_value": "draker.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-07 18:02:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-taysescl6s",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583418": [
        {
            "ioc_value": "koko7878.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-07 18:02:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-wf796avvhz",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583416": [
        {
            "ioc_value": "law-notebooks.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-07 18:01:29",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-v1emxadr3z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583417": [
        {
            "ioc_value": "albanakatana-48889.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-07 18:01:29",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-s2h1lsbr8v",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583414": [
        {
            "ioc_value": "omnizplsr-22653.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-07 18:01:10",
            "last_seen_utc": "2025-09-13 11:43:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-wdvahsek8z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583413": [
        {
            "ioc_value": "zom.tyjyxie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 17:57:42",
            "last_seen_utc": "2025-09-07 18:27:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583407": [
        {
            "ioc_value": "hs.tyjyxie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 17:25:52",
            "last_seen_utc": "2025-09-07 17:46:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583397": [
        {
            "ioc_value": "dogcded.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 16:48:19",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1583399": [
        {
            "ioc_value": "mns.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 16:48:18",
            "last_seen_utc": "2025-09-07 16:30:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583400": [
        {
            "ioc_value": "kls.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 16:48:18",
            "last_seen_utc": "2025-09-07 16:34:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583381": [
        {
            "ioc_value": "social-vpdf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-07 16:01:45",
            "last_seen_utc": "2025-11-07 23:00:20",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/164.68.120.30+social-vpdf.com",
            "tags": "AS51167,AsyncRAT,C2,censys,CONTABO,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583371": [
        {
            "ioc_value": "brokencars.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-07 15:34:02",
            "last_seen_utc": "2025-10-25 10:38:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1583372": [
        {
            "ioc_value": "cartdetails.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-07 15:34:00",
            "last_seen_utc": "2025-10-25 10:38:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1583373": [
        {
            "ioc_value": "luxgames.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-07 15:34:00",
            "last_seen_utc": "2025-10-25 10:38:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1583374": [
        {
            "ioc_value": "radioengineering.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-07 15:34:00",
            "last_seen_utc": "2025-10-25 10:38:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "aurastealer",
            "anonymous": "0",
            "reporter": "meowmeow"
        }
    ],
    "1583356": [
        {
            "ioc_value": "uvwh.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 15:05:56",
            "last_seen_utc": "2025-09-07 13:46:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583358": [
        {
            "ioc_value": "xyh.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 15:05:56",
            "last_seen_utc": "2025-09-07 14:06:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583359": [
        {
            "ioc_value": "cdh.lypelya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 15:05:56",
            "last_seen_utc": "2025-09-07 14:27:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583362": [
        {
            "ioc_value": "consnbx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 15:05:55",
            "last_seen_utc": "2025-10-17 21:50:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583363": [
        {
            "ioc_value": "diadtuky.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 15:05:54",
            "last_seen_utc": "2025-10-17 21:50:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583364": [
        {
            "ioc_value": "sirhirssg.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 15:05:53",
            "last_seen_utc": "2025-11-04 13:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583365": [
        {
            "ioc_value": "prebwle.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 15:05:53",
            "last_seen_utc": "2025-11-04 13:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583366": [
        {
            "ioc_value": "rhussois.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 15:05:52",
            "last_seen_utc": "2025-11-04 13:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583367": [
        {
            "ioc_value": "todoexy.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 15:05:52",
            "last_seen_utc": "2025-10-17 21:50:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583368": [
        {
            "ioc_value": "acrislegt.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 15:05:51",
            "last_seen_utc": "2025-11-04 13:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583369": [
        {
            "ioc_value": "averiryvx.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 15:05:51",
            "last_seen_utc": "2025-11-04 13:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583370": [
        {
            "ioc_value": "cerasatvf.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 15:05:51",
            "last_seen_utc": "2025-11-04 13:58:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583360": [
        {
            "ioc_value": "vru.xapomyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 14:27:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583288": [
        {
            "ioc_value": "uhv.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:49",
            "last_seen_utc": "2025-09-07 07:19:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583273": [
        {
            "ioc_value": "ohsp.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:48",
            "last_seen_utc": "2025-09-07 04:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583274": [
        {
            "ioc_value": "rsht.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:48",
            "last_seen_utc": "2025-09-07 05:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583286": [
        {
            "ioc_value": "esf.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:48",
            "last_seen_utc": "2025-09-07 06:49:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583248": [
        {
            "ioc_value": "mnho.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:47",
            "last_seen_utc": "2025-09-07 03:48:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583245": [
        {
            "ioc_value": "chhd.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:45",
            "last_seen_utc": "2025-09-07 02:49:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583246": [
        {
            "ioc_value": "xshy.luwotaa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:45",
            "last_seen_utc": "2025-09-07 02:56:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583242": [
        {
            "ioc_value": "sstu.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:44",
            "last_seen_utc": "2025-09-07 02:41:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583238": [
        {
            "ioc_value": "pqhr.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:43",
            "last_seen_utc": "2025-09-07 02:11:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583240": [
        {
            "ioc_value": "ehgf.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:43",
            "last_seen_utc": "2025-09-07 02:16:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583094": [
        {
            "ioc_value": "khsl.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:42",
            "last_seen_utc": "2025-09-06 23:47:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583090": [
        {
            "ioc_value": "hex.namenyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:41",
            "last_seen_utc": "2025-09-06 23:19:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583092": [
        {
            "ioc_value": "asfb.kixyzoo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:41",
            "last_seen_utc": "2025-09-06 23:25:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583082": [
        {
            "ioc_value": "saj.namenyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:40",
            "last_seen_utc": "2025-09-06 22:11:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583085": [
        {
            "ioc_value": "dru.namenyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:40",
            "last_seen_utc": "2025-09-06 22:39:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583078": [
        {
            "ioc_value": "cq.xijoxou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:39",
            "last_seen_utc": "2025-09-06 21:41:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583076": [
        {
            "ioc_value": "nzi.xijoxou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:38",
            "last_seen_utc": "2025-09-06 21:33:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583080": [
        {
            "ioc_value": "vl.namenyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:38",
            "last_seen_utc": "2025-09-06 22:23:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583073": [
        {
            "ioc_value": "kro.xijoxou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583074": [
        {
            "ioc_value": "ux.xijoxou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:37",
            "last_seen_utc": "2025-09-06 21:23:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583066": [
        {
            "ioc_value": "pqt.kujywii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:36",
            "last_seen_utc": "2025-09-06 20:49:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583070": [
        {
            "ioc_value": "hn.kujywii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:36",
            "last_seen_utc": "2025-09-06 20:59:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583071": [
        {
            "ioc_value": "fj.xijoxou.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:36",
            "last_seen_utc": "2025-09-06 21:18:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582862": [
        {
            "ioc_value": "yc.kujywii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:35",
            "last_seen_utc": "2025-09-06 19:47:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582858": [
        {
            "ioc_value": "wa.kujywii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:34",
            "last_seen_utc": "2025-09-06 18:43:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582860": [
        {
            "ioc_value": "bzl.kujywii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:34",
            "last_seen_utc": "2025-09-06 19:19:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582848": [
        {
            "ioc_value": "vcn.pylohao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:33",
            "last_seen_utc": "2025-09-06 18:14:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582856": [
        {
            "ioc_value": "rk.pylohao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:33",
            "last_seen_utc": "2025-09-06 18:38:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582816": [
        {
            "ioc_value": "qd.pylohao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:31",
            "last_seen_utc": "2025-09-06 16:17:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582819": [
        {
            "ioc_value": "zmi.pylohao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:30",
            "last_seen_utc": "2025-09-06 16:49:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582831": [
        {
            "ioc_value": "lt.pylohao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:30",
            "last_seen_utc": "2025-09-06 17:47:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582833": [
        {
            "ioc_value": "cobyrose.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokeloader",
            "malware_alias": "Dofoil,Sharik,Smoke,Smoke Loader",
            "malware_printable": "SmokeLoader",
            "first_seen_utc": "2025-09-07 13:12:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/tag/cobyrose-com/",
            "tags": "SmokeLoader",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1583289": [
        {
            "ioc_value": "ghsi.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:26",
            "last_seen_utc": "2025-09-07 07:48:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583296": [
        {
            "ioc_value": "translate.googleegah.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-07 13:12:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "chromesetup,rat,silverfox",
            "anonymous": "0",
            "reporter": "dejavu"
        }
    ],
    "1583297": [
        {
            "ioc_value": "translate.googleegaz.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-07 13:12:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "chromesetup,rat,silverfox",
            "anonymous": "0",
            "reporter": "dejavu"
        }
    ],
    "1583298": [
        {
            "ioc_value": "appb-chrome.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-07 13:12:25",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "rat,silverfox",
            "anonymous": "0",
            "reporter": "dejavu"
        }
    ],
    "1583299": [
        {
            "ioc_value": "googlechrome-ww.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-07 13:12:24",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "rat,silverfox",
            "anonymous": "0",
            "reporter": "dejavu"
        }
    ],
    "1583308": [
        {
            "ioc_value": "jhk.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:24",
            "last_seen_utc": "2025-09-07 09:48:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583310": [
        {
            "ioc_value": "wsxy.kufapoi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:23",
            "last_seen_utc": "2025-09-07 10:05:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583312": [
        {
            "ioc_value": "stamrbyb.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 13:12:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583311": [
        {
            "ioc_value": "lmh.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:22",
            "last_seen_utc": "2025-09-07 10:47:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583313": [
        {
            "ioc_value": "tetrwoo.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 13:12:21",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583314": [
        {
            "ioc_value": "figueqhk.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 13:12:21",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583315": [
        {
            "ioc_value": "hffiahz.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 13:12:21",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583316": [
        {
            "ioc_value": "plataukz.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 13:12:20",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583317": [
        {
            "ioc_value": "sprimvd.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 13:12:20",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583318": [
        {
            "ioc_value": "renohhde.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 13:12:20",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583319": [
        {
            "ioc_value": "lithfzx.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 13:12:19",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583320": [
        {
            "ioc_value": "titlexy.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-07 13:12:19",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1583323": [
        {
            "ioc_value": "abh.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:19",
            "last_seen_utc": "2025-09-07 11:46:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583351": [
        {
            "ioc_value": "sth.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 13:12:17",
            "last_seen_utc": "2025-09-07 12:45:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1583350": [
        {
            "ioc_value": "pqr.rocixaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 12:26:10",
            "last_seen_utc": "2025-09-07 12:26:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583327": [
        {
            "ioc_value": "fireblazecorrect.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-07 12:01:10",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-hwwdmsxjt2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583328": [
        {
            "ioc_value": "maintainthefeex.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-07 12:01:10",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-hwwdmsxjt2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583329": [
        {
            "ioc_value": "masqingtestformat.gleeze.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-07 12:01:10",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-hwwdmsxjt2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583326": [
        {
            "ioc_value": "bank-danny.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-07 12:01:09",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-lfazjsxr15",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583324": [
        {
            "ioc_value": "qn.xapomyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 11:46:49",
            "last_seen_utc": "2025-09-07 14:06:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583322": [
        {
            "ioc_value": "stc.s3.masterclasstonewow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-07 11:10:27",
            "last_seen_utc": "2025-09-08 02:10:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1583309": [
        {
            "ioc_value": "tz.vikidii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 09:48:11",
            "last_seen_utc": "2025-09-07 10:47:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583284": [
        {
            "ioc_value": "a6.nbdsnb2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.fatal_rat",
            "malware_alias": "Sainbox RAT",
            "malware_printable": "FatalRat",
            "first_seen_utc": "2025-09-07 06:04:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-d7w24abp2w",
            "tags": "C2,domain,fatalrat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583280": [
        {
            "ioc_value": "anonam39-21749.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-07 06:02:00",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-f32swsdn91",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583282": [
        {
            "ioc_value": "electronics-webmaster.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-07 06:02:00",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-b3zajsvxgx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583279": [
        {
            "ioc_value": "www.gondeen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-07 06:01:15",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-c9nytstps2",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583275": [
        {
            "ioc_value": "cx3fbungd.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-07 06:01:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-fn8b5adl81",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583277": [
        {
            "ioc_value": "box-dealer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-07 06:01:08",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-dqmgbswthx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583278": [
        {
            "ioc_value": "hit-calculation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-07 06:01:08",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250907-b8mhyaak9t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1583256": [
        {
            "ioc_value": "n8n-video-demo.keerok.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-07 04:01:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.128.203.163+n8n-video-demo.keerok.tech",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1583252": [
        {
            "ioc_value": "www.zcuke.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-07 04:00:12",
            "last_seen_utc": "2025-09-07 04:00:13",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.136.179+www.zcuke.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1583251": [
        {
            "ioc_value": "transfiles.tld56.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-07 04:00:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/129.28.180.115+transfiles.tld56.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1583250": [
        {
            "ioc_value": "bmsmobile.tld56.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-07 04:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/129.28.180.115+bmsmobile.tld56.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1583249": [
        {
            "ioc_value": "manage.tld56.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-07 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/129.28.180.115+manage.tld56.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1583247": [
        {
            "ioc_value": "dr.hulenao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 02:56:56",
            "last_seen_utc": "2025-09-07 07:48:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583243": [
        {
            "ioc_value": "gri.cyzukae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 02:41:48",
            "last_seen_utc": "2025-09-07 02:49:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583241": [
        {
            "ioc_value": "vm.cyzukae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 02:16:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583239": [
        {
            "ioc_value": "kal.biryquo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-07 02:11:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583095": [
        {
            "ioc_value": "vra.fokymeu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 23:47:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583089": [
        {
            "ioc_value": "img.s3.masterclasstonewow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-06 23:10:32",
            "last_seen_utc": "2025-09-07 10:10:35",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1583086": [
        {
            "ioc_value": "dk.fokymeu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 22:39:06",
            "last_seen_utc": "2025-09-06 23:25:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583083": [
        {
            "ioc_value": "peu.dygyliy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 22:11:21",
            "last_seen_utc": "2025-09-06 22:23:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583079": [
        {
            "ioc_value": "ms.dygyliy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 21:41:53",
            "last_seen_utc": "2025-09-06 21:57:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583077": [
        {
            "ioc_value": "klo.xevenyu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 21:33:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583075": [
        {
            "ioc_value": "vz.xevenyu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 21:23:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583072": [
        {
            "ioc_value": "laj.tigelie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 21:18:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1583069": [
        {
            "ioc_value": "rc.tigelie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 20:49:25",
            "last_seen_utc": "2025-09-06 20:59:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582859": [
        {
            "ioc_value": "tme.hicymui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 18:43:32",
            "last_seen_utc": "2025-09-06 19:47:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582857": [
        {
            "ioc_value": "qv.hicymui.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 18:38:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582849": [
        {
            "ioc_value": "tku.rowe6yi5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 18:14:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582847": [
        {
            "ioc_value": "whatdoyouwant.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-06 18:03:19",
            "last_seen_utc": "2025-09-24 11:56:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-qv4bvsep91",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582846": [
        {
            "ioc_value": "sumsank.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-09-06 18:03:18",
            "last_seen_utc": "2025-09-24 11:56:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-v5kpqacj81",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582845": [
        {
            "ioc_value": "dbcoo.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-06 18:02:24",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-qbxpzatkv7",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582844": [
        {
            "ioc_value": "rawrxdd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-06 18:02:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-sw8dbahm8s",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582840": [
        {
            "ioc_value": "report-prepare.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-06 18:01:06",
            "last_seen_utc": "2025-09-13 11:43:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-sg6k6sx1at",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582841": [
        {
            "ioc_value": "thursday-mere.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-06 18:01:06",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-r28qlagn3z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582838": [
        {
            "ioc_value": "inc-glasgow.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-06 18:01:05",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-vd6swaxmw4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582839": [
        {
            "ioc_value": "reader-engaging.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-06 18:01:05",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-vbexdaxlz6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582832": [
        {
            "ioc_value": "mgi.kelu0yo5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 17:47:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582815": [
        {
            "ioc_value": "bolt.test.silvan.earth",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-09-06 16:02:02",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": "https://search.censys.io/hosts/45.135.58.232+bolt.test.silvan.earth",
            "tags": "Amadey,AS206176,C2,censys,GREENEDGE,Payloads",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582813": [
        {
            "ioc_value": "ec2-3-110-210-126.ap-south-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-06 16:01:49",
            "last_seen_utc": "2025-09-07 04:01:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.110.210.126+ec2-3-110-210-126.ap-south-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582800": [
        {
            "ioc_value": "xg.vihuqau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 15:44:59",
            "last_seen_utc": "2025-09-06 14:26:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582802": [
        {
            "ioc_value": "pwa.vihuqau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 15:44:59",
            "last_seen_utc": "2025-09-06 14:38:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582805": [
        {
            "ioc_value": "bn.vihuqau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 15:44:59",
            "last_seen_utc": "2025-09-06 15:22:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582806": [
        {
            "ioc_value": "zu.kelu0yo5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 15:22:36",
            "last_seen_utc": "2025-09-06 16:49:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582803": [
        {
            "ioc_value": "hqo.pewi2ee5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 14:38:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582801": [
        {
            "ioc_value": "va.pewi2ee5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 14:26:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582792": [
        {
            "ioc_value": "starshipcrown.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-09-06 13:44:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1582795": [
        {
            "ioc_value": "zi.vihuqau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 13:44:49",
            "last_seen_utc": "2025-09-06 13:17:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582796": [
        {
            "ioc_value": "mre.vihuqau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 13:44:49",
            "last_seen_utc": "2025-09-06 13:27:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582797": [
        {
            "ioc_value": "pqe.nyho0io9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 13:27:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582769": [
        {
            "ioc_value": "hmno.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 13:03:56",
            "last_seen_utc": "2025-09-06 11:49:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582786": [
        {
            "ioc_value": "dskl.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 13:03:55",
            "last_seen_utc": "2025-09-06 12:18:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582788": [
        {
            "ioc_value": "srst.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 13:03:55",
            "last_seen_utc": "2025-09-06 12:47:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582775": [
        {
            "ioc_value": "rem0925.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-06 12:01:12",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-hsr7taal7t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582772": [
        {
            "ioc_value": "www.ctsapa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-06 12:01:11",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-j9ll2azrs6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582773": [
        {
            "ioc_value": "rem31rem.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-06 12:01:11",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-hvz1fasth1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582774": [
        {
            "ioc_value": "2septiembrerem.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-06 12:01:11",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-hvz1fasthz",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582770": [
        {
            "ioc_value": "others-beastality.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-06 12:01:03",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-mwv54ack5y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582771": [
        {
            "ioc_value": "dcrat0106.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-06 12:01:03",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-htde2sal7w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582739": [
        {
            "ioc_value": "alm.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 11:29:39",
            "last_seen_utc": "2025-09-06 07:49:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582755": [
        {
            "ioc_value": "jhab.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 11:29:38",
            "last_seen_utc": "2025-09-06 08:19:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582759": [
        {
            "ioc_value": "hpqr.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 11:29:38",
            "last_seen_utc": "2025-09-06 08:48:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582761": [
        {
            "ioc_value": "dhst.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 11:29:38",
            "last_seen_utc": "2025-09-06 09:19:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582763": [
        {
            "ioc_value": "suvw.qapyfyi0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 11:29:37",
            "last_seen_utc": "2025-09-06 09:47:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582765": [
        {
            "ioc_value": "hdxy.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 11:29:37",
            "last_seen_utc": "2025-09-06 10:18:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582768": [
        {
            "ioc_value": "hhcd.somipaa9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 11:29:37",
            "last_seen_utc": "2025-09-06 11:18:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582766": [
        {
            "ioc_value": "ks.nyho0io9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 10:18:34",
            "last_seen_utc": "2025-09-06 13:17:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582738": [
        {
            "ioc_value": "awxy.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 07:28:51",
            "last_seen_utc": "2025-09-06 07:18:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582735": [
        {
            "ioc_value": "ajk.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:57:20",
            "last_seen_utc": "2025-09-06 06:48:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582733": [
        {
            "ioc_value": "vwsol.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-06 06:37:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582732": [
        {
            "ioc_value": "crtjpanel.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-06 06:22:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582731": [
        {
            "ioc_value": "talkpump.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-06 06:22:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582730": [
        {
            "ioc_value": "sghi.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:19:54",
            "last_seen_utc": "2025-09-06 06:18:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582300": [
        {
            "ioc_value": "uvw.xekifye8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:56",
            "last_seen_utc": "2025-09-05 15:58:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582312": [
        {
            "ioc_value": "st.xekifye8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:56",
            "last_seen_utc": "2025-09-05 16:32:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582313": [
        {
            "ioc_value": "pqr.xekifye8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:55",
            "last_seen_utc": "2025-09-05 16:48:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582315": [
        {
            "ioc_value": "ab.xekifye8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:55",
            "last_seen_utc": "2025-09-05 17:18:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582332": [
        {
            "ioc_value": "wx.zicedoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:54",
            "last_seen_utc": "2025-09-05 19:52:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582330": [
        {
            "ioc_value": "lm.xekifye8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:53",
            "last_seen_utc": "2025-09-05 18:20:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582334": [
        {
            "ioc_value": "pik.zicedoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:53",
            "last_seen_utc": "2025-09-05 20:00:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582360": [
        {
            "ioc_value": "ghi.zicedoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:52",
            "last_seen_utc": "2025-09-05 20:20:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582361": [
        {
            "ioc_value": "uv.zicedoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:52",
            "last_seen_utc": "2025-09-05 20:30:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582367": [
        {
            "ioc_value": "ef.zicedoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:52",
            "last_seen_utc": "2025-09-05 20:48:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582372": [
        {
            "ioc_value": "op.fapigya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:51",
            "last_seen_utc": "2025-09-05 21:33:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582370": [
        {
            "ioc_value": "rst.fapigya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:50",
            "last_seen_utc": "2025-09-05 21:12:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582375": [
        {
            "ioc_value": "xyz.fapigya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:50",
            "last_seen_utc": "2025-09-05 21:50:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582377": [
        {
            "ioc_value": "kl.fapigya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:50",
            "last_seen_utc": "2025-09-05 21:55:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582379": [
        {
            "ioc_value": "cd.fapigya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:48",
            "last_seen_utc": "2025-09-05 21:59:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582381": [
        {
            "ioc_value": "stu.pihuvio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:48",
            "last_seen_utc": "2025-09-05 22:18:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582384": [
        {
            "ioc_value": "pqr.pihuvio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:48",
            "last_seen_utc": "2025-09-05 22:22:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582598": [
        {
            "ioc_value": "xy.pihuvio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:48",
            "last_seen_utc": "2025-09-05 22:51:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582610": [
        {
            "ioc_value": "ab.pihuvio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:47",
            "last_seen_utc": "2025-09-05 23:11:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582612": [
        {
            "ioc_value": "sab.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:47",
            "last_seen_utc": "2025-09-05 23:43:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582634": [
        {
            "ioc_value": "gxy.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:47",
            "last_seen_utc": "2025-09-06 00:06:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582635": [
        {
            "ioc_value": "fpqr.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:46",
            "last_seen_utc": "2025-09-06 00:19:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582637": [
        {
            "ioc_value": "hmn.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:46",
            "last_seen_utc": "2025-09-06 00:23:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582638": [
        {
            "ioc_value": "gstu.voxuzeo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:46",
            "last_seen_utc": "2025-09-06 00:49:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582640": [
        {
            "ioc_value": "dcd.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:46",
            "last_seen_utc": "2025-09-06 01:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582650": [
        {
            "ioc_value": "gef.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:45",
            "last_seen_utc": "2025-09-06 03:48:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582642": [
        {
            "ioc_value": "hkl.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:44",
            "last_seen_utc": "2025-09-06 01:47:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582645": [
        {
            "ioc_value": "fop.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:44",
            "last_seen_utc": "2025-09-06 02:18:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582643": [
        {
            "ioc_value": "sxyz.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:43",
            "last_seen_utc": "2025-09-06 01:54:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582647": [
        {
            "ioc_value": "grst.sumukye2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:43",
            "last_seen_utc": "2025-09-06 02:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582639": [
        {
            "ioc_value": "asoworld.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-06 06:04:38",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1582716": [
        {
            "ioc_value": "suv.vekoloe8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 06:04:30",
            "last_seen_utc": "2025-09-06 05:48:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582717": [
        {
            "ioc_value": "aiopal.camdvr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-06 06:01:01",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-e27r3sylw6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582718": [
        {
            "ioc_value": "plan-fine.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-06 06:01:01",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250906-e47j4a1th1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582658": [
        {
            "ioc_value": "alltimehighinthesky.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-06 04:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/52.51.44.169+alltimehighinthesky.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1582651": [
        {
            "ioc_value": "tms.tld56.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-06 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/129.28.180.115+tms.tld56.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1582644": [
        {
            "ioc_value": "mx.puva6ey2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 01:54:37",
            "last_seen_utc": "2025-09-06 09:47:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582641": [
        {
            "ioc_value": "yp.rijo6oe1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 01:18:18",
            "last_seen_utc": "2025-09-06 01:47:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582636": [
        {
            "ioc_value": "rka.firu6ui8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-06 00:19:04",
            "last_seen_utc": "2025-09-06 00:49:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582630": [
        {
            "ioc_value": "kws1.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-06 00:02:02",
            "last_seen_utc": "2025-09-06 04:01:12",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+kws1.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582613": [
        {
            "ioc_value": "ng.firu6ui8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 23:43:51",
            "last_seen_utc": "2025-09-06 00:06:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582609": [
        {
            "ioc_value": "bwa.mize0ao1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 22:51:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582385": [
        {
            "ioc_value": "ck.mize0ao1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 22:22:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582382": [
        {
            "ioc_value": "zmu.gily1yo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 22:18:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582376": [
        {
            "ioc_value": "lj.gily1yo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 21:50:03",
            "last_seen_utc": "2025-09-05 21:59:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582373": [
        {
            "ioc_value": "tpr.hati3ea0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 21:33:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582371": [
        {
            "ioc_value": "cv.wolyviy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 21:12:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582362": [
        {
            "ioc_value": "op.radinau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 20:30:07",
            "last_seen_utc": "2025-09-05 20:48:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582335": [
        {
            "ioc_value": "cv.radinau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 20:00:27",
            "last_seen_utc": "2025-09-05 20:20:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582333": [
        {
            "ioc_value": "op.koxulaa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 19:52:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582331": [
        {
            "ioc_value": "cv.koxulaa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 18:20:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582328": [
        {
            "ioc_value": "ai.gw.hypersend.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-05 18:10:36",
            "last_seen_utc": "2025-09-06 09:10:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582323": [
        {
            "ioc_value": "wajig60179-23764.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-05 18:01:16",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-v9cjxafm7y",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582320": [
        {
            "ioc_value": "socmer.airdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-05 18:01:06",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-swxa2syrv2",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582321": [
        {
            "ioc_value": "sdniduhiudvudbucbudb.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-05 18:01:06",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-r5qn7ack4x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582322": [
        {
            "ioc_value": "greatzimebube.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-05 18:01:06",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-q4rdnaz1cv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582319": [
        {
            "ioc_value": "island-chubby.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-05 18:00:59",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-szekeadl61",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582318": [
        {
            "ioc_value": "usa-chick.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-05 18:00:58",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-vpll3ser4v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582310": [
        {
            "ioc_value": "login.mfacheck.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.mimikatz",
            "malware_alias": null,
            "malware_printable": "MimiKatz",
            "first_seen_utc": "2025-09-05 16:02:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/77.170.165.141+login.mfacheck.com",
            "tags": "AS1136,C2,censys,hacktool,KPN,Mimikatz,open-dir",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582301": [
        {
            "ioc_value": "op.pysywao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 15:58:16",
            "last_seen_utc": "2025-09-05 17:18:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582290": [
        {
            "ioc_value": "xy.racypue5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 15:41:56",
            "last_seen_utc": "2025-09-05 15:09:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582296": [
        {
            "ioc_value": "swimlibrary.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-05 15:28:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582297": [
        {
            "ioc_value": "shadesquirrel.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-05 15:28:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582295": [
        {
            "ioc_value": "cdn.zhuqiy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-05 15:23:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "CobaltStrike",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582291": [
        {
            "ioc_value": "ebube.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-05 15:10:39",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/995e1cb1224ed52a2fa231159abc0bdeb8de8dedd5208666f6434df87ea156bb/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582210": [
        {
            "ioc_value": "xy.puwalyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:43",
            "last_seen_utc": "2025-09-05 07:18:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582206": [
        {
            "ioc_value": "mno.puwalyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:42",
            "last_seen_utc": "2025-09-05 06:48:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582214": [
        {
            "ioc_value": "cd.puwalyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:42",
            "last_seen_utc": "2025-09-05 07:48:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582229": [
        {
            "ioc_value": "stu.qawimii0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:41",
            "last_seen_utc": "2025-09-05 08:18:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582238": [
        {
            "ioc_value": "ef.qawimii0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:41",
            "last_seen_utc": "2025-09-05 09:48:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582241": [
        {
            "ioc_value": "pqr.qawimii0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:40",
            "last_seen_utc": "2025-09-05 10:47:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582242": [
        {
            "ioc_value": "choutek.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-05 14:49:40",
            "last_seen_utc": "2025-09-08 14:10:41",
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1582280": [
        {
            "ioc_value": "email.directoryindustry.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-05 14:49:39",
            "last_seen_utc": "2025-09-05 14:47:53",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115151864262207800",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1582245": [
        {
            "ioc_value": "kl.qawimii0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:37",
            "last_seen_utc": "2025-09-05 11:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582272": [
        {
            "ioc_value": "rst.racypue5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:37",
            "last_seen_utc": "2025-09-05 12:47:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582283": [
        {
            "ioc_value": "kl.racypue5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:35",
            "last_seen_utc": "2025-09-05 13:19:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582287": [
        {
            "ioc_value": "mno.racypue5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:34",
            "last_seen_utc": "2025-09-05 13:47:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582288": [
        {
            "ioc_value": "cd.racypue5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:49:34",
            "last_seen_utc": "2025-09-05 14:48:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582289": [
        {
            "ioc_value": "cv.pysywao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 14:48:16",
            "last_seen_utc": "2025-09-05 15:09:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582284": [
        {
            "ioc_value": "cocopserver.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-05 13:40:36",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/66419cb32e2cfc269563e09e97ad3a6536dedeff355058f0acc2add613978757/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582279": [
        {
            "ioc_value": "io.gw.hypersend.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-05 13:10:28",
            "last_seen_utc": "2025-09-06 22:10:52",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582273": [
        {
            "ioc_value": "em8li.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-05 12:50:48",
            "last_seen_utc": "2025-10-09 13:51:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582271": [
        {
            "ioc_value": "ab.qawimii0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 12:17:16",
            "last_seen_utc": "2025-09-05 12:17:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582265": [
        {
            "ioc_value": "names-accident.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-05 12:03:19",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-jnqc4axsfv",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582260": [
        {
            "ioc_value": "daten-sicher.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-09-05 12:01:41",
            "last_seen_utc": "2025-09-06 04:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.66.114+daten-sicher.click",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582257": [
        {
            "ioc_value": "othmanesp.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-05 12:01:18",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-j3db3stpx3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582252": [
        {
            "ioc_value": "www.dlvatecsl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-05 12:01:06",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-mpfrtsytdx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582250": [
        {
            "ioc_value": "choose-pixel.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-05 12:00:59",
            "last_seen_utc": "2025-09-13 11:43:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-jm914sel6z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582251": [
        {
            "ioc_value": "memory-smilies.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-05 12:00:59",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-jalgzsej51",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582248": [
        {
            "ioc_value": "petro4prime.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-05 12:00:58",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-m1cjjsgj8w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582249": [
        {
            "ioc_value": "style-tropical.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-05 12:00:58",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-jqt43axsht",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582224": [
        {
            "ioc_value": "www.miconestaffing.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-05 08:01:38",
            "last_seen_utc": "2025-09-06 04:00:41",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.61.149.99+www.miconestaffing.us",
            "tags": "AS14956,C2,censys,Havoc,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582203": [
        {
            "ioc_value": "op.puwalyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:19:11",
            "last_seen_utc": "2025-09-05 06:18:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581908": [
        {
            "ioc_value": "pqr.cofepoi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:28",
            "last_seen_utc": "2025-09-04 22:49:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582138": [
        {
            "ioc_value": "ab.cofepoi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:28",
            "last_seen_utc": "2025-09-05 00:27:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582140": [
        {
            "ioc_value": "lm.cofepoi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:27",
            "last_seen_utc": "2025-09-05 00:37:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582141": [
        {
            "ioc_value": "wxy.ritenoo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:27",
            "last_seen_utc": "2025-09-05 00:40:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582146": [
        {
            "ioc_value": "ghi.ritenoo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:26",
            "last_seen_utc": "2025-09-05 03:48:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582142": [
        {
            "ioc_value": "jk.ritenoo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:25",
            "last_seen_utc": "2025-09-05 02:45:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582185": [
        {
            "ioc_value": "ef.ritenoo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:24",
            "last_seen_utc": "2025-09-05 04:48:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1582188": [
        {
            "ioc_value": "rst.puwalyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:24",
            "last_seen_utc": "2025-09-05 05:19:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581791": [
        {
            "ioc_value": "lm.hihijie3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581793": [
        {
            "ioc_value": "st.hihijie3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:21",
            "last_seen_utc": "2025-09-04 18:48:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581795": [
        {
            "ioc_value": "uvw.hihijie3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:20",
            "last_seen_utc": "2025-09-04 18:58:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581902": [
        {
            "ioc_value": "uvw.cofepoi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:18",
            "last_seen_utc": "2025-09-04 21:18:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581905": [
        {
            "ioc_value": "st.cofepoi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:18",
            "last_seen_utc": "2025-09-04 22:18:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581904": [
        {
            "ioc_value": "trade-view-hub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-05 06:12:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1581797": [
        {
            "ioc_value": "xy.winenoy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:12",
            "last_seen_utc": "2025-09-04 19:18:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581800": [
        {
            "ioc_value": "kl.winenoy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 06:12:12",
            "last_seen_utc": "2025-09-04 19:47:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581821": [
        {
            "ioc_value": "simplwordwide.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-05 06:12:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "smartapesg",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1582194": [
        {
            "ioc_value": "Iusefatalbtw-50944.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-05 06:01:20",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-cemghsaj61",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582193": [
        {
            "ioc_value": "loritoexpresss.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-05 06:01:14",
            "last_seen_utc": "2025-09-13 11:43:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-dzkn4abl4v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582191": [
        {
            "ioc_value": "infopoint.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-05 06:01:00",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-az85xahl21",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582192": [
        {
            "ioc_value": "prove.mine.nu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-05 06:01:00",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-az85xahl21",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582190": [
        {
            "ioc_value": "ablelifepurp.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-05 06:00:59",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-c6nhws1lx4",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582189": [
        {
            "ioc_value": "friends-martial.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-05 06:00:53",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250905-gjf8hswvcy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582186": [
        {
            "ioc_value": "cv.bojyqiy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 04:48:16",
            "last_seen_utc": "2025-09-05 13:47:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582184": [
        {
            "ioc_value": "uv.ritenoo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 04:17:15",
            "last_seen_utc": "2025-09-05 04:17:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582152": [
        {
            "ioc_value": "ip133.ip-146-59-246.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-05 04:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/146.59.246.133+ip133.ip-146-59-246.eu",
            "tags": "AS16276,C2,censys,Mythic,OVH",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1582145": [
        {
            "ioc_value": "sx.11.duitmasyuk.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-05 03:10:28",
            "last_seen_utc": "2025-09-05 12:11:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1582143": [
        {
            "ioc_value": "cv.bizahao.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 02:45:28",
            "last_seen_utc": "2025-09-05 04:17:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582139": [
        {
            "ioc_value": "cv.jikeqye.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-05 00:27:43",
            "last_seen_utc": "2025-09-05 00:40:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1582134": [
        {
            "ioc_value": "widgets.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-05 00:01:55",
            "last_seen_utc": "2025-09-05 04:01:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+widgets.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1582135": [
        {
            "ioc_value": "pogoda.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-05 00:01:55",
            "last_seen_utc": "2025-09-05 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+pogoda.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581906": [
        {
            "ioc_value": "cv.kogudoo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 22:18:21",
            "last_seen_utc": "2025-09-04 22:49:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581901": [
        {
            "ioc_value": "ho.11.duitmasyuk.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-04 21:10:25",
            "last_seen_utc": "2025-09-05 02:11:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581818": [
        {
            "ioc_value": "rst.winenoy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 20:47:56",
            "last_seen_utc": "2025-09-04 20:48:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581819": [
        {
            "ioc_value": "cv.bezyweo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 20:47:56",
            "last_seen_utc": "2025-09-04 21:18:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581809": [
        {
            "ioc_value": "limg.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-04 20:01:51",
            "last_seen_utc": "2025-09-05 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+limg.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581801": [
        {
            "ioc_value": "wtg.xajaqoy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 19:47:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581798": [
        {
            "ioc_value": "vd.kygupyy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 19:18:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581790": [
        {
            "ioc_value": "electrico.co.zw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lokipws",
            "malware_alias": "Burkina,Loki,LokiBot,LokiPWS",
            "malware_printable": "Loki Password Stealer (PWS)",
            "first_seen_utc": "2025-09-04 18:36:02",
            "last_seen_utc": "2025-10-03 23:48:04",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=electrico.co.zw",
            "tags": "Lokibot,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581783": [
        {
            "ioc_value": "logical-whose-niagara-durable.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-04 18:25:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1581784": [
        {
            "ioc_value": "geology-gilbert-domain-thesaurus.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-04 18:25:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1581785": [
        {
            "ioc_value": "ferry-addressed-adams-vice.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-04 18:25:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1581786": [
        {
            "ioc_value": "valentine-platform-wood-examination.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-04 18:25:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1581787": [
        {
            "ioc_value": "florence-hrs-savage-serial.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-04 18:25:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1581788": [
        {
            "ioc_value": "considering-infringement-subject-myself.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-04 18:25:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1581789": [
        {
            "ioc_value": "ghi.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 18:15:13",
            "last_seen_utc": "2025-09-04 18:21:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581778": [
        {
            "ioc_value": "freeben.myddns.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-04 18:01:18",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-smg5rshp9z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581773": [
        {
            "ioc_value": "idklo-35627.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 18:00:55",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-s6hweaaj5z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581774": [
        {
            "ioc_value": "compare-captured.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 18:00:55",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-r9qvrahm8w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581775": [
        {
            "ioc_value": "bonislawska.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 18:00:55",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-rwdchagr6v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581770": [
        {
            "ioc_value": "oof.servebeer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 18:00:54",
            "last_seen_utc": "2025-09-13 11:43:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-vewz3avkz4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581771": [
        {
            "ioc_value": "idklolmmLMQMMQ-54828.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 18:00:54",
            "last_seen_utc": "2025-09-13 11:43:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-t8besaan6t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581772": [
        {
            "ioc_value": "corinyo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 18:00:54",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-s9vpdaaj91",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581769": [
        {
            "ioc_value": "svp.lecyfoe.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 17:49:21",
            "last_seen_utc": "2025-09-04 18:58:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581768": [
        {
            "ioc_value": "uv.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 17:49:20",
            "last_seen_utc": "2025-09-04 18:10:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581757": [
        {
            "ioc_value": "mn.lysyrei3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 17:27:41",
            "last_seen_utc": "2025-09-04 15:40:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581758": [
        {
            "ioc_value": "vsa.lalequo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 15:40:31",
            "last_seen_utc": "2025-09-04 15:53:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581754": [
        {
            "ioc_value": "xy.lysyrei3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 15:09:12",
            "last_seen_utc": "2025-09-04 14:48:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581746": [
        {
            "ioc_value": "ab.lysyrei3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 14:25:25",
            "last_seen_utc": "2025-09-04 14:18:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581751": [
        {
            "ioc_value": "dwssa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-04 14:20:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnct",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581747": [
        {
            "ioc_value": "scr.shirt.rip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-04 14:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581748": [
        {
            "ioc_value": "access.shirt.rip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-04 14:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581749": [
        {
            "ioc_value": "abku.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-04 14:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581750": [
        {
            "ioc_value": "rzqlive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-04 14:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581745": [
        {
            "ioc_value": "txlcare.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-04 14:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581744": [
        {
            "ioc_value": "woriarcraft.4cloud.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-04 13:45:55",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/5ca08e15da8921ea58d50aa7e9541bd510fa2993ba8387e45f4eaaf4e8c055a7/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581737": [
        {
            "ioc_value": "mb.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 13:40:11",
            "last_seen_utc": "2025-09-04 12:17:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581738": [
        {
            "ioc_value": "iw.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 13:40:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581740": [
        {
            "ioc_value": "images.indianadforum.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-04 13:40:11",
            "last_seen_utc": "2025-09-04 13:15:53",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115146197699636973",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1581743": [
        {
            "ioc_value": "tl.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 13:40:10",
            "last_seen_utc": "2025-09-04 13:18:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581719": [
        {
            "ioc_value": "lethals.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-04 12:01:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-m6zk9sdr9t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581714": [
        {
            "ioc_value": "centralserver.theworkpc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 12:00:53",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-kggm2syqv7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581716": [
        {
            "ioc_value": "cyb3rw0lf.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 12:00:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-hm1l1abm3t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581712": [
        {
            "ioc_value": "through-nearest.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 12:00:52",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-l3nh6atsdv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581681": [
        {
            "ioc_value": "nh.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 11:50:58",
            "last_seen_utc": "2025-09-04 09:47:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581706": [
        {
            "ioc_value": "doll.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 11:50:57",
            "last_seen_utc": "2025-09-04 11:17:26",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581705": [
        {
            "ioc_value": "razer.chatology.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-04 11:10:27",
            "last_seen_utc": "2025-09-04 20:10:35",
            "confidence_level": 75,
            "reference": null,
            "tags": "r4_46,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581684": [
        {
            "ioc_value": "ice.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 10:47:08",
            "last_seen_utc": "2025-09-04 10:47:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581683": [
        {
            "ioc_value": "dll.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 10:16:36",
            "last_seen_utc": "2025-09-04 10:16:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581678": [
        {
            "ioc_value": "allupdateservices.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-04 09:27:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1581679": [
        {
            "ioc_value": "flac.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 09:27:51",
            "last_seen_utc": "2025-09-04 09:17:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581675": [
        {
            "ioc_value": "saewh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-04 08:52:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1581674": [
        {
            "ioc_value": "bpm.w0rkz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-04 08:49:41",
            "last_seen_utc": "2025-12-11 19:55:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581668": [
        {
            "ioc_value": "ug.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 08:47:30",
            "last_seen_utc": "2025-09-04 08:49:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581547": [
        {
            "ioc_value": "xjk.luxemyy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 08:07:36",
            "last_seen_utc": "2025-09-04 06:48:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581556": [
        {
            "ioc_value": "wod.qehucuu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 08:07:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581654": [
        {
            "ioc_value": "jerrytech2020.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 07:53:46",
            "last_seen_utc": "2025-09-26 07:38:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1581651": [
        {
            "ioc_value": "c2.sombras.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-04 07:52:55",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1581652": [
        {
            "ioc_value": "makarovs839.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-04 07:52:55",
            "last_seen_utc": "2025-09-13 11:44:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1581646": [
        {
            "ioc_value": "adobesystem.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-09-04 07:52:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1581647": [
        {
            "ioc_value": "decena10.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-09-04 07:52:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1581648": [
        {
            "ioc_value": "marzo2020.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-09-04 07:52:20",
            "last_seen_utc": "2025-10-03 09:02:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1581649": [
        {
            "ioc_value": "teamvievwerup.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-09-04 07:52:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1581640": [
        {
            "ioc_value": "maravillas12.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-04 07:51:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1581639": [
        {
            "ioc_value": "julio2020.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-04 07:51:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1581553": [
        {
            "ioc_value": "dload.chatology.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-04 07:00:03",
            "last_seen_utc": "2025-09-04 10:10:32",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1581536": [
        {
            "ioc_value": "jt.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 06:14:12",
            "last_seen_utc": "2025-09-04 05:47:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581537": [
        {
            "ioc_value": "dc.burydyu0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 06:14:12",
            "last_seen_utc": "2025-09-04 05:59:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581539": [
        {
            "ioc_value": "payload.tahirvoip.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 06:00:50",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-e2scdsz1bz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581538": [
        {
            "ioc_value": "then-northeast.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-04 06:00:49",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250904-fjv61ahr9z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581527": [
        {
            "ioc_value": "cd.winenoy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:15:00",
            "last_seen_utc": "2025-09-04 04:17:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581528": [
        {
            "ioc_value": "mno.winenoy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:59",
            "last_seen_utc": "2025-09-04 04:27:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581257": [
        {
            "ioc_value": "pqr.lysyrei3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:55",
            "last_seen_utc": "2025-09-04 01:46:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581258": [
        {
            "ioc_value": "ab.hihijie3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:54",
            "last_seen_utc": "2025-09-04 01:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581481": [
        {
            "ioc_value": "pqr.hihijie3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:53",
            "last_seen_utc": "2025-09-04 03:18:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581240": [
        {
            "ioc_value": "jc.zelojue1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:51",
            "last_seen_utc": "2025-09-03 23:09:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581253": [
        {
            "ioc_value": "vx.rogosie4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:50",
            "last_seen_utc": "2025-09-04 00:16:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581254": [
        {
            "ioc_value": "dl.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:49",
            "last_seen_utc": "2025-09-04 00:56:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581255": [
        {
            "ioc_value": "ip.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:49",
            "last_seen_utc": "2025-09-04 01:17:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581233": [
        {
            "ioc_value": "ou.nufypiy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:40",
            "last_seen_utc": "2025-09-03 22:48:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581232": [
        {
            "ioc_value": "phoenix-brands.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-04 05:14:38",
            "last_seen_utc": "2025-09-28 20:22:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1581231": [
        {
            "ioc_value": "streamin.style",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-04 05:14:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1581230": [
        {
            "ioc_value": "lzh.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-04 05:14:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1581229": [
        {
            "ioc_value": "pyscalp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-04 05:14:34",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1581228": [
        {
            "ioc_value": "iaed.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-04 05:14:33",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1581227": [
        {
            "ioc_value": "voando26.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-04 05:14:32",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1581226": [
        {
            "ioc_value": "digitbasket.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-04 05:14:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1581225": [
        {
            "ioc_value": "marvelvod.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-04 05:14:30",
            "last_seen_utc": "2025-09-28 20:20:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1581224": [
        {
            "ioc_value": "iv.qehucuu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:28",
            "last_seen_utc": "2025-09-03 21:48:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581223": [
        {
            "ioc_value": "zr.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:27",
            "last_seen_utc": "2025-09-03 21:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581197": [
        {
            "ioc_value": "gqy.zelojue1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:25",
            "last_seen_utc": "2025-09-03 19:47:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581195": [
        {
            "ioc_value": "bbj.subozaa7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:11",
            "last_seen_utc": "2025-09-03 19:16:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581194": [
        {
            "ioc_value": "xux.xonulee9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-04 05:14:10",
            "last_seen_utc": "2025-09-03 18:47:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581515": [
        {
            "ioc_value": "static.38.171.181.135.clients.your-server.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-09-04 04:01:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/135.181.171.38+static.38.171.181.135.clients.your-server.de",
            "tags": "AS24940,C2,censys,Ermac,HETZNER-AS,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581511": [
        {
            "ioc_value": "inst.institutionjosephdcharles.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-04 04:01:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.198.27.131+inst.institutionjosephdcharles.com",
            "tags": "AS51167,censys,CONTABO,EvilGoPhish,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1581512": [
        {
            "ioc_value": "accounts.snapchat.com.5t8.pw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-04 04:01:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.198.27.131+accounts.snapchat.com.5t8.pw",
            "tags": "AS51167,censys,CONTABO,EvilGoPhish,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1581493": [
        {
            "ioc_value": "ad.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-04 04:01:05",
            "last_seen_utc": "2025-09-04 04:01:44",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+ad.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1581238": [
        {
            "ioc_value": "idf-dev.nacc.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-03 22:49:22",
            "last_seen_utc": "2025-10-04 07:49:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581192": [
        {
            "ioc_value": "un.qehucuu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 18:26:05",
            "last_seen_utc": "2025-09-03 18:18:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581191": [
        {
            "ioc_value": "plasticjoin.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-03 18:13:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581189": [
        {
            "ioc_value": "maidjellyfish.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-03 18:12:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581190": [
        {
            "ioc_value": "streetway.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-03 18:12:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581186": [
        {
            "ioc_value": "roadtrousers.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-03 18:02:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581182": [
        {
            "ioc_value": "insurancemorning.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-03 18:01:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581183": [
        {
            "ioc_value": "yamnote.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-03 18:01:28",
            "last_seen_utc": "2025-09-03 18:01:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581184": [
        {
            "ioc_value": "inkseed.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-03 18:01:28",
            "last_seen_utc": "2025-09-23 11:20:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581185": [
        {
            "ioc_value": "watchcake.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-03 18:01:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581180": [
        {
            "ioc_value": "hours-scientific.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-03 18:00:47",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250903-wjtaeavtdw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581177": [
        {
            "ioc_value": "kmmlive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 17:58:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581178": [
        {
            "ioc_value": "ktmlive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 17:58:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581179": [
        {
            "ioc_value": "secure.bmobileroute.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 17:58:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581162": [
        {
            "ioc_value": "nz.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 17:49:38",
            "last_seen_utc": "2025-09-03 15:27:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581171": [
        {
            "ioc_value": "tdz.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 17:49:35",
            "last_seen_utc": "2025-09-03 16:17:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581175": [
        {
            "ioc_value": "gpw.logyvai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 17:49:33",
            "last_seen_utc": "2025-09-03 17:17:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581170": [
        {
            "ioc_value": "ec2-35-167-130-200.us-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-09-03 16:01:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/35.167.130.200+ec2-35-167-130-200.us-west-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Gafgyt,open-dir",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581163": [
        {
            "ioc_value": "it.fobiweu2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 15:27:27",
            "last_seen_utc": "2025-09-04 14:48:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581152": [
        {
            "ioc_value": "ethiopialocal.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-03 14:06:54",
            "last_seen_utc": "2025-10-04 07:49:22",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581147": [
        {
            "ioc_value": "jk.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 13:28:12",
            "last_seen_utc": "2025-09-03 12:38:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581151": [
        {
            "ioc_value": "feedback.luxurypartybustoronto.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-03 13:28:12",
            "last_seen_utc": "2025-09-03 15:15:56",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115140539368804936",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1581150": [
        {
            "ioc_value": "wxy.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 13:07:47",
            "last_seen_utc": "2025-09-03 13:08:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581129": [
        {
            "ioc_value": "louglas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-03 12:36:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1581143": [
        {
            "ioc_value": "ef.cadynue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 12:36:37",
            "last_seen_utc": "2025-09-03 12:07:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581136": [
        {
            "ioc_value": "exelelo.webhop.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-03 12:03:07",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250903-nvdebscn8y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581130": [
        {
            "ioc_value": "tls.sharesoffices.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 12:02:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.238.34.179+tls.sharesoffices.com",
            "tags": "AS199959,C2,censys,CROWNCLOUD,RAT,SpiceRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581127": [
        {
            "ioc_value": "insurance-statistical.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-03 12:01:43",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250903-m1drlsvjz6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581126": [
        {
            "ioc_value": "macsoon.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-03 12:01:36",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250903-nd7a3szsd1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581116": [
        {
            "ioc_value": "cd.nejofea9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 11:46:28",
            "last_seen_utc": "2025-09-04 15:53:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581118": [
        {
            "ioc_value": "eleccqt.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-03 11:46:27",
            "last_seen_utc": "2025-09-12 08:53:39",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1581119": [
        {
            "ioc_value": "10.a3.bijakbuatduit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-03 11:46:26",
            "last_seen_utc": "2025-09-04 07:00:03",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1581114": [
        {
            "ioc_value": "stu.lysyrei3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 11:11:20",
            "last_seen_utc": "2025-09-03 11:07:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581110": [
        {
            "ioc_value": "sas.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 10:49:18",
            "last_seen_utc": "2025-09-03 10:38:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581111": [
        {
            "ioc_value": "craftss.bumbleshrimp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-03 10:40:39",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/61ec38741f1b45c5e797ab56bedc01f63fb089d1946f978a1ba735602e2cb455/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581105": [
        {
            "ioc_value": "tuk.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 10:18:32",
            "last_seen_utc": "2025-09-03 09:43:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581106": [
        {
            "ioc_value": "wug.hekulei5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 09:43:15",
            "last_seen_utc": "2025-09-03 13:07:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1581104": [
        {
            "ioc_value": "jys.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 09:25:25",
            "last_seen_utc": "2025-09-03 09:23:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581102": [
        {
            "ioc_value": "ib.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 09:22:42",
            "last_seen_utc": "2025-09-03 09:08:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581100": [
        {
            "ioc_value": "drto.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 09:02:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581051": [
        {
            "ioc_value": "flc.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 08:57:01",
            "last_seen_utc": "2025-09-03 05:53:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581067": [
        {
            "ioc_value": "wa.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 08:57:00",
            "last_seen_utc": "2025-09-03 06:14:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581070": [
        {
            "ioc_value": "hym.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 08:57:00",
            "last_seen_utc": "2025-09-03 07:08:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581071": [
        {
            "ioc_value": "pop.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 08:56:59",
            "last_seen_utc": "2025-09-03 07:38:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581095": [
        {
            "ioc_value": "bx.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 08:56:59",
            "last_seen_utc": "2025-09-03 08:08:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581096": [
        {
            "ioc_value": "iz.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 08:56:58",
            "last_seen_utc": "2025-09-03 08:31:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581084": [
        {
            "ioc_value": "www.opsecsrv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-03 08:01:29",
            "last_seen_utc": "2025-09-04 04:00:40",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.71.137.28+www.opsecsrv.com",
            "tags": "AS8075,C2,censys,Havoc,MICROSOFT-CORP-MSN-AS-BLOCK",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581062": [
        {
            "ioc_value": "zfgsol.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 06:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581063": [
        {
            "ioc_value": "solzzz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 06:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581064": [
        {
            "ioc_value": "prnlive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 06:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581065": [
        {
            "ioc_value": "livenqh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 06:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581066": [
        {
            "ioc_value": "bgzlive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-03 06:09:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1581056": [
        {
            "ioc_value": "oldone888d.casacam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-03 06:01:17",
            "last_seen_utc": "2025-09-13 11:43:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250903-ayke6as1cz",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581052": [
        {
            "ioc_value": "town-minor.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-03 06:00:49",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250903-f4dsfsgj7v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581053": [
        {
            "ioc_value": "wanted-villa.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-03 06:00:49",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250903-ejblxszqx7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581054": [
        {
            "ioc_value": "shopping-velvet.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-03 06:00:49",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250903-cjx4tayqt3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1581049": [
        {
            "ioc_value": "tfy.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 05:19:04",
            "last_seen_utc": "2025-09-03 05:18:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1581047": [
        {
            "ioc_value": "oh.qecufey7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:17",
            "last_seen_utc": "2025-09-03 04:21:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580718": [
        {
            "ioc_value": "rt.tygilyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:14",
            "last_seen_utc": "2025-09-02 18:22:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580722": [
        {
            "ioc_value": "tp.sewumoa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:13",
            "last_seen_utc": "2025-09-02 18:53:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580724": [
        {
            "ioc_value": "hlc.sewumoa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:13",
            "last_seen_utc": "2025-09-02 19:22:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580744": [
        {
            "ioc_value": "tqx.sewedau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:12",
            "last_seen_utc": "2025-09-02 20:23:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580756": [
        {
            "ioc_value": "gicaway3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:11",
            "last_seen_utc": "2025-09-02 21:14:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580754": [
        {
            "ioc_value": "wg.gevicii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:10",
            "last_seen_utc": "2025-09-02 20:52:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580745": [
        {
            "ioc_value": "loi.sewumoa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:09",
            "last_seen_utc": "2025-09-02 20:26:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580746": [
        {
            "ioc_value": "sc.tygilyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:09",
            "last_seen_utc": "2025-09-02 20:30:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580757": [
        {
            "ioc_value": "erq.vuzojiu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:08",
            "last_seen_utc": "2025-09-02 22:22:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580759": [
        {
            "ioc_value": "drg.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:08",
            "last_seen_utc": "2025-09-02 22:52:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580760": [
        {
            "ioc_value": "clq.hifeboi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:07",
            "last_seen_utc": "2025-09-02 23:23:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580990": [
        {
            "ioc_value": "ldl.fozomya6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:07",
            "last_seen_utc": "2025-09-03 01:26:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580991": [
        {
            "ioc_value": "si.kidizue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-03 04:58:07",
            "last_seen_utc": "2025-09-03 01:56:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580998": [
        {
            "ioc_value": "app.xinzyun.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-03 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.207.193.76+app.xinzyun.cn",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1580992": [
        {
            "ioc_value": "www.fwefwefwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-03 02:49:18",
            "last_seen_utc": "2025-10-06 07:50:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580776": [
        {
            "ioc_value": "r.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-03 00:01:37",
            "last_seen_utc": "2025-09-03 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+r.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580774": [
        {
            "ioc_value": "www.landownerdozenguard.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.venom",
            "malware_alias": null,
            "malware_printable": "Venom RAT",
            "first_seen_utc": "2025-09-03 00:01:24",
            "last_seen_utc": "2025-09-08 08:01:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.208.158.155+www.landownerdozenguard.com",
            "tags": "AS42624,C2,censys,RAT,SWISSNETWORK02,Venom",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580747": [
        {
            "ioc_value": "loe.jujosuu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 20:30:14",
            "last_seen_utc": "2025-09-03 09:23:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1580725": [
        {
            "ioc_value": "ewg.jujosuu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 19:22:00",
            "last_seen_utc": "2025-09-02 20:26:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1580721": [
        {
            "ioc_value": "ns2.microoosoft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-02 18:50:45",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580720": [
        {
            "ioc_value": "ns1.microoosoft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-02 18:50:42",
            "last_seen_utc": "2025-12-14 11:48:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580717": [
        {
            "ioc_value": "crisp.cucy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 18:08:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1580712": [
        {
            "ioc_value": "manual-terminology.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-02 18:01:13",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-q8yzaswycx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580709": [
        {
            "ioc_value": "click-constraints.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-02 18:00:47",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-sj38tssq19",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580710": [
        {
            "ioc_value": "fund-eyes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-02 18:00:47",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-pc4z1aam6w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580707": [
        {
            "ioc_value": "change-america.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-02 18:00:46",
            "last_seen_utc": "2025-09-13 11:43:45",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-sqr45sxygz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580708": [
        {
            "ioc_value": "brand-courses.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-02 18:00:46",
            "last_seen_utc": "2025-09-13 11:43:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-sj38tssq19",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580696": [
        {
            "ioc_value": "dfm.qacacoe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 17:37:49",
            "last_seen_utc": "2025-09-02 16:22:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580697": [
        {
            "ioc_value": "ashigaruwallet.rs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-02 17:37:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1580699": [
        {
            "ioc_value": "kwk.burydyu0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 17:37:49",
            "last_seen_utc": "2025-09-02 16:53:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580701": [
        {
            "ioc_value": "load.granivit.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-02 17:37:48",
            "last_seen_utc": "2025-09-09 05:10:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1580704": [
        {
            "ioc_value": "zip.sewumoa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 17:37:47",
            "last_seen_utc": "2025-09-02 17:22:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580693": [
        {
            "ioc_value": "kws4.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-02 16:02:11",
            "last_seen_utc": "2025-09-03 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+kws4.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580689": [
        {
            "ioc_value": "ec2-63-178-148-142.eu-central-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-09-02 16:01:42",
            "last_seen_utc": "2025-09-03 04:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/63.178.148.142+ec2-63-178-148-142.eu-central-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580684": [
        {
            "ioc_value": "up.xonulee9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 15:55:30",
            "last_seen_utc": "2025-09-02 15:53:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580682": [
        {
            "ioc_value": "auf.nelypuu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 15:48:35",
            "last_seen_utc": "2025-09-02 15:23:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580672": [
        {
            "ioc_value": "wb.kesogio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 15:04:00",
            "last_seen_utc": "2025-09-02 14:22:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580680": [
        {
            "ioc_value": "szh.saqehyo1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 15:03:56",
            "last_seen_utc": "2025-09-02 14:53:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580579": [
        {
            "ioc_value": "wv.safofoe5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 13:57:21",
            "last_seen_utc": "2025-09-02 11:23:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580580": [
        {
            "ioc_value": "mu.nelypuu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 13:57:20",
            "last_seen_utc": "2025-09-02 11:52:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580593": [
        {
            "ioc_value": "vcsinfo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-02 13:57:19",
            "last_seen_utc": "2025-09-02 13:11:01",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115134623718155960",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1580596": [
        {
            "ioc_value": "info-2go.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-02 13:57:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115134631148960678",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1580598": [
        {
            "ioc_value": "wood-simple.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-02 13:57:17",
            "last_seen_utc": "2025-09-02 12:11:01",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115134631148960678",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1580603": [
        {
            "ioc_value": "yh.qacacoe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 13:57:16",
            "last_seen_utc": "2025-09-02 12:52:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580665": [
        {
            "ioc_value": "uq.xexykuo2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 13:57:15",
            "last_seen_utc": "2025-09-02 13:52:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580624": [
        {
            "ioc_value": "alv.lotegeo7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 13:57:14",
            "last_seen_utc": "2025-09-02 13:22:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580667": [
        {
            "ioc_value": "samples.salondeguitaredemontreal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-02 13:57:13",
            "last_seen_utc": "2025-09-02 14:13:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1580669": [
        {
            "ioc_value": "updates.highendmark.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-09-02 13:57:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1580663": [
        {
            "ioc_value": "remixripiolo.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-02 13:35:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580604": [
        {
            "ioc_value": "the-xxxy.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-02 12:52:05",
            "last_seen_utc": "2025-12-14 11:48:17",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580588": [
        {
            "ioc_value": "www.libertydroid-metabu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-09-02 12:01:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/135.181.171.38+www.libertydroid-metabu.top",
            "tags": "AS24940,C2,censys,Ermac,HETZNER-AS,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580584": [
        {
            "ioc_value": "remcodit.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-02 12:00:46",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-kbeaqsfm3v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580582": [
        {
            "ioc_value": "posted-ethnic.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-02 12:00:40",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-npckvavtb1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580575": [
        {
            "ioc_value": "jp.walowue2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 10:42:47",
            "last_seen_utc": "2025-09-02 09:52:17",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580577": [
        {
            "ioc_value": "znz.xexykuo2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 10:42:46",
            "last_seen_utc": "2025-09-02 10:22:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580571": [
        {
            "ioc_value": "tu.luxemyy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 09:48:40",
            "last_seen_utc": "2025-09-02 08:51:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580574": [
        {
            "ioc_value": "al.luxemyy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 09:48:40",
            "last_seen_utc": "2025-09-02 09:23:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580556": [
        {
            "ioc_value": "ask.xonulee9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 08:25:51",
            "last_seen_utc": "2025-09-02 07:53:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580566": [
        {
            "ioc_value": "pen.luxemyy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 08:25:51",
            "last_seen_utc": "2025-09-02 08:21:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580547": [
        {
            "ioc_value": "gm.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 07:50:47",
            "last_seen_utc": "2025-09-02 06:36:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580548": [
        {
            "ioc_value": "ry.zelojue1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 07:50:47",
            "last_seen_utc": "2025-09-02 06:40:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580554": [
        {
            "ioc_value": "qr.nelypuu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 07:50:46",
            "last_seen_utc": "2025-09-02 07:23:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580550": [
        {
            "ioc_value": "guq.mosatiy4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 07:50:45",
            "last_seen_utc": "2025-09-02 06:52:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580545": [
        {
            "ioc_value": "gyr.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 06:26:06",
            "last_seen_utc": "2025-09-02 06:13:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580540": [
        {
            "ioc_value": "8scom.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-02 06:03:25",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-bfyeqsvkw8",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580535": [
        {
            "ioc_value": "BELL.mokveid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-02 06:00:50",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-gj3rhsdr6v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580534": [
        {
            "ioc_value": "user0001.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-02 06:00:44",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-akxhkatrx8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580531": [
        {
            "ioc_value": "oahs8y352.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-02 06:00:43",
            "last_seen_utc": "2025-09-13 11:43:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-gnyy5adr7s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580532": [
        {
            "ioc_value": "if-compared.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-02 06:00:43",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250902-gjqf7axjy4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580529": [
        {
            "ioc_value": "ebay-governance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-02 05:59:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580525": [
        {
            "ioc_value": "advpdxapi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xagent",
            "malware_alias": "splm,chopstick",
            "malware_printable": "X-Agent",
            "first_seen_utc": "2025-09-02 05:58:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xagent",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580526": [
        {
            "ioc_value": "securesystemwin.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xagent",
            "malware_alias": "splm,chopstick",
            "malware_printable": "X-Agent",
            "first_seen_utc": "2025-09-02 05:58:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xagent",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580523": [
        {
            "ioc_value": "www.salesmarking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-02 05:57:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580512": [
        {
            "ioc_value": "www.sy897.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580513": [
        {
            "ioc_value": "www.tudygym.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580514": [
        {
            "ioc_value": "www.udness.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580515": [
        {
            "ioc_value": "www.utihslote.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580516": [
        {
            "ioc_value": "www.vahaca.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580517": [
        {
            "ioc_value": "www.wn6do.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580518": [
        {
            "ioc_value": "www.ye6cvdg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580519": [
        {
            "ioc_value": "www.ystems2beyond.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580520": [
        {
            "ioc_value": "www.zborderfree.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580495": [
        {
            "ioc_value": "www.ngimg.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580496": [
        {
            "ioc_value": "www.ockscrm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580497": [
        {
            "ioc_value": "www.ogw159.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580498": [
        {
            "ioc_value": "www.oisturizee.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580499": [
        {
            "ioc_value": "www.olikujyh990.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580500": [
        {
            "ioc_value": "www.omeradar.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580501": [
        {
            "ioc_value": "www.oofwaterproofing462.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580502": [
        {
            "ioc_value": "www.orytharothis.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580503": [
        {
            "ioc_value": "www.ososo.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580504": [
        {
            "ioc_value": "www.osteam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580505": [
        {
            "ioc_value": "www.oticiasdamanha.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580506": [
        {
            "ioc_value": "www.ove678i.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580507": [
        {
            "ioc_value": "www.oviesnn.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580508": [
        {
            "ioc_value": "www.povamu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580509": [
        {
            "ioc_value": "www.rownandcleatco.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580510": [
        {
            "ioc_value": "www.s667788.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580511": [
        {
            "ioc_value": "www.sy644.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580478": [
        {
            "ioc_value": "www.etchelpgovtw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580479": [
        {
            "ioc_value": "www.etnow.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580480": [
        {
            "ioc_value": "www.etworkmodel.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580481": [
        {
            "ioc_value": "www.excol.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580482": [
        {
            "ioc_value": "www.g-899b9.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580483": [
        {
            "ioc_value": "www.ghhfy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580484": [
        {
            "ioc_value": "www.hysicians-to-women.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580485": [
        {
            "ioc_value": "www.ian485.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580486": [
        {
            "ioc_value": "www.itaslotk.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580487": [
        {
            "ioc_value": "www.iveroad.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580488": [
        {
            "ioc_value": "www.ivn.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580489": [
        {
            "ioc_value": "www.jc169.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580490": [
        {
            "ioc_value": "www.lhet.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580491": [
        {
            "ioc_value": "www.livinski.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580492": [
        {
            "ioc_value": "www.lossbossclean.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580493": [
        {
            "ioc_value": "www.lphageek.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580494": [
        {
            "ioc_value": "www.mvv34z.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580460": [
        {
            "ioc_value": "www.ablu.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580461": [
        {
            "ioc_value": "www.alloffameopen1.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580462": [
        {
            "ioc_value": "www.anktl.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580463": [
        {
            "ioc_value": "www.apital-a.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580464": [
        {
            "ioc_value": "www.arewajan.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580465": [
        {
            "ioc_value": "www.astplay.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580466": [
        {
            "ioc_value": "www.atchbox.exchange",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580467": [
        {
            "ioc_value": "www.attoosbymatt.studio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580468": [
        {
            "ioc_value": "www.c0824.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580469": [
        {
            "ioc_value": "www.c1302.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580470": [
        {
            "ioc_value": "www.c2751.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580471": [
        {
            "ioc_value": "www.c4589.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580472": [
        {
            "ioc_value": "www.dfsewq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580473": [
        {
            "ioc_value": "www.earches.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580474": [
        {
            "ioc_value": "www.eet-new-people-21453.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580475": [
        {
            "ioc_value": "www.eetmoonbuggy.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580476": [
        {
            "ioc_value": "www.ellgreensportseducation.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580477": [
        {
            "ioc_value": "www.eople-search-65430.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580456": [
        {
            "ioc_value": "www.0632.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580457": [
        {
            "ioc_value": "www.0llhs.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580458": [
        {
            "ioc_value": "www.1tnsf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580459": [
        {
            "ioc_value": "www.77-matraca777.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-09-02 05:56:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1580250": [
        {
            "ioc_value": "serpentinelexicon.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-02 05:41:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580251": [
        {
            "ioc_value": "loadinnnhr.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-02 05:41:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580252": [
        {
            "ioc_value": "telluricaphelion.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-02 05:41:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580249": [
        {
            "ioc_value": "wmjlive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-02 05:41:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580248": [
        {
            "ioc_value": "bfvfuausfo.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-02 05:41:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579928": [
        {
            "ioc_value": "sbv.gevicii.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:58",
            "last_seen_utc": "2025-09-01 16:21:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579930": [
        {
            "ioc_value": "ung.sewumoa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:58",
            "last_seen_utc": "2025-09-01 16:52:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579932": [
        {
            "ioc_value": "teb.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:57",
            "last_seen_utc": "2025-09-01 17:49:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579945": [
        {
            "ioc_value": "cso.burydyu0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:56",
            "last_seen_utc": "2025-09-01 18:22:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579947": [
        {
            "ioc_value": "nuu.qacacoe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:55",
            "last_seen_utc": "2025-09-01 18:53:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579948": [
        {
            "ioc_value": "re.qacacoe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:55",
            "last_seen_utc": "2025-09-01 19:22:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579950": [
        {
            "ioc_value": "vc.rogosie4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:55",
            "last_seen_utc": "2025-09-01 19:53:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579960": [
        {
            "ioc_value": "lm.rogosie4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:54",
            "last_seen_utc": "2025-09-01 20:22:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580154": [
        {
            "ioc_value": "x-vape.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-02 05:25:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1580155": [
        {
            "ioc_value": "kl.xoreniu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:53",
            "last_seen_utc": "2025-09-01 21:52:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580161": [
        {
            "ioc_value": "jsm.mosatiy4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:53",
            "last_seen_utc": "2025-09-01 22:52:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580164": [
        {
            "ioc_value": "brt.velyzeu3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:53",
            "last_seen_utc": "2025-09-01 23:54:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580178": [
        {
            "ioc_value": "bu.xoreniu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:51",
            "last_seen_utc": "2025-09-02 00:04:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580179": [
        {
            "ioc_value": "hdn.qacacoe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:51",
            "last_seen_utc": "2025-09-02 00:24:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580180": [
        {
            "ioc_value": "qo.subozaa7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:50",
            "last_seen_utc": "2025-09-02 00:31:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580240": [
        {
            "ioc_value": "dv.kesogio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:48",
            "last_seen_utc": "2025-09-02 04:37:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580245": [
        {
            "ioc_value": "id.madicoo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:47",
            "last_seen_utc": "2025-09-02 05:13:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580246": [
        {
            "ioc_value": "rq.mufabui4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 05:25:47",
            "last_seen_utc": "2025-09-02 05:23:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1580247": [
        {
            "ioc_value": "doc.e-statement.estate",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-02 05:23:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580198": [
        {
            "ioc_value": "bold-chandrasekhar.134-199-166-195.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-02 04:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/134.199.166.195+bold-chandrasekhar.134-199-166-195.plesk.page",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1580190": [
        {
            "ioc_value": "sctms.tld56.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-02 04:00:13",
            "last_seen_utc": "2025-09-05 21:49:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/129.28.180.115+sctms.tld56.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1580191": [
        {
            "ioc_value": "wxweb.tld56.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-02 04:00:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/129.28.180.115+wxweb.tld56.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1580189": [
        {
            "ioc_value": "blog.xinzyun.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-02 04:00:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.207.193.76+blog.xinzyun.cn",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1580188": [
        {
            "ioc_value": "transapi.tld56.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-02 04:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/129.28.180.115+transapi.tld56.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1580182": [
        {
            "ioc_value": "ph.safofoe5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-02 01:06:50",
            "last_seen_utc": "2025-09-02 01:08:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1580177": [
        {
            "ioc_value": "bcm.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-02 00:01:38",
            "last_seen_utc": "2025-09-02 04:01:10",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+bcm.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1580157": [
        {
            "ioc_value": "tld56.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-01 22:49:38",
            "last_seen_utc": "2025-09-02 03:50:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1580156": [
        {
            "ioc_value": "11.jujosuu4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 21:52:58",
            "last_seen_utc": "2025-09-02 18:53:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1579964": [
        {
            "ioc_value": "pr.es.grantech.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-01 21:10:27",
            "last_seen_utc": "2025-09-02 15:10:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579959": [
        {
            "ioc_value": "pr.es.hombresg.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-01 20:10:38",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579946": [
        {
            "ioc_value": "ch.hekulei5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 18:22:37",
            "last_seen_utc": "2025-09-01 20:22:09",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1579943": [
        {
            "ioc_value": "mhzlhhhh378-43006.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-09-01 18:01:29",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-tpw75stsdy",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579941": [
        {
            "ioc_value": "NigNig12344-54127.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-01 18:00:55",
            "last_seen_utc": "2025-09-13 11:43:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-s7w5esyjv6",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579940": [
        {
            "ioc_value": "mora1987.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-01 18:00:49",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-n6p79svnt7",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579938": [
        {
            "ioc_value": "startmenuexperiencehostw.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-01 18:00:48",
            "last_seen_utc": "2025-09-13 11:43:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-ttbr1abp21",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579939": [
        {
            "ioc_value": "hone32.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-01 18:00:48",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-n6p79svnt7",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579937": [
        {
            "ioc_value": "ring-bd.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-01 18:00:37",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-pbv1psvpt3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579934": [
        {
            "ioc_value": "dabenchy.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-01 18:00:36",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-vy6nlsyr16",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579935": [
        {
            "ioc_value": "benefits-bumper.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-01 18:00:36",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-txem3attfs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579936": [
        {
            "ioc_value": "related-suspended.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-01 18:00:36",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-p9fzfaz1av",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579925": [
        {
            "ioc_value": "mellive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-01 16:15:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579920": [
        {
            "ioc_value": "njqlive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-01 16:15:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579921": [
        {
            "ioc_value": "web.qxfhelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-01 16:15:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579922": [
        {
            "ioc_value": "armb.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-01 16:15:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579923": [
        {
            "ioc_value": "helphbc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-01 16:15:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579924": [
        {
            "ioc_value": "roofvest.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-01 16:15:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579910": [
        {
            "ioc_value": "ak.tygilyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 15:53:51",
            "last_seen_utc": "2025-09-01 15:52:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579909": [
        {
            "ioc_value": "pzy.sewedau.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 15:42:49",
            "last_seen_utc": "2025-09-01 15:34:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579908": [
        {
            "ioc_value": "ers.logyvai.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 15:28:01",
            "last_seen_utc": "2025-09-01 15:21:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579670": [
        {
            "ioc_value": "ce.tygilyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 15:16:53",
            "last_seen_utc": "2025-09-01 14:49:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579893": [
        {
            "ioc_value": "turzhzt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579894": [
        {
            "ioc_value": "unfill.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579895": [
        {
            "ioc_value": "unpaclpe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579896": [
        {
            "ioc_value": "unworva.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579897": [
        {
            "ioc_value": "vicejlr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579898": [
        {
            "ioc_value": "virwvtz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579899": [
        {
            "ioc_value": "visifxs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579900": [
        {
            "ioc_value": "viticpc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579901": [
        {
            "ioc_value": "waryyip.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579902": [
        {
            "ioc_value": "whipwdv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579903": [
        {
            "ioc_value": "whitlcl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": "2025-09-10 08:31:33",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579904": [
        {
            "ioc_value": "wildxba.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579905": [
        {
            "ioc_value": "windmqg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579906": [
        {
            "ioc_value": "yammrfn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:58",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579873": [
        {
            "ioc_value": "squabkq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579874": [
        {
            "ioc_value": "stimumu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579875": [
        {
            "ioc_value": "strekyc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579876": [
        {
            "ioc_value": "strinyj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579877": [
        {
            "ioc_value": "strypgo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579878": [
        {
            "ioc_value": "supporbt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579879": [
        {
            "ioc_value": "synadvn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579880": [
        {
            "ioc_value": "tadjirl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579881": [
        {
            "ioc_value": "taiffmzy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579882": [
        {
            "ioc_value": "tallubk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579883": [
        {
            "ioc_value": "tankrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579884": [
        {
            "ioc_value": "tensqms.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579885": [
        {
            "ioc_value": "threeql.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579886": [
        {
            "ioc_value": "tillcuh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579887": [
        {
            "ioc_value": "togoeww.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579888": [
        {
            "ioc_value": "treabcf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579889": [
        {
            "ioc_value": "treavi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579890": [
        {
            "ioc_value": "troocea.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579891": [
        {
            "ioc_value": "tumbikj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579892": [
        {
            "ioc_value": "turtljbv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579858": [
        {
            "ioc_value": "rutxnm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579859": [
        {
            "ioc_value": "sabiwgb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-10 08:31:33",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579860": [
        {
            "ioc_value": "sarpabb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579861": [
        {
            "ioc_value": "savoesf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-01 20:47:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579862": [
        {
            "ioc_value": "scordtw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579863": [
        {
            "ioc_value": "scruxhb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579864": [
        {
            "ioc_value": "sempqrz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579865": [
        {
            "ioc_value": "serrsvn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579866": [
        {
            "ioc_value": "shocvxli.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-01 20:47:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579867": [
        {
            "ioc_value": "shofxd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579868": [
        {
            "ioc_value": "showcet.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579869": [
        {
            "ioc_value": "skiddgw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-01 20:47:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579870": [
        {
            "ioc_value": "sluggtq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579871": [
        {
            "ioc_value": "smoovns.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579872": [
        {
            "ioc_value": "sociiud.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579846": [
        {
            "ioc_value": "pasyrbe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579847": [
        {
            "ioc_value": "petesie.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579848": [
        {
            "ioc_value": "pilotpfp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579849": [
        {
            "ioc_value": "pistdvd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579850": [
        {
            "ioc_value": "plinwxl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579851": [
        {
            "ioc_value": "preeybt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579852": [
        {
            "ioc_value": "preobsl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579853": [
        {
            "ioc_value": "proleau.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579854": [
        {
            "ioc_value": "prolnwo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579855": [
        {
            "ioc_value": "rebechh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": "2025-09-01 20:47:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579856": [
        {
            "ioc_value": "reveham.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579857": [
        {
            "ioc_value": "ringlti.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:55",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579832": [
        {
            "ioc_value": "lipsofu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579833": [
        {
            "ioc_value": "malelaw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579834": [
        {
            "ioc_value": "marceln.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579835": [
        {
            "ioc_value": "mendjks.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579836": [
        {
            "ioc_value": "monking.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579837": [
        {
            "ioc_value": "morvoz01.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579838": [
        {
            "ioc_value": "mothysb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579839": [
        {
            "ioc_value": "newbvrp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579840": [
        {
            "ioc_value": "niptfyz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579841": [
        {
            "ioc_value": "obblipc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579842": [
        {
            "ioc_value": "obtuutc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579843": [
        {
            "ioc_value": "onqukok.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": "2025-09-10 08:31:33",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579844": [
        {
            "ioc_value": "oscaiwz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579845": [
        {
            "ioc_value": "parajga.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579817": [
        {
            "ioc_value": "huntlds.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579818": [
        {
            "ioc_value": "hydczdp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579819": [
        {
            "ioc_value": "hymnqx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579820": [
        {
            "ioc_value": "hypohuw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-01 20:48:23",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579821": [
        {
            "ioc_value": "incroqj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579822": [
        {
            "ioc_value": "inczujv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579823": [
        {
            "ioc_value": "infids.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579824": [
        {
            "ioc_value": "inwkpu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579825": [
        {
            "ioc_value": "jaywzkd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579826": [
        {
            "ioc_value": "ketnwdg.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-27 11:10:38",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579827": [
        {
            "ioc_value": "komidbx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579828": [
        {
            "ioc_value": "leftpvb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579829": [
        {
            "ioc_value": "lenhpqy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579830": [
        {
            "ioc_value": "lepitzg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579831": [
        {
            "ioc_value": "lievozs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:53",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579799": [
        {
            "ioc_value": "geisqbb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579800": [
        {
            "ioc_value": "gelatpy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579801": [
        {
            "ioc_value": "genecdg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579802": [
        {
            "ioc_value": "genemgv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579803": [
        {
            "ioc_value": "genulqz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579804": [
        {
            "ioc_value": "genupnt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-01 20:48:23",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579805": [
        {
            "ioc_value": "genupui.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579806": [
        {
            "ioc_value": "genusdfg.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579807": [
        {
            "ioc_value": "genuwwk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579808": [
        {
            "ioc_value": "graygqk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579809": [
        {
            "ioc_value": "grenlel.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579810": [
        {
            "ioc_value": "gripck.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579811": [
        {
            "ioc_value": "guileml.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579812": [
        {
            "ioc_value": "hdj63.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579813": [
        {
            "ioc_value": "hitiedy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579814": [
        {
            "ioc_value": "hittf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579815": [
        {
            "ioc_value": "hocuaox.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": "2025-09-10 08:31:29",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579816": [
        {
            "ioc_value": "homemdks.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579781": [
        {
            "ioc_value": "encibmo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579782": [
        {
            "ioc_value": "endaepd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579783": [
        {
            "ioc_value": "eudrrfl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579784": [
        {
            "ioc_value": "eugvshk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579785": [
        {
            "ioc_value": "evermvn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579786": [
        {
            "ioc_value": "exchdfh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579787": [
        {
            "ioc_value": "excufoc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579788": [
        {
            "ioc_value": "famivfm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579789": [
        {
            "ioc_value": "fasthqx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579790": [
        {
            "ioc_value": "favncyg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579791": [
        {
            "ioc_value": "fawnvjl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579792": [
        {
            "ioc_value": "foojblh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579793": [
        {
            "ioc_value": "forkdp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579794": [
        {
            "ioc_value": "formkjk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579795": [
        {
            "ioc_value": "forxba.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579796": [
        {
            "ioc_value": "framoa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579797": [
        {
            "ioc_value": "franrzc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579798": [
        {
            "ioc_value": "galawgtl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:51",
            "last_seen_utc": "2025-09-10 08:31:31",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579764": [
        {
            "ioc_value": "darnued.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579765": [
        {
            "ioc_value": "darrfbp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579766": [
        {
            "ioc_value": "declpfp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579767": [
        {
            "ioc_value": "defiloa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-10 08:31:33",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579768": [
        {
            "ioc_value": "demnjyx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579769": [
        {
            "ioc_value": "depapom.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-01 20:47:26",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579770": [
        {
            "ioc_value": "dermurt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579771": [
        {
            "ioc_value": "disgxow.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579772": [
        {
            "ioc_value": "disiiat.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579773": [
        {
            "ioc_value": "disluqd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579774": [
        {
            "ioc_value": "divamgo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579775": [
        {
            "ioc_value": "docuhpu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579776": [
        {
            "ioc_value": "doudnrr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579777": [
        {
            "ioc_value": "droacon.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-10 08:31:36",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579778": [
        {
            "ioc_value": "duncian.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579779": [
        {
            "ioc_value": "dysplld.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579780": [
        {
            "ioc_value": "echocej.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:50",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579750": [
        {
            "ioc_value": "capexzo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579751": [
        {
            "ioc_value": "carlozo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579752": [
        {
            "ioc_value": "carrkxh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579753": [
        {
            "ioc_value": "carrokd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579754": [
        {
            "ioc_value": "chlonch.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579755": [
        {
            "ioc_value": "chryzju.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579756": [
        {
            "ioc_value": "cinnmfl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579757": [
        {
            "ioc_value": "claihbs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579758": [
        {
            "ioc_value": "climjuw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579759": [
        {
            "ioc_value": "comqpru.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579760": [
        {
            "ioc_value": "condyal.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": "2025-09-10 08:31:33",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579761": [
        {
            "ioc_value": "conmgyr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579762": [
        {
            "ioc_value": "contnni.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579763": [
        {
            "ioc_value": "craajvg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:49",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579738": [
        {
            "ioc_value": "apoqosp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579739": [
        {
            "ioc_value": "ardhpeb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579740": [
        {
            "ioc_value": "atriurx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579741": [
        {
            "ioc_value": "auspjwr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579742": [
        {
            "ioc_value": "bandmetw.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579743": [
        {
            "ioc_value": "bearvi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579744": [
        {
            "ioc_value": "beatvwe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579745": [
        {
            "ioc_value": "befswj38.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579746": [
        {
            "ioc_value": "blassu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": "2025-09-10 08:31:33",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579747": [
        {
            "ioc_value": "blatfdg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579748": [
        {
            "ioc_value": "blisurn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579749": [
        {
            "ioc_value": "bordehx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:48",
            "last_seen_utc": "2025-09-10 08:31:33",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579731": [
        {
            "ioc_value": "accoapf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:47",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579732": [
        {
            "ioc_value": "achoqqe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:47",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579733": [
        {
            "ioc_value": "aciujpr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:47",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579734": [
        {
            "ioc_value": "adelxks.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:47",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579735": [
        {
            "ioc_value": "airtbvi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:47",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579736": [
        {
            "ioc_value": "aleyywv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579737": [
        {
            "ioc_value": "anguklp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:13:47",
            "last_seen_utc": "2025-09-10 08:31:32",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579719": [
        {
            "ioc_value": "sonst.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579720": [
        {
            "ioc_value": "sortxkm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579721": [
        {
            "ioc_value": "sugaaox.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579722": [
        {
            "ioc_value": "swampcs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579723": [
        {
            "ioc_value": "talkxaxs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579724": [
        {
            "ioc_value": "testimc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579725": [
        {
            "ioc_value": "toobedg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579726": [
        {
            "ioc_value": "unpvmqn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579727": [
        {
            "ioc_value": "wirelft.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579728": [
        {
            "ioc_value": "wrigwtt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579729": [
        {
            "ioc_value": "xerorov.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579730": [
        {
            "ioc_value": "yearsfa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:23",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579685": [
        {
            "ioc_value": "enljbe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:51",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579686": [
        {
            "ioc_value": "ensuibv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:51",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579687": [
        {
            "ioc_value": "exfopgg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:51",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579688": [
        {
            "ioc_value": "faltlsj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:51",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579689": [
        {
            "ioc_value": "famidvw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:51",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579690": [
        {
            "ioc_value": "feasero.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:51",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579691": [
        {
            "ioc_value": "flfzpt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:51",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579692": [
        {
            "ioc_value": "gentlsu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579693": [
        {
            "ioc_value": "genubsl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579694": [
        {
            "ioc_value": "glutbfw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579695": [
        {
            "ioc_value": "hairyzd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579696": [
        {
            "ioc_value": "indpret.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579697": [
        {
            "ioc_value": "insczel.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579698": [
        {
            "ioc_value": "kingduy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579699": [
        {
            "ioc_value": "laevuun.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579700": [
        {
            "ioc_value": "lanmew.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579701": [
        {
            "ioc_value": "lanwkv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579702": [
        {
            "ioc_value": "medizafx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579703": [
        {
            "ioc_value": "minoxih.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579704": [
        {
            "ioc_value": "moutoxj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579705": [
        {
            "ioc_value": "overwwx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579706": [
        {
            "ioc_value": "peppegn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579707": [
        {
            "ioc_value": "pezwsv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579708": [
        {
            "ioc_value": "poniaym.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579709": [
        {
            "ioc_value": "presexe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579710": [
        {
            "ioc_value": "pterobm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579711": [
        {
            "ioc_value": "racecem.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579712": [
        {
            "ioc_value": "recomdpk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579713": [
        {
            "ioc_value": "reeprka.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579714": [
        {
            "ioc_value": "runnrxl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579715": [
        {
            "ioc_value": "scruejk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579716": [
        {
            "ioc_value": "sensiqy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579717": [
        {
            "ioc_value": "servopi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579718": [
        {
            "ioc_value": "sidivhe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:22",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579672": [
        {
            "ioc_value": "acisbpp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:47",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579673": [
        {
            "ioc_value": "anionqh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:47",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579674": [
        {
            "ioc_value": "beralvk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579675": [
        {
            "ioc_value": "brusfnk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579676": [
        {
            "ioc_value": "canzuiq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579677": [
        {
            "ioc_value": "carteop.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579678": [
        {
            "ioc_value": "comramm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579679": [
        {
            "ioc_value": "condetv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579680": [
        {
            "ioc_value": "cupclek.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579681": [
        {
            "ioc_value": "cusisbz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579682": [
        {
            "ioc_value": "cutdodl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-02 16:57:14",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579683": [
        {
            "ioc_value": "eclmezm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:50",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579684": [
        {
            "ioc_value": "effiug.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 15:09:21",
            "last_seen_utc": "2025-09-01 15:13:50",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "500mk500"
        }
    ],
    "1579639": [
        {
            "ioc_value": "xqi.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 14:49:34",
            "last_seen_utc": "2025-09-01 14:06:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579641": [
        {
            "ioc_value": "ny.tygilyo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 14:49:34",
            "last_seen_utc": "2025-09-01 14:20:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579638": [
        {
            "ioc_value": "kt.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 13:53:03",
            "last_seen_utc": "2025-09-01 13:53:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579634": [
        {
            "ioc_value": "ug.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 13:51:42",
            "last_seen_utc": "2025-09-01 13:21:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579633": [
        {
            "ioc_value": "dpd.voltexpressdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-09-01 13:10:26",
            "last_seen_utc": "2025-09-01 19:10:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1579575": [
        {
            "ioc_value": "ven.rilefoo8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 12:47:52",
            "last_seen_utc": "2025-09-01 12:22:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579620": [
        {
            "ioc_value": "teaspdj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 12:28:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579619": [
        {
            "ioc_value": "devel.asurans.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-01 12:28:38",
            "last_seen_utc": "2025-10-08 13:16:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,gholoader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579617": [
        {
            "ioc_value": "almiighty-47767.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-01 12:27:55",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579616": [
        {
            "ioc_value": "visual-cp.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-01 12:27:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579606": [
        {
            "ioc_value": "dfdfhdhdrgethftrj.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-01 12:26:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579607": [
        {
            "ioc_value": "hbws.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-01 12:26:47",
            "last_seen_utc": "2025-09-17 10:27:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579608": [
        {
            "ioc_value": "honeyportsecurityresearchteam.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-01 12:26:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579609": [
        {
            "ioc_value": "kbs-frb.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-01 12:26:47",
            "last_seen_utc": "2025-09-13 11:43:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579610": [
        {
            "ioc_value": "rmdns.servesarcasm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-01 12:26:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579611": [
        {
            "ioc_value": "www.saleskunshan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-01 12:26:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579605": [
        {
            "ioc_value": "sswad-48767.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-01 12:26:30",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579603": [
        {
            "ioc_value": "bebe228855.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-01 12:26:29",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579604": [
        {
            "ioc_value": "dv2.bbanddd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-01 12:26:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579600": [
        {
            "ioc_value": "drooby.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-01 12:25:31",
            "last_seen_utc": "2025-09-13 11:44:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579599": [
        {
            "ioc_value": "cnc.48101.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-09-01 12:25:30",
            "last_seen_utc": "2025-09-13 11:44:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579596": [
        {
            "ioc_value": "feepro1.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-01 12:24:44",
            "last_seen_utc": "2025-09-13 11:44:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579597": [
        {
            "ioc_value": "k24cwchgd.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-09-01 12:24:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579595": [
        {
            "ioc_value": "fan-rui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-01 12:24:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579593": [
        {
            "ioc_value": "i.stasismyfuture.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bunitu",
            "malware_alias": null,
            "malware_printable": "Bunitu",
            "first_seen_utc": "2025-09-01 12:24:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "bunitu,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579594": [
        {
            "ioc_value": "x.stasismyfuture.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bunitu",
            "malware_alias": null,
            "malware_printable": "Bunitu",
            "first_seen_utc": "2025-09-01 12:24:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "bunitu,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579590": [
        {
            "ioc_value": "daddadasd-29521.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-01 12:23:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579591": [
        {
            "ioc_value": "dns.njalla.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-01 12:23:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579592": [
        {
            "ioc_value": "dns.njalla.si",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-01 12:23:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1579054": [
        {
            "ioc_value": "account.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-01 12:01:35",
            "last_seen_utc": "2025-09-02 04:01:11",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+account.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579053": [
        {
            "ioc_value": "800flower.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-09-01 12:01:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.16.1+800flower.cyou",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Ermac,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579045": [
        {
            "ioc_value": "amarrepago25.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-01 12:00:44",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-l4rxzael21",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579046": [
        {
            "ioc_value": "fteamez7iurs01.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-09-01 12:00:44",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-h434fssnw3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579044": [
        {
            "ioc_value": "hirox81444-21878.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-01 12:00:36",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-j664kasr16",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579043": [
        {
            "ioc_value": "saftycar.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-01 12:00:35",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-l15dwsek5t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579021": [
        {
            "ioc_value": "up.qenogia7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 11:51:06",
            "last_seen_utc": "2025-09-01 10:09:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579023": [
        {
            "ioc_value": "poertywindow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-01 11:51:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115128496943673248",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1579025": [
        {
            "ioc_value": "futurenaturallistic.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-09-01 11:51:04",
            "last_seen_utc": "2025-09-01 10:11:05",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115128496943673248",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1579029": [
        {
            "ioc_value": "tr.qenogia7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 11:51:03",
            "last_seen_utc": "2025-09-01 11:24:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579030": [
        {
            "ioc_value": "nx.qenogia7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 11:51:02",
            "last_seen_utc": "2025-09-01 11:10:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579028": [
        {
            "ioc_value": "savoref.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 10:13:09",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579003": [
        {
            "ioc_value": "rur.qenogia7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 09:57:04",
            "last_seen_utc": "2025-09-01 09:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1579013": [
        {
            "ioc_value": "dirtdsbv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:41:58",
            "last_seen_utc": "2025-09-01 15:13:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579014": [
        {
            "ioc_value": "pivzyhjq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:41:58",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579015": [
        {
            "ioc_value": "ordczzp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:41:58",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579016": [
        {
            "ioc_value": "ancirbf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:41:58",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579017": [
        {
            "ioc_value": "eleormb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:41:58",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579018": [
        {
            "ioc_value": "actcuavh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:41:58",
            "last_seen_utc": "2025-09-01 15:13:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579004": [
        {
            "ioc_value": "caltpps.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:40:09",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579005": [
        {
            "ioc_value": "bastxtu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:40:09",
            "last_seen_utc": "2025-09-01 20:48:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579006": [
        {
            "ioc_value": "appedfx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:40:09",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579007": [
        {
            "ioc_value": "libahqg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:40:09",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579008": [
        {
            "ioc_value": "chrynks.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:40:09",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579009": [
        {
            "ioc_value": "pubceva.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:40:09",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579010": [
        {
            "ioc_value": "somefed.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:40:09",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579011": [
        {
            "ioc_value": "hotpsyb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:40:09",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579012": [
        {
            "ioc_value": "despofe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-09-01 09:40:09",
            "last_seen_utc": "2025-09-01 20:01:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1579000": [
        {
            "ioc_value": "nvk.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 09:09:39",
            "last_seen_utc": "2025-09-01 09:09:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578984": [
        {
            "ioc_value": "zf.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 08:57:28",
            "last_seen_utc": "2025-09-01 07:40:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578993": [
        {
            "ioc_value": "zfp.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 08:57:27",
            "last_seen_utc": "2025-09-01 08:08:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578994": [
        {
            "ioc_value": "hu.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 08:57:27",
            "last_seen_utc": "2025-09-01 08:40:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578995": [
        {
            "ioc_value": "tmello.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-09-01 08:57:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "KongTuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578981": [
        {
            "ioc_value": "zk.toqyboe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 07:19:48",
            "last_seen_utc": "2025-09-01 07:02:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578978": [
        {
            "ioc_value": "yco.nufypiy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 06:47:34",
            "last_seen_utc": "2025-09-01 06:41:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578977": [
        {
            "ioc_value": "mgc.nufypiy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 06:10:05",
            "last_seen_utc": "2025-09-01 06:09:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578976": [
        {
            "ioc_value": "zbj22.zbj888uul.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-09-01 06:03:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-fq9yqsar8y",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578974": [
        {
            "ioc_value": "root123454321-24953.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-09-01 06:00:59",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-c9xkzahm7y",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578971": [
        {
            "ioc_value": "lookup2-42134.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-09-01 06:00:48",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250901-e7fwjsan2v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578598": [
        {
            "ioc_value": "vl.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:56:04",
            "last_seen_utc": "2025-08-31 15:10:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578599": [
        {
            "ioc_value": "ebn.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:56:03",
            "last_seen_utc": "2025-08-31 15:39:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578609": [
        {
            "ioc_value": "chromus.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-01 05:56:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578610": [
        {
            "ioc_value": "panelswp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-01 05:56:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578611": [
        {
            "ioc_value": "allworldnewses.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-01 05:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578816": [
        {
            "ioc_value": "iua.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:56:02",
            "last_seen_utc": "2025-08-31 16:52:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578819": [
        {
            "ioc_value": "gl.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:56:01",
            "last_seen_utc": "2025-08-31 17:03:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578821": [
        {
            "ioc_value": "mudanzasfacilghh.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-01 05:56:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578822": [
        {
            "ioc_value": "ga.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:56:00",
            "last_seen_utc": "2025-08-31 17:19:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578823": [
        {
            "ioc_value": "tgj.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:59",
            "last_seen_utc": "2025-08-31 17:49:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578838": [
        {
            "ioc_value": "yze.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:59",
            "last_seen_utc": "2025-08-31 18:30:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578847": [
        {
            "ioc_value": "chromusimus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-09-01 05:55:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578856": [
        {
            "ioc_value": "third-placing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-09-01 05:55:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/a7aa7f70-09b9-40a8-a3a9-9c79889e6d7a",
            "tags": "SheetRAT",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1578857": [
        {
            "ioc_value": "ztu.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:55",
            "last_seen_utc": "2025-08-31 20:08:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578895": [
        {
            "ioc_value": "pmu.gyjyvyy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:54",
            "last_seen_utc": "2025-08-31 20:31:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578902": [
        {
            "ioc_value": "te.migyvya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:52",
            "last_seen_utc": "2025-08-31 21:09:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578908": [
        {
            "ioc_value": "ogg.migyvya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:50",
            "last_seen_utc": "2025-08-31 22:09:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578909": [
        {
            "ioc_value": "hsd.migyvya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:48",
            "last_seen_utc": "2025-08-31 22:39:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578910": [
        {
            "ioc_value": "nr.migyvya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:47",
            "last_seen_utc": "2025-08-31 22:43:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578911": [
        {
            "ioc_value": "fvz.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:47",
            "last_seen_utc": "2025-08-31 23:10:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578926": [
        {
            "ioc_value": "sekegyu6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:47",
            "last_seen_utc": "2025-09-01 00:39:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578930": [
        {
            "ioc_value": "cq.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:46",
            "last_seen_utc": "2025-09-01 02:10:14",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578937": [
        {
            "ioc_value": "ve.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:45",
            "last_seen_utc": "2025-09-01 03:11:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578938": [
        {
            "ioc_value": "www.apprank.one",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-09-01 05:55:45",
            "last_seen_utc": "2025-10-21 07:27:33",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1578939": [
        {
            "ioc_value": "tfc.nufypiy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:44",
            "last_seen_utc": "2025-09-01 03:39:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578969": [
        {
            "ioc_value": "dc.nufypiy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:40",
            "last_seen_utc": "2025-09-01 05:10:33",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578499": [
        {
            "ioc_value": "computers-favorite.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-09-01 05:55:28",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-p8jnyasvfs",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1578500": [
        {
            "ioc_value": "pkq.toludye0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:27",
            "last_seen_utc": "2025-08-31 13:08:54",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578503": [
        {
            "ioc_value": "miq.toludye0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:27",
            "last_seen_utc": "2025-08-31 13:41:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578505": [
        {
            "ioc_value": "iz.toludye0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:27",
            "last_seen_utc": "2025-08-31 14:09:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578512": [
        {
            "ioc_value": "cfb.goxuxuy4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 05:55:26",
            "last_seen_utc": "2025-08-31 14:40:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578965": [
        {
            "ioc_value": "syswolupdatesupp1.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-09-01 04:01:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.16.1+syswolupdatesupp1.com",
            "tags": "Amatera,AS13335,C2,censys,CLOUDFLARENET,Panel,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578940": [
        {
            "ioc_value": "www.lianhua.xn--fiqs8s",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-09-01 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/156.238.243.107+www.lianhua.xn--fiqs8s",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1578928": [
        {
            "ioc_value": "ucx.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 01:39:01",
            "last_seen_utc": "2025-09-01 01:39:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1578925": [
        {
            "ioc_value": "my.lulugiy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-09-01 00:08:50",
            "last_seen_utc": "2025-09-01 00:08:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1578894": [
        {
            "ioc_value": "earffgm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:28:09",
            "last_seen_utc": "2025-09-01 15:13:50",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/earffgm.top",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578885": [
        {
            "ioc_value": "spripof.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:53",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578886": [
        {
            "ioc_value": "loudfci.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:53",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578887": [
        {
            "ioc_value": "typifdl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:53",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578888": [
        {
            "ioc_value": "larpfxs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:53",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578889": [
        {
            "ioc_value": "injurek.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:53",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578890": [
        {
            "ioc_value": "dietpas.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:53",
            "last_seen_utc": "2025-09-01 15:13:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578891": [
        {
            "ioc_value": "unmegrx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:53",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578892": [
        {
            "ioc_value": "cutatms.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:53",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578893": [
        {
            "ioc_value": "blooaeo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:53",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578879": [
        {
            "ioc_value": "overzmb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:52",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578880": [
        {
            "ioc_value": "plurcfq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:52",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578881": [
        {
            "ioc_value": "wesyjzn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:52",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578882": [
        {
            "ioc_value": "lawsifc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:52",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578883": [
        {
            "ioc_value": "optcows.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:52",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578884": [
        {
            "ioc_value": "onledyv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:26:52",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578871": [
        {
            "ioc_value": "bastbjt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:08",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578872": [
        {
            "ioc_value": "cyliwnv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:08",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578873": [
        {
            "ioc_value": "finijez.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:08",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578874": [
        {
            "ioc_value": "phenkce.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:08",
            "last_seen_utc": "2025-09-28 20:22:15",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578875": [
        {
            "ioc_value": "solacdf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:08",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578876": [
        {
            "ioc_value": "telesbx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:08",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578877": [
        {
            "ioc_value": "cozers.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:08",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578878": [
        {
            "ioc_value": "shorduy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:08",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578858": [
        {
            "ioc_value": "laterjs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578859": [
        {
            "ioc_value": "pintvv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578860": [
        {
            "ioc_value": "sancapq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578861": [
        {
            "ioc_value": "sepaglu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578862": [
        {
            "ioc_value": "sainofj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578863": [
        {
            "ioc_value": "lipafru.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578864": [
        {
            "ioc_value": "palldvz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578865": [
        {
            "ioc_value": "sinujhp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578866": [
        {
            "ioc_value": "cedacfc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578867": [
        {
            "ioc_value": "unexjhg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578868": [
        {
            "ioc_value": "parabcn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578869": [
        {
            "ioc_value": "tricyb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578870": [
        {
            "ioc_value": "passzce.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-31 20:25:07",
            "last_seen_utc": "2025-09-01 20:47:27",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578834": [
        {
            "ioc_value": "duncan01.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-31 18:03:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-s5cyrsej4t",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578833": [
        {
            "ioc_value": "igodoh123.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-31 18:03:17",
            "last_seen_utc": "2025-08-31 18:03:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-p7ectssvdy",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578831": [
        {
            "ioc_value": "igodoh123.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-31 18:03:16",
            "last_seen_utc": "2025-08-31 18:03:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-p7ectssvdy",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578832": [
        {
            "ioc_value": "spynet123.no-ip.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-31 18:03:16",
            "last_seen_utc": "2025-08-31 18:03:17",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-p7ectssvdy",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578829": [
        {
            "ioc_value": "microman2015.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-31 18:01:15",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-t1kcqafq5w",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578827": [
        {
            "ioc_value": "ratrithee.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-31 18:00:40",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-tkpx9swzfw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578826": [
        {
            "ioc_value": "keys2023.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-31 18:00:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-rccxmabl8x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578825": [
        {
            "ioc_value": "rat.varrisdom.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-31 18:00:28",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-v9jcfssrv3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578817": [
        {
            "ioc_value": "we.vupabya1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 16:52:37",
            "last_seen_utc": "2025-09-01 17:49:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1578608": [
        {
            "ioc_value": "a0.e.voltexpressdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-31 16:10:54",
            "last_seen_utc": "2025-09-01 12:10:29",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578493": [
        {
            "ioc_value": "tinarox.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-31 12:59:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "GenesisStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1578494": [
        {
            "ioc_value": "boostnoise.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-31 12:59:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "GenesisStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1578495": [
        {
            "ioc_value": "tinarox.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-31 12:59:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "GenesisStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1578496": [
        {
            "ioc_value": "boostnoise.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-31 12:59:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "GenesisStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1578486": [
        {
            "ioc_value": "nagjos.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:52:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578483": [
        {
            "ioc_value": "tomcatapachi.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:49:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578485": [
        {
            "ioc_value": "tomcat.wiki",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578481": [
        {
            "ioc_value": "yft.toludye0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:45:13",
            "last_seen_utc": "2025-08-31 12:40:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578482": [
        {
            "ioc_value": "videollan.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:45:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578478": [
        {
            "ioc_value": "pvtty.pw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:34:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578479": [
        {
            "ioc_value": "obsprojects.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:34:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578426": [
        {
            "ioc_value": "ia.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:30:55",
            "last_seen_utc": "2025-08-31 08:10:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578427": [
        {
            "ioc_value": "mhb.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:30:55",
            "last_seen_utc": "2025-08-31 08:38:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578434": [
        {
            "ioc_value": "hl.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:30:54",
            "last_seen_utc": "2025-08-31 09:11:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578437": [
        {
            "ioc_value": "keeypass.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:30:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578438": [
        {
            "ioc_value": "keepass.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:30:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578440": [
        {
            "ioc_value": "verification.keepass.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:30:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578441": [
        {
            "ioc_value": "secureview.keepass.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:30:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578444": [
        {
            "ioc_value": "cmqsqomiwwksmcsw.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-08-31 12:30:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578442": [
        {
            "ioc_value": "2908.photolives.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:30:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578445": [
        {
            "ioc_value": "macawiwmaacckuow.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-08-31 12:30:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578446": [
        {
            "ioc_value": "yeosyyyaewokgioa.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-08-31 12:30:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578448": [
        {
            "ioc_value": "ww.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:30:49",
            "last_seen_utc": "2025-08-31 09:39:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578450": [
        {
            "ioc_value": "yje.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:30:48",
            "last_seen_utc": "2025-08-31 10:10:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578452": [
        {
            "ioc_value": "ba.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:30:48",
            "last_seen_utc": "2025-08-31 10:39:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578453": [
        {
            "ioc_value": "xrc.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:30:47",
            "last_seen_utc": "2025-08-31 11:09:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578454": [
        {
            "ioc_value": "guu.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:30:47",
            "last_seen_utc": "2025-08-31 11:39:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578469": [
        {
            "ioc_value": "dfr.myhehaa4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 12:30:47",
            "last_seen_utc": "2025-08-31 12:10:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578472": [
        {
            "ioc_value": "wlinscp.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:30:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578473": [
        {
            "ioc_value": "anydeskt.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:30:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578474": [
        {
            "ioc_value": "anydeesk.ink",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:30:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578476": [
        {
            "ioc_value": "pvtty.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:30:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Fake Software,MetaStealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1578471": [
        {
            "ioc_value": "41.13.voltexpressdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-31 12:10:53",
            "last_seen_utc": "2025-08-31 15:10:27",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578468": [
        {
            "ioc_value": "qqa.preech.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-31 12:01:53",
            "last_seen_utc": "2025-08-31 12:01:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-hf1nesvjt2",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578466": [
        {
            "ioc_value": "img.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:01:24",
            "last_seen_utc": "2025-09-01 04:00:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+img.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578464": [
        {
            "ioc_value": "trk.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:01:23",
            "last_seen_utc": "2025-09-01 04:00:58",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+trk.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578465": [
        {
            "ioc_value": "kws5-1.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-31 12:01:23",
            "last_seen_utc": "2025-09-01 04:00:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+kws5-1.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578458": [
        {
            "ioc_value": "otoekekasa233.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-31 12:00:44",
            "last_seen_utc": "2025-09-13 11:43:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-jg8wvsvm12",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578457": [
        {
            "ioc_value": "adamblackie12312312-62714.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-31 12:00:43",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250831-nlhyfswps3",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578343": [
        {
            "ioc_value": "ac.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:27",
            "last_seen_utc": "2025-08-30 22:39:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578348": [
        {
            "ioc_value": "yz.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:27",
            "last_seen_utc": "2025-08-30 23:17:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578327": [
        {
            "ioc_value": "alk.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:26",
            "last_seen_utc": "2025-08-30 21:09:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578331": [
        {
            "ioc_value": "jd.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:26",
            "last_seen_utc": "2025-08-30 21:22:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578332": [
        {
            "ioc_value": "yi.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:26",
            "last_seen_utc": "2025-08-30 21:48:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578320": [
        {
            "ioc_value": "dm.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:24",
            "last_seen_utc": "2025-08-30 20:11:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578325": [
        {
            "ioc_value": "yy.cuzolia9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:24",
            "last_seen_utc": "2025-08-30 20:51:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578305": [
        {
            "ioc_value": "tl.reluxiy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:23",
            "last_seen_utc": "2025-08-30 19:09:02",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578308": [
        {
            "ioc_value": "ym.vadykoe7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:22",
            "last_seen_utc": "2025-08-30 19:40:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578303": [
        {
            "ioc_value": "qg.tyjysoe0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:21",
            "last_seen_utc": "2025-08-30 18:30:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578051": [
        {
            "ioc_value": "siradyo1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:20",
            "last_seen_utc": "2025-08-30 17:31:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578085": [
        {
            "ioc_value": "kywuzeo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:20",
            "last_seen_utc": "2025-08-30 17:40:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578048": [
        {
            "ioc_value": "zyxyqie.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:19",
            "last_seen_utc": "2025-08-30 16:31:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578050": [
        {
            "ioc_value": "ziqyrae.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:19",
            "last_seen_utc": "2025-08-30 17:16:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578046": [
        {
            "ioc_value": "hyhiqaa.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:18",
            "last_seen_utc": "2025-08-30 16:03:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578039": [
        {
            "ioc_value": "rihuwuo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:17",
            "last_seen_utc": "2025-08-30 15:39:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578036": [
        {
            "ioc_value": "cevyfoy.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:16",
            "last_seen_utc": "2025-08-30 15:28:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578347": [
        {
            "ioc_value": "lb.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:14",
            "last_seen_utc": "2025-08-30 23:04:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578349": [
        {
            "ioc_value": "cj.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:14",
            "last_seen_utc": "2025-08-30 23:40:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578358": [
        {
            "ioc_value": "qke.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:14",
            "last_seen_utc": "2025-08-31 00:10:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578365": [
        {
            "ioc_value": "jp.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:13",
            "last_seen_utc": "2025-08-31 02:40:45",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578362": [
        {
            "ioc_value": "zm.mexyxei9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:12",
            "last_seen_utc": "2025-08-31 02:08:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578366": [
        {
            "ioc_value": "yje.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:11",
            "last_seen_utc": "2025-08-31 03:09:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578367": [
        {
            "ioc_value": "appinstall.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-31 07:43:10",
            "last_seen_utc": "2025-10-21 07:27:33",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1578411": [
        {
            "ioc_value": "snh.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:10",
            "last_seen_utc": "2025-08-31 06:10:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578368": [
        {
            "ioc_value": "keyapp.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-31 07:43:09",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1578407": [
        {
            "ioc_value": "tl.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:08",
            "last_seen_utc": "2025-08-31 04:39:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578414": [
        {
            "ioc_value": "fv.xibovyu5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:07",
            "last_seen_utc": "2025-08-31 07:10:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578418": [
        {
            "ioc_value": "pv.libityi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-31 07:43:07",
            "last_seen_utc": "2025-08-31 07:39:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578416": [
        {
            "ioc_value": "rat.nicosoft.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-31 07:15:46",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/69746d52ef2210b22e6845afc0ea7aee9e86133364e0386fff37acaf2c9631c2/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578370": [
        {
            "ioc_value": "ec2-3-134-251-168.us-east-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-31 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.134.251.168+ec2-3-134-251-168.us-east-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1578371": [
        {
            "ioc_value": "auth.xinzyun.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-31 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.207.193.76+auth.xinzyun.cn",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1578334": [
        {
            "ioc_value": "attaocc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-30 22:23:48",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578335": [
        {
            "ioc_value": "limcuz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-30 22:23:48",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578336": [
        {
            "ioc_value": "justitt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-30 22:23:48",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578337": [
        {
            "ioc_value": "complve.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-30 22:23:48",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578338": [
        {
            "ioc_value": "huitpah.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-30 22:23:48",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578329": [
        {
            "ioc_value": "70.4.voltexpressdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-30 21:10:25",
            "last_seen_utc": "2025-08-31 11:10:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578306": [
        {
            "ioc_value": "pf.vozunaa0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 19:09:02",
            "last_seen_utc": "2025-08-31 15:39:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1578296": [
        {
            "ioc_value": "dudididididsadas-47367.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-30 18:00:31",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-pzct2ahj4v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578294": [
        {
            "ioc_value": "audio-soc.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-30 18:00:30",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-ttmt9s1zbz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578295": [
        {
            "ioc_value": "g-reveal.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-30 18:00:30",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-qacy6stmv5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578293": [
        {
            "ioc_value": "wednesday-posts.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-30 18:00:29",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-v4c89adj7w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578044": [
        {
            "ioc_value": "privacy-cs.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-30 16:01:17",
            "last_seen_utc": "2025-08-31 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+privacy-cs.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578045": [
        {
            "ioc_value": "cdn.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-30 16:01:17",
            "last_seen_utc": "2025-08-31 04:00:56",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+cdn.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578043": [
        {
            "ioc_value": "storage.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-30 16:01:16",
            "last_seen_utc": "2025-08-31 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+storage.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1578035": [
        {
            "ioc_value": "seheli.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 15:12:46",
            "last_seen_utc": "2025-08-30 15:10:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578027": [
        {
            "ioc_value": "solmub.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:44:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578022": [
        {
            "ioc_value": "armydevice.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-30 14:44:14",
            "last_seen_utc": "2025-11-22 10:06:36",
            "confidence_level": 100,
            "reference": "https://foresiet.com/blog/aura-stealer-malware-analysis/",
            "tags": "AURAStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578023": [
        {
            "ioc_value": "auracorp.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-30 14:44:14",
            "last_seen_utc": "2025-11-22 10:06:36",
            "confidence_level": 100,
            "reference": "https://foresiet.com/blog/aura-stealer-malware-analysis/",
            "tags": "AURAStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578024": [
        {
            "ioc_value": "opencamping.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-30 14:44:14",
            "last_seen_utc": "2025-11-22 10:06:36",
            "confidence_level": 100,
            "reference": "https://foresiet.com/blog/aura-stealer-malware-analysis/",
            "tags": "AURAStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578025": [
        {
            "ioc_value": "secondhandcloth.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-30 14:44:14",
            "last_seen_utc": "2025-11-22 10:06:36",
            "confidence_level": 100,
            "reference": "https://foresiet.com/blog/aura-stealer-malware-analysis/",
            "tags": "AURAStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578026": [
        {
            "ioc_value": "softytoys.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-30 14:44:14",
            "last_seen_utc": "2025-11-22 10:06:36",
            "confidence_level": 100,
            "reference": "https://foresiet.com/blog/aura-stealer-malware-analysis/",
            "tags": "AURAStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578011": [
        {
            "ioc_value": "hovera.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 14:39:46",
            "last_seen_utc": "2025-08-30 14:39:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578016": [
        {
            "ioc_value": "web.ktfs4.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:39:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578017": [
        {
            "ioc_value": "ynrlive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:39:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578018": [
        {
            "ioc_value": "liveisu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:39:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578019": [
        {
            "ioc_value": "ejalive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:39:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578020": [
        {
            "ioc_value": "we.bhelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:39:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578012": [
        {
            "ioc_value": "prloglink.prsa7.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:39:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578013": [
        {
            "ioc_value": "helpxir.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:39:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578014": [
        {
            "ioc_value": "ewssol.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:39:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578015": [
        {
            "ioc_value": "soljmp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-30 14:39:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1578010": [
        {
            "ioc_value": "lolora.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 14:09:00",
            "last_seen_utc": "2025-08-30 14:08:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577927": [
        {
            "ioc_value": "xyhyleo1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:35",
            "last_seen_utc": "2025-08-30 07:09:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577926": [
        {
            "ioc_value": "pimonoo9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:34",
            "last_seen_utc": "2025-08-30 06:39:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577928": [
        {
            "ioc_value": "gesamiu2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:33",
            "last_seen_utc": "2025-08-30 07:38:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577943": [
        {
            "ioc_value": "zinyjuu1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:30",
            "last_seen_utc": "2025-08-30 08:08:32",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577949": [
        {
            "ioc_value": "wonohi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:30",
            "last_seen_utc": "2025-08-30 09:39:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577951": [
        {
            "ioc_value": "buwyvo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:29",
            "last_seen_utc": "2025-08-30 10:07:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577955": [
        {
            "ioc_value": "wegazo.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:29",
            "last_seen_utc": "2025-08-30 10:38:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577962": [
        {
            "ioc_value": "fidoqi.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:28",
            "last_seen_utc": "2025-08-30 11:10:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577963": [
        {
            "ioc_value": "genutlx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-30 13:33:27",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1577965": [
        {
            "ioc_value": "battpnd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-30 13:33:27",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1577966": [
        {
            "ioc_value": "cuzavu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:26",
            "last_seen_utc": "2025-08-30 11:38:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577967": [
        {
            "ioc_value": "trainisshit.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-08-30 13:33:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1577995": [
        {
            "ioc_value": "sucile.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:24",
            "last_seen_utc": "2025-08-30 12:39:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1578002": [
        {
            "ioc_value": "xajazu.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 13:33:22",
            "last_seen_utc": "2025-08-30 13:08:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577996": [
        {
            "ioc_value": "adfbc0a2-084a-4b7a-8b76-199b04d6c816-00-2bvnr0w3yla5t.picard.replit.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-30 12:50:45",
            "last_seen_utc": "2025-08-30 15:49:23",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577994": [
        {
            "ioc_value": "52.64.voltexpressdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-30 12:10:38",
            "last_seen_utc": "2025-08-30 20:10:29",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577985": [
        {
            "ioc_value": "volume-defendant.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-30 12:01:23",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-nhk9eafr4z",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577972": [
        {
            "ioc_value": "31.ip.gl.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-30 12:00:24",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-j3xqqadk6s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577969": [
        {
            "ioc_value": "kinglear11.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-30 12:00:23",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-nrgycagk5w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577970": [
        {
            "ioc_value": "let-card.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-30 12:00:23",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-nmwkyagj5t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577971": [
        {
            "ioc_value": "input-editing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-30 12:00:23",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-mqal7sfj81",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577700": [
        {
            "ioc_value": "butizio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:34",
            "last_seen_utc": "2025-08-29 14:37:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577702": [
        {
            "ioc_value": "pufunyo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:33",
            "last_seen_utc": "2025-08-29 14:58:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577704": [
        {
            "ioc_value": "kimmenkiz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-30 06:24:33",
            "last_seen_utc": "2025-09-22 14:05:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1577708": [
        {
            "ioc_value": "dabafuo6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:32",
            "last_seen_utc": "2025-08-29 15:34:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577723": [
        {
            "ioc_value": "zupbyupmlh.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.agent_tesla",
            "malware_alias": "AgenTesla,AgentTesla,Negasteal",
            "malware_printable": "Agent Tesla",
            "first_seen_utc": "2025-08-30 06:24:32",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://app.any.run/tasks/8c5cd54a-f620-4201-aea3-12365e1381ed",
            "tags": "AgentTesla",
            "anonymous": "0",
            "reporter": "eternal"
        }
    ],
    "1577725": [
        {
            "ioc_value": "dewuhou7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:31",
            "last_seen_utc": "2025-08-29 16:40:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577727": [
        {
            "ioc_value": "kerubuo3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:31",
            "last_seen_utc": "2025-08-29 17:11:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577728": [
        {
            "ioc_value": "jumivue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:29",
            "last_seen_utc": "2025-08-29 17:37:12",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577743": [
        {
            "ioc_value": "gysehiy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:29",
            "last_seen_utc": "2025-08-29 18:39:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577744": [
        {
            "ioc_value": "musicoo1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:29",
            "last_seen_utc": "2025-08-29 18:59:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577746": [
        {
            "ioc_value": "wr.baruruy1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:29",
            "last_seen_utc": "2025-08-29 19:18:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577748": [
        {
            "ioc_value": "qokikau4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:28",
            "last_seen_utc": "2025-08-29 19:32:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577755": [
        {
            "ioc_value": "pt.gyvivae7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:27",
            "last_seen_utc": "2025-08-29 20:13:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577757": [
        {
            "ioc_value": "wc.dabytea7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:27",
            "last_seen_utc": "2025-08-29 20:33:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577763": [
        {
            "ioc_value": "vememye3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:24",
            "last_seen_utc": "2025-08-29 21:19:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577764": [
        {
            "ioc_value": "payrollghana.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-30 06:24:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1577766": [
        {
            "ioc_value": "kugavai4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:23",
            "last_seen_utc": "2025-08-29 21:38:23",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577768": [
        {
            "ioc_value": "ad.sapeniu2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:23",
            "last_seen_utc": "2025-08-29 21:56:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577772": [
        {
            "ioc_value": "bivedyi2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:23",
            "last_seen_utc": "2025-08-29 22:37:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577840": [
        {
            "ioc_value": "zapugoi7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:22",
            "last_seen_utc": "2025-08-30 02:29:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577841": [
        {
            "ioc_value": "zisoqiy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:22",
            "last_seen_utc": "2025-08-30 03:09:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577842": [
        {
            "ioc_value": "nojucua1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:21",
            "last_seen_utc": "2025-08-30 03:38:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577919": [
        {
            "ioc_value": "gevujya5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:12",
            "last_seen_utc": "2025-08-30 05:05:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577924": [
        {
            "ioc_value": "ludatae4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-30 06:24:11",
            "last_seen_utc": "2025-08-30 06:08:34",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577923": [
        {
            "ioc_value": "glauco69.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-30 06:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-aangxafj7y",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577920": [
        {
            "ioc_value": "been-club.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-30 06:00:20",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250830-am3scs1wez",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577845": [
        {
            "ioc_value": "www.stick.xn--fiqs8s",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-30 04:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/43.255.158.38+www.stick.xn--fiqs8s",
            "tags": "AS932,C2,censys,XNNET",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1577843": [
        {
            "ioc_value": "virtury.oreki.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-30 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.172.26.89+virtury.oreki.eu.org",
            "tags": "AS150315,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1577844": [
        {
            "ioc_value": "www.haowuxiu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-30 04:00:08",
            "last_seen_utc": "2025-09-02 04:00:12",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/39.100.74.54+www.haowuxiu.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1577837": [
        {
            "ioc_value": "37.101.voltexpressdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-30 01:10:23",
            "last_seen_utc": "2025-08-30 11:10:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577830": [
        {
            "ioc_value": "r3.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-30 00:01:25",
            "last_seen_utc": "2025-08-30 04:01:16",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+r3.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577831": [
        {
            "ioc_value": "rootdz.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-30 00:01:25",
            "last_seen_utc": "2025-08-30 04:01:17",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+rootdz.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577829": [
        {
            "ioc_value": "b2.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-30 00:01:24",
            "last_seen_utc": "2025-08-30 04:01:17",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+b2.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577825": [
        {
            "ioc_value": "www.libertydroid-magma.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-08-30 00:01:04",
            "last_seen_utc": "2025-08-30 04:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.63.215.79+www.libertydroid-magma.top",
            "tags": "AS24940,C2,censys,HETZNER-AS,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577809": [
        {
            "ioc_value": "monozfx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:20:27",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577810": [
        {
            "ioc_value": "milliam.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:20:27",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577811": [
        {
            "ioc_value": "atomqne.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:20:27",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577805": [
        {
            "ioc_value": "interbk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:19",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577789": [
        {
            "ioc_value": "pitbubs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577790": [
        {
            "ioc_value": "willozm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577791": [
        {
            "ioc_value": "waterkz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577792": [
        {
            "ioc_value": "stepwxv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577793": [
        {
            "ioc_value": "poisoha.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577794": [
        {
            "ioc_value": "aerokju.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577795": [
        {
            "ioc_value": "realhwo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577796": [
        {
            "ioc_value": "buttalx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577797": [
        {
            "ioc_value": "saltzmx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577798": [
        {
            "ioc_value": "ravimwz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577799": [
        {
            "ioc_value": "theapte.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577800": [
        {
            "ioc_value": "eminpxo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:51",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577801": [
        {
            "ioc_value": "backkrj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577802": [
        {
            "ioc_value": "acarkkg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:47",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577803": [
        {
            "ioc_value": "rapsmmv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:55",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577804": [
        {
            "ioc_value": "grodpgy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:18",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577785": [
        {
            "ioc_value": "ozoned.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:17",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577786": [
        {
            "ioc_value": "meadofnb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:17",
            "last_seen_utc": "2025-09-01 15:13:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577787": [
        {
            "ioc_value": "gravilh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:17",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577788": [
        {
            "ioc_value": "blacksu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 23:10:17",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577779": [
        {
            "ioc_value": "ns2.pakistancode.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 22:49:08",
            "last_seen_utc": "2025-10-14 07:51:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577778": [
        {
            "ioc_value": "ns1.pakistancode.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 22:49:06",
            "last_seen_utc": "2025-10-14 07:51:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577775": [
        {
            "ioc_value": "n1.google-analytcis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 22:49:03",
            "last_seen_utc": "2025-12-14 11:48:10",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577776": [
        {
            "ioc_value": "n2.google-analytcis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 22:49:03",
            "last_seen_utc": "2025-12-14 11:48:10",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577777": [
        {
            "ioc_value": "n3.google-analytcis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 22:49:03",
            "last_seen_utc": "2025-12-14 11:48:10",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577774": [
        {
            "ioc_value": "lab.google-analytcis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 22:49:01",
            "last_seen_utc": "2025-12-14 11:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577773": [
        {
            "ioc_value": "auth.inmediavault.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 22:48:54",
            "last_seen_utc": "2025-12-14 11:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577753": [
        {
            "ioc_value": "static.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 20:01:17",
            "last_seen_utc": "2025-08-30 04:01:16",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+static.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577740": [
        {
            "ioc_value": "senaildebe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-08-29 18:01:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-te2pwavxcy",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577741": [
        {
            "ioc_value": "adoniexmar.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-08-29 18:01:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-te2pwavxcy",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577738": [
        {
            "ioc_value": "mauasas35safael5.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-29 18:00:35",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-ttdxcsyqt7",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577735": [
        {
            "ioc_value": "mauasas35safael2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-29 18:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-ttdxcsyqt7",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577736": [
        {
            "ioc_value": "mauasas35safael3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-29 18:00:34",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-ttdxcsyqt7",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577737": [
        {
            "ioc_value": "mauasas35safael4.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-29 18:00:34",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-ttdxcsyqt7",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577734": [
        {
            "ioc_value": "mauasas35safael1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-29 18:00:33",
            "last_seen_utc": "2025-08-29 18:00:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-ttdxcsyqt7",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577732": [
        {
            "ioc_value": "expected-sleeps.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-29 18:00:21",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-vrbvnav1g1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577733": [
        {
            "ioc_value": "engineering-consensus.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-29 18:00:21",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-sxy62afl9y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577731": [
        {
            "ioc_value": "lines-jordan.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-29 18:00:20",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-we6pyagk7t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577701": [
        {
            "ioc_value": "genuumc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 14:49:15",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-m3dvdsvrt2",
            "tags": "c2,domain,Lumma,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577678": [
        {
            "ioc_value": "couturellin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-29 14:21:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115111998021449477",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1577680": [
        {
            "ioc_value": "humble-photo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-29 14:21:37",
            "last_seen_utc": "2025-08-29 12:15:08",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115111998021449477",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1577690": [
        {
            "ioc_value": "app.montreallimousineservice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-29 14:21:37",
            "last_seen_utc": "2025-08-29 13:15:47",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115112218038599633",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1577695": [
        {
            "ioc_value": "stats.pinaview.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ghostsocks",
            "malware_alias": null,
            "malware_printable": "GhostSocks",
            "first_seen_utc": "2025-08-29 14:21:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://tria.ge/250829-qkpqqaxjt9/behavioral3",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1577696": [
        {
            "ioc_value": "track.pinaview.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ghostsocks",
            "malware_alias": null,
            "malware_printable": "GhostSocks",
            "first_seen_utc": "2025-08-29 14:21:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://tria.ge/250829-qkpqqaxjt9/behavioral3",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1577697": [
        {
            "ioc_value": "mimyfai0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 14:21:35",
            "last_seen_utc": "2025-08-29 13:41:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577699": [
        {
            "ioc_value": "diruroy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 14:21:31",
            "last_seen_utc": "2025-08-29 14:12:15",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1577691": [
        {
            "ioc_value": "cavehuy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 13:10:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1577687": [
        {
            "ioc_value": "muma.91xs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 12:50:29",
            "last_seen_utc": "2025-10-02 11:49:53",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577686": [
        {
            "ioc_value": "c2.wifi.hypdncy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 12:50:20",
            "last_seen_utc": "2025-10-09 07:50:39",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577685": [
        {
            "ioc_value": "1311056882-lcqm122smr.ap-guangzhou.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 12:50:15",
            "last_seen_utc": "2025-09-29 11:50:45",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577684": [
        {
            "ioc_value": "samyfiy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 12:40:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1577676": [
        {
            "ioc_value": "14.ae.voltexpressdelivery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-29 12:10:28",
            "last_seen_utc": "2025-08-30 00:10:43",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1577673": [
        {
            "ioc_value": "vyjilua3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 12:09:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1577671": [
        {
            "ioc_value": "tnuuu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-29 12:01:59",
            "last_seen_utc": "2025-08-29 12:01:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-g8vr7sy1gt",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577669": [
        {
            "ioc_value": "app.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 12:01:16",
            "last_seen_utc": "2025-08-30 04:01:17",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+app.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577654": [
        {
            "ioc_value": "fuckrat.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-29 12:00:20",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-kawtdstqt3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577653": [
        {
            "ioc_value": "only-standing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-29 12:00:19",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-nklyqawkz9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577649": [
        {
            "ioc_value": "murphkirk.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-08-29 11:45:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1577647": [
        {
            "ioc_value": "qegikua9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 11:38:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1577643": [
        {
            "ioc_value": "tiwahyi6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 11:03:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1577636": [
        {
            "ioc_value": "oneflof.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 09:08:32",
            "last_seen_utc": "2025-09-22 14:05:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1577637": [
        {
            "ioc_value": "epitherd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 09:08:32",
            "last_seen_utc": "2025-09-22 14:05:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1577638": [
        {
            "ioc_value": "backab.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 09:08:32",
            "last_seen_utc": "2025-09-22 14:05:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1577639": [
        {
            "ioc_value": "eigwos.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 09:08:31",
            "last_seen_utc": "2025-09-22 14:05:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1577618": [
        {
            "ioc_value": "rs.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 08:01:23",
            "last_seen_utc": "2025-08-30 04:01:16",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+rs.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1577596": [
        {
            "ioc_value": "wblspc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-29 07:06:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576332": [
        {
            "ioc_value": "es6featureshub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-29 06:42:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576326": [
        {
            "ioc_value": "mityxyo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 06:42:06",
            "last_seen_utc": "2025-08-28 12:08:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576333": [
        {
            "ioc_value": "prototypechain.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-29 06:42:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576334": [
        {
            "ioc_value": "debuggingscripts.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-29 06:42:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576335": [
        {
            "ioc_value": "typescripttools.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-29 06:42:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576340": [
        {
            "ioc_value": "cudefoe9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 06:42:01",
            "last_seen_utc": "2025-08-28 13:10:31",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576336": [
        {
            "ioc_value": "javascriptbasics.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-29 06:42:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576337": [
        {
            "ioc_value": "buvusio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 06:42:00",
            "last_seen_utc": "2025-08-28 12:45:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576342": [
        {
            "ioc_value": "files.taxibleapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-29 06:41:59",
            "last_seen_utc": "2025-08-28 13:15:52",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115106557945032541",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1576343": [
        {
            "ioc_value": "mql5.offers-special.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576347": [
        {
            "ioc_value": "mykutea4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 06:41:58",
            "last_seen_utc": "2025-08-28 13:41:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576351": [
        {
            "ioc_value": "spider-wamp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-29 06:41:56",
            "last_seen_utc": "2025-08-28 14:02:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1576349": [
        {
            "ioc_value": "linomu.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-29 06:41:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1576365": [
        {
            "ioc_value": "freaks.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-08-29 06:41:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1576367": [
        {
            "ioc_value": "salvmps.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 06:41:49",
            "last_seen_utc": "2025-09-01 15:13:56",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1576368": [
        {
            "ioc_value": "saocloud.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576376": [
        {
            "ioc_value": "swrcfjlm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 06:41:48",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1576379": [
        {
            "ioc_value": "nimdelcapital.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576381": [
        {
            "ioc_value": "proteamgroup.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:45",
            "last_seen_utc": "2025-08-28 18:34:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576386": [
        {
            "ioc_value": "axiscx.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576384": [
        {
            "ioc_value": "qhost.ro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576387": [
        {
            "ioc_value": "healthstation1.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576389": [
        {
            "ioc_value": "washerv.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 06:41:41",
            "last_seen_utc": "2025-09-01 15:13:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1576390": [
        {
            "ioc_value": "noggs.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 06:41:40",
            "last_seen_utc": "2025-09-22 14:05:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1576391": [
        {
            "ioc_value": "georgej.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-29 06:41:40",
            "last_seen_utc": "2025-09-22 14:05:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1576392": [
        {
            "ioc_value": "macusa.best",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576395": [
        {
            "ioc_value": "tadanohito.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576396": [
        {
            "ioc_value": "cloudflare-c9g.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576397": [
        {
            "ioc_value": "macnaved.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:37",
            "last_seen_utc": "2025-08-28 19:14:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576398": [
        {
            "ioc_value": "cloudflarev-pfm.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576400": [
        {
            "ioc_value": "cloudverify-1ua.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576401": [
        {
            "ioc_value": "cloudfarev.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-29 06:41:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1576402": [
        {
            "ioc_value": "ANIMAILSHEALTHYFOODSLINE.TOP",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-29 06:41:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "simplehelp",
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1576440": [
        {
            "ioc_value": "susedey1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 06:41:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576441": [
        {
            "ioc_value": "tirohua7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 06:41:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576723": [
        {
            "ioc_value": "dugoreu2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-29 06:16:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1576722": [
        {
            "ioc_value": "complete-youth.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-29 06:03:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-d946gssmv2",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576721": [
        {
            "ioc_value": "pepesigmarespect.servemp3.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-08-29 06:01:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-dpyg7sysbv",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576715": [
        {
            "ioc_value": "62e993f98a75.ngrok-free.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-29 06:00:38",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-be7l1sej5x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576716": [
        {
            "ioc_value": "connections.ignorelist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-29 06:00:38",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-be7l1sej5x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576717": [
        {
            "ioc_value": "grandoner.cloudns.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-29 06:00:38",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-be7l1sej5x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576714": [
        {
            "ioc_value": "testconnection.servemp3.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-29 06:00:37",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250829-be7l1sej5x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576676": [
        {
            "ioc_value": "www.qinyue.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-29 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/154.12.26.73+www.qinyue.cc",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1576657": [
        {
            "ioc_value": "2ch.im.versiononefinance.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-28 23:10:24",
            "last_seen_utc": "2025-08-29 11:10:27",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1576433": [
        {
            "ioc_value": "reklama.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-28 20:01:35",
            "last_seen_utc": "2025-08-29 04:01:01",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+reklama.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576371": [
        {
            "ioc_value": "g100cf.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-28 18:00:15",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250828-qnnyla11cy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576370": [
        {
            "ioc_value": "linux-seminars.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-28 18:00:14",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250828-t7tjzatset",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576357": [
        {
            "ioc_value": "dru.x.fortisheritagebank.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-28 15:10:26",
            "last_seen_utc": "2025-08-28 22:10:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "gtt/9,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1576322": [
        {
            "ioc_value": "mierwos.loseyourip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-28 12:00:37",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250828-m5dmeazye1",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576321": [
        {
            "ioc_value": "morad.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-28 12:00:35",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250828-m5dmeazye1",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576320": [
        {
            "ioc_value": "screenconecctserv.giize.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-28 12:00:34",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250828-m5dmeazye1",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576313": [
        {
            "ioc_value": "hylyqoo2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 11:44:13",
            "last_seen_utc": "2025-08-28 11:12:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576315": [
        {
            "ioc_value": "bawejai1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 11:44:12",
            "last_seen_utc": "2025-08-28 11:37:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576310": [
        {
            "ioc_value": "rezufaa4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 10:46:38",
            "last_seen_utc": "2025-08-28 09:39:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576312": [
        {
            "ioc_value": "vajigiy7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 10:46:37",
            "last_seen_utc": "2025-08-28 10:20:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576308": [
        {
            "ioc_value": "myqareu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 09:24:13",
            "last_seen_utc": "2025-08-28 08:53:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576309": [
        {
            "ioc_value": "hovopuy9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 09:24:12",
            "last_seen_utc": "2025-08-28 09:09:10",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576300": [
        {
            "ioc_value": "rubalyi3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 08:02:13",
            "last_seen_utc": "2025-08-28 07:39:11",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576305": [
        {
            "ioc_value": "dev.cukurukuk.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-28 08:00:48",
            "last_seen_utc": "2025-08-29 04:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.235.75.42+dev.cukurukuk.fun",
            "tags": "AS135444,C2,censys,Havoc,IDNIC-IKUBARU-AS-ID",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576296": [
        {
            "ioc_value": "pcx.h.fortisheritagebank.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-28 07:28:18",
            "last_seen_utc": "2025-08-28 14:10:50",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1576288": [
        {
            "ioc_value": "maxoxio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 07:27:07",
            "last_seen_utc": "2025-08-28 07:18:35",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1576291": [
        {
            "ioc_value": "carowf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-28 07:21:14",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250828-fpkmfsbq31",
            "tags": "c2,domain,lumma,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576290": [
        {
            "ioc_value": "ebalazhabagadyku.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-08-28 07:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250828-e3spjs1qy5",
            "tags": "c2,domain,stealc,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1576283": [
        {
            "ioc_value": "JYNX404-53109.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-28 06:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576284": [
        {
            "ioc_value": "engine-decide.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-28 06:56:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576277": [
        {
            "ioc_value": "www.y488.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576278": [
        {
            "ioc_value": "www.ybx64y.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576279": [
        {
            "ioc_value": "www.zjiaqi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576255": [
        {
            "ioc_value": "www.renagames.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576256": [
        {
            "ioc_value": "www.rhalten.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576257": [
        {
            "ioc_value": "www.rhamoutreach.center",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576258": [
        {
            "ioc_value": "www.rr01h.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576259": [
        {
            "ioc_value": "www.rysimpson-judgeteam.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576260": [
        {
            "ioc_value": "www.sbxn0.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576261": [
        {
            "ioc_value": "www.spgo2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576262": [
        {
            "ioc_value": "www.spiringhopetherapy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576263": [
        {
            "ioc_value": "www.svsku.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576264": [
        {
            "ioc_value": "www.telierprive.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576265": [
        {
            "ioc_value": "www.terators-harmful.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576266": [
        {
            "ioc_value": "www.tonano.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576267": [
        {
            "ioc_value": "www.touvl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576268": [
        {
            "ioc_value": "www.trckt.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576269": [
        {
            "ioc_value": "www.utch-lessons-utrecht.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576270": [
        {
            "ioc_value": "www.utiara88slot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576271": [
        {
            "ioc_value": "www.v9.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576272": [
        {
            "ioc_value": "www.vemaci.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576273": [
        {
            "ioc_value": "www.vetxiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576274": [
        {
            "ioc_value": "www.vixmedical.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576275": [
        {
            "ioc_value": "www.xoyopa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576276": [
        {
            "ioc_value": "www.xrdj6.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576232": [
        {
            "ioc_value": "www.nviodigiitaalmail.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576233": [
        {
            "ioc_value": "www.nviodigitalbox.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576234": [
        {
            "ioc_value": "www.o-tci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576235": [
        {
            "ioc_value": "www.oinlivegoodbusiness.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576236": [
        {
            "ioc_value": "www.okhaus.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576237": [
        {
            "ioc_value": "www.oldsmitglass.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576238": [
        {
            "ioc_value": "www.olimit4.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576239": [
        {
            "ioc_value": "www.omcafe.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576240": [
        {
            "ioc_value": "www.op-lottery.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576241": [
        {
            "ioc_value": "www.oto.africa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576242": [
        {
            "ioc_value": "www.ourbon.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576243": [
        {
            "ioc_value": "www.overed-terrace-12433.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576244": [
        {
            "ioc_value": "www.peneochub.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576245": [
        {
            "ioc_value": "www.pentomorrow-team.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576246": [
        {
            "ioc_value": "www.pi0wp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576247": [
        {
            "ioc_value": "www.pitegromab.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576248": [
        {
            "ioc_value": "www.plta.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576249": [
        {
            "ioc_value": "www.poe154.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576250": [
        {
            "ioc_value": "www.psrn.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576251": [
        {
            "ioc_value": "www.pyd290.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576252": [
        {
            "ioc_value": "www.rankie-shop.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576253": [
        {
            "ioc_value": "www.ranscooter.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576254": [
        {
            "ioc_value": "www.readepagamentodocliente.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576211": [
        {
            "ioc_value": "www.hyd309.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576212": [
        {
            "ioc_value": "www.ian450.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576213": [
        {
            "ioc_value": "www.iaurro.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576214": [
        {
            "ioc_value": "www.iendaneba.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576215": [
        {
            "ioc_value": "www.ij300.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576216": [
        {
            "ioc_value": "www.ingfengyun.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576217": [
        {
            "ioc_value": "www.inoro.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576218": [
        {
            "ioc_value": "www.intechwizard.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576219": [
        {
            "ioc_value": "www.iq0wh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576220": [
        {
            "ioc_value": "www.ir-condition-56201.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576221": [
        {
            "ioc_value": "www.irtrghhgfgerd.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576222": [
        {
            "ioc_value": "www.j-guiapg.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576223": [
        {
            "ioc_value": "www.j-turismopg.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576224": [
        {
            "ioc_value": "www.jyjmm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576225": [
        {
            "ioc_value": "www.lackheads-treatment-54469.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576226": [
        {
            "ioc_value": "www.lassicaluxe.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576227": [
        {
            "ioc_value": "www.layclub-win.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576228": [
        {
            "ioc_value": "www.lobalschoolfinder.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576229": [
        {
            "ioc_value": "www.loo-meet.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576230": [
        {
            "ioc_value": "www.nglish-class-in12.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576231": [
        {
            "ioc_value": "www.nline-dating-90203.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576188": [
        {
            "ioc_value": "www.e944.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576189": [
        {
            "ioc_value": "www.ealmworld563.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576190": [
        {
            "ioc_value": "www.ecordsuspension.services",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576191": [
        {
            "ioc_value": "www.eds-bz.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576192": [
        {
            "ioc_value": "www.eet-new-people-35202.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576193": [
        {
            "ioc_value": "www.eet-new-people-42361.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576194": [
        {
            "ioc_value": "www.eeyee.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576195": [
        {
            "ioc_value": "www.elegcpnm.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576196": [
        {
            "ioc_value": "www.ellogreentechproducts.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576197": [
        {
            "ioc_value": "www.encentvxug.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576198": [
        {
            "ioc_value": "www.enviodoocorreio.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576199": [
        {
            "ioc_value": "www.ergki.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576200": [
        {
            "ioc_value": "www.et-simpson-judgehq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576201": [
        {
            "ioc_value": "www.ewelry-39148.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576202": [
        {
            "ioc_value": "www.eylonesports.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576203": [
        {
            "ioc_value": "www.fhtre.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576204": [
        {
            "ioc_value": "www.fxk6i.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576205": [
        {
            "ioc_value": "www.g8.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576206": [
        {
            "ioc_value": "www.gbrfvedc556.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576207": [
        {
            "ioc_value": "www.gyl.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576208": [
        {
            "ioc_value": "www.hopluxurys.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576209": [
        {
            "ioc_value": "www.hoppers.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576210": [
        {
            "ioc_value": "www.hy-is-tiktok-back.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576167": [
        {
            "ioc_value": "www.8622.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576168": [
        {
            "ioc_value": "www.8j08o.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576169": [
        {
            "ioc_value": "www.956.ceo",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576170": [
        {
            "ioc_value": "www.a-lumiosa.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576171": [
        {
            "ioc_value": "www.ampiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576172": [
        {
            "ioc_value": "www.ands.services",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576173": [
        {
            "ioc_value": "www.anfa.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576174": [
        {
            "ioc_value": "www.angfuji.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576175": [
        {
            "ioc_value": "www.arkinsons-treatment-15707.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576176": [
        {
            "ioc_value": "www.arshaastore.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576177": [
        {
            "ioc_value": "www.artadecondutorjunho.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576178": [
        {
            "ioc_value": "www.aser-hair-removal-dje.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576179": [
        {
            "ioc_value": "www.asorobles.pizza",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576180": [
        {
            "ioc_value": "www.attcursor.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576181": [
        {
            "ioc_value": "www.avddk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576182": [
        {
            "ioc_value": "www.b811.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576183": [
        {
            "ioc_value": "www.c0679.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576184": [
        {
            "ioc_value": "www.c4509.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576185": [
        {
            "ioc_value": "www.c4821.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576186": [
        {
            "ioc_value": "www.ceberg.black",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576187": [
        {
            "ioc_value": "www.deacloud.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576154": [
        {
            "ioc_value": "www.1e1ff22.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576155": [
        {
            "ioc_value": "www.1sosq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576156": [
        {
            "ioc_value": "www.1vwud.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576157": [
        {
            "ioc_value": "www.24d9b8e.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576158": [
        {
            "ioc_value": "www.2yxp0.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576159": [
        {
            "ioc_value": "www.30cc.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576160": [
        {
            "ioc_value": "www.3sao.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576161": [
        {
            "ioc_value": "www.3x.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576162": [
        {
            "ioc_value": "www.400forestwood.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576163": [
        {
            "ioc_value": "www.55501.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576164": [
        {
            "ioc_value": "www.6417968.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576165": [
        {
            "ioc_value": "www.73102.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576166": [
        {
            "ioc_value": "www.849n7the.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-28 06:54:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1576023": [
        {
            "ioc_value": "scorpionvirus.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-28 06:53:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1575901": [
        {
            "ioc_value": "fkyhelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-28 06:46:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575900": [
        {
            "ioc_value": "yfvlive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-28 06:46:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575892": [
        {
            "ioc_value": "careoaz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-28 06:42:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575885": [
        {
            "ioc_value": "scambaiting001-34039.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-28 06:00:57",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250828-eqfjfsbk4v",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575884": [
        {
            "ioc_value": "cbzr-98pq1.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-28 06:00:21",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250828-akm9wszkz3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575563": [
        {
            "ioc_value": "quickomat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-28 05:47:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1575564": [
        {
            "ioc_value": "lyjydau5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:45",
            "last_seen_utc": "2025-08-27 19:37:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575589": [
        {
            "ioc_value": "savenay2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:43",
            "last_seen_utc": "2025-08-27 21:55:47",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575881": [
        {
            "ioc_value": "zeniqaa7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575880": [
        {
            "ioc_value": "sipejou7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575882": [
        {
            "ioc_value": "dodiquy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:40",
            "last_seen_utc": "2025-08-28 06:11:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575583": [
        {
            "ioc_value": "gytovao5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:33",
            "last_seen_utc": "2025-08-27 20:38:18",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575588": [
        {
            "ioc_value": "jiriwia8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:33",
            "last_seen_utc": "2025-08-27 21:14:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575592": [
        {
            "ioc_value": "dedyhao2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575593": [
        {
            "ioc_value": "bitxps.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-28 05:47:32",
            "last_seen_utc": "2025-09-01 15:13:48",
            "confidence_level": 100,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1575594": [
        {
            "ioc_value": "repottenfuc.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-28 05:47:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1575595": [
        {
            "ioc_value": "fractux.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-28 05:47:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1575596": [
        {
            "ioc_value": "macropoffen.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-28 05:47:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1575817": [
        {
            "ioc_value": "wevolyo4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575825": [
        {
            "ioc_value": "jakacea2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575844": [
        {
            "ioc_value": "wajinye8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575848": [
        {
            "ioc_value": "wofehoo0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575559": [
        {
            "ioc_value": "qunohei5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-28 05:47:09",
            "last_seen_utc": "2025-08-27 19:16:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1575862": [
        {
            "ioc_value": "ec2-54-66-50-36.ap-southeast-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-28 04:00:38",
            "last_seen_utc": "2025-08-28 04:00:48",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/54.66.50.36+ec2-54-66-50-36.ap-southeast-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1575853": [
        {
            "ioc_value": "hippopotamusyou.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-28 04:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.147.241.10+hippopotamusyou.site",
            "tags": "AS4213,C2,censys,EVOCATIVE-GLOBAL",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1575854": [
        {
            "ioc_value": "processingfile.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-28 04:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.147.241.10+processingfile.com",
            "tags": "AS4213,C2,censys,EVOCATIVE-GLOBAL",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1575851": [
        {
            "ioc_value": "pan.xinzyun.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-28 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.207.193.76+pan.xinzyun.cn",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1575850": [
        {
            "ioc_value": "screened.autoinsurecare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-28 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/173.254.201.23+screened.autoinsurecare.com",
            "tags": "AS-COLOCROSSING,AS36352,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1575578": [
        {
            "ioc_value": "geneqey6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 20:01:49",
            "last_seen_utc": "2025-08-27 20:22:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575556": [
        {
            "ioc_value": "fix-project.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-27 18:46:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-w7jqwaszc1/behavioral1",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1575553": [
        {
            "ioc_value": "xihilia5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 18:29:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575552": [
        {
            "ioc_value": "pisamya8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 18:19:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575545": [
        {
            "ioc_value": "enviosenvios8899.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-27 18:01:03",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-pn834adn4t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575546": [
        {
            "ioc_value": "freexfree2025.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-27 18:01:03",
            "last_seen_utc": "2025-09-13 11:43:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-kfm4faan3t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575544": [
        {
            "ioc_value": "ysgnmmjmmj.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-27 18:00:55",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-j9a6asam3x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575541": [
        {
            "ioc_value": "trabalhoescolar7.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-27 18:00:48",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-qel3mszzby",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575542": [
        {
            "ioc_value": "paris-cds.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-27 18:00:48",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-pqm9eadn7t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575540": [
        {
            "ioc_value": "woxivie8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 17:58:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575539": [
        {
            "ioc_value": "gomocya2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 17:38:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575521": [
        {
            "ioc_value": "readydocument-download.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-27 17:22:20",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/c6ff86039714b862389db1ecb2cbf684beca716d91a95e1999debd5c24752a75/",
            "tags": "PDQ",
            "anonymous": "0",
            "reporter": "eternal"
        }
    ],
    "1575522": [
        {
            "ioc_value": "state-swiss-info.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-27 17:22:19",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "PDQ",
            "anonymous": "0",
            "reporter": "eternal"
        }
    ],
    "1575527": [
        {
            "ioc_value": "ahmm.ca",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-27 17:22:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115101836604754160",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1575529": [
        {
            "ioc_value": "shark-watewer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-27 17:22:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115101836604754160",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1575531": [
        {
            "ioc_value": "stradomi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-27 17:22:13",
            "last_seen_utc": "2025-08-27 17:10:58",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115101836604754160",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1575536": [
        {
            "ioc_value": "comparisons-builder-loves-ratios.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-08-27 17:22:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1575537": [
        {
            "ioc_value": "qahodey5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 17:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575524": [
        {
            "ioc_value": "gepinui5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 17:02:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575520": [
        {
            "ioc_value": "kodulue6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 16:25:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575511": [
        {
            "ioc_value": "xepetiu7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 15:59:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575510": [
        {
            "ioc_value": "hexoluy6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 15:38:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575509": [
        {
            "ioc_value": "duwixoi9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 15:23:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575494": [
        {
            "ioc_value": "camitel.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-08-27 15:13:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1575497": [
        {
            "ioc_value": "mebejaa7.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 14:41:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575493": [
        {
            "ioc_value": "pets.thevoicefordogs.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-27 14:20:33",
            "last_seen_utc": "2025-08-27 14:59:39",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115101139895739652",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1575490": [
        {
            "ioc_value": "jsruigbvsikurhgvb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-27 14:06:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-n9ntlscr81",
            "tags": "domain,rat,screenconnect,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575478": [
        {
            "ioc_value": "file-neww-downready.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-27 14:02:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/b4b75a1667562bac7e6cbd8f519fb429f6c067ef2fb4724dcf625ab03bea3d68/",
            "tags": "PDQ,ScreenConnect",
            "anonymous": "0",
            "reporter": "eternal"
        }
    ],
    "1575489": [
        {
            "ioc_value": "liwamye6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 14:00:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575482": [
        {
            "ioc_value": "putty.network",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-27 13:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,OyesterLoader",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1575483": [
        {
            "ioc_value": "putty.today",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-27 13:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,OyesterLoader",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1575484": [
        {
            "ioc_value": "pytty.life",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-27 13:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,OyesterLoader",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1575485": [
        {
            "ioc_value": "pytty.lol",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-27 13:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,OyesterLoader",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1575486": [
        {
            "ioc_value": "putty.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-27 13:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,OyesterLoader",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1575487": [
        {
            "ioc_value": "putty.fyi",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-27 13:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,OyesterLoader",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1575488": [
        {
            "ioc_value": "pytty.id",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-27 13:37:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,OyesterLoader",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1575479": [
        {
            "ioc_value": "haggwwb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-27 13:32:15",
            "last_seen_utc": "2025-09-01 15:13:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dc600fdcc37eff865d7a4faa70f2e2ea39862c6987c002b5d409a4abf5870667/",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575477": [
        {
            "ioc_value": "cumutiu1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 13:24:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575475": [
        {
            "ioc_value": "husygya3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 13:03:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575473": [
        {
            "ioc_value": "lusoboa3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 12:42:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575470": [
        {
            "ioc_value": "bezyhio9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 12:22:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575458": [
        {
            "ioc_value": "zdqxdcj7s.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-27 12:00:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-ngzemsyybx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575459": [
        {
            "ioc_value": "its-nil.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-27 12:00:49",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-nbc98ack9v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575460": [
        {
            "ioc_value": "look-polo.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-27 12:00:49",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-k3mq7aap9x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575461": [
        {
            "ioc_value": "bigwso.playit.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-27 12:00:49",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-kbrwtsam61",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575452": [
        {
            "ioc_value": "tofyjoi0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 11:45:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575451": [
        {
            "ioc_value": "xixonua5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 11:25:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575441": [
        {
            "ioc_value": "job-danish.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-27 10:50:49",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-lt1r5aykx8/",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1575450": [
        {
            "ioc_value": "jijeruy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 10:43:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575445": [
        {
            "ioc_value": "xoqywoa2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 10:23:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575443": [
        {
            "ioc_value": "joneroa1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 10:02:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575440": [
        {
            "ioc_value": "qepucyy2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 09:31:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575439": [
        {
            "ioc_value": "rysaryo0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 09:05:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575436": [
        {
            "ioc_value": "murmuringramrod.bet",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-27 09:00:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575413": [
        {
            "ioc_value": "zz.aass654.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-27 08:05:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3714fc0446a1adaedbc86e3dd0b2121e65b34cc3d40494f709c6873fa0d56bc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575414": [
        {
            "ioc_value": "zz.xxcc789.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-27 08:05:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3714fc0446a1adaedbc86e3dd0b2121e65b34cc3d40494f709c6873fa0d56bc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575415": [
        {
            "ioc_value": "zz.vvbb321.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-27 08:05:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3714fc0446a1adaedbc86e3dd0b2121e65b34cc3d40494f709c6873fa0d56bc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575416": [
        {
            "ioc_value": "zz.jjkk567.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-27 08:05:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3714fc0446a1adaedbc86e3dd0b2121e65b34cc3d40494f709c6873fa0d56bc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575417": [
        {
            "ioc_value": "zz.nnmm234.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-27 08:05:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3714fc0446a1adaedbc86e3dd0b2121e65b34cc3d40494f709c6873fa0d56bc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575400": [
        {
            "ioc_value": "solgfn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-27 07:10:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575081": [
        {
            "ioc_value": "tdcegypt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-27 06:13:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1575118": [
        {
            "ioc_value": "bernnaum.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-08-27 06:13:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1575061": [
        {
            "ioc_value": "macpro.offers-special.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-27 06:12:48",
            "last_seen_utc": "2025-08-28 13:15:54",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1575062": [
        {
            "ioc_value": "iphone.offers-special.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-27 06:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1575392": [
        {
            "ioc_value": "streetwisecre.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-27 06:01:03",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250827-bqfyfael3x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575387": [
        {
            "ioc_value": "650c4138-96f4e-80104-9167-81hate8c91b4-671c6hj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.venom",
            "malware_alias": null,
            "malware_printable": "Venom RAT",
            "first_seen_utc": "2025-08-27 04:01:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.208.158.155+650c4138-96f4e-80104-9167-81hate8c91b4-671c6hj.com",
            "tags": "AS42624,C2,censys,RAT,SWISSNETWORK02,Venom",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575348": [
        {
            "ioc_value": "ec2-3-131-91-218.us-east-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-27 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.131.91.218+ec2-3-131-91-218.us-east-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1575347": [
        {
            "ioc_value": "code.xinzyun.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-27 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.207.193.76+code.xinzyun.cn",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1575337": [
        {
            "ioc_value": "proxy.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-27 00:01:49",
            "last_seen_utc": "2025-08-27 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+proxy.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575329": [
        {
            "ioc_value": "balamand.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-27 00:01:21",
            "last_seen_utc": "2025-08-27 04:00:30",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.83.162+balamand.net",
            "tags": "AS401120,AsyncRAT,C2,censys,CHEAPY-HOST,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575077": [
        {
            "ioc_value": "cdndz.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 20:01:43",
            "last_seen_utc": "2025-08-27 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+cdndz.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575059": [
        {
            "ioc_value": "a7.nbdsnb2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.fatal_rat",
            "malware_alias": "Sainbox RAT",
            "malware_printable": "FatalRat",
            "first_seen_utc": "2025-08-26 18:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-rqwa5agq61",
            "tags": "C2,domain,fatalrat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575056": [
        {
            "ioc_value": "gael20242.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-26 18:00:51",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-pg7xfsyrx6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575052": [
        {
            "ioc_value": "age-restriction.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-26 18:00:45",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-sqyxpahm2w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575053": [
        {
            "ioc_value": "duskesthostplug.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-26 18:00:45",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-rct6xazsft",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575054": [
        {
            "ioc_value": "optimra.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-26 18:00:45",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-rbg5ysgn9v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575055": [
        {
            "ioc_value": "casino-truth.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-26 18:00:45",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-n946layse1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575049": [
        {
            "ioc_value": "francisco-play-it-reai.play.it.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-26 18:00:44",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-wjg75s1xgs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575050": [
        {
            "ioc_value": "owners-nevada.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-26 18:00:44",
            "last_seen_utc": "2025-09-13 11:43:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-whythaaq3s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575051": [
        {
            "ioc_value": "form-saver.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-26 18:00:44",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-v6gpfs1rw2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1575045": [
        {
            "ioc_value": "es.montreallimosvip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-26 17:36:20",
            "last_seen_utc": "2025-08-26 18:00:39",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115096175979198684",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1575044": [
        {
            "ioc_value": "antitoxicperkiness.run",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 16:50:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575041": [
        {
            "ioc_value": "limpingmagnitude.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 16:24:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575029": [
        {
            "ioc_value": "raxeniy5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 15:17:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575026": [
        {
            "ioc_value": "ridinyo9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 14:51:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575023": [
        {
            "ioc_value": "luzazai5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 14:30:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1575020": [
        {
            "ioc_value": "flrtginvsoergm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-26 14:22:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575021": [
        {
            "ioc_value": "hkc.support",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-26 14:22:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575022": [
        {
            "ioc_value": "jksol.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-26 14:22:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574992": [
        {
            "ioc_value": "mail-serve-9a5d4f13e3a7.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574993": [
        {
            "ioc_value": "sharespace-link-360b265f3942.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574994": [
        {
            "ioc_value": "signcentral-7df32454744c.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574995": [
        {
            "ioc_value": "signcentral-vault-33ce0aff08dc.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574996": [
        {
            "ioc_value": "signflow-e15eda21396d.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574997": [
        {
            "ioc_value": "signforge-a61a5975a04b.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574998": [
        {
            "ioc_value": "signhub-view-09a16562134b.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574999": [
        {
            "ioc_value": "signlink-portal-37c581992418.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575000": [
        {
            "ioc_value": "signstream-docs-de3fa399b173.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575001": [
        {
            "ioc_value": "signtrack-docs-6a96b334b140.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575002": [
        {
            "ioc_value": "trilineconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575003": [
        {
            "ioc_value": "viewshare-4a47630892e1.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1575004": [
        {
            "ioc_value": "webmailapp-0e6cff4089a4.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574974": [
        {
            "ioc_value": "tollcrm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": "2025-08-26 14:14:18",
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574975": [
        {
            "ioc_value": "humcrm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": "2025-08-26 14:14:17",
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574976": [
        {
            "ioc_value": "vnrsales.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": "2025-08-26 14:14:18",
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574977": [
        {
            "ioc_value": "atriocrm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": "2025-08-26 14:14:17",
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574978": [
        {
            "ioc_value": "zappiercrm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": "2025-08-26 14:14:18",
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574979": [
        {
            "ioc_value": "caultonconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574980": [
        {
            "ioc_value": "chipmanconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574981": [
        {
            "ioc_value": "clear-sign-e69444a8e4ea.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574982": [
        {
            "ioc_value": "collab-sign-8e36fa762841.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574983": [
        {
            "ioc_value": "crmforretailers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574984": [
        {
            "ioc_value": "crosleyconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574985": [
        {
            "ioc_value": "docsign-hub-3295a03470c3.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574986": [
        {
            "ioc_value": "hancockconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574987": [
        {
            "ioc_value": "john-deer-apple-0c6f34d9c276.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574988": [
        {
            "ioc_value": "kprocurement.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574989": [
        {
            "ioc_value": "lamyconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574990": [
        {
            "ioc_value": "legal-sign-8ec8b9f1edb2.herokuapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574991": [
        {
            "ioc_value": "lvprocurement.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 14:14:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://research.checkpoint.com/2025/zipline-phishing-campaign/",
            "tags": "GreenSec,ZipLine",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574973": [
        {
            "ioc_value": "mogixyu9.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 14:09:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574970": [
        {
            "ioc_value": "homelab.omtoi101.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.orcus_rat",
            "malware_alias": "Schnorchel",
            "malware_printable": "Orcus RAT",
            "first_seen_utc": "2025-08-26 14:01:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1574971": [
        {
            "ioc_value": "kuqogaa4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 13:54:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574968": [
        {
            "ioc_value": "rysesao8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 13:33:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574967": [
        {
            "ioc_value": "hasyzio6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 13:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574965": [
        {
            "ioc_value": "noxymiy3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 12:52:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574963": [
        {
            "ioc_value": "www.hag505.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-26 12:49:58",
            "last_seen_utc": "2025-10-25 07:49:35",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574959": [
        {
            "ioc_value": "suboluo0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 12:31:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574958": [
        {
            "ioc_value": "sokowao4.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 12:21:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574956": [
        {
            "ioc_value": "xadokyy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 12:06:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574946": [
        {
            "ioc_value": "TIRAT1CK-28292.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-26 12:00:55",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-l697bsdp2w",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574942": [
        {
            "ioc_value": "zvvyf9zn8.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-26 12:00:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-lp4yzsxsbt",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574934": [
        {
            "ioc_value": "celokya5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 10:48:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574933": [
        {
            "ioc_value": "faberiy0.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 10:07:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574928": [
        {
            "ioc_value": "sakicoe3.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 09:30:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574927": [
        {
            "ioc_value": "wopyhay6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 09:04:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574919": [
        {
            "ioc_value": "nulymoo1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 08:44:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574914": [
        {
            "ioc_value": "o2.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 08:01:37",
            "last_seen_utc": "2025-08-27 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+o2.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574897": [
        {
            "ioc_value": "www.qnuhelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-26 06:37:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574898": [
        {
            "ioc_value": "rdgcare.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-26 06:37:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574899": [
        {
            "ioc_value": "kasthelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-26 06:37:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574892": [
        {
            "ioc_value": "asgasg.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-26 06:01:02",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-bw9spsgp6w",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574893": [
        {
            "ioc_value": "calero921.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-26 06:01:02",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-bghexagn3y",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574890": [
        {
            "ioc_value": "low-incl.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-26 06:00:46",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-ddkrzahp51",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574891": [
        {
            "ioc_value": "bell.mtd-l.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-26 06:00:46",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-b2nsestrv9",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574889": [
        {
            "ioc_value": "hosterphobic.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-26 06:00:39",
            "last_seen_utc": "2025-09-13 11:43:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250826-c4j3patxet",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574447": [
        {
            "ioc_value": "cpanel.kickstartyourcakebiz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-26 05:22:14",
            "last_seen_utc": "2025-08-26 14:41:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115090992228123936",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1574449": [
        {
            "ioc_value": "cloudshielders.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 05:22:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1574454": [
        {
            "ioc_value": "g-o-f-y-s-e-l-f.foo",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-26 05:22:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/6d0f6c26-3dc6-4934-8d96-80010e065a69",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1574455": [
        {
            "ioc_value": "madys.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-26 05:22:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/6d0f6c26-3dc6-4934-8d96-80010e065a69",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1574456": [
        {
            "ioc_value": "winapi.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-26 05:22:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/6d0f6c26-3dc6-4934-8d96-80010e065a69",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1574887": [
        {
            "ioc_value": "wyhocie8.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-26 05:11:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574884": [
        {
            "ioc_value": "moodleuni.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 04:47:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA450",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574885": [
        {
            "ioc_value": "photosjournalism.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 04:47:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA450",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574886": [
        {
            "ioc_value": "opluschat.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 04:47:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA450",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574881": [
        {
            "ioc_value": "al-touring.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-26 04:46:25",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574817": [
        {
            "ioc_value": "portal.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-26 04:01:02",
            "last_seen_utc": "2025-08-26 04:01:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+portal.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1574799": [
        {
            "ioc_value": "cloud.xinzyun.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-26 04:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.207.193.76+cloud.xinzyun.cn",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1574798": [
        {
            "ioc_value": "highwaytolline.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-26 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.80.193+highwaytolline.sbs",
            "tags": "AS401120,C2,censys,CHEAPY-HOST",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1574791": [
        {
            "ioc_value": "objective-morse.45-138-16-249.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-08-26 00:01:19",
            "last_seen_utc": "2025-08-26 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.138.16.249+objective-morse.45-138-16-249.plesk.page",
            "tags": "AS210558,C2,censys,Hookbot,SERVICES-1337-GMBH",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574782": [
        {
            "ioc_value": "runiloe2.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-25 23:54:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574780": [
        {
            "ioc_value": "tyhavau6.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-25 22:12:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574448": [
        {
            "ioc_value": "qifokya5.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-25 19:15:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1574440": [
        {
            "ioc_value": "nonononon-23162.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-25 18:00:35",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-wgnl5scq8z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574439": [
        {
            "ioc_value": "lst.socialsalesnaija.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-25 17:10:22",
            "last_seen_utc": "2025-09-02 15:10:27",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574426": [
        {
            "ioc_value": "togomwd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 14:26:37",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574424": [
        {
            "ioc_value": "irsdd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-25 14:26:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "LandUpdate808",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574425": [
        {
            "ioc_value": "pfanaerstill.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-25 14:26:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "LandUpdate808",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574423": [
        {
            "ioc_value": "xwormlover69-40917.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-25 14:25:19",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574412": [
        {
            "ioc_value": "amarre29.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-25 14:23:23",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574411": [
        {
            "ioc_value": "stack.variables.below",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.raccoon",
            "malware_alias": "Mohazo,RaccoonStealer,Racealer,Racoon",
            "malware_printable": "Raccoon",
            "first_seen_utc": "2025-08-25 14:23:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,raccoon",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574406": [
        {
            "ioc_value": "a-http.bbanddd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-25 14:22:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574407": [
        {
            "ioc_value": "a-tls.bbanddd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-25 14:22:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574399": [
        {
            "ioc_value": "bbos.p-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-25 14:21:07",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574400": [
        {
            "ioc_value": "csk.vietnamddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-25 14:21:07",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574398": [
        {
            "ioc_value": "ok12345.serveminecraft.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-25 14:20:32",
            "last_seen_utc": "2025-09-13 11:44:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574396": [
        {
            "ioc_value": "cstest250822.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-25 14:20:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574397": [
        {
            "ioc_value": "www.wkilohs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-25 14:20:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574394": [
        {
            "ioc_value": "asyaugusth5858.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-25 14:20:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574395": [
        {
            "ioc_value": "asyjuly5858.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-25 14:20:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1574217": [
        {
            "ioc_value": "41.59.reliabletrustbank.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-25 13:46:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1574216": [
        {
            "ioc_value": "img.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-25 13:46:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1574195": [
        {
            "ioc_value": "rivatalk.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.fickle",
            "malware_alias": null,
            "malware_printable": "Fickle Stealer",
            "first_seen_utc": "2025-08-25 12:36:02",
            "last_seen_utc": "2025-09-23 23:48:05",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=rivatalk.digital",
            "tags": "Fickle,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574185": [
        {
            "ioc_value": "clck.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-25 12:01:31",
            "last_seen_utc": "2025-08-26 04:01:02",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+clck.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574181": [
        {
            "ioc_value": "nuovosarto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-08-25 12:01:13",
            "last_seen_utc": "2025-08-26 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/77.91.66.252+nuovosarto.com",
            "tags": "AS209693,C2,censys,Hookbot,OC-NETWORK",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574180": [
        {
            "ioc_value": "blackyywire.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-25 12:00:58",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-hhya3ssxez",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574178": [
        {
            "ioc_value": "oneoptionforeverling.mysynology.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-25 12:00:57",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-nynz8swpw8",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574179": [
        {
            "ioc_value": "brasilselectbackup.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-25 12:00:57",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-mq534svrx3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574173": [
        {
            "ioc_value": "heyguyswelcomebacktoanotheryoutubevideo-23337.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-25 12:00:44",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-m13qqsvtex",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574174": [
        {
            "ioc_value": "female-ebay.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-25 12:00:44",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-kbcrxatrz4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574172": [
        {
            "ioc_value": "hostermasterplug.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-25 12:00:43",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-nbgmmsfl7s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1574145": [
        {
            "ioc_value": "code-api.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-25 11:25:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-mlzqjavqy5",
            "tags": "GenesisStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1574164": [
        {
            "ioc_value": "conn.elbbird.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-25 11:25:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "botnet,c2,masjesu,xorbot",
            "anonymous": "0",
            "reporter": "redrabytes"
        }
    ],
    "1574146": [
        {
            "ioc_value": "www.66chat3.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-25 10:49:55",
            "last_seen_utc": "2025-09-27 11:49:20",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1574140": [
        {
            "ioc_value": "ck1.bnwqdudbwqxxbiqwnjdwnqw.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-25 10:24:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/69e97a5f-d9dc-4880-a74b-8b1b66ca2fff",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1574136": [
        {
            "ioc_value": "db.socialsalesnaija.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-25 09:10:24",
            "last_seen_utc": "2025-08-25 16:10:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573803": [
        {
            "ioc_value": "xray.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-25 08:01:29",
            "last_seen_utc": "2025-08-30 04:01:17",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+xray.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573801": [
        {
            "ioc_value": "stag.cukurukuk.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-25 08:01:13",
            "last_seen_utc": "2025-08-26 04:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.235.75.42+stag.cukurukuk.fun",
            "tags": "AS135444,C2,censys,Havoc,IDNIC-IKUBARU-AS-ID",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573783": [
        {
            "ioc_value": "cirwelh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 07:45:52",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573784": [
        {
            "ioc_value": "debuqda.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 07:45:52",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573785": [
        {
            "ioc_value": "larilly.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 07:45:52",
            "last_seen_utc": "2025-09-01 15:13:53",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573786": [
        {
            "ioc_value": "ironcrt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 07:45:52",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573787": [
        {
            "ioc_value": "toplyws.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 07:45:52",
            "last_seen_utc": "2025-09-01 15:13:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573788": [
        {
            "ioc_value": "connbkg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 07:45:52",
            "last_seen_utc": "2025-09-01 15:13:49",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573789": [
        {
            "ioc_value": "oldergunne.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 07:45:52",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573790": [
        {
            "ioc_value": "reschsc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 07:45:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,lumma,stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573779": [
        {
            "ioc_value": "healthmonitorupdate.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-25 06:00:44",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-bv22gazxax",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573778": [
        {
            "ioc_value": "netbiosinterface.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-25 06:00:43",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-bv6dwshm2z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573776": [
        {
            "ioc_value": "needed-otherwise.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-25 06:00:34",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-apwrts1kx8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573777": [
        {
            "ioc_value": "where-pleasure.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-25 06:00:34",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-apllvsgq7w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573775": [
        {
            "ioc_value": "approved-ccd.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-25 06:00:33",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250825-a17cps1lw4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573693": [
        {
            "ioc_value": "iosif-brodskiy.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-25 05:39:15",
            "last_seen_utc": "2025-09-20 06:50:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "Lumma",
            "anonymous": "1",
            "reporter": "TAKE"
        }
    ],
    "1573768": [
        {
            "ioc_value": "ll.nnmm234.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-25 05:30:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/10e43894490d98a91f3d409a83d984556d619e91782333033ad3d7fb1b9def8b/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573764": [
        {
            "ioc_value": "ll.aass654.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-25 05:30:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/10e43894490d98a91f3d409a83d984556d619e91782333033ad3d7fb1b9def8b/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573765": [
        {
            "ioc_value": "ll.xxcc789.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-25 05:30:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/10e43894490d98a91f3d409a83d984556d619e91782333033ad3d7fb1b9def8b/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573766": [
        {
            "ioc_value": "ll.vvbb321.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-25 05:30:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/10e43894490d98a91f3d409a83d984556d619e91782333033ad3d7fb1b9def8b/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573767": [
        {
            "ioc_value": "ll.jjkk567.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-25 05:30:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/10e43894490d98a91f3d409a83d984556d619e91782333033ad3d7fb1b9def8b/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573699": [
        {
            "ioc_value": "giga.socialsalesnaija.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-24 21:10:22",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573691": [
        {
            "ioc_value": "me.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 20:01:29",
            "last_seen_utc": "2025-08-25 04:00:57",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+me.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573689": [
        {
            "ioc_value": "pdf.cukurukuk.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-24 20:01:14",
            "last_seen_utc": "2025-08-25 04:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.235.75.42+pdf.cukurukuk.fun",
            "tags": "AS135444,C2,censys,Havoc,IDNIC-IKUBARU-AS-ID",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573672": [
        {
            "ioc_value": "shall-downloaded.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-24 18:03:49",
            "last_seen_utc": "2025-09-13 11:44:07",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-s9p4wswves",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573670": [
        {
            "ioc_value": "stain.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-24 18:03:16",
            "last_seen_utc": "2025-09-13 11:44:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-qn646san5w",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573671": [
        {
            "ioc_value": "evil2dead1.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-24 18:03:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-prvpwaaj5z",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573668": [
        {
            "ioc_value": "axnewpower.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-24 18:02:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-rm6yfsbl2v",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573667": [
        {
            "ioc_value": "adnan7yousf.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-24 18:01:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-p8kagawkv2",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573665": [
        {
            "ioc_value": "RatHellaNiggas-54052.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-24 18:00:49",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-p5btxsvvaw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573664": [
        {
            "ioc_value": "microsoft-spencer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-24 18:00:48",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-qlqz6san3x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573663": [
        {
            "ioc_value": "looking-harley.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-24 18:00:31",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-pjjmmshr2x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573662": [
        {
            "ioc_value": "besrrt345-28765.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-24 18:00:30",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-t85nmawxf1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573469": [
        {
            "ioc_value": "dns.qqq911.dns-cloud.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-24 16:49:04",
            "last_seen_utc": "2025-12-14 11:48:05",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573465": [
        {
            "ioc_value": "grafana.cukurukuk.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-24 16:01:06",
            "last_seen_utc": "2025-08-25 04:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.235.75.42+grafana.cukurukuk.fun",
            "tags": "AS135444,C2,censys,Havoc,IDNIC-IKUBARU-AS-ID",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573458": [
        {
            "ioc_value": "gate.socialsalesnaija.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-24 12:10:25",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573454": [
        {
            "ioc_value": "staging.germ-ac.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-08-24 12:01:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/62.72.13.145+staging.germ-ac.com",
            "tags": "AS-HOSTINGER,AS47583,C2,censys,Ermac,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573441": [
        {
            "ioc_value": "simple-commerce.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-24 12:00:31",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-m9y4xagn9w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573442": [
        {
            "ioc_value": "opinion-stolen.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-24 12:00:31",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-lelpnasyay",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573443": [
        {
            "ioc_value": "artist-singing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-24 12:00:31",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-k6ngwssxht",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573444": [
        {
            "ioc_value": "cable-aged.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-24 12:00:31",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-k6ngwssxht",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573440": [
        {
            "ioc_value": "however-extends.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-24 12:00:30",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-nhkb4stwcx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573411": [
        {
            "ioc_value": "kk.aass654.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-24 06:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5fefeaf30b8cd96607ee013a771c619d2bcba75e294f57e98ba86e8b40e51090/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573412": [
        {
            "ioc_value": "kk.xxcc789.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-24 06:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5fefeaf30b8cd96607ee013a771c619d2bcba75e294f57e98ba86e8b40e51090/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573413": [
        {
            "ioc_value": "kk.vvbb321.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-24 06:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5fefeaf30b8cd96607ee013a771c619d2bcba75e294f57e98ba86e8b40e51090/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573414": [
        {
            "ioc_value": "kk.jjkk567.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-24 06:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5fefeaf30b8cd96607ee013a771c619d2bcba75e294f57e98ba86e8b40e51090/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573415": [
        {
            "ioc_value": "kk.nnmm234.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-24 06:39:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5fefeaf30b8cd96607ee013a771c619d2bcba75e294f57e98ba86e8b40e51090/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573096": [
        {
            "ioc_value": "smartpdfzone.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:32:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573100": [
        {
            "ioc_value": "clickconvertio.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573101": [
        {
            "ioc_value": "horoscopesbyonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573102": [
        {
            "ioc_value": "launchonestart.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573103": [
        {
            "ioc_value": "onestartemplates.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573104": [
        {
            "ioc_value": "templatesbyonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573105": [
        {
            "ioc_value": "yoursignwithonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573097": [
        {
            "ioc_value": "viewpdfonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:49",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573094": [
        {
            "ioc_value": "printbyappsuite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573095": [
        {
            "ioc_value": "smartpdflab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573093": [
        {
            "ioc_value": "pdfplusconvert.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573091": [
        {
            "ioc_value": "pdfhubtoday.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573092": [
        {
            "ioc_value": "pdfonestart.ai",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:46",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573089": [
        {
            "ioc_value": "pdfbyappsuite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573090": [
        {
            "ioc_value": "pdfguides.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:45",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573087": [
        {
            "ioc_value": "onestartpdfs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:44",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573088": [
        {
            "ioc_value": "onestartprint.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:44",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573084": [
        {
            "ioc_value": "onestartconverter.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:43",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573085": [
        {
            "ioc_value": "onestartmanuals.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:43",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573086": [
        {
            "ioc_value": "onestartpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:43",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573081": [
        {
            "ioc_value": "launchpdfplus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573083": [
        {
            "ioc_value": "manualsonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:42",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573080": [
        {
            "ioc_value": "justconvertpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573082": [
        {
            "ioc_value": "manualsbyappsuite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573077": [
        {
            "ioc_value": "converterbyonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:39",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573078": [
        {
            "ioc_value": "convertwithonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:39",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573079": [
        {
            "ioc_value": "foundpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:39",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573076": [
        {
            "ioc_value": "astrologyappsuite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573073": [
        {
            "ioc_value": "pdf-working.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:37",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573074": [
        {
            "ioc_value": "manualsfc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573075": [
        {
            "ioc_value": "ascenti-stage.fiora.agency",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573072": [
        {
            "ioc_value": "easydirectpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:36",
            "last_seen_utc": "2025-08-23 14:34:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573098": [
        {
            "ioc_value": "macverification.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1573099": [
        {
            "ioc_value": "mac-best.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1573106": [
        {
            "ioc_value": "slowdevaction.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-24 06:31:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1573115": [
        {
            "ioc_value": "cdnpoint.guru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1573116": [
        {
            "ioc_value": "nextpage-gwg.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1573117": [
        {
            "ioc_value": "fastmirror.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 06:31:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1573369": [
        {
            "ioc_value": "cnc.504.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-24 06:31:23",
            "last_seen_utc": "2025-09-13 11:44:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "elfdigest"
        }
    ],
    "1573403": [
        {
            "ioc_value": "rockwood.call105.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-24 06:31:13",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 100,
            "reference": "https://x.com/redrabytes/status/1959475516739633344",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "redrabytes"
        }
    ],
    "1573404": [
        {
            "ioc_value": "host117.xtpanel.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-24 06:31:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/redrabytes/status/1959475516739633344",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "redrabytes"
        }
    ],
    "1573405": [
        {
            "ioc_value": "autodiscover.milkir.ro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-24 06:31:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/redrabytes/status/1959475516739633344",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "redrabytes"
        }
    ],
    "1573408": [
        {
            "ioc_value": "NoNameArtie-27276.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-24 06:01:56",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-dn6r7a1ps9",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573407": [
        {
            "ioc_value": "beginning-chancellor.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-24 06:00:32",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-e6k4waskt5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573406": [
        {
            "ioc_value": "million-sanyo.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-24 06:00:31",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250824-fcva5adm6s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573376": [
        {
            "ioc_value": "ec2-13-236-179-186.ap-southeast-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-08-24 04:00:27",
            "last_seen_utc": "2025-08-24 04:01:02",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.236.179.186+ec2-13-236-179-186.ap-southeast-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Hookbot",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1573373": [
        {
            "ioc_value": "ec2-18-220-79-189.us-east-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 04:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.220.79.189+ec2-18-220-79-189.us-east-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1573374": [
        {
            "ioc_value": "broker-1.t48zw5f8.data.bizmrg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 04:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/89.208.211.30+broker-1.t48zw5f8.data.bizmrg.com",
            "tags": "AS47764,C2,censys,Mythic,VK-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1573363": [
        {
            "ioc_value": "dlp.socialsalesnaija.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-24 00:10:24",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573357": [
        {
            "ioc_value": "logdz.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-24 00:01:25",
            "last_seen_utc": "2025-08-24 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+logdz.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573338": [
        {
            "ioc_value": "filin.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 20:01:27",
            "last_seen_utc": "2025-08-24 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+filin.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573118": [
        {
            "ioc_value": "MFLO2T-24280.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-23 18:00:29",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250823-q69ysawns5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573114": [
        {
            "ioc_value": "kws5.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 16:01:16",
            "last_seen_utc": "2025-08-24 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+kws5.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573071": [
        {
            "ioc_value": "lm.p.socialsalesnaija.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-23 14:10:22",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1573045": [
        {
            "ioc_value": "domaninspalillos.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-23 12:00:42",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250823-lh1b8atsct",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573040": [
        {
            "ioc_value": "shadow2515.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-23 12:00:30",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250823-lvxrvsbn51",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573041": [
        {
            "ioc_value": "edpisblacklmfao-38234.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-23 12:00:30",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250823-levybstsav",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573042": [
        {
            "ioc_value": "unit-consultancy.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-23 12:00:30",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250823-hw5bjsam5w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1573043": [
        {
            "ioc_value": "resolution-onto.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-23 12:00:30",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250823-hmhfestjv3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572970": [
        {
            "ioc_value": "advancedtransmitart.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572971": [
        {
            "ioc_value": "allpdflive.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572972": [
        {
            "ioc_value": "amazeriencequant.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572973": [
        {
            "ioc_value": "apdft.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572974": [
        {
            "ioc_value": "apdft.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572975": [
        {
            "ioc_value": "apdfty.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572976": [
        {
            "ioc_value": "businesspdf.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572978": [
        {
            "ioc_value": "convertpdfplus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:34",
            "last_seen_utc": "2025-08-23 14:34:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572977": [
        {
            "ioc_value": "cdasynergy.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572979": [
        {
            "ioc_value": "easyonestartpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572980": [
        {
            "ioc_value": "fastonestartpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:30",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572981": [
        {
            "ioc_value": "getonestart.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:30",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572982": [
        {
            "ioc_value": "getpdfonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572983": [
        {
            "ioc_value": "getsmartpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572984": [
        {
            "ioc_value": "gopdfhub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:28",
            "last_seen_utc": "2025-08-23 14:34:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572985": [
        {
            "ioc_value": "gridnodeessentials.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:28",
            "last_seen_utc": "2025-08-23 14:06:09",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572986": [
        {
            "ioc_value": "itpdf.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572987": [
        {
            "ioc_value": "itpdf.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572988": [
        {
            "ioc_value": "ltdpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:26",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572989": [
        {
            "ioc_value": "ltdpdf.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572990": [
        {
            "ioc_value": "manualsbyonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:25",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572991": [
        {
            "ioc_value": "masterlifemastermind.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572992": [
        {
            "ioc_value": "micromacrotechbase.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572993": [
        {
            "ioc_value": "mypdfonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572994": [
        {
            "ioc_value": "onestartbrowser.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:23",
            "last_seen_utc": "2025-08-23 14:44:58",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572995": [
        {
            "ioc_value": "pdf-kiosk.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572996": [
        {
            "ioc_value": "pdf-kiosks.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572997": [
        {
            "ioc_value": "pdffacts.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:19",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572999": [
        {
            "ioc_value": "pdffilehub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:19",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572998": [
        {
            "ioc_value": "pdffacts.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573000": [
        {
            "ioc_value": "pdffilehub.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573001": [
        {
            "ioc_value": "pdfgj.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573002": [
        {
            "ioc_value": "pdfonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:16",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573003": [
        {
            "ioc_value": "pdfonestarthub.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573004": [
        {
            "ioc_value": "pdfscraper.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:15",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573005": [
        {
            "ioc_value": "pdfscraper.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573007": [
        {
            "ioc_value": "printwithonestart.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:14",
            "last_seen_utc": "2025-08-23 14:44:59",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573006": [
        {
            "ioc_value": "pdfts.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573008": [
        {
            "ioc_value": "quickfastpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:12",
            "last_seen_utc": "2025-08-23 14:34:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573009": [
        {
            "ioc_value": "sharkeagle.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573010": [
        {
            "ioc_value": "transmitcdnzion.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573011": [
        {
            "ioc_value": "Publicagipdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573012": [
        {
            "ioc_value": "Publicappsuites.ai",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573013": [
        {
            "ioc_value": "Publicclick4pdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573014": [
        {
            "ioc_value": "Publicgpt-pdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573015": [
        {
            "ioc_value": "Publicpdf-central.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573017": [
        {
            "ioc_value": "Publicpdfartisan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573016": [
        {
            "ioc_value": "Publicpdfadmin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573018": [
        {
            "ioc_value": "Publicpdfhubspot.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:17:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573019": [
        {
            "ioc_value": "Publicpdfideas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:16:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573020": [
        {
            "ioc_value": "Publicpdfmeta.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:16:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573024": [
        {
            "ioc_value": "Publicscholarpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:16:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573021": [
        {
            "ioc_value": "Publicpdforsmartminds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:16:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573022": [
        {
            "ioc_value": "Publicpdfreplace.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:16:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573023": [
        {
            "ioc_value": "Publicpdfworker.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:16:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573025": [
        {
            "ioc_value": "Publictypdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:14:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1573032": [
        {
            "ioc_value": "goal-world.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 09:14:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572965": [
        {
            "ioc_value": "new-yorktimes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 07:45:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572966": [
        {
            "ioc_value": "uptomac.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 07:45:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572967": [
        {
            "ioc_value": "addidas-wear.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 07:45:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572963": [
        {
            "ioc_value": "goalheadline.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 07:41:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572964": [
        {
            "ioc_value": "nettflixservice.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 07:41:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572869": [
        {
            "ioc_value": "dragonshop.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 06:09:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572888": [
        {
            "ioc_value": "britains-news.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 06:09:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572866": [
        {
            "ioc_value": "budparbanjarnegara.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 06:09:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572868": [
        {
            "ioc_value": "dragonshop.tech",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 06:09:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdate",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572883": [
        {
            "ioc_value": "britainsbrodcastingnews.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 06:09:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572884": [
        {
            "ioc_value": "uytghkhl.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 06:09:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572885": [
        {
            "ioc_value": "momuus.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 06:09:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572886": [
        {
            "ioc_value": "appates.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-23 06:09:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "AMOS,ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572887": [
        {
            "ioc_value": "britainsbroadcasting.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 06:09:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,m1m1c",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572851": [
        {
            "ioc_value": "wykupae1.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-23 06:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1572864": [
        {
            "ioc_value": "tok-info.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 06:08:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1572949": [
        {
            "ioc_value": "domainovertake.gockteam.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-23 06:02:57",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250823-e6s5gssmv9",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572948": [
        {
            "ioc_value": "condition-furniture.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-23 06:00:23",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250823-c4kn8azzat",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572912": [
        {
            "ioc_value": "office303.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-23 04:00:40",
            "last_seen_utc": "2025-08-23 04:00:58",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/64.225.126.237+office303.duckdns.org",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1572910": [
        {
            "ioc_value": "common.sanspepin.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-23 04:00:39",
            "last_seen_utc": "2025-08-23 04:00:57",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/54.242.171.49+common.sanspepin.tech",
            "tags": "AMAZON-AES,AS14618,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1572911": [
        {
            "ioc_value": "ec2-3-106-249-233.ap-southeast-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-23 04:00:39",
            "last_seen_utc": "2025-08-23 04:00:58",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.106.249.233+ec2-3-106-249-233.ap-southeast-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1572903": [
        {
            "ioc_value": "lucid-edison.45-138-16-249.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-08-23 04:00:33",
            "last_seen_utc": "2025-08-23 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.138.16.249+lucid-edison.45-138-16-249.plesk.page",
            "tags": "AS210558,C2,censys,Hookbot",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1572896": [
        {
            "ioc_value": "pay.msxzcc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-23 04:00:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/154.201.84.67+pay.msxzcc.com",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1572897": [
        {
            "ioc_value": "pensi.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-23 04:00:06",
            "last_seen_utc": "2025-09-26 07:49:20",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/217.154.212.25+pensi.me",
            "tags": "AS8560,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1572879": [
        {
            "ioc_value": "rootyan.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 00:01:21",
            "last_seen_utc": "2025-08-23 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+rootyan.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572880": [
        {
            "ioc_value": "kws2-1.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 00:01:21",
            "last_seen_utc": "2025-08-23 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+kws2-1.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572881": [
        {
            "ioc_value": "venus.web.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-23 00:01:21",
            "last_seen_utc": "2025-08-25 04:00:56",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+venus.web.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572847": [
        {
            "ioc_value": "api.rootvk.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 20:01:25",
            "last_seen_utc": "2025-08-23 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+api.rootvk.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572842": [
        {
            "ioc_value": "g92a8n.hidessh.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-22 20:01:06",
            "last_seen_utc": "2025-08-23 04:00:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.245.54.105+g92a8n.hidessh.my.id",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572833": [
        {
            "ioc_value": "coop-digi.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-08-22 20:01:01",
            "last_seen_utc": "2025-08-23 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.183.123+coop-digi.de",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572796": [
        {
            "ioc_value": "loeisd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-22 18:00:42",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-v5r4ssbn4z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572795": [
        {
            "ioc_value": "cloedjw.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-22 18:00:41",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-v5r4ssbn4z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572794": [
        {
            "ioc_value": "wertyhfg.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-22 18:00:40",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-v5r4ssbn4z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572791": [
        {
            "ioc_value": "bckstark54.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 18:00:23",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-sdqesaal9v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572792": [
        {
            "ioc_value": "newstark54.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 18:00:23",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-sdqesaal9v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572788": [
        {
            "ioc_value": "friends-optional.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 18:00:22",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-tcrrwswpz9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572789": [
        {
            "ioc_value": "fucktheworlds.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 18:00:22",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-s4mftawnw7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572790": [
        {
            "ioc_value": "3zoz.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 18:00:22",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-s4mftawnw7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572786": [
        {
            "ioc_value": "jacknourssss.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 18:00:21",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-v2x6msbn3s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572787": [
        {
            "ioc_value": "SQCorporation-40357.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 18:00:21",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-ttlxzawtct",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572772": [
        {
            "ioc_value": "umbragequartz.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-22 15:17:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba/",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572614": [
        {
            "ioc_value": "forcepear.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-22 14:36:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572615": [
        {
            "ioc_value": "roofspade.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-22 14:36:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572611": [
        {
            "ioc_value": "web.ydihelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-22 14:34:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572612": [
        {
            "ioc_value": "web.xvbhelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-22 14:34:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572606": [
        {
            "ioc_value": "shzlive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-22 14:34:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572607": [
        {
            "ioc_value": "awglive.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-22 14:34:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572608": [
        {
            "ioc_value": "solrdt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-22 14:34:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572609": [
        {
            "ioc_value": "solvqs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-22 14:34:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572610": [
        {
            "ioc_value": "pnssol.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-22 14:34:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572586": [
        {
            "ioc_value": "portal.manualfinder.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:40",
            "last_seen_utc": "2025-08-23 07:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572587": [
        {
            "ioc_value": "stormcoming.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:40",
            "last_seen_utc": "2025-08-23 07:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572589": [
        {
            "ioc_value": "m-appsuite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:40",
            "last_seen_utc": "2025-08-23 07:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572588": [
        {
            "ioc_value": "pdfappsuite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:39",
            "last_seen_utc": "2025-08-23 14:34:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572590": [
        {
            "ioc_value": "click4pdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:38",
            "last_seen_utc": "2025-08-23 14:34:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572591": [
        {
            "ioc_value": "pdfworker.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:38",
            "last_seen_utc": "2025-08-23 14:34:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572592": [
        {
            "ioc_value": "pdforsmartminds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:38",
            "last_seen_utc": "2025-08-23 07:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572593": [
        {
            "ioc_value": "pdfhubspot.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:38",
            "last_seen_utc": "2025-08-23 07:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572594": [
        {
            "ioc_value": "pdfideas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:37",
            "last_seen_utc": "2025-08-23 14:34:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572595": [
        {
            "ioc_value": "typdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:36",
            "last_seen_utc": "2025-08-23 14:34:26",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572596": [
        {
            "ioc_value": "agipdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:36",
            "last_seen_utc": "2025-08-23 14:34:24",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572597": [
        {
            "ioc_value": "gpt-pdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:35",
            "last_seen_utc": "2025-08-23 07:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572598": [
        {
            "ioc_value": "scholarpdf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:35",
            "last_seen_utc": "2025-08-23 07:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572599": [
        {
            "ioc_value": "pdf-central.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:34",
            "last_seen_utc": "2025-08-23 07:54:20",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572600": [
        {
            "ioc_value": "fileconverterdownload.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:34",
            "last_seen_utc": "2025-08-31 09:03:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572601": [
        {
            "ioc_value": "printappsuite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:33",
            "last_seen_utc": "2025-08-23 14:34:25",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572602": [
        {
            "ioc_value": "findthemanual.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:33",
            "last_seen_utc": "2025-08-31 09:03:31",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572603": [
        {
            "ioc_value": "morethanmanuals.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:32",
            "last_seen_utc": "2025-08-23 07:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572604": [
        {
            "ioc_value": "manualsappsuite.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 13:50:32",
            "last_seen_utc": "2025-08-23 07:54:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "TamperedChef",
            "anonymous": "0",
            "reporter": "Syndikalist"
        }
    ],
    "1572580": [
        {
            "ioc_value": "hope-deutschland.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-22 12:01:47",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-mvrraatpv2",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572572": [
        {
            "ioc_value": "2025takby.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-22 12:00:35",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-mem36asxfv",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572564": [
        {
            "ioc_value": "googlei.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 12:00:18",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-mgd82asxgz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572566": [
        {
            "ioc_value": "itzprocabal.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 12:00:18",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-jxy2la1ygw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572557": [
        {
            "ioc_value": "out.p.socialsalesnaija.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-22 10:10:22",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572548": [
        {
            "ioc_value": "iwp41178-44386.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-22 09:59:26",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-lb4q3asrt5",
            "tags": "Vitimas",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1572517": [
        {
            "ioc_value": "jj.aass654.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-22 07:05:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/09898756f3e900900093fe4890680734f41ece38362912f4da2a3994a12a833e/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572518": [
        {
            "ioc_value": "jj.xxcc789.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-22 07:05:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/09898756f3e900900093fe4890680734f41ece38362912f4da2a3994a12a833e/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572519": [
        {
            "ioc_value": "jj.vvbb321.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-22 07:05:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/09898756f3e900900093fe4890680734f41ece38362912f4da2a3994a12a833e/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572520": [
        {
            "ioc_value": "jj.jjkk567.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-22 07:05:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/09898756f3e900900093fe4890680734f41ece38362912f4da2a3994a12a833e/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572521": [
        {
            "ioc_value": "jj.nnmm234.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-22 07:05:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/09898756f3e900900093fe4890680734f41ece38362912f4da2a3994a12a833e/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572510": [
        {
            "ioc_value": "craiglist.ignorelist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-22 06:02:26",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-eqtq3szsfw",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572506": [
        {
            "ioc_value": "credit-destroyed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 06:00:22",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-frbgkazwe1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572507": [
        {
            "ioc_value": "countries-degree.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 06:00:22",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-fgl6bazvev",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572508": [
        {
            "ioc_value": "least-revised.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 06:00:22",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250822-b9rt2sal31",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572397": [
        {
            "ioc_value": "image-advantage.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 05:45:15",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1572398": [
        {
            "ioc_value": "things-uses.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-22 05:45:15",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-x1bmcswvg1",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1572361": [
        {
            "ioc_value": "myth.instantlypay.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-22 05:45:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "GenesisStealer,MythStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1572344": [
        {
            "ioc_value": "nexus-cloud-360.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-08-22 05:45:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1572343": [
        {
            "ioc_value": "showypresume.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-22 05:45:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1572342": [
        {
            "ioc_value": "iietrich.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-08-22 05:45:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1572341": [
        {
            "ioc_value": "escencearuba.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 05:45:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1572333": [
        {
            "ioc_value": "boos.caramelmojo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-08-22 05:45:02",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://app.any.run/tasks/9a22f970-ffcd-4883-b049-9b87fced1efa",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1572334": [
        {
            "ioc_value": "onedomainpro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-08-22 05:45:01",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://app.any.run/tasks/9a22f970-ffcd-4883-b049-9b87fced1efa",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1572335": [
        {
            "ioc_value": "suspendedclash.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-08-22 05:45:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1572340": [
        {
            "ioc_value": "trannlu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-22 05:44:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1572458": [
        {
            "ioc_value": "www.huanyinxagsxy.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-22 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.209.49+www.huanyinxagsxy.fun",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1572453": [
        {
            "ioc_value": "skcjdghscjkd9.softether.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-22 00:01:15",
            "last_seen_utc": "2025-08-22 04:00:58",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+skcjdghscjkd9.softether.net",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572404": [
        {
            "ioc_value": "ns2.zhengwubiaoge.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-21 22:48:46",
            "last_seen_utc": "2025-09-24 09:49:54",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572403": [
        {
            "ioc_value": "ns1.zhengwubiaoge.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-21 22:48:44",
            "last_seen_utc": "2025-09-24 09:49:52",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572400": [
        {
            "ioc_value": "stic.shipensburginvestmentgroup.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-21 21:10:22",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572393": [
        {
            "ioc_value": "prdelb.sgsrmy.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-21 20:48:55",
            "last_seen_utc": "2025-09-26 17:49:02",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572392": [
        {
            "ioc_value": "awsapi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-21 20:48:41",
            "last_seen_utc": "2025-09-24 11:50:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572365": [
        {
            "ioc_value": "rapidloader.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-21 19:36:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,mirai",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1572366": [
        {
            "ioc_value": "blackmafia.rapidloader.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-21 19:36:56",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,mirai",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1572354": [
        {
            "ioc_value": "favsouds.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-21 18:00:52",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-sfk8vacp7y",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572355": [
        {
            "ioc_value": "hsnajdjkpas.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-21 18:00:52",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-sfk8vacp7y",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572356": [
        {
            "ioc_value": "kosdlscbf.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-21 18:00:52",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-sfk8vacp7y",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572348": [
        {
            "ioc_value": "w3hhhhh-44281.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-21 18:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-v3wzzaej7w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572349": [
        {
            "ioc_value": "md-mean.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-21 18:00:22",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-pk8m6atlw9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572312": [
        {
            "ioc_value": "dakk5rnsax46s.cfc-execute.su.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-21 12:49:30",
            "last_seen_utc": "2025-12-14 11:48:05",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572311": [
        {
            "ioc_value": "keepmasterr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-21 12:02:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-jy9vgs1qs8",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572299": [
        {
            "ioc_value": "applications-designer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-21 12:00:18",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-lt2z7a1xav",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572296": [
        {
            "ioc_value": "heart-hunger.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-21 12:00:17",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-nwznyssrw4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572297": [
        {
            "ioc_value": "authors-recall.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-21 12:00:17",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-nr1qfsstex",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572298": [
        {
            "ioc_value": "may-steering.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-21 12:00:17",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-nfqfcaspw3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1572290": [
        {
            "ioc_value": "api.shipensburginvestmentgroup.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-21 10:10:27",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1572288": [
        {
            "ioc_value": "updates.highendmark.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-21 10:07:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "gholoader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572286": [
        {
            "ioc_value": "friendly-mercy.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-21 10:06:25",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572285": [
        {
            "ioc_value": "therefore-nothing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-21 10:06:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572281": [
        {
            "ioc_value": "remcos.as.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-21 10:05:00",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572280": [
        {
            "ioc_value": "vivepakx.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-21 10:04:29",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572275": [
        {
            "ioc_value": "allahbotnet.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-21 10:04:11",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572276": [
        {
            "ioc_value": "cnc.9257.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-21 10:04:11",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572277": [
        {
            "ioc_value": "cnc.zinomc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-21 10:04:11",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572278": [
        {
            "ioc_value": "codingvix.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-21 10:04:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572279": [
        {
            "ioc_value": "streamcodex.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-21 10:04:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572274": [
        {
            "ioc_value": "p6nnjzgxl.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-21 10:03:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572270": [
        {
            "ioc_value": "4mxlrhcab.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-21 10:03:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1572271": [
        {
            "ioc_value": "jdpg1sudz.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-21 10:03:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1571981": [
        {
            "ioc_value": "solnoq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-21 06:05:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571982": [
        {
            "ioc_value": "cybertron.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-21 06:05:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571983": [
        {
            "ioc_value": "mkbr.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-21 06:05:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571979": [
        {
            "ioc_value": "lisastevenson-42329.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-21 06:00:20",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-er9tpayzdv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571978": [
        {
            "ioc_value": "too-decorating.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-21 06:00:13",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250821-b4cg6symx4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571946": [
        {
            "ioc_value": "devhdfcbank.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-21 04:27:49",
            "last_seen_utc": "2025-08-26 04:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.48.106.87+devhdfcbank.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571953": [
        {
            "ioc_value": "rootyas.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-21 04:27:45",
            "last_seen_utc": "2025-08-21 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+rootyas.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571955": [
        {
            "ioc_value": "kws2.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-21 04:27:44",
            "last_seen_utc": "2025-08-21 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+kws2.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571936": [
        {
            "ioc_value": "bbs.blyyzs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-21 04:27:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/154.201.84.67+bbs.blyyzs.com",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571937": [
        {
            "ioc_value": "www.ueuser.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-21 04:27:37",
            "last_seen_utc": "2025-09-09 04:00:08",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.136.179+www.ueuser.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571933": [
        {
            "ioc_value": "sefaword.com",
            "ioc_type": "domain",
            "threat_type": "cc_skimming",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2025-08-21 04:27:32",
            "last_seen_utc": "2025-08-21 04:22:21",
            "confidence_level": 100,
            "reference": "",
            "tags": "skimmer,websocket",
            "anonymous": "0",
            "reporter": "ravelin"
        }
    ],
    "1571954": [
        {
            "ioc_value": "kws4-1.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-21 04:01:06",
            "last_seen_utc": "2025-08-21 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+kws4-1.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571925": [
        {
            "ioc_value": "mail.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-21 00:03:23",
            "last_seen_utc": "2025-08-21 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+mail.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571926": [
        {
            "ioc_value": "favicon.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-21 00:03:23",
            "last_seen_utc": "2025-08-21 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+favicon.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571874": [
        {
            "ioc_value": "rtx.shipensburginvestmentgroup.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-20 19:10:23",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571865": [
        {
            "ioc_value": "kb34vsd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-20 18:02:28",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-vs3prshr31",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571866": [
        {
            "ioc_value": "ksj43ts.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-20 18:02:28",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-vs3prshr31",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571867": [
        {
            "ioc_value": "jskeywon.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-20 18:02:28",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-vs3prshr31",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571861": [
        {
            "ioc_value": "reply-suits.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-20 18:02:15",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-tfelqshm3w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571863": [
        {
            "ioc_value": "vxnishhisbacl-53480.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-20 18:02:15",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-svrn6sgr8w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571859": [
        {
            "ioc_value": "jul5050quasae.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-20 18:01:04",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/268501cbc4704142a83673aab0b20dc7b8bf9221b70f0e7bbb42f072ed341e7a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571860": [
        {
            "ioc_value": "jul5050quasaf.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-20 18:01:04",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/268501cbc4704142a83673aab0b20dc7b8bf9221b70f0e7bbb42f072ed341e7a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571856": [
        {
            "ioc_value": "jul5050quasab.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-20 18:01:03",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/268501cbc4704142a83673aab0b20dc7b8bf9221b70f0e7bbb42f072ed341e7a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571857": [
        {
            "ioc_value": "jul5050quasac.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-20 18:01:03",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/268501cbc4704142a83673aab0b20dc7b8bf9221b70f0e7bbb42f072ed341e7a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571858": [
        {
            "ioc_value": "jul5050quasad.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-20 18:01:03",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/268501cbc4704142a83673aab0b20dc7b8bf9221b70f0e7bbb42f072ed341e7a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571855": [
        {
            "ioc_value": "jul5050quasa.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-20 18:01:02",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/268501cbc4704142a83673aab0b20dc7b8bf9221b70f0e7bbb42f072ed341e7a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571710": [
        {
            "ioc_value": "688c674cf3f6d.xvest6.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 16:03:05",
            "last_seen_utc": "2025-08-21 04:00:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/176.9.1.152+688c674cf3f6d.xvest6.ru",
            "tags": "AS24940,C2,censys,HETZNER-AS,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571690": [
        {
            "ioc_value": "stellob.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-20 15:02:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1571687": [
        {
            "ioc_value": "sodipuc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-20 13:43:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1571680": [
        {
            "ioc_value": "bradtae.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-08-20 13:14:16",
            "last_seen_utc": "2025-08-21 17:18:00",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115061260245537096",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1571676": [
        {
            "ioc_value": "introduction-hello.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-20 13:08:42",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-n9td4atkt4",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571675": [
        {
            "ioc_value": "newthingsforagirltolovebestpersoninthewo.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-20 13:08:36",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-p4bsjasyht",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571673": [
        {
            "ioc_value": "demo-ztxhfeoqql.cn-hangzhou.fcapp.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-20 12:49:26",
            "last_seen_utc": "2025-09-20 07:48:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571672": [
        {
            "ioc_value": "bbrwyckeadd5e.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-20 12:49:23",
            "last_seen_utc": "2025-09-12 11:49:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571665": [
        {
            "ioc_value": "upload.shipensburginvestmentgroup.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-20 12:10:26",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571651": [
        {
            "ioc_value": "kalelsianox.twilightparadox.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-20 12:02:27",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-m3zrvsssbv",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571650": [
        {
            "ioc_value": "klm25.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-20 12:02:21",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-mvtwmssny4",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571647": [
        {
            "ioc_value": "msi.tail65a1e3.ts.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-20 12:02:15",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-j64cnscq8s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571644": [
        {
            "ioc_value": "airport-lottery.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-20 12:02:14",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-nxvrdssvev",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571637": [
        {
            "ioc_value": "billing.roofnrack.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-20 11:18:51",
            "last_seen_utc": "2025-08-26 14:51:36",
            "confidence_level": 75,
            "reference": "",
            "tags": "drb-ra,SocGholish",
            "anonymous": "0",
            "reporter": "drb_ra"
        }
    ],
    "1571638": [
        {
            "ioc_value": "cp.envisionfonddulac.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-20 11:18:51",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "drb-ra,SocGholish",
            "anonymous": "0",
            "reporter": "drb_ra"
        }
    ],
    "1571597": [
        {
            "ioc_value": "canadianpizza.me",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 08:43:33",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1571600": [
        {
            "ioc_value": "theguardshield.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 08:43:33",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1571601": [
        {
            "ioc_value": "cyberguardex.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 08:43:32",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1571624": [
        {
            "ioc_value": "ac-backend.sarkhsolution.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-20 08:02:57",
            "last_seen_utc": "2025-08-21 04:00:41",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.245.54.105+ac-backend.sarkhsolution.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571577": [
        {
            "ioc_value": "ship-be.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-20 06:16:10",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-f9pf5sbn8s",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571590": [
        {
            "ioc_value": "sophos-upd-srv.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.morpheus",
            "malware_alias": null,
            "malware_printable": "Morpheus Loader ",
            "first_seen_utc": "2025-08-20 06:15:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6e1b152e34c76fab5414c4210a28bb5ca47b2155e6205e58e7df78ee9de6cb64/",
            "tags": "MorhpeusLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571586": [
        {
            "ioc_value": "knoeyyrt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-20 06:03:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-e81x4szqs8",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571587": [
        {
            "ioc_value": "run0.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-20 06:03:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-fklzqazqx7",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571584": [
        {
            "ioc_value": "soxsox1.twilightparadox.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-20 06:02:26",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-fyxy5sbn4t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571581": [
        {
            "ioc_value": "studentessaywriting.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-20 06:02:12",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-cpz6csal8x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571582": [
        {
            "ioc_value": "rule-passport.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-20 06:02:12",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-ctzqdsam2s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571583": [
        {
            "ioc_value": "now-sight.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-20 06:02:12",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-bqys9aaj61",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571580": [
        {
            "ioc_value": "stop-butterfly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-20 06:02:11",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250820-d4hqasar4w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571492": [
        {
            "ioc_value": "lopersab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 05:17:21",
            "last_seen_utc": "2025-08-19 23:29:13",
            "confidence_level": 75,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1571487": [
        {
            "ioc_value": "miscorof.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 05:17:20",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1571493": [
        {
            "ioc_value": "picarrs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 05:16:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1571491": [
        {
            "ioc_value": "thelinedesigns.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 05:16:53",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1571523": [
        {
            "ioc_value": "znaiweb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-20 04:00:08",
            "last_seen_utc": "2025-09-12 04:00:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.136.179+znaiweb.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571524": [
        {
            "ioc_value": "www.dirigarmenttech.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-20 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.136.179+www.dirigarmenttech.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571522": [
        {
            "ioc_value": "msxzvip.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-20 04:00:07",
            "last_seen_utc": "2025-08-20 04:00:08",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/154.201.84.67+msxzvip.top",
            "tags": "AS401696,C2,censys,COGNETCLOUD",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571512": [
        {
            "ioc_value": "rootyar.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 00:03:02",
            "last_seen_utc": "2025-08-20 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+rootyar.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571513": [
        {
            "ioc_value": "auth.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-20 00:03:02",
            "last_seen_utc": "2025-08-20 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+auth.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571508": [
        {
            "ioc_value": "ec2-75-101-210-201.compute-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-20 00:02:47",
            "last_seen_utc": "2025-08-20 04:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/75.101.210.201+ec2-75-101-210-201.compute-1.amazonaws.com",
            "tags": "AMAZON-AES,AS14618,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571509": [
        {
            "ioc_value": "www.shwepaukkan.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-20 00:02:47",
            "last_seen_utc": "2025-08-20 04:00:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.245.54.105+www.shwepaukkan.org",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571481": [
        {
            "ioc_value": "wew.shipensburginvestmentgroup.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-19 21:10:24",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571314": [
        {
            "ioc_value": "ccm.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-19 20:03:01",
            "last_seen_utc": "2025-08-20 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+ccm.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571294": [
        {
            "ioc_value": "docs.atlantascales.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-19 19:03:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115056774232553911",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1571296": [
        {
            "ioc_value": "HeroicsStipend.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-19 18:37:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1571292": [
        {
            "ioc_value": "witasametry.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-08-19 18:04:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1626d048d160be512ed5e4e9755c924980a09d1759216ff3ea2966a0347d0ce7/",
            "tags": "Amadey",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571290": [
        {
            "ioc_value": "70zv5n4wj.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-19 18:03:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-pps39stwaw",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571285": [
        {
            "ioc_value": "compare-qualify.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-19 18:02:10",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-vmfcaawsa1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571286": [
        {
            "ioc_value": "gmt-prevention.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-19 18:02:10",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-vmfcaawsa1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571287": [
        {
            "ioc_value": "restaurants-colonial.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-19 18:02:10",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-vmfcaawsa1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571283": [
        {
            "ioc_value": "telemety-sys.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-08-19 17:56:55",
            "last_seen_utc": "2025-08-19 18:04:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1626d048d160be512ed5e4e9755c924980a09d1759216ff3ea2966a0347d0ce7/",
            "tags": "Amadey",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571284": [
        {
            "ioc_value": "telemety-xbox.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-08-19 17:56:55",
            "last_seen_utc": "2025-08-19 18:04:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1626d048d160be512ed5e4e9755c924980a09d1759216ff3ea2966a0347d0ce7/",
            "tags": "Amadey",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571255": [
        {
            "ioc_value": "shagkeg.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-19 17:47:25",
            "last_seen_utc": "2025-09-10 08:31:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-sp6adadr6w",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571249": [
        {
            "ioc_value": "capitalior.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-19 17:47:24",
            "last_seen_utc": "2025-09-10 08:31:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-sp6adadr6w",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571250": [
        {
            "ioc_value": "copulardi.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-19 17:47:24",
            "last_seen_utc": "2025-09-10 08:31:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-sp6adadr6w",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571251": [
        {
            "ioc_value": "cursilibim.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-19 17:47:23",
            "last_seen_utc": "2025-09-10 08:31:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-sp6adadr6w",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571252": [
        {
            "ioc_value": "retrofik.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-19 17:47:22",
            "last_seen_utc": "2025-09-10 08:31:35",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-sp6adadr6w",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571253": [
        {
            "ioc_value": "runmgov.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-19 17:47:21",
            "last_seen_utc": "2025-09-10 08:31:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-sp6adadr6w",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571254": [
        {
            "ioc_value": "semipervaz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-19 17:47:21",
            "last_seen_utc": "2025-09-10 08:31:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-sp6adadr6w",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571256": [
        {
            "ioc_value": "tiltyufaz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-19 17:47:20",
            "last_seen_utc": "2025-09-10 08:31:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-sp6adadr6w",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571262": [
        {
            "ioc_value": "microsoft-telemetry.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-08-19 17:47:16",
            "last_seen_utc": "2025-09-17 23:48:04",
            "confidence_level": 50,
            "reference": "https://tria.ge/250819-s5fpnavqs6",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571275": [
        {
            "ioc_value": "13.107.ihireinternationalagency.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-19 16:10:51",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571232": [
        {
            "ioc_value": "develop.nxtintel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-19 13:39:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115055598631820984",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1571203": [
        {
            "ioc_value": "gitsecguards.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-19 12:20:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1571213": [
        {
            "ioc_value": "dfbgvswrtegf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-19 11:56:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://securelist.com/godrat/117119/",
            "tags": "asyncrat,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571209": [
        {
            "ioc_value": "wuwu6.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-19 11:53:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://securelist.com/godrat/117119/",
            "tags": "asyncrat,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571201": [
        {
            "ioc_value": "075229cm.nyash.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-19 11:14:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/174084bc-fc19-462b-97c5-0caa78513ed1?malconf=true",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1571160": [
        {
            "ioc_value": "is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 10:51:43",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1571161": [
        {
            "ioc_value": "www.is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 10:51:43",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1571162": [
        {
            "ioc_value": "in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 10:51:42",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1571163": [
        {
            "ioc_value": "www.in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 10:51:42",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1571156": [
        {
            "ioc_value": "regional-around.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-19 06:02:08",
            "last_seen_utc": "2025-09-13 11:43:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-a1y2bsel41",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571154": [
        {
            "ioc_value": "morning-divorce.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-19 06:02:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250819-fx34rsgn2v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571149": [
        {
            "ioc_value": "mail.akastatementspdf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-19 05:06:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571148": [
        {
            "ioc_value": "ventasio.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-19 05:01:57",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "",
            "tags": "AsyncRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571147": [
        {
            "ioc_value": "liveksz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-19 05:01:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571050": [
        {
            "ioc_value": "www.is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 04:18:25",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1571051": [
        {
            "ioc_value": "www.in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 04:18:24",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1571052": [
        {
            "ioc_value": "in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 04:18:23",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1571047": [
        {
            "ioc_value": "bootasactive.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-19 04:18:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,mirai",
            "anonymous": "0",
            "reporter": "redrabytes"
        }
    ],
    "1571049": [
        {
            "ioc_value": "is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 04:18:17",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570819": [
        {
            "ioc_value": "venamst.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-19 04:18:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1570814": [
        {
            "ioc_value": "americovespucci.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-08-19 04:18:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1570769": [
        {
            "ioc_value": "is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 04:18:07",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570770": [
        {
            "ioc_value": "www.is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 04:18:07",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570771": [
        {
            "ioc_value": "in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 04:18:06",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570772": [
        {
            "ioc_value": "www.in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-19 04:18:06",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1571096": [
        {
            "ioc_value": "oficios2026.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-19 04:17:56",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "tanner"
        }
    ],
    "1571139": [
        {
            "ioc_value": "sdfaklfsdklffjsdfj.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-19 04:12:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1571142": [
        {
            "ioc_value": "dasdasidjasjdkasdttt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-19 04:12:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1571143": [
        {
            "ioc_value": "fixclomyfodp.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-19 04:12:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1571145": [
        {
            "ioc_value": "ititoiaitoaitoiakkaka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-19 04:12:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1571121": [
        {
            "ioc_value": "nhvc.c7.cl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-19 04:00:46",
            "last_seen_utc": "2025-08-19 04:02:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.96.1+nhvc.c7.cl",
            "tags": "AS13335,C2,censys,CLOUDFLARENET",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571120": [
        {
            "ioc_value": "support.suter-mthal.ch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-19 04:00:45",
            "last_seen_utc": "2025-08-19 04:02:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.48.106.87+support.suter-mthal.ch",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1571100": [
        {
            "ioc_value": "dev.johnnetcli999.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-19 02:49:28",
            "last_seen_utc": "2025-09-22 09:49:44",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571099": [
        {
            "ioc_value": "2n9kf8y7533c0.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-19 02:49:22",
            "last_seen_utc": "2025-12-07 19:48:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571098": [
        {
            "ioc_value": "b.dev.drakeinternationalagency.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-19 02:10:27",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1571088": [
        {
            "ioc_value": "logya.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-19 00:03:04",
            "last_seen_utc": "2025-08-19 04:01:11",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+logya.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1571089": [
        {
            "ioc_value": "sdk-api.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-19 00:03:04",
            "last_seen_utc": "2025-08-19 04:01:11",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+sdk-api.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570821": [
        {
            "ioc_value": "www.diuwdx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-18 22:49:13",
            "last_seen_utc": "2025-09-19 09:49:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570784": [
        {
            "ioc_value": "pbj.cukurukuk.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-18 20:02:43",
            "last_seen_utc": "2025-08-19 04:00:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.235.75.42+pbj.cukurukuk.fun",
            "tags": "AS135444,C2,censys,Havoc,IDNIC-IKUBARU-AS-ID",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570767": [
        {
            "ioc_value": "epidmov.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-18 18:54:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-wy336awxc1",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1570735": [
        {
            "ioc_value": "is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-18 18:09:55",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570736": [
        {
            "ioc_value": "www.is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-18 18:09:54",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570737": [
        {
            "ioc_value": "in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-18 18:09:54",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570738": [
        {
            "ioc_value": "www.in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-18 18:09:53",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570764": [
        {
            "ioc_value": "l5ewog1zc.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-18 18:03:14",
            "last_seen_utc": "2025-08-18 18:03:14",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-tb9w3svzez",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570765": [
        {
            "ioc_value": "lwtgiajga.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-18 18:03:14",
            "last_seen_utc": "2025-08-18 18:03:14",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-pywkratkt6",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570762": [
        {
            "ioc_value": "kecfcnyn-28082.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-18 18:02:23",
            "last_seen_utc": "2025-09-13 11:43:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-pqe8sstjt9",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570756": [
        {
            "ioc_value": "kalilinujikoll-37508.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-18 18:02:21",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-tt6mdav1cz",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570752": [
        {
            "ioc_value": "yehsnop.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-18 18:02:14",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-v78jkawvgx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570753": [
        {
            "ioc_value": "satybsa.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-18 18:02:14",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-v78jkawvgx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570751": [
        {
            "ioc_value": "yehnsops.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-18 18:02:13",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-v78jkawvgx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570750": [
        {
            "ioc_value": "started-knives.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-18 18:02:02",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-t7yhxsan71",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570691": [
        {
            "ioc_value": "is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-18 13:46:53",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570692": [
        {
            "ioc_value": "www.is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-18 13:46:53",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570693": [
        {
            "ioc_value": "in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-18 13:46:52",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570694": [
        {
            "ioc_value": "www.in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-18 13:46:52",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1570728": [
        {
            "ioc_value": "cpanel.northtru.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-18 13:46:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115049929393462539",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1570719": [
        {
            "ioc_value": "185-196-10-10.cprapid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-18 12:02:39",
            "last_seen_utc": "2025-08-19 04:00:45",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.196.10.10+185-196-10-10.cprapid.com",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570710": [
        {
            "ioc_value": "ulkum.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-18 12:02:15",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-gx47hazqz7",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570709": [
        {
            "ioc_value": "account-reached.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-18 12:02:01",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-l8tmcssvew",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570663": [
        {
            "ioc_value": "trendmnicro.qzz.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-18 10:49:47",
            "last_seen_utc": "2025-09-20 07:48:36",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570662": [
        {
            "ioc_value": "sliv.ogzhenren.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-18 10:49:46",
            "last_seen_utc": "2025-09-18 13:50:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570644": [
        {
            "ioc_value": "t.dev.drakeinternationalagency.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-18 07:10:25",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570637": [
        {
            "ioc_value": "customer-cheats.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-18 06:02:37",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-cjpgnszta1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570633": [
        {
            "ioc_value": "up.drivers-bp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-18 06:02:36",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-f24wvsz1ax",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570634": [
        {
            "ioc_value": "pop-kruger.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-18 06:02:36",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-fn4c6szny3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570635": [
        {
            "ioc_value": "ie-sorts.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-18 06:02:36",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-fqmhfaznz4",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570631": [
        {
            "ioc_value": "terang.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-18 06:02:09",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-b93ljsyqw5",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570630": [
        {
            "ioc_value": "lines-clothes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-18 06:02:03",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250818-c1fabsbn8v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570623": [
        {
            "ioc_value": "type.plex.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-18 04:10:38",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570593": [
        {
            "ioc_value": "autoconfig.box.livrocentauros.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-18 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.143.11.34+autoconfig.box.livrocentauros.cfd",
            "tags": "AS25693,C2,censys,VIRMACH",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1570592": [
        {
            "ioc_value": "autodiscover.box.livrocentauros.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-18 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.143.11.34+autodiscover.box.livrocentauros.cfd",
            "tags": "AS25693,C2,censys,VIRMACH",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1570589": [
        {
            "ioc_value": "cloud.defenderblt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-18 02:48:56",
            "last_seen_utc": "2025-09-17 07:49:48",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570581": [
        {
            "ioc_value": "openapi.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-18 00:02:50",
            "last_seen_utc": "2025-08-18 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+openapi.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570582": [
        {
            "ioc_value": "avatars.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-18 00:02:50",
            "last_seen_utc": "2025-08-19 00:03:04",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+avatars.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570583": [
        {
            "ioc_value": "id.rootvk.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-18 00:02:50",
            "last_seen_utc": "2025-08-19 04:01:11",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+id.rootvk.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570579": [
        {
            "ioc_value": "imgs2.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-18 00:02:49",
            "last_seen_utc": "2025-08-18 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+imgs2.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570580": [
        {
            "ioc_value": "acm.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-18 00:02:49",
            "last_seen_utc": "2025-08-18 04:00:56",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+acm.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570574": [
        {
            "ioc_value": "admiring-newton.86-54-42-217.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-18 00:02:34",
            "last_seen_utc": "2025-08-18 04:00:34",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/86.54.42.217+admiring-newton.86-54-42-217.plesk.page",
            "tags": "AS42624,C2,censys,Havoc,SWISSNETWORK02",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570575": [
        {
            "ioc_value": "cukurukuk.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-18 00:02:34",
            "last_seen_utc": "2025-08-18 04:00:35",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.235.75.42+cukurukuk.fun",
            "tags": "AS135444,C2,censys,Havoc,IDNIC-IKUBARU-AS-ID",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570489": [
        {
            "ioc_value": "bassjj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-17 18:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1570501": [
        {
            "ioc_value": "yohlkdt3m.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-17 18:02:39",
            "last_seen_utc": "2025-08-17 18:02:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-vsx5aaw1gt",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570502": [
        {
            "ioc_value": "j4gn7dcux.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-17 18:02:39",
            "last_seen_utc": "2025-08-17 18:02:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-v6ej4agl91",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570503": [
        {
            "ioc_value": "jne7ovfut.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-17 18:02:39",
            "last_seen_utc": "2025-08-17 18:02:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-sklp6swl17",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570499": [
        {
            "ioc_value": "ritihas826-36023.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-17 18:02:05",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-ttyxjawzfy",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570500": [
        {
            "ioc_value": "miacata.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-17 18:02:05",
            "last_seen_utc": "2025-09-13 11:43:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-pcmeysem9w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570497": [
        {
            "ioc_value": "voxenil647-38077.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-17 18:02:04",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-wctmlagm5v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570496": [
        {
            "ioc_value": "ngdgbedgtw-61717.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-17 18:01:58",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-qv1kzawscs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570494": [
        {
            "ioc_value": "club-argue.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-17 18:01:57",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-whwddaxjs4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570463": [
        {
            "ioc_value": "tvstream.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-17 16:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/c3ffd5b5-9460-4f49-a252-948394f7ae39",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1570482": [
        {
            "ioc_value": "waitdriverupdating.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-17 16:34:41",
            "last_seen_utc": "2025-09-13 11:43:39",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1570470": [
        {
            "ioc_value": "rzr.plex.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-17 15:10:28",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570466": [
        {
            "ioc_value": "csgeneration-win.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-17 14:48:54",
            "last_seen_utc": "2025-08-24 15:48:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570459": [
        {
            "ioc_value": "we.sorvr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-17 13:11:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570458": [
        {
            "ioc_value": "we.helpasist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-17 13:10:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570451": [
        {
            "ioc_value": "po.rcwade.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-17 12:49:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SimpleHelp",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570452": [
        {
            "ioc_value": "cartatrantap.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-17 12:49:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SimpleHelp",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570453": [
        {
            "ioc_value": "joi-b.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-17 12:49:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SimpleHelp",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570449": [
        {
            "ioc_value": "glutebikes.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-17 12:49:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SimpleHelp",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570450": [
        {
            "ioc_value": "secx.avsecpnl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-17 12:49:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SimpleHelp",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570447": [
        {
            "ioc_value": "bpwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-17 12:46:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570448": [
        {
            "ioc_value": "u9b.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-17 12:46:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570436": [
        {
            "ioc_value": "static.140.144.161.5.clients.your-server.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-17 12:02:30",
            "last_seen_utc": "2025-08-18 04:00:34",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/5.161.144.140+static.140.144.161.5.clients.your-server.de",
            "tags": "AS213230,C2,censys,Havoc,HETZNER-CLOUD2-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570430": [
        {
            "ioc_value": "Camerwamper-64923.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-17 12:02:13",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-nmnv4avjx8",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570428": [
        {
            "ioc_value": "few-mines.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-17 12:01:56",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-jvjtwstjw2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570322": [
        {
            "ioc_value": "l86.wpherc.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ares",
            "malware_alias": null,
            "malware_printable": "Ares",
            "first_seen_utc": "2025-08-17 07:38:06",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": "https://search.censys.io/hosts/176.58.109.21+l86.wpherc.dev",
            "tags": "AS63949,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1570097": [
        {
            "ioc_value": "global-weekends.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-17 07:38:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG,ZPHP",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1570377": [
        {
            "ioc_value": "public-radios.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-17 06:01:56",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250817-e5ln1sar81",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570375": [
        {
            "ioc_value": "stubbb.airdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-17 05:38:59",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1570376": [
        {
            "ioc_value": "technical-harder.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-17 05:38:59",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1570373": [
        {
            "ioc_value": "s3ov838.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-17 05:36:38",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1570372": [
        {
            "ioc_value": "itredirect.merseine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-17 05:36:20",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1570099": [
        {
            "ioc_value": "tp.api.plex.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-16 22:10:40",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570095": [
        {
            "ioc_value": "security.gueradflwre.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-16 21:06:49",
            "last_seen_utc": "2025-08-17 20:29:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1570096": [
        {
            "ioc_value": "andezileb.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-16 21:06:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1570084": [
        {
            "ioc_value": "industries-ii-wine-details.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-08-16 20:17:39",
            "last_seen_utc": "2025-08-18 15:08:59",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115040269680413289",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1570064": [
        {
            "ioc_value": "archeckfix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-16 19:55:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1570061": [
        {
            "ioc_value": "telemetrywatson.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-08-16 18:36:02",
            "last_seen_utc": "2025-09-14 23:48:04",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=telemetrywatson.live",
            "tags": "Amadey,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1570051": [
        {
            "ioc_value": "restaurant-do.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-16 18:01:51",
            "last_seen_utc": "2025-09-13 11:43:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250816-qbyx2axyh1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1570052": [
        {
            "ioc_value": "Snfers-56365.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-16 18:01:51",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250816-qhnewaxzfx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1569957": [
        {
            "ioc_value": "propiaworser.quest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569958": [
        {
            "ioc_value": "rosekarat.quest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569959": [
        {
            "ioc_value": "route36grille.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569960": [
        {
            "ioc_value": "sheller.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569961": [
        {
            "ioc_value": "sinchew.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569962": [
        {
            "ioc_value": "szwanglou.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569963": [
        {
            "ioc_value": "tangerinearray.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569964": [
        {
            "ioc_value": "tispenodnos.quest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569965": [
        {
            "ioc_value": "twdesignacreation.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569966": [
        {
            "ioc_value": "vortex-crystal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569967": [
        {
            "ioc_value": "waynenicholson.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569968": [
        {
            "ioc_value": "xmegami.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569969": [
        {
            "ioc_value": "xn--balcasurucukursu-khc93a.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569970": [
        {
            "ioc_value": "zozovahbrands.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569935": [
        {
            "ioc_value": "hoanghachai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569936": [
        {
            "ioc_value": "isportdata.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569937": [
        {
            "ioc_value": "jaqeba.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569938": [
        {
            "ioc_value": "jeanmarielafon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569939": [
        {
            "ioc_value": "jetbud.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569940": [
        {
            "ioc_value": "jmcorporationkorea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569941": [
        {
            "ioc_value": "justabunchofbs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569942": [
        {
            "ioc_value": "kcverse.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569943": [
        {
            "ioc_value": "kurlonhyderabad.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569944": [
        {
            "ioc_value": "managejabsurd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569945": [
        {
            "ioc_value": "marine-struct.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569946": [
        {
            "ioc_value": "marthaoneil.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569947": [
        {
            "ioc_value": "menocon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569948": [
        {
            "ioc_value": "mgav71.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569949": [
        {
            "ioc_value": "mlscolumbus.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569950": [
        {
            "ioc_value": "mtrainierlodge.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569951": [
        {
            "ioc_value": "munozconsulting.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569952": [
        {
            "ioc_value": "no1parnell.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569953": [
        {
            "ioc_value": "ofvbufybsvirfg.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569954": [
        {
            "ioc_value": "pawz-store.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569955": [
        {
            "ioc_value": "plantestine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569956": [
        {
            "ioc_value": "plumbersincali.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569914": [
        {
            "ioc_value": "assetacre.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569915": [
        {
            "ioc_value": "associates-pl.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569916": [
        {
            "ioc_value": "axiabjj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569917": [
        {
            "ioc_value": "beatbopped.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569918": [
        {
            "ioc_value": "bracunis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569919": [
        {
            "ioc_value": "bsessis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569920": [
        {
            "ioc_value": "bundimshelbwala.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569921": [
        {
            "ioc_value": "carshaltonfestival.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569922": [
        {
            "ioc_value": "carter-wallace.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569923": [
        {
            "ioc_value": "chaikuo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569924": [
        {
            "ioc_value": "chouinardcustomcreations.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569925": [
        {
            "ioc_value": "columbiabutikk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569926": [
        {
            "ioc_value": "coolingmvmath.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569927": [
        {
            "ioc_value": "creacn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569928": [
        {
            "ioc_value": "dfgdfgivetender.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569929": [
        {
            "ioc_value": "dtcandco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569930": [
        {
            "ioc_value": "epointbd.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569931": [
        {
            "ioc_value": "equestrianlimousine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569932": [
        {
            "ioc_value": "fkjdkjreiofkkldskldfklefd.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569933": [
        {
            "ioc_value": "frfrfrjrbfkfncifnsnqwnxbcb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569934": [
        {
            "ioc_value": "healthians.care",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569908": [
        {
            "ioc_value": "302mh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569909": [
        {
            "ioc_value": "33m123.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569910": [
        {
            "ioc_value": "6montecitoblvd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569911": [
        {
            "ioc_value": "airiosystems.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569912": [
        {
            "ioc_value": "alivehydrolounge.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569913": [
        {
            "ioc_value": "asesoriaseguridadysalud.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-16 15:41:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569903": [
        {
            "ioc_value": "indianagoods.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-08-16 15:38:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569904": [
        {
            "ioc_value": "seamonkey.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.glupteba",
            "malware_alias": null,
            "malware_printable": "Glupteba",
            "first_seen_utc": "2025-08-16 15:38:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,glupteba",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569821": [
        {
            "ioc_value": "ai.api.plex.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-16 14:10:39",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1569803": [
        {
            "ioc_value": "bootaa.anondns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-16 12:33:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "redrabytes"
        }
    ],
    "1569811": [
        {
            "ioc_value": "Crimey1337-43127.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-16 12:02:17",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250816-hj21navp19",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1569808": [
        {
            "ioc_value": "carljas.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-16 12:01:57",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250816-l14glawlv8",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1569807": [
        {
            "ioc_value": "an-schema.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-16 12:01:52",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250816-nf1w3scp7y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1569806": [
        {
            "ioc_value": "qiuy.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-16 11:21:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1569800": [
        {
            "ioc_value": "windows-updates.nice-data.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-16 10:49:03",
            "last_seen_utc": "2025-09-17 07:50:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1569799": [
        {
            "ioc_value": "9ra2xnnm8v62x.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-16 10:48:43",
            "last_seen_utc": "2025-10-07 09:51:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1569147": [
        {
            "ioc_value": "storage.givescash.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-16 08:19:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115034603912497311",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1569148": [
        {
            "ioc_value": "security.flqaergwaard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-16 08:19:31",
            "last_seen_utc": "2025-08-19 21:20:30",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1569149": [
        {
            "ioc_value": "bonzevud.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-16 08:19:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1569163": [
        {
            "ioc_value": "api.signatureofdocs.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-16 08:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/c0e47f5a-4b2b-45e0-8d5a-73479ce6ad6f",
            "tags": "c2,infostealer,stealer",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1569694": [
        {
            "ioc_value": "cdoventures.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-16 08:19:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://malasada.tech/landupdate808-backend-c2-analysis/",
            "tags": "LandUpdate808",
            "anonymous": "0",
            "reporter": "MalasadaTech"
        }
    ],
    "1569697": [
        {
            "ioc_value": "stefanchik.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-16 08:19:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://malasada.tech/landupdate808-backend-c2-analysis/",
            "tags": "LandUpdate808",
            "anonymous": "0",
            "reporter": "MalasadaTech"
        }
    ],
    "1569695": [
        {
            "ioc_value": "cwcstudios.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-16 08:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://malasada.tech/landupdate808-backend-c2-analysis/",
            "tags": "LandUpdate808",
            "anonymous": "0",
            "reporter": "MalasadaTech"
        }
    ],
    "1569696": [
        {
            "ioc_value": "laceyanns.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-16 08:19:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://malasada.tech/landupdate808-backend-c2-analysis/",
            "tags": "LandUpdate808",
            "anonymous": "0",
            "reporter": "MalasadaTech"
        }
    ],
    "1569773": [
        {
            "ioc_value": "ratty.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-16 06:03:36",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250816-dat68svtcs",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1569716": [
        {
            "ioc_value": "ec2-3-146-105-91.us-east-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-16 04:00:38",
            "last_seen_utc": "2025-08-16 04:02:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.146.105.91+ec2-3-146-105-91.us-east-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1569715": [
        {
            "ioc_value": "ec2-16-170-232-86.eu-north-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-16 04:00:37",
            "last_seen_utc": "2025-08-16 04:02:20",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/16.170.232.86+ec2-16-170-232-86.eu-north-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1569701": [
        {
            "ioc_value": "gitcompay.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-16 02:48:47",
            "last_seen_utc": "2025-10-04 07:49:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1569699": [
        {
            "ioc_value": "smtp.mx.plex.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-16 01:10:25",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1569677": [
        {
            "ioc_value": "tl.dr.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-15 22:24:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569675": [
        {
            "ioc_value": "told-accomplished.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 22:22:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569670": [
        {
            "ioc_value": "names-petite.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xenorat",
            "malware_alias": null,
            "malware_printable": "XenoRAT",
            "first_seen_utc": "2025-08-15 22:20:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xenorat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569669": [
        {
            "ioc_value": "abundancia.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-15 22:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569663": [
        {
            "ioc_value": "ykglqsbgjbxsja.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569664": [
        {
            "ioc_value": "ypropjjqlnq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569665": [
        {
            "ioc_value": "ysvsagwfr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569666": [
        {
            "ioc_value": "yvqebqmd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:34",
            "last_seen_utc": "2025-08-16 15:40:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569667": [
        {
            "ioc_value": "ywrskdunkqgkikfv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569668": [
        {
            "ioc_value": "yxqcwilaughqrxxhuv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569638": [
        {
            "ioc_value": "vuhvdkvo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569639": [
        {
            "ioc_value": "vupepgfagso.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569640": [
        {
            "ioc_value": "vusiqdyp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569641": [
        {
            "ioc_value": "vyhxatulmuaxvexjv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569642": [
        {
            "ioc_value": "vytiwhwdomibkisctq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569643": [
        {
            "ioc_value": "waoimlpgtvdsqx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569644": [
        {
            "ioc_value": "wbmpvebw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569645": [
        {
            "ioc_value": "wcbpdfpgwffjs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569646": [
        {
            "ioc_value": "wodrfdxakskqdurgg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569647": [
        {
            "ioc_value": "wwwlridhcphwak.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569648": [
        {
            "ioc_value": "wybypnnefwrnijmr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569649": [
        {
            "ioc_value": "wyvxmxnkkibgdxhv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569650": [
        {
            "ioc_value": "xablgjgqpfayxcoan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569651": [
        {
            "ioc_value": "xdgeivuswhon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569652": [
        {
            "ioc_value": "xhxribeneigukhyeaxj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569653": [
        {
            "ioc_value": "xkchipoapyp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569654": [
        {
            "ioc_value": "xlpmvmcaoppokdcldc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569655": [
        {
            "ioc_value": "xmjmlxiibhblorc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569656": [
        {
            "ioc_value": "xopkmvijckajixcnu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569657": [
        {
            "ioc_value": "xowgbwpurkrbdaoweh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569658": [
        {
            "ioc_value": "xwbjkvtdmufmf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569659": [
        {
            "ioc_value": "xyshvidiova.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569660": [
        {
            "ioc_value": "ydviihefckogxwqhrla.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569661": [
        {
            "ioc_value": "yelwnmiuvoqhqi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569662": [
        {
            "ioc_value": "ygisojwewdsirmo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569615": [
        {
            "ioc_value": "tbtvpgng.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569616": [
        {
            "ioc_value": "tfguhidoew.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569617": [
        {
            "ioc_value": "tfudlnro.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": "2025-08-21 10:04:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569618": [
        {
            "ioc_value": "tjtabrbfk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569619": [
        {
            "ioc_value": "tschqwwyck.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569620": [
        {
            "ioc_value": "twcdgtvl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569621": [
        {
            "ioc_value": "udauindm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569622": [
        {
            "ioc_value": "ujvdgbtkowj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569623": [
        {
            "ioc_value": "ujyprlpoxwwshj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569624": [
        {
            "ioc_value": "ukpamxcqknbrwtxeon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569625": [
        {
            "ioc_value": "ulgdnhsejsmcottuod.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569626": [
        {
            "ioc_value": "umwwjriucoa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569627": [
        {
            "ioc_value": "uoctajwdjlqltbf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569628": [
        {
            "ioc_value": "uqlmkgtnofmabnpwhj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569629": [
        {
            "ioc_value": "uvptsjqdvxkjsca.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569630": [
        {
            "ioc_value": "uwoxkmwul.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569631": [
        {
            "ioc_value": "uxasdaxjiqrk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569632": [
        {
            "ioc_value": "uxvbhdtbhth.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569633": [
        {
            "ioc_value": "vajskiyluwh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569634": [
        {
            "ioc_value": "vhhbenjngfkdqqrxyef.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569635": [
        {
            "ioc_value": "vixqwtroi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569636": [
        {
            "ioc_value": "vrrkcmgm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569637": [
        {
            "ioc_value": "vsmtiytrcacrgcj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569592": [
        {
            "ioc_value": "qivurbqwxv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569593": [
        {
            "ioc_value": "qjqykmyd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569594": [
        {
            "ioc_value": "qlpuekmxibf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569595": [
        {
            "ioc_value": "qocdtgtkl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569596": [
        {
            "ioc_value": "qtlmbubna.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569597": [
        {
            "ioc_value": "rbartdeguauwfnmuf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569598": [
        {
            "ioc_value": "rdxcvejik.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569599": [
        {
            "ioc_value": "rjdirngskatrtg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569600": [
        {
            "ioc_value": "rntqtgcqnc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569601": [
        {
            "ioc_value": "rnxlvwchep.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569602": [
        {
            "ioc_value": "roukwtmdvelyea.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569603": [
        {
            "ioc_value": "rrnlbwklkfmlllveh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569604": [
        {
            "ioc_value": "rubyscoeicm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569605": [
        {
            "ioc_value": "ruiwjxtgflljp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569606": [
        {
            "ioc_value": "ruvbymubogvlllkyaji.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569607": [
        {
            "ioc_value": "rwptujecxf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569608": [
        {
            "ioc_value": "sjtklvpttgogitvptca.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569609": [
        {
            "ioc_value": "slkfbshuoru.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569610": [
        {
            "ioc_value": "spenoiqcbsymgptcj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569611": [
        {
            "ioc_value": "sqhmkesvsraquihx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569612": [
        {
            "ioc_value": "squstnyywumup.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569613": [
        {
            "ioc_value": "ssvducwu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569614": [
        {
            "ioc_value": "svdyfsdeyawxhxn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569567": [
        {
            "ioc_value": "mnnbfmkccrlacrpi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569568": [
        {
            "ioc_value": "mrtksmcwd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569569": [
        {
            "ioc_value": "mskifyvnjgjlbe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569570": [
        {
            "ioc_value": "musdeyejbcbkse.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569571": [
        {
            "ioc_value": "mvtaudrockn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569572": [
        {
            "ioc_value": "nioidweriaxmwa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569573": [
        {
            "ioc_value": "nnsnaaqivnbtouvdaxv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569574": [
        {
            "ioc_value": "nrfronglu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569575": [
        {
            "ioc_value": "nvplxmxnnfsrmjk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569576": [
        {
            "ioc_value": "nwynfhre.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569577": [
        {
            "ioc_value": "ocjsqbqoyjlavan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569578": [
        {
            "ioc_value": "oijkhgcahdwyixo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569579": [
        {
            "ioc_value": "oswgbooxfmqeejem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569580": [
        {
            "ioc_value": "pbbvkscdfqmx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569581": [
        {
            "ioc_value": "pchlbfwusr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569582": [
        {
            "ioc_value": "pgtbvvjadweh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569583": [
        {
            "ioc_value": "picaqhesd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569584": [
        {
            "ioc_value": "pkfrnnsvab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569585": [
        {
            "ioc_value": "psjldypo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569586": [
        {
            "ioc_value": "psnylopyt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569587": [
        {
            "ioc_value": "ptddbyopodpanxbu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569588": [
        {
            "ioc_value": "qbbroaeamomeoqgsxuc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569589": [
        {
            "ioc_value": "qfoulraymhyds.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569590": [
        {
            "ioc_value": "qhlhsaytjeaorx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569591": [
        {
            "ioc_value": "qisgxhcl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569542": [
        {
            "ioc_value": "jdjcpnuhmiimsalkwdf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569543": [
        {
            "ioc_value": "jdonpdfvw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569544": [
        {
            "ioc_value": "jfvabcgsouslpimik.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569545": [
        {
            "ioc_value": "jkvkigmtstgh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569546": [
        {
            "ioc_value": "jltqngrgikawpnoji.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569547": [
        {
            "ioc_value": "jlwnwcwbp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569548": [
        {
            "ioc_value": "jpuityvakjgg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569549": [
        {
            "ioc_value": "jrkjiooayfdqehmolap.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569550": [
        {
            "ioc_value": "jsrdpgvmu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569551": [
        {
            "ioc_value": "jstxomkn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569552": [
        {
            "ioc_value": "kbchmynenfcuktfxa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569553": [
        {
            "ioc_value": "kegnvjtiowifoavcb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569554": [
        {
            "ioc_value": "kiggwewecpyimvup.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569555": [
        {
            "ioc_value": "kpsfabxdwbvv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569556": [
        {
            "ioc_value": "ksdrwalv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569557": [
        {
            "ioc_value": "ktfejmafpmubmis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569558": [
        {
            "ioc_value": "kwqfxbogu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569559": [
        {
            "ioc_value": "kxusdydywsppkdtlxws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569560": [
        {
            "ioc_value": "llcpbelxf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569561": [
        {
            "ioc_value": "lnwdxoqoqxtxxdgs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569562": [
        {
            "ioc_value": "lsvxqptfxfehhprpuj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569563": [
        {
            "ioc_value": "lwrrvrebt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569564": [
        {
            "ioc_value": "mevofemqreinlirk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569565": [
        {
            "ioc_value": "mjrittpmk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569566": [
        {
            "ioc_value": "mmfahqrmftuu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569518": [
        {
            "ioc_value": "gswcjhdhgkjnvkent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569519": [
        {
            "ioc_value": "guvdavhwoylcb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569520": [
        {
            "ioc_value": "gwqqcthftcngyt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569521": [
        {
            "ioc_value": "gyaxrikstdwtkai.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569522": [
        {
            "ioc_value": "gyxdoppqvsy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569523": [
        {
            "ioc_value": "hbuqmyrrpoqmybl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569524": [
        {
            "ioc_value": "hfomcijpsxnry.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569525": [
        {
            "ioc_value": "hgydiduewiltga.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569526": [
        {
            "ioc_value": "hmuhvsjjl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569527": [
        {
            "ioc_value": "hqepovopfoskaf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569528": [
        {
            "ioc_value": "hvkhytpydqm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569529": [
        {
            "ioc_value": "hwgcksenffubhwqmdal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569530": [
        {
            "ioc_value": "iavfuykg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569531": [
        {
            "ioc_value": "iedttkfpokhgfclsk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569532": [
        {
            "ioc_value": "ijwjkcdpbueqq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569533": [
        {
            "ioc_value": "ijxgwfuxvgoks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569534": [
        {
            "ioc_value": "imuqnrtccpissbmefte.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569535": [
        {
            "ioc_value": "irgpjqkcojxabjs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569536": [
        {
            "ioc_value": "irulbexujsaskp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569537": [
        {
            "ioc_value": "irypcpym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569538": [
        {
            "ioc_value": "isxvhiqqlflxicdno.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569539": [
        {
            "ioc_value": "iwdshywjrvggnqohg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569540": [
        {
            "ioc_value": "iwtkdxsmu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569541": [
        {
            "ioc_value": "jbeqyjlvjqbmq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569496": [
        {
            "ioc_value": "dmhvburtxot.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569497": [
        {
            "ioc_value": "dssuxhidrapxvcxmqvo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569498": [
        {
            "ioc_value": "dusxnqcoykl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569499": [
        {
            "ioc_value": "dvfturrpb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569500": [
        {
            "ioc_value": "dwerjnnkpfbmdfeuwby.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569501": [
        {
            "ioc_value": "eelepdsrwmggiilpaq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569502": [
        {
            "ioc_value": "emwdrbwapescxix.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569503": [
        {
            "ioc_value": "epwbonwkmcvjunodvf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569504": [
        {
            "ioc_value": "epwnqeghafyocr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569505": [
        {
            "ioc_value": "evolxbnmxnighbhpbw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569506": [
        {
            "ioc_value": "exjijcjhjlatkplnfol.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569507": [
        {
            "ioc_value": "fbbntdkljkvb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569508": [
        {
            "ioc_value": "fboymydk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569509": [
        {
            "ioc_value": "fcajmvxrd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569510": [
        {
            "ioc_value": "fdijucnvsfvpel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569511": [
        {
            "ioc_value": "fimntlxswx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569512": [
        {
            "ioc_value": "fkdrsgjjroodh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569513": [
        {
            "ioc_value": "fmxkhwlbsvjic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569514": [
        {
            "ioc_value": "fxflcqdiilffuhwmvn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569515": [
        {
            "ioc_value": "gflyifvtyuarn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569516": [
        {
            "ioc_value": "gfyysdjdftm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569517": [
        {
            "ioc_value": "gjnjaevyntcjkdemqa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569471": [
        {
            "ioc_value": "afgfevmeplavvi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569472": [
        {
            "ioc_value": "aftfjuclhvdubfeuqs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569473": [
        {
            "ioc_value": "amhqfywanwiip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569474": [
        {
            "ioc_value": "andeyvgrdmcuhdmwkd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569475": [
        {
            "ioc_value": "anhdpsualxmxqrbne.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569476": [
        {
            "ioc_value": "aqjwtguuxc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569477": [
        {
            "ioc_value": "aqyycusxpiyphgqt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569478": [
        {
            "ioc_value": "aykibilkbvufrevib.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569479": [
        {
            "ioc_value": "baywsfsemlttpsj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569480": [
        {
            "ioc_value": "bbdtowayyw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569481": [
        {
            "ioc_value": "bjmwcmpyrghf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569482": [
        {
            "ioc_value": "bnduajijjnyjowost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569483": [
        {
            "ioc_value": "bxnopdkka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569484": [
        {
            "ioc_value": "bxqvcimgcaepkubgi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569485": [
        {
            "ioc_value": "celiwgodhgcwknkot.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569486": [
        {
            "ioc_value": "celnjqtqkgxsccabmj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569487": [
        {
            "ioc_value": "ckbytyyandmpgyuojl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": "2025-08-21 10:04:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569488": [
        {
            "ioc_value": "cuagwiain.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569489": [
        {
            "ioc_value": "cugxojvumi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569490": [
        {
            "ioc_value": "cwpppiblxarfcmqoym.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569491": [
        {
            "ioc_value": "dajxhcddxoyp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569492": [
        {
            "ioc_value": "dakqyppswmvuyncbis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569493": [
        {
            "ioc_value": "ddeqsgsws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569494": [
        {
            "ioc_value": "dedbtgnilfqq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569495": [
        {
            "ioc_value": "djtftjakyiqfn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569469": [
        {
            "ioc_value": "aalhoqwtompx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569470": [
        {
            "ioc_value": "adhymefcryqjfsg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-08-15 22:19:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569468": [
        {
            "ioc_value": "villayuhh-63081.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 22:18:55",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569464": [
        {
            "ioc_value": "sale-brings.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 22:18:54",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569465": [
        {
            "ioc_value": "villayuh-50048.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 22:18:54",
            "last_seen_utc": "2025-09-13 11:43:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569466": [
        {
            "ioc_value": "villayuh-57711.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 22:18:54",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569467": [
        {
            "ioc_value": "villayuhh-59194.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 22:18:54",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569440": [
        {
            "ioc_value": "thaus.ws",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-08-15 22:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569441": [
        {
            "ioc_value": "tsrv3.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-08-15 22:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569442": [
        {
            "ioc_value": "zzruuoooshfrohu.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phorpiex",
            "malware_alias": "Trik,phorphiex",
            "malware_printable": "Phorpiex",
            "first_seen_utc": "2025-08-15 22:18:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,phorpiex",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569436": [
        {
            "ioc_value": "phulocnhat2005.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 22:16:31",
            "last_seen_utc": "2025-09-13 11:44:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569437": [
        {
            "ioc_value": "riseonid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 22:16:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569438": [
        {
            "ioc_value": "s3o-cnc.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 22:16:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569421": [
        {
            "ioc_value": "www.sesimpson-judgehq.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569422": [
        {
            "ioc_value": "www.sportsboost.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569423": [
        {
            "ioc_value": "www.stanbulwizad.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569424": [
        {
            "ioc_value": "www.tartingmoments.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569425": [
        {
            "ioc_value": "www.tb-india.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569426": [
        {
            "ioc_value": "www.ugpostc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569427": [
        {
            "ioc_value": "www.uixing.coffee",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569428": [
        {
            "ioc_value": "www.vcdc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569429": [
        {
            "ioc_value": "www.vovegas330.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569430": [
        {
            "ioc_value": "www.wastontechnology.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569431": [
        {
            "ioc_value": "www.wrlab.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569432": [
        {
            "ioc_value": "www.xgh17g.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569433": [
        {
            "ioc_value": "www.yuggb.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569434": [
        {
            "ioc_value": "www.zcasf.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569404": [
        {
            "ioc_value": "www.imercyaye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569405": [
        {
            "ioc_value": "www.jangbet.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569406": [
        {
            "ioc_value": "www.leaning-services-73684.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569407": [
        {
            "ioc_value": "www.mhzvwn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569408": [
        {
            "ioc_value": "www.ms-stl.services",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569409": [
        {
            "ioc_value": "www.nderwoods.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569410": [
        {
            "ioc_value": "www.netrve.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": "2025-08-28 06:54:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569411": [
        {
            "ioc_value": "www.nfmedi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569412": [
        {
            "ioc_value": "www.nterac24-confirmation.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569413": [
        {
            "ioc_value": "www.omesup.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569414": [
        {
            "ioc_value": "www.omfort-domivka.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569415": [
        {
            "ioc_value": "www.ommunication-skills-40641.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569416": [
        {
            "ioc_value": "www.ompassiondrivenleadership.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569417": [
        {
            "ioc_value": "www.overed-terrace-21427.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569418": [
        {
            "ioc_value": "www.picmovies.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569419": [
        {
            "ioc_value": "www.qdq6d.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569420": [
        {
            "ioc_value": "www.rdentia.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569388": [
        {
            "ioc_value": "www.e-1.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569389": [
        {
            "ioc_value": "www.ealth-urinary-rco2i5.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569390": [
        {
            "ioc_value": "www.eedance.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569391": [
        {
            "ioc_value": "www.eetproviderprep.directory",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569392": [
        {
            "ioc_value": "www.eh7pk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569393": [
        {
            "ioc_value": "www.ellieisla.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569394": [
        {
            "ioc_value": "www.erenxinzi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569395": [
        {
            "ioc_value": "www.etiwu-lahexa.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569396": [
        {
            "ioc_value": "www.evxeki2.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569397": [
        {
            "ioc_value": "www.gouvq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569398": [
        {
            "ioc_value": "www.hampseru.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569399": [
        {
            "ioc_value": "www.hhjhrretu.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569400": [
        {
            "ioc_value": "www.hone-unlocker.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569401": [
        {
            "ioc_value": "www.i2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569402": [
        {
            "ioc_value": "www.ian454.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569403": [
        {
            "ioc_value": "www.igdesondaj.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569370": [
        {
            "ioc_value": "www.12xxhs.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569371": [
        {
            "ioc_value": "www.2rm7y.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569372": [
        {
            "ioc_value": "www.31cha.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569373": [
        {
            "ioc_value": "www.336611.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569374": [
        {
            "ioc_value": "www.3y28z.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569375": [
        {
            "ioc_value": "www.76aviacraft.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569376": [
        {
            "ioc_value": "www.7p.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569377": [
        {
            "ioc_value": "www.93cc.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569378": [
        {
            "ioc_value": "www.ajesticserver.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569379": [
        {
            "ioc_value": "www.amuel608.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569380": [
        {
            "ioc_value": "www.asyre.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569381": [
        {
            "ioc_value": "www.ayanplus.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569382": [
        {
            "ioc_value": "www.c0513.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569383": [
        {
            "ioc_value": "www.c1265.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569384": [
        {
            "ioc_value": "www.c2059.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569385": [
        {
            "ioc_value": "www.cgvtdh.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569386": [
        {
            "ioc_value": "www.dfhhja.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569387": [
        {
            "ioc_value": "www.duuqm.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-15 22:15:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569289": [
        {
            "ioc_value": "ads-leaf.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569290": [
        {
            "ioc_value": "cancersincura02.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569291": [
        {
            "ioc_value": "cancersincura03.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569292": [
        {
            "ioc_value": "cancersincura04.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569293": [
        {
            "ioc_value": "cancersincura05.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569294": [
        {
            "ioc_value": "cancersincura06.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569295": [
        {
            "ioc_value": "cancersincura07.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569296": [
        {
            "ioc_value": "cancersincura08.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569297": [
        {
            "ioc_value": "cancersincura09.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569298": [
        {
            "ioc_value": "cancersincura10.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569299": [
        {
            "ioc_value": "cancersincura11.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569300": [
        {
            "ioc_value": "cancersincura12.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569301": [
        {
            "ioc_value": "cancersincura13.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569302": [
        {
            "ioc_value": "cancersincura14.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569303": [
        {
            "ioc_value": "cancersincura15.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-08-15 22:14:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569288": [
        {
            "ioc_value": "mind.fsdragonballs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ave_maria",
            "malware_alias": "AVE_MARIA,AveMariaRAT,Warzone RAT,WarzoneRAT,avemaria",
            "malware_printable": "Ave Maria",
            "first_seen_utc": "2025-08-15 22:14:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "avemaria,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569286": [
        {
            "ioc_value": "s2gj9tonn.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-15 22:13:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1569125": [
        {
            "ioc_value": "ngdgbedgtw-35702.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 18:01:44",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250815-r46n1sbn8s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1569115": [
        {
            "ioc_value": "laughing-lumiere.35-179-93-188.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-15 16:02:22",
            "last_seen_utc": "2025-08-16 04:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/35.179.93.188+laughing-lumiere.35-179-93-188.plesk.page",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1569063": [
        {
            "ioc_value": "img.cdn.plex.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-15 15:10:27",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1569060": [
        {
            "ioc_value": "niggerlover.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 14:50:45",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/97ac7f267466d0546e1655f199aadde77aa0bf94d63d3b9efb086ed6c3b7b7da/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1569010": [
        {
            "ioc_value": "terbibfx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:51",
            "last_seen_utc": "2025-08-15 13:42:33",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569011": [
        {
            "ioc_value": "genunaf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:50",
            "last_seen_utc": "2025-09-27 11:10:38",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569012": [
        {
            "ioc_value": "campaqr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:50",
            "last_seen_utc": "2025-08-15 13:42:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569013": [
        {
            "ioc_value": "dishoti.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:49",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569014": [
        {
            "ioc_value": "folotni.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:48",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569015": [
        {
            "ioc_value": "rockfw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:48",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569017": [
        {
            "ioc_value": "sublupm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:47",
            "last_seen_utc": "2025-09-10 08:31:33",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569016": [
        {
            "ioc_value": "darkhbt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:46",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569019": [
        {
            "ioc_value": "inceputn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:46",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569018": [
        {
            "ioc_value": "mflopj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:45",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569020": [
        {
            "ioc_value": "skitvhg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:44",
            "last_seen_utc": "2025-09-10 08:31:30",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569021": [
        {
            "ioc_value": "jadgqh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:44",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569022": [
        {
            "ioc_value": "steyxld.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:44",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569023": [
        {
            "ioc_value": "seismrzw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:43",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569024": [
        {
            "ioc_value": "spordcp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:43",
            "last_seen_utc": "2025-09-10 08:31:25",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569025": [
        {
            "ioc_value": "theymsq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:42",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569026": [
        {
            "ioc_value": "persprz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:42",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569027": [
        {
            "ioc_value": "kenyafu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:41",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569028": [
        {
            "ioc_value": "homeuhd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:41",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569029": [
        {
            "ioc_value": "untgxlb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:40",
            "last_seen_utc": "2025-08-15 13:42:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569031": [
        {
            "ioc_value": "hannuxb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:38",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569032": [
        {
            "ioc_value": "calixzgk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:38",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569030": [
        {
            "ioc_value": "acromrr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:37",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569033": [
        {
            "ioc_value": "cyanogl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:37",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569035": [
        {
            "ioc_value": "perjxup.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:36",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569034": [
        {
            "ioc_value": "creaprj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:35",
            "last_seen_utc": "2025-09-10 08:31:34",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569036": [
        {
            "ioc_value": "lingzvl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:34",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569037": [
        {
            "ioc_value": "dristha.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:33",
            "last_seen_utc": "2025-08-15 13:42:35",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569038": [
        {
            "ioc_value": "clotmh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:33",
            "last_seen_utc": "2025-09-27 11:10:38",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569039": [
        {
            "ioc_value": "capsiqp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:32",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569040": [
        {
            "ioc_value": "hyphap.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:31",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569041": [
        {
            "ioc_value": "refrico.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:31",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569042": [
        {
            "ioc_value": "angucccg.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:30",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569043": [
        {
            "ioc_value": "decatvl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:30",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569044": [
        {
            "ioc_value": "skunku.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:29",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569045": [
        {
            "ioc_value": "arsetca.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:29",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569046": [
        {
            "ioc_value": "topofnm.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:28",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569047": [
        {
            "ioc_value": "tagawoh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:26",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569048": [
        {
            "ioc_value": "physscq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:26",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569049": [
        {
            "ioc_value": "bearrre.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:25",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569050": [
        {
            "ioc_value": "drespi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:24",
            "last_seen_utc": "2025-09-27 11:10:38",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569051": [
        {
            "ioc_value": "flagump.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:23",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569052": [
        {
            "ioc_value": "greerfa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:23",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569053": [
        {
            "ioc_value": "nearsic.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:22",
            "last_seen_utc": "2025-09-27 11:10:38",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569054": [
        {
            "ioc_value": "acuttia.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:21",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569055": [
        {
            "ioc_value": "incmrvk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:21",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569056": [
        {
            "ioc_value": "combvff.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:20",
            "last_seen_utc": "2025-09-27 11:10:39",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1569057": [
        {
            "ioc_value": "divqtwp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-15 14:40:19",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1568792": [
        {
            "ioc_value": "nodejsexpress.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-15 12:51:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1568791": [
        {
            "ioc_value": "asyncawaitzone.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-15 12:51:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1569004": [
        {
            "ioc_value": "8ve3qsgxk7rs6.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-15 12:49:06",
            "last_seen_utc": "2025-09-16 07:51:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568995": [
        {
            "ioc_value": "rating-amy.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-08-15 12:13:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568996": [
        {
            "ioc_value": "strongdx.freedynamicdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-08-15 12:13:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568997": [
        {
            "ioc_value": "boy-ana.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-08-15 12:13:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568998": [
        {
            "ioc_value": "androman1.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-08-15 12:13:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568999": [
        {
            "ioc_value": "item-expense.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-08-15 12:13:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1569000": [
        {
            "ioc_value": "niklainwar-52787.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-08-15 12:13:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1569001": [
        {
            "ioc_value": "islands-myanmar.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-08-15 12:13:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568960": [
        {
            "ioc_value": "ajczgt.ignorelist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568961": [
        {
            "ioc_value": "snoopdogweedhitler.comslut.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568962": [
        {
            "ioc_value": "savaswsd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": "2025-09-10 12:18:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568963": [
        {
            "ioc_value": "xosjcq.twilightparadox.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568964": [
        {
            "ioc_value": "s.botsaresafu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568965": [
        {
            "ioc_value": "voidc2.p-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568966": [
        {
            "ioc_value": "faggot.comslut.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568967": [
        {
            "ioc_value": "mortetwo.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568968": [
        {
            "ioc_value": "zazadawg.comslut.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568969": [
        {
            "ioc_value": "zebratitties.autblx.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568939": [
        {
            "ioc_value": "cnc.botnet.agency",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568940": [
        {
            "ioc_value": "weed.pozie.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568941": [
        {
            "ioc_value": "swepgv.crabdance.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568942": [
        {
            "ioc_value": "botnetszx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568943": [
        {
            "ioc_value": "j2hnet.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568944": [
        {
            "ioc_value": "iotmiraibotnet.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568945": [
        {
            "ioc_value": "zazadawg3.comslut.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568946": [
        {
            "ioc_value": "cnc.kalonarkks.tk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568947": [
        {
            "ioc_value": "cvawrs.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": "2025-09-10 12:18:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568948": [
        {
            "ioc_value": "mrrplikeuwantit.niggabutt.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568949": [
        {
            "ioc_value": "nigger.comslut.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568950": [
        {
            "ioc_value": "1.santaiot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568951": [
        {
            "ioc_value": "oseuum.chickenkiller.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568952": [
        {
            "ioc_value": "mortebin.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568953": [
        {
            "ioc_value": "s3osx.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568954": [
        {
            "ioc_value": "j2hnet2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568955": [
        {
            "ioc_value": "vpsx64.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568956": [
        {
            "ioc_value": "turkishzenci.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568957": [
        {
            "ioc_value": "love.thotiana.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568958": [
        {
            "ioc_value": "hbtxhuy.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568959": [
        {
            "ioc_value": "dawr1.cyberpros.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568924": [
        {
            "ioc_value": "condiv5.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568925": [
        {
            "ioc_value": "skidlol.p-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568926": [
        {
            "ioc_value": "vmklsfdv.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": "2025-09-10 12:18:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568927": [
        {
            "ioc_value": "hihi.blazingnetwork.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568928": [
        {
            "ioc_value": "idk.daga.house",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568929": [
        {
            "ioc_value": "asdfavae.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": "2025-09-10 12:18:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568930": [
        {
            "ioc_value": "mortefour.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568931": [
        {
            "ioc_value": "fasdv.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": "2025-09-10 12:18:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568932": [
        {
            "ioc_value": "snoopdogweed.n0rv3m.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568933": [
        {
            "ioc_value": "s3ov8.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568934": [
        {
            "ioc_value": "mortethree.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568935": [
        {
            "ioc_value": "connect.feds.gay",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568936": [
        {
            "ioc_value": "naldlh.jumpingcrab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568937": [
        {
            "ioc_value": "raw.vaticanc2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568938": [
        {
            "ioc_value": "nigga.dstat.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-15 12:13:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568921": [
        {
            "ioc_value": "canyouhostme.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-08-15 12:13:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568922": [
        {
            "ioc_value": "top.lacarwashjo.waw.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-08-15 12:13:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568923": [
        {
            "ioc_value": "sub.lacarwashcompanyjo.waw.pl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-08-15 12:13:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568909": [
        {
            "ioc_value": "myhost19.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568910": [
        {
            "ioc_value": "robotix.dyndns.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568911": [
        {
            "ioc_value": "devilpsndarkcomet.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568912": [
        {
            "ioc_value": "kilian33o3.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568913": [
        {
            "ioc_value": "omfg123.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568889": [
        {
            "ioc_value": "florian74.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568890": [
        {
            "ioc_value": "w4tchrs.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568891": [
        {
            "ioc_value": "noziv.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568892": [
        {
            "ioc_value": "phazzze.dyndns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568893": [
        {
            "ioc_value": "jesjee.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568894": [
        {
            "ioc_value": "heska240.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568895": [
        {
            "ioc_value": "fuckrules.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568896": [
        {
            "ioc_value": "hakkaribet.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568897": [
        {
            "ioc_value": "liamderneger.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568898": [
        {
            "ioc_value": "fouadelyaouti9.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568899": [
        {
            "ioc_value": "asmodian.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568900": [
        {
            "ioc_value": "testhost.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568901": [
        {
            "ioc_value": "rsraterboi.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568902": [
        {
            "ioc_value": "shoeb.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568903": [
        {
            "ioc_value": "id-4561.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568904": [
        {
            "ioc_value": "yurrie893.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568905": [
        {
            "ioc_value": "doll14face.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568906": [
        {
            "ioc_value": "hooked.myftp.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568907": [
        {
            "ioc_value": "brutalserver666.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568908": [
        {
            "ioc_value": "drakohack.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-15 12:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568871": [
        {
            "ioc_value": "gzuf777.myftp.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-15 12:12:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568868": [
        {
            "ioc_value": "1453.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-15 12:12:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568869": [
        {
            "ioc_value": "membership-satisfied.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-15 12:12:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568870": [
        {
            "ioc_value": "imsara.dynu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-15 12:12:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568865": [
        {
            "ioc_value": "galpetco.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-15 12:12:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568866": [
        {
            "ioc_value": "chmsts.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-15 12:12:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568858": [
        {
            "ioc_value": "xvskill6.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568859": [
        {
            "ioc_value": "ability-vb.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568860": [
        {
            "ioc_value": "kakarik-32070.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568861": [
        {
            "ioc_value": "larger-farmers.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568862": [
        {
            "ioc_value": "maybe-declared.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568851": [
        {
            "ioc_value": "304af9c5bac4.ngrok-free.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568852": [
        {
            "ioc_value": "search-shuttle.gl.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568853": [
        {
            "ioc_value": "last-get.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568854": [
        {
            "ioc_value": "center-everything.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568855": [
        {
            "ioc_value": "really-disease.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568856": [
        {
            "ioc_value": "system63.linkpc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568857": [
        {
            "ioc_value": "rat.kvlar.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:12:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568838": [
        {
            "ioc_value": "ansyjul29.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-15 12:12:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568839": [
        {
            "ioc_value": "marten1.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-15 12:12:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568840": [
        {
            "ioc_value": "installlgrand1001-53258.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-15 12:12:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568841": [
        {
            "ioc_value": "marten1.loseyourip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-15 12:12:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568842": [
        {
            "ioc_value": "enviodiomdes.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-15 12:12:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568827": [
        {
            "ioc_value": "william-walking.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 12:12:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568828": [
        {
            "ioc_value": "stores-activists.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 12:12:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568829": [
        {
            "ioc_value": "similar-cordless.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 12:12:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568830": [
        {
            "ioc_value": "among-quick.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 12:12:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568831": [
        {
            "ioc_value": "skibidi.minecraft.party",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 12:12:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "15August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1568798": [
        {
            "ioc_value": "172-104-53-127.ip.linodeusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-15 12:02:18",
            "last_seen_utc": "2025-08-16 04:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.104.53.127+172-104-53-127.ip.linodeusercontent.com",
            "tags": "AKAMAI-LINODE-AP,AS63949,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568797": [
        {
            "ioc_value": "z10nx710011-53037.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 12:01:58",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250815-mv35bavrw5",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568796": [
        {
            "ioc_value": "phentermine-institute.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 12:01:43",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250815-mf2b6sgk41",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568788": [
        {
            "ioc_value": "demo.shop.plex.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-15 10:10:36",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568756": [
        {
            "ioc_value": "rianid.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.moobot",
            "malware_alias": null,
            "malware_printable": "MooBot",
            "first_seen_utc": "2025-08-15 06:56:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "mirai,moobot",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1568739": [
        {
            "ioc_value": "ee.vvbb321.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-15 06:31:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6ddf688bdf16a1d465aef954ff90b372dacd8162bac2c7797ff7b6b4f20afcbc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568740": [
        {
            "ioc_value": "ee.jjkk567.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-15 06:31:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6ddf688bdf16a1d465aef954ff90b372dacd8162bac2c7797ff7b6b4f20afcbc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568741": [
        {
            "ioc_value": "ee.nnmm234.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-15 06:31:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6ddf688bdf16a1d465aef954ff90b372dacd8162bac2c7797ff7b6b4f20afcbc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568742": [
        {
            "ioc_value": "ee.aass654.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-15 06:31:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6ddf688bdf16a1d465aef954ff90b372dacd8162bac2c7797ff7b6b4f20afcbc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568743": [
        {
            "ioc_value": "ee.xxcc789.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-15 06:31:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6ddf688bdf16a1d465aef954ff90b372dacd8162bac2c7797ff7b6b4f20afcbc/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568639": [
        {
            "ioc_value": "documents-here.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 06:21:43",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-xpbg8azvdt",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1568671": [
        {
            "ioc_value": "henzelvab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-15 06:21:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1568670": [
        {
            "ioc_value": "security.flaegrudad.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-15 06:21:40",
            "last_seen_utc": "2025-08-21 16:57:43",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1568695": [
        {
            "ioc_value": "4kdownload.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-15 06:21:36",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1568736": [
        {
            "ioc_value": "evbnet.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-15 06:03:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250815-dw8azsdk9x",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568734": [
        {
            "ioc_value": "nature-neutral.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-15 06:02:39",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250815-fcwtysek4w",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568731": [
        {
            "ioc_value": "greater-strategy.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-15 06:02:02",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250815-gbjnnst1ex",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568729": [
        {
            "ioc_value": "channel-expectations.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-15 06:01:40",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250815-cp69nscn3w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568703": [
        {
            "ioc_value": "panel.infodatasinc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-15 02:48:54",
            "last_seen_utc": "2025-09-24 11:50:20",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568704": [
        {
            "ioc_value": "prod.infodatasinc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-15 02:48:54",
            "last_seen_utc": "2025-09-24 11:50:21",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568701": [
        {
            "ioc_value": "login.infodatasinc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-15 02:48:47",
            "last_seen_utc": "2025-09-24 11:50:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568702": [
        {
            "ioc_value": "m2th3k.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-15 02:48:47",
            "last_seen_utc": "2025-09-23 09:50:20",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568694": [
        {
            "ioc_value": "dd.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-15 00:10:42",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568662": [
        {
            "ioc_value": "telamtykina.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-08-14 20:36:02",
            "last_seen_utc": "2025-09-12 23:48:05",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=telamtykina.live",
            "tags": "Amadey,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568656": [
        {
            "ioc_value": "strm.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-14 20:02:32",
            "last_seen_utc": "2025-08-15 04:00:52",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+strm.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568651": [
        {
            "ioc_value": "host0.tryfancify.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-14 20:02:09",
            "last_seen_utc": "2025-08-15 04:00:23",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.42+host0.tryfancify.com",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568641": [
        {
            "ioc_value": "xuyo.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-14 19:23:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1568631": [
        {
            "ioc_value": "what-nudist.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-14 18:01:55",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-qgxbdshj41",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568632": [
        {
            "ioc_value": "had-palmer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-14 18:01:55",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-pjnatsvvgz",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568628": [
        {
            "ioc_value": "educare1.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-14 18:01:44",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-v7z77ayxf1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568629": [
        {
            "ioc_value": "coldalt.coldalt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-14 18:01:44",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-s2lfqswps6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568630": [
        {
            "ioc_value": "vvig.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-14 18:01:44",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-rm3wssak3w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568624": [
        {
            "ioc_value": "stat.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-14 16:02:34",
            "last_seen_utc": "2025-08-15 04:00:52",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+stat.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568619": [
        {
            "ioc_value": "base.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-14 15:10:24",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568588": [
        {
            "ioc_value": "app.makemoremoneychallenge.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-14 13:38:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115027280512286091",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1568585": [
        {
            "ioc_value": "shyda6317.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-14 12:02:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-nhfc6afm6y",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568583": [
        {
            "ioc_value": "thomas-compromise.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-14 12:02:33",
            "last_seen_utc": "2025-09-13 11:44:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-k8d18ssscs",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568576": [
        {
            "ioc_value": "agents-bought.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-14 12:02:00",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-g9ahnazxhy",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568573": [
        {
            "ioc_value": "english-trackbacks.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-14 12:01:52",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-hdmc1scm4y",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568571": [
        {
            "ioc_value": "msasteelalloys.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-14 12:01:44",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-k52ccsssav",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568568": [
        {
            "ioc_value": "programs-realty.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-14 12:01:38",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-n2k3rat1ht",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568570": [
        {
            "ioc_value": "series-segments.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-14 12:01:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-m1fk7ser6x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568563": [
        {
            "ioc_value": "static.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-14 10:11:14",
            "last_seen_utc": "2025-08-14 14:10:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568560": [
        {
            "ioc_value": "antique-proper-prizes-civilian.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-14 09:28:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "asyncrat,cloudflare,xworm",
            "anonymous": "0",
            "reporter": "0xb0mb3r"
        }
    ],
    "1568561": [
        {
            "ioc_value": "oxford-sri-fast-eve.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-14 09:28:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "asyncrat,cloudflare,xworm",
            "anonymous": "0",
            "reporter": "0xb0mb3r"
        }
    ],
    "1568538": [
        {
            "ioc_value": "access.skaparade.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-14 08:52:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1568526": [
        {
            "ioc_value": "redroademail.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.koadic",
            "malware_alias": null,
            "malware_printable": "Koadic",
            "first_seen_utc": "2025-08-14 07:21:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Koadic",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1568294": [
        {
            "ioc_value": "wasabidesktop.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-14 07:21:11",
            "last_seen_utc": "2025-08-13 21:58:05",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/682cb942-b339-4b5c-9c84-d0c322e47d90",
            "tags": "infostealer,msi,stealer",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1568219": [
        {
            "ioc_value": "vendomen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-14 07:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1568223": [
        {
            "ioc_value": "captchaverift.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-08-14 07:21:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1568249": [
        {
            "ioc_value": "items-ana.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-14 07:21:05",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-ysf3jsgq5y/",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1568217": [
        {
            "ioc_value": "analyticanoden.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-14 07:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1568218": [
        {
            "ioc_value": "security.flacergurad.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-14 07:21:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1568208": [
        {
            "ioc_value": "coverdealsforfood.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-14 07:21:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "simplehelp",
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1568523": [
        {
            "ioc_value": "ask-nancy.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-14 06:04:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-cx13maxmt9",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568522": [
        {
            "ioc_value": "jobs-religions.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-14 06:01:53",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-azs4paap6v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568517": [
        {
            "ioc_value": "whiteness.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-14 06:01:42",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-evzswsykv3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568518": [
        {
            "ioc_value": "jajaj2024.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-14 06:01:42",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-df17qsxnt8",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568515": [
        {
            "ioc_value": "mar-cant.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-14 06:01:36",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250814-dc836syxhv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568483": [
        {
            "ioc_value": "ec2-3-8-147-54.eu-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-14 04:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.8.147.54+ec2-3-8-147-54.eu-west-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1568313": [
        {
            "ioc_value": "amaprox.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-14 00:02:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.96.1+amaprox.click",
            "tags": "Amatera,AS13335,C2,censys,CLOUDFLARENET,Panel,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568297": [
        {
            "ioc_value": "fog.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-13 23:10:32",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568289": [
        {
            "ioc_value": "test.woet.ip-ddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-13 20:49:25",
            "last_seen_utc": "2025-09-17 07:50:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568246": [
        {
            "ioc_value": "login.rootvk.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-13 20:02:31",
            "last_seen_utc": "2025-09-01 04:00:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+login.rootvk.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568247": [
        {
            "ioc_value": "e.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-13 20:02:31",
            "last_seen_utc": "2025-08-14 04:00:57",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+e.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568245": [
        {
            "ioc_value": "top-fwz1.messager.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-13 20:02:30",
            "last_seen_utc": "2025-08-14 04:00:56",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.161.209.117+top-fwz1.messager.my",
            "tags": "AS42159,censys,DELTAHOST-AS,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568216": [
        {
            "ioc_value": "HoKsha-41399.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-13 18:02:26",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-qkxrbsztft",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568215": [
        {
            "ioc_value": "cofik60057-64752.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-13 18:01:54",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-r54wtasves",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568212": [
        {
            "ioc_value": "px.zcidc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-13 18:01:40",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-rdnqhscp8y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568214": [
        {
            "ioc_value": "inverterpos.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-13 18:01:40",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-n52vnsyxfy",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568210": [
        {
            "ioc_value": "data.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-13 17:10:29",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568188": [
        {
            "ioc_value": "amassb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-13 15:08:34",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1568187": [
        {
            "ioc_value": "safeguarddelusion.life",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-13 15:05:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1568171": [
        {
            "ioc_value": "checkfivem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-08-13 14:48:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://app.any.run/tasks/2a3e757a-76ee-47e8-8966-962681485adf",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1568177": [
        {
            "ioc_value": "xalo432.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkvision_rat",
            "malware_alias": null,
            "malware_printable": "DarkVision RAT",
            "first_seen_utc": "2025-08-13 14:48:14",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 50,
            "reference": "https://app.any.run/tasks/2a3e757a-76ee-47e8-8966-962681485adf",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1568176": [
        {
            "ioc_value": "squeaxz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-13 14:48:13",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1568183": [
        {
            "ioc_value": "maoismn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-13 14:48:12",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1568169": [
        {
            "ioc_value": "email.atmgift.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-13 13:10:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/115021619272726468",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1568149": [
        {
            "ioc_value": "bestoffivem.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-13 12:33:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1755962/0/html",
            "tags": "DogeStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1568163": [
        {
            "ioc_value": "trust-mpg.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-13 12:02:42",
            "last_seen_utc": "2025-09-13 11:44:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-naw1yabj7x",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568156": [
        {
            "ioc_value": "mission-dude.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-13 12:01:55",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-myk3xawlv2",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568154": [
        {
            "ioc_value": "z10nx711111111-61801.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-13 12:01:50",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-hn1ndsgm6x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568145": [
        {
            "ioc_value": "venom-lazarus.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-13 10:46:32",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/solostalking/status/1953741512136688056",
            "tags": null,
            "anonymous": "0",
            "reporter": "solostalking"
        }
    ],
    "1568142": [
        {
            "ioc_value": "blq.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-13 08:10:52",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1568130": [
        {
            "ioc_value": "anime34.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-13 06:04:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-b1d7ladp3t",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568127": [
        {
            "ioc_value": "best-displayed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-13 06:03:38",
            "last_seen_utc": "2025-08-15 12:12:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-dpwcva1nz2",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568122": [
        {
            "ioc_value": "Shadow32434-42879.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-13 06:02:33",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-gfg1mswvbx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568123": [
        {
            "ioc_value": "catpoopa-53750.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-13 06:02:33",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-clfbsadq81",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568121": [
        {
            "ioc_value": "rema.earise.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-13 06:01:38",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-er8avseq5x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568120": [
        {
            "ioc_value": "evelmarin.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-13 06:01:37",
            "last_seen_utc": "2025-09-13 11:43:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-fxj1wsskw4",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1568118": [
        {
            "ioc_value": "st-yea.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-13 06:01:31",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250813-ggddvasms8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567828": [
        {
            "ioc_value": "security.flavregurads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-13 02:51:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1567829": [
        {
            "ioc_value": "dekelins.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-13 02:51:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1568077": [
        {
            "ioc_value": "flyinglotuss.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-08-13 02:51:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1567831": [
        {
            "ioc_value": "okx.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-12 23:10:30",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567783": [
        {
            "ioc_value": "ns1.kohlerco.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-12 20:49:25",
            "last_seen_utc": "2025-09-17 07:49:56",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567745": [
        {
            "ioc_value": "crypherx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-12 18:01:36",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-vk87kstses",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567743": [
        {
            "ioc_value": "embanex.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-12 18:01:35",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-vl1a3afl6v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567744": [
        {
            "ioc_value": "generalboss.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-12 18:01:35",
            "last_seen_utc": "2025-09-13 11:43:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-vhvamsfl2s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567741": [
        {
            "ioc_value": "inc-changes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-12 18:01:28",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-vsnwlsfn9w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567703": [
        {
            "ioc_value": "jerseymz.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.koistealer",
            "malware_alias": null,
            "malware_printable": "Koi Stealer",
            "first_seen_utc": "2025-08-12 14:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1955037646327288261",
            "tags": "KoiStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567704": [
        {
            "ioc_value": "jerseymz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.koistealer",
            "malware_alias": null,
            "malware_printable": "Koi Stealer",
            "first_seen_utc": "2025-08-12 14:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1955037646327288261",
            "tags": "KoiStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567651": [
        {
            "ioc_value": "piptpa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-12 13:28:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1567653": [
        {
            "ioc_value": "openedhouses.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-08-12 13:28:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1567655": [
        {
            "ioc_value": "burahrmp.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-12 13:28:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1567691": [
        {
            "ioc_value": "audit.fsia.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-12 13:28:23",
            "last_seen_utc": "2025-08-12 21:01:16",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1567688": [
        {
            "ioc_value": "ix.de.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-12 13:10:31",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567685": [
        {
            "ioc_value": "neonhush.cipherdrift.qzz.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-12 12:49:55",
            "last_seen_utc": "2025-09-17 17:49:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567684": [
        {
            "ioc_value": "1258922563-2333n6dmlx.ap-guangzhou.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-12 12:49:44",
            "last_seen_utc": "2025-12-14 11:48:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567669": [
        {
            "ioc_value": "pasotslv.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-08-12 12:02:00",
            "last_seen_utc": "2025-08-13 04:00:32",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.80.35+pasotslv.click",
            "tags": "AS401120,C2,censys,CHEAPY-HOST,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567662": [
        {
            "ioc_value": "public-officer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-12 12:01:50",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-kkzm2ax1dw",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567661": [
        {
            "ioc_value": "melolz.3utilities.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-12 12:01:49",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-kkzm2ax1dw",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567656": [
        {
            "ioc_value": "noniggersallowed.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-12 12:01:27",
            "last_seen_utc": "2025-09-13 11:43:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-mp69saak7s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567657": [
        {
            "ioc_value": "and-build.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-12 12:01:27",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-j2qk1sxxdz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567647": [
        {
            "ioc_value": "ns1.p3bet44.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-12 10:49:43",
            "last_seen_utc": "2025-09-25 09:49:37",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567644": [
        {
            "ioc_value": "pampersnastily.life",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-12 10:17:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1567616": [
        {
            "ioc_value": "rbx.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-12 07:10:33",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567613": [
        {
            "ioc_value": "makslove.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-12 06:53:50",
            "last_seen_utc": "2025-12-08 15:38:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6f51db7d300620ab8ad2034f19edf7a73ac5f0b41b7d78279065d7833b937d76/",
            "tags": "MaksRAT,MavenRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567612": [
        {
            "ioc_value": "lunared-cdn.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-08-12 06:38:09",
            "last_seen_utc": "2025-08-12 11:17:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "HijackLoader",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1567328": [
        {
            "ioc_value": "security.flaershueld.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-12 06:25:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1567329": [
        {
            "ioc_value": "polsenia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-12 06:25:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1567363": [
        {
            "ioc_value": "booking-v.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-12 06:25:24",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1567562": [
        {
            "ioc_value": "c3.b1o.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-12 06:25:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.188.140.220+c3.b1o.it",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1567588": [
        {
            "ioc_value": "ferrarlworldabudhabl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-12 06:25:07",
            "last_seen_utc": "2025-10-21 07:27:33",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1567599": [
        {
            "ioc_value": "tonedoc641-58670.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-12 06:02:10",
            "last_seen_utc": "2025-09-13 11:43:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-a79reabr61",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567597": [
        {
            "ioc_value": "zoo33.myddns.rocks",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-12 06:01:50",
            "last_seen_utc": "2025-09-13 11:43:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-c2kansdj4s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567595": [
        {
            "ioc_value": "obyconnect.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-12 06:01:49",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-demyqadk8z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567596": [
        {
            "ioc_value": "odbconnect.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-12 06:01:49",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-demyqadk8z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567591": [
        {
            "ioc_value": "well-interface.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-12 06:01:24",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250812-fhrr7adr6y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567372": [
        {
            "ioc_value": "cs.ivyx.team",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-12 02:49:04",
            "last_seen_utc": "2025-09-12 09:49:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567334": [
        {
            "ioc_value": "hibmarket.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-11 22:49:05",
            "last_seen_utc": "2025-12-14 11:48:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567333": [
        {
            "ioc_value": "awtitipies.fasters.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-11 22:48:58",
            "last_seen_utc": "2025-09-13 09:48:38",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567301": [
        {
            "ioc_value": "sec.death-angel.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-11 19:10:30",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567297": [
        {
            "ioc_value": "roaj1om6hh5dchv0xjudgxtt0fcucdjh.scvhost.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-11 16:49:09",
            "last_seen_utc": "2025-09-28 13:49:58",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567283": [
        {
            "ioc_value": "hr.lexnational.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-11 15:33:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1567273": [
        {
            "ioc_value": "ferrariworldabudhabl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-11 13:29:07",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1567276": [
        {
            "ioc_value": "cdnli.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-11 12:49:37",
            "last_seen_utc": "2025-12-14 11:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567268": [
        {
            "ioc_value": "data.utfoundation.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-11 12:01:56",
            "last_seen_utc": "2025-08-12 04:00:35",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/86.106.85.191+data.utfoundation.net",
            "tags": "AS9009,C2,censys,Havoc,M247",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567258": [
        {
            "ioc_value": "pnraku.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-11 09:08:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567247": [
        {
            "ioc_value": "dub.polarissonic.biz.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-11 08:10:30",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567182": [
        {
            "ioc_value": "security.flheregurend.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-11 07:05:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1567183": [
        {
            "ioc_value": "abersuin.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-11 07:05:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1567226": [
        {
            "ioc_value": "booking-en.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-11 07:05:00",
            "last_seen_utc": "2025-10-21 07:27:34",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1567190": [
        {
            "ioc_value": "cdachyd-mil.serveftp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-10 22:48:45",
            "last_seen_utc": "2025-09-12 09:49:29",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567189": [
        {
            "ioc_value": "pcx.polarissonic.biz.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-10 22:10:30",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567170": [
        {
            "ioc_value": "vmi2025279.contaboserver.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-10 20:02:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/100.42.176.116+vmi2025279.contaboserver.net",
            "tags": "AS51167,C2,censys,CONTABO,open-dir,Xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567153": [
        {
            "ioc_value": "xxx20250710.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-10 18:02:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-v85jasyrs6",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567117": [
        {
            "ioc_value": "db.polarissonic.biz.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-10 16:10:35",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567108": [
        {
            "ioc_value": "gqwy.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-10 12:49:05",
            "last_seen_utc": "2025-09-10 15:50:16",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567056": [
        {
            "ioc_value": "quagkmz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567058": [
        {
            "ioc_value": "chokei.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567057": [
        {
            "ioc_value": "airmcjr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567059": [
        {
            "ioc_value": "linexb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567060": [
        {
            "ioc_value": "clethde.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567061": [
        {
            "ioc_value": "nonckucg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567062": [
        {
            "ioc_value": "ellipmea.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567063": [
        {
            "ioc_value": "epidebg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567064": [
        {
            "ioc_value": "speazsu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567065": [
        {
            "ioc_value": "deesczj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567066": [
        {
            "ioc_value": "litaneq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567067": [
        {
            "ioc_value": "appevql.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567069": [
        {
            "ioc_value": "setswml.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:40",
            "last_seen_utc": "2025-08-27 22:34:21",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567068": [
        {
            "ioc_value": "fireqk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567070": [
        {
            "ioc_value": "airsttu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567071": [
        {
            "ioc_value": "partilj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:38",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567072": [
        {
            "ioc_value": "crosske.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:38",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567073": [
        {
            "ioc_value": "flamiwf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:38",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567074": [
        {
            "ioc_value": "procuvt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:37",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567075": [
        {
            "ioc_value": "melicov.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:37",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567076": [
        {
            "ioc_value": "leaprs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567077": [
        {
            "ioc_value": "magneri.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567078": [
        {
            "ioc_value": "inveuy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:35",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567079": [
        {
            "ioc_value": "cryixfy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:35",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567081": [
        {
            "ioc_value": "heartp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:35",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567080": [
        {
            "ioc_value": "coshas.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:34",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567082": [
        {
            "ioc_value": "arnolfv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:33",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567083": [
        {
            "ioc_value": "orderfg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:33",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567084": [
        {
            "ioc_value": "provssk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:32",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567085": [
        {
            "ioc_value": "marsefx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:42:32",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1566705": [
        {
            "ioc_value": "trust.scriptobject.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-10 12:40:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1566760": [
        {
            "ioc_value": "security.flsaregursd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-10 12:40:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1566761": [
        {
            "ioc_value": "kopenbal.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-10 12:40:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1567086": [
        {
            "ioc_value": "colikvl.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:40:30",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567087": [
        {
            "ioc_value": "excalcf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-10 12:40:29",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1567096": [
        {
            "ioc_value": "foreso8150-41869.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-10 12:01:42",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-k79rhstmt3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567097": [
        {
            "ioc_value": "meet-festivals.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-10 12:01:42",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-jysk7sak7w",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567098": [
        {
            "ioc_value": "ssh.serveo.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-10 12:01:42",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-h72d2ahp7v",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567095": [
        {
            "ioc_value": "fewafef-56170.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-10 12:01:41",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-mbsjgaxzdz",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567092": [
        {
            "ioc_value": "slvbx0pkq.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-10 12:01:33",
            "last_seen_utc": "2025-08-10 12:01:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-grmehagp81",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567055": [
        {
            "ioc_value": "xs.sx.polarissonic.biz.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-10 10:10:36",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1567036": [
        {
            "ioc_value": "forcr4ck-24910.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-10 06:01:45",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-czjlcstzay",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567035": [
        {
            "ioc_value": "salpdf.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-10 06:01:37",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-cvx8ysfj3v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567031": [
        {
            "ioc_value": "design-jordan.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-10 06:01:13",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-fnslnsvxbv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567032": [
        {
            "ioc_value": "australia-additionally.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-10 06:01:13",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250810-cjwkzseq71",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1567007": [
        {
            "ioc_value": "h90.wpherc.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ares",
            "malware_alias": null,
            "malware_printable": "Ares",
            "first_seen_utc": "2025-08-10 04:00:40",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": "https://search.censys.io/hosts/5.75.134.42+h90.wpherc.dev",
            "tags": "AS24940,C2,censys,HETZNER-AS,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1567003": [
        {
            "ioc_value": "c2.b1o.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-10 04:00:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.218.46.106+c2.b1o.it",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1567001": [
        {
            "ioc_value": "ex9.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-10 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/43.134.9.57+ex9.cc",
            "tags": "AS132203,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1566773": [
        {
            "ioc_value": "client.hosthlior.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-10 02:49:28",
            "last_seen_utc": "2025-09-10 17:48:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1566766": [
        {
            "ioc_value": "ftp.aigirlfriend.altervista.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-10 00:02:10",
            "last_seen_utc": "2025-08-30 04:01:11",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/78.46.128.136+ftp.aigirlfriend.altervista.org",
            "tags": "AS24940,C2,censys,HETZNER-AS,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566762": [
        {
            "ioc_value": "xxcaocs.556688.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-09 22:50:13",
            "last_seen_utc": "2025-11-12 07:58:19",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1566752": [
        {
            "ioc_value": "ftp.polarissonic.biz.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-09 20:10:28",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1566727": [
        {
            "ioc_value": "ssa-personalservices.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-09 18:01:19",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-t5eb9shm3z",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566728": [
        {
            "ioc_value": "chrisbekner02.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-09 18:01:19",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-q3vdxstjx8",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566729": [
        {
            "ioc_value": "w1lz.ddnsking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-09 18:01:19",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-pazx9swyez",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566726": [
        {
            "ioc_value": "me-work.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-09 18:01:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-t4hy3ahl9t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566722": [
        {
            "ioc_value": "businesses-extensive.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-09 18:01:12",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-wkd7wazzcv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566723": [
        {
            "ioc_value": "dc-historic.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-09 18:01:12",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-wkd7wazzcv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566724": [
        {
            "ioc_value": "mr-fold.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-09 18:01:12",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-s6ehzstnv9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566725": [
        {
            "ioc_value": "love-interpreted.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-09 18:01:12",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-pptpssem9t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566720": [
        {
            "ioc_value": "stage-edinburgh.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-09 18:01:11",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-wh2kdsvmx6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566721": [
        {
            "ioc_value": "arch.wsf-steel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-09 18:01:11",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-v97eaavl19",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566718": [
        {
            "ioc_value": "flaskproxy-fedg.onrender.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-09 16:52:24",
            "last_seen_utc": "2025-12-14 11:48:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1566712": [
        {
            "ioc_value": "superclouds.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-09 16:01:47",
            "last_seen_utc": "2025-08-10 04:00:32",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/107.158.128.36+superclouds.website",
            "tags": "AS62904,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566681": [
        {
            "ioc_value": "syntrva.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-09 14:41:00",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1566703": [
        {
            "ioc_value": "hermitimplode.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-09 14:14:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1566698": [
        {
            "ioc_value": "sudo.polarissonic.biz.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-09 12:10:30",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1566693": [
        {
            "ioc_value": "eijmdixci.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-09 12:02:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-g6ctlshl7v",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566692": [
        {
            "ioc_value": "conditions-lake.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-09 12:01:53",
            "last_seen_utc": "2025-08-15 12:12:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-g9qjwahm41",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566688": [
        {
            "ioc_value": "Eliotexe0110-26529.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-09 12:01:26",
            "last_seen_utc": "2025-08-15 12:12:35",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-km3sgatwdv",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566686": [
        {
            "ioc_value": "corepulsesync.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-09 12:01:22",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-lvqzbacl6y",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566685": [
        {
            "ioc_value": "cannonistanbulsskyss.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-09 12:01:14",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-lxqfkacl8y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566684": [
        {
            "ioc_value": "official-ol.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-09 12:01:09",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-kfqjkatvby",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566683": [
        {
            "ioc_value": "type-modules.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-09 12:01:08",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-m8ph3sdj71",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566673": [
        {
            "ioc_value": "vaganetka.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-09 10:41:27",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1566674": [
        {
            "ioc_value": "ichmidt.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-08-09 10:41:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1566672": [
        {
            "ioc_value": "nameless-mouse-2f97.gogohoog546.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.skuld",
            "malware_alias": "TMPN",
            "malware_printable": "Skuld",
            "first_seen_utc": "2025-08-09 09:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/d56cf6f5-3099-43cd-98f9-3a9442854096",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1566410": [
        {
            "ioc_value": "vinsodg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-09 06:06:09",
            "last_seen_utc": "2025-08-10 11:26:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-1njnzsek9y/",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1566653": [
        {
            "ioc_value": "xworm7.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-09 06:01:07",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250809-fkmags1yfx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566607": [
        {
            "ioc_value": "ec2-54-242-171-49.compute-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-09 04:00:43",
            "last_seen_utc": "2025-08-09 04:01:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/54.242.171.49+ec2-54-242-171-49.compute-1.amazonaws.com",
            "tags": "AMAZON-AES,AS14618,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1566595": [
        {
            "ioc_value": "pub.k22digital.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-09 01:10:27",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1566592": [
        {
            "ioc_value": "shareaz.allianz-courtage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-08-09 00:01:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.116.39+shareaz.allianz-courtage.co",
            "tags": "AS401116,C2,censys,Ermac,NYBULA,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566587": [
        {
            "ioc_value": "autodiscover.project-w.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-09 00:01:49",
            "last_seen_utc": "2025-08-09 04:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/107.158.128.36+autodiscover.project-w.xyz",
            "tags": "AS62904,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566372": [
        {
            "ioc_value": "webdisk.project-w.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-08 20:01:47",
            "last_seen_utc": "2025-08-09 04:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/107.158.128.36+webdisk.project-w.xyz",
            "tags": "AS62904,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566358": [
        {
            "ioc_value": "cost-snap.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-08 18:01:18",
            "last_seen_utc": "2025-08-21 10:06:25",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-s58enshr41",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566359": [
        {
            "ioc_value": "anything-javascript.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-08 18:01:18",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-r8hsrahn2y",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566357": [
        {
            "ioc_value": "windowsdefenderservice.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-08 18:01:13",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-wfl2xsbp7s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566356": [
        {
            "ioc_value": "last0.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-08 18:01:08",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-t9lbdaap8v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566353": [
        {
            "ioc_value": "fewafef-61686.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-08 18:01:05",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-s4wpgszms6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566354": [
        {
            "ioc_value": "case-physically.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-08 18:01:05",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-trwdmav1bv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566355": [
        {
            "ioc_value": "break-analytical.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-08 18:01:05",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-ss2rcshq2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566348": [
        {
            "ioc_value": "pattemqr.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-08 16:14:46",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "LummaStealer",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1566328": [
        {
            "ioc_value": "habakkg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-08 16:12:02",
            "last_seen_utc": "2025-08-10 11:26:38",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1566333": [
        {
            "ioc_value": "closeddoors.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-08-08 16:12:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1566335": [
        {
            "ioc_value": "yikpspbi.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-08 16:12:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/252550df-df22-4f43-aa8a-312b226a1ccd",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1566336": [
        {
            "ioc_value": "smockle.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-08 16:11:58",
            "last_seen_utc": "2025-08-10 11:26:37",
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1566337": [
        {
            "ioc_value": "devicecheck.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-08 16:11:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "FakeCaptcha",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1566338": [
        {
            "ioc_value": "jacobwensley.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-08 16:11:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "FakeCaptcha",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1566331": [
        {
            "ioc_value": "i1.out.k22digital.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-08 15:10:31",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1566320": [
        {
            "ioc_value": "adult-purchased.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-08 13:27:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-ptasgsxry4/",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1566325": [
        {
            "ioc_value": "feedback.fortunetaxs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-08 13:27:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114993307171514963",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1566288": [
        {
            "ioc_value": "d1ge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-08 12:05:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/aaf0fd53-b490-4f01-9b04-b014bcc83e37/",
            "tags": "DogeStealer,Infostealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1566290": [
        {
            "ioc_value": "laplmav.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-08 12:05:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-m89t1sxjz7",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1566308": [
        {
            "ioc_value": "xxxjjj250711.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-08 12:01:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-nmp36afk4z",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566301": [
        {
            "ioc_value": "HazeSenpai-21866.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-08 12:01:09",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-ml65lssvhx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566302": [
        {
            "ioc_value": "loan-rv.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-08 12:01:09",
            "last_seen_utc": "2025-08-15 12:12:35",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-mgjhraen9s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566298": [
        {
            "ioc_value": "generalboss001.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-08 12:01:04",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-nh348afj9v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566295": [
        {
            "ioc_value": "lk7799.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-08 12:01:00",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-nb3vwasxfz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566267": [
        {
            "ioc_value": "s3.cdn.k22digital.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-08 09:10:29",
            "last_seen_utc": "2025-08-25 13:46:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1566182": [
        {
            "ioc_value": "ferrariworldabudhabi.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-08 07:08:21",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1566183": [
        {
            "ioc_value": "banki-ru.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-08-08 07:08:21",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1565867": [
        {
            "ioc_value": "security.flaezguered.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-08 07:08:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1565868": [
        {
            "ioc_value": "neopendas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-08 07:08:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1566195": [
        {
            "ioc_value": "paid-location.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-08 06:02:50",
            "last_seen_utc": "2025-08-15 12:12:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-cm1dcasp17",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566192": [
        {
            "ioc_value": "nha2wjgep.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-08 06:01:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-fnt5habk5y",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566188": [
        {
            "ioc_value": "center-mpeg.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-08 06:01:25",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-cgw4qsx1hx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566187": [
        {
            "ioc_value": "properties-lf.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-08 06:01:12",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-aq3xjagr8z",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1566186": [
        {
            "ioc_value": "association-fairfield.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-08 06:01:07",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250808-fekvgatn12",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565919": [
        {
            "ioc_value": "176-58-109-21.ip.linodeusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ares",
            "malware_alias": null,
            "malware_printable": "Ares",
            "first_seen_utc": "2025-08-08 04:00:52",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": "https://search.censys.io/hosts/176.58.109.21+176-58-109-21.ip.linodeusercontent.com",
            "tags": "AS63949,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1565909": [
        {
            "ioc_value": "abcdef.886802.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-08 02:48:47",
            "last_seen_utc": "2025-09-11 09:49:17",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565895": [
        {
            "ioc_value": "ftp.project-w.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-08 00:01:42",
            "last_seen_utc": "2025-08-09 04:00:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/107.158.128.36+ftp.project-w.xyz",
            "tags": "AS62904,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565853": [
        {
            "ioc_value": "however-fundraising.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-07 18:03:04",
            "last_seen_utc": "2025-08-15 12:12:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-n9yc2sgr5t",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565852": [
        {
            "ioc_value": "send-deferred.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-07 18:01:47",
            "last_seen_utc": "2025-08-15 12:12:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-sr1snsbq9y",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565847": [
        {
            "ioc_value": "august-ibm.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-07 18:01:04",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-rm6yfswqv4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565843": [
        {
            "ioc_value": "xmbless25.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-07 18:01:03",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-vqrjqayky7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565844": [
        {
            "ioc_value": "open-tyler.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-07 18:01:03",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-t6x6rsyjx6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565845": [
        {
            "ioc_value": "thomas-giant.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-07 18:01:03",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-t6x6rsyjx5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565846": [
        {
            "ioc_value": "yet-format.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-07 18:01:03",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-rk1nnabk71",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565833": [
        {
            "ioc_value": "172-104-142-143.ip.linodeusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-07 16:01:39",
            "last_seen_utc": "2025-08-08 04:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.104.142.143+172-104-142-143.ip.linodeusercontent.com",
            "tags": "AKAMAI-LINODE-AP,AS63949,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565807": [
        {
            "ioc_value": "gallery.erickillorinphotostore.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-07 15:55:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114987651309782568",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1565821": [
        {
            "ioc_value": "st.cdn.k22digital.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-07 15:10:30",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565814": [
        {
            "ioc_value": "104d.hldns.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-07 13:23:18",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1565805": [
        {
            "ioc_value": "nginx.myneath.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-07 12:49:58",
            "last_seen_utc": "2025-09-08 01:48:38",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565803": [
        {
            "ioc_value": "luntpi.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-07 12:32:01",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-peah6sgr9w/",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1565766": [
        {
            "ioc_value": "land-dies.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-07 12:04:42",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-nrywvszxft",
            "tags": "Office04",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1565783": [
        {
            "ioc_value": "osmshk.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-07 12:01:14",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-jelzbadq3t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565781": [
        {
            "ioc_value": "zxzczxz.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-07 12:01:12",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-kqsfxayyby",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565779": [
        {
            "ioc_value": "responsible-hostel.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-07 12:01:03",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-jzq4rssmw2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565777": [
        {
            "ioc_value": "author-pine.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-07 12:01:02",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-kmcw2seq71",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565775": [
        {
            "ioc_value": "standard-seas.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-07 12:01:01",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-lbaszsfl7t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565738": [
        {
            "ioc_value": "hololive.mozicloud.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-07 07:41:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dafb6cfaa8bef0c98d9c3bb38d837a12a1b3a29f77dc7c0eb71d6cca81b89264/",
            "tags": "DDoSAgent",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565739": [
        {
            "ioc_value": "okayuthefoodiecat.mozicloud.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-07 07:41:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dafb6cfaa8bef0c98d9c3bb38d837a12a1b3a29f77dc7c0eb71d6cca81b89264/",
            "tags": "DDoSAgent",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565734": [
        {
            "ioc_value": "whois.myserv012.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.xorddos",
            "malware_alias": "XORDDOS",
            "malware_printable": "XOR DDoS",
            "first_seen_utc": "2025-08-07 07:26:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/607581255b01b191d549a550965142f01bd6a7e34c8beb14113553a7d8dfe0ab/",
            "tags": "XorDDoS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565732": [
        {
            "ioc_value": "bkp.payoopoint.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-07 07:10:31",
            "last_seen_utc": "2025-08-07 14:10:39",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565615": [
        {
            "ioc_value": "lasoriodrens.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:56:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565617": [
        {
            "ioc_value": "asioklaydpory.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:56:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565616": [
        {
            "ioc_value": "gifrodasderty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:56:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565618": [
        {
            "ioc_value": "viropirostandap.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:56:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565619": [
        {
            "ioc_value": "mimamimoflarestore.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:56:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565620": [
        {
            "ioc_value": "fastmionarabastore.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:56:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565621": [
        {
            "ioc_value": "qrwestfiodterty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:56:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565622": [
        {
            "ioc_value": "firopirocloundare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:55:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565623": [
        {
            "ioc_value": "sumgifaluis.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:55:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565638": [
        {
            "ioc_value": "on.borneointernusa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-08-07 06:55:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "eqvsec"
        }
    ],
    "1565358": [
        {
            "ioc_value": "anatylicsnode.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-07 06:55:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1565357": [
        {
            "ioc_value": "security.flcreagurade.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-07 06:55:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1565727": [
        {
            "ioc_value": "zechaxrp.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-07 06:10:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1565723": [
        {
            "ioc_value": "social-flag.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-07 06:09:05",
            "last_seen_utc": "2025-08-15 12:12:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1565722": [
        {
            "ioc_value": "boatn1941.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-07 06:08:51",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1565721": [
        {
            "ioc_value": "bc0c40.ddnsking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-07 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1565695": [
        {
            "ioc_value": "understand-vip.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-07 06:01:28",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-akl2tsvtc1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565693": [
        {
            "ioc_value": "sevster23452-30169.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-07 06:01:27",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-fhxnfaw1gx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565694": [
        {
            "ioc_value": "published-falls.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-07 06:01:27",
            "last_seen_utc": "2025-08-15 12:12:35",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-el8pfabp6s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565690": [
        {
            "ioc_value": "soc.cartsan-mold.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-07 06:01:11",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-bec3eaynz5",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565688": [
        {
            "ioc_value": "aattcc.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-07 06:01:10",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-frq71scm5s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565689": [
        {
            "ioc_value": "qxuom.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-07 06:01:10",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250807-emc9xszp15",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565687": [
        {
            "ioc_value": "sonosarcs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-07 05:40:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "NetSupport,RAT",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1565652": [
        {
            "ioc_value": "h82.wpherc.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ares",
            "malware_alias": null,
            "malware_printable": "Ares",
            "first_seen_utc": "2025-08-07 04:01:03",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": "https://search.censys.io/hosts/65.108.210.95+h82.wpherc.dev",
            "tags": "AS24940,C2,censys,HETZNER-AS,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1565646": [
        {
            "ioc_value": "ec2-54-89-193-82.compute-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-07 04:00:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/54.89.193.82+ec2-54-89-193-82.compute-1.amazonaws.com",
            "tags": "AMAZON-AES,AS14618,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1565645": [
        {
            "ioc_value": "paper.micsoloft.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-07 04:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.105.24.242+paper.micsoloft.info",
            "tags": "AS63949,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1565639": [
        {
            "ioc_value": "297d4064-b529-4934-af6f-b3f266e64f8a-00-316tm8g12nc9a.riker.replit.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-07 02:49:11",
            "last_seen_utc": "2025-08-09 15:50:42",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565347": [
        {
            "ioc_value": "prepintal.campinascidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565348": [
        {
            "ioc_value": "sprolinxonsil.campinascidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565349": [
        {
            "ioc_value": "stabander.portoalegrecidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565350": [
        {
            "ioc_value": "stacindor.maceiocidadde.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565351": [
        {
            "ioc_value": "strasanbansil.saoluiscidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565352": [
        {
            "ioc_value": "truroncol1.maceiocidadde.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565353": [
        {
            "ioc_value": "vadintansal.belemcidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565334": [
        {
            "ioc_value": "brucol21.duquedecaxiascidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565335": [
        {
            "ioc_value": "clajannil.portoalegrecidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565336": [
        {
            "ioc_value": "crapenral116.teresinacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565337": [
        {
            "ioc_value": "crolanhal.saogoncalocidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565338": [
        {
            "ioc_value": "frapinvaz.duquedecaxiascidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565339": [
        {
            "ioc_value": "glabanriz.guarulhoscidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565340": [
        {
            "ioc_value": "gloel4.guarulhoscidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565341": [
        {
            "ioc_value": "glonal.saoluiscidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565342": [
        {
            "ioc_value": "gloringundiz.natalcidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565343": [
        {
            "ioc_value": "plamincil.natalcidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565344": [
        {
            "ioc_value": "pledenxil.teresinacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565345": [
        {
            "ioc_value": "plelinder.saogoncalocidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565346": [
        {
            "ioc_value": "prepinhenfer.belemcidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-08-06 21:04:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0c56a4eded3669c39ffa65b1709006b766537cfdfc23b20f618098c6b4726221/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565274": [
        {
            "ioc_value": "apexkolp.today",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-06 20:25:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1565298": [
        {
            "ioc_value": "meatuzr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 20:24:59",
            "last_seen_utc": "2025-08-10 11:26:38",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1565320": [
        {
            "ioc_value": "koliwooclients.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 20:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/suyog41/status/1952990924210094369",
            "tags": "APT,BitterAPT,BitterElephant",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565299": [
        {
            "ioc_value": "sinjita.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 20:08:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/SinghSoodeep/status/1953011682382615008",
            "tags": "APT,APT36,TransparentTribe",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565300": [
        {
            "ioc_value": "sinjita.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 20:08:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/SinghSoodeep/status/1953011682382615008",
            "tags": "APT,APT36,TransparentTribe",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565301": [
        {
            "ioc_value": "solarwindturbine.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 20:08:05",
            "last_seen_utc": "2025-08-06 20:08:05",
            "confidence_level": 100,
            "reference": "https://x.com/SinghSoodeep/status/1953011682382615008",
            "tags": "APT,APT36,TransparentTribe",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565302": [
        {
            "ioc_value": "trmm.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 20:08:05",
            "last_seen_utc": "2025-10-16 14:32:36",
            "confidence_level": 100,
            "reference": "https://x.com/SinghSoodeep/status/1953011682382615008",
            "tags": "APT,APT36,TransparentTribe",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565290": [
        {
            "ioc_value": "studiodevkit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-06 20:01:34",
            "last_seen_utc": "2025-08-07 04:00:53",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/202.71.14.166+studiodevkit.com",
            "tags": "AS43641,C2,censys,Havoc,SOLLUTIUM-NL",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565273": [
        {
            "ioc_value": "swachbharat.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ares",
            "malware_alias": null,
            "malware_printable": "Ares",
            "first_seen_utc": "2025-08-06 19:55:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/PrakkiSathwik/status/1952682759555776979",
            "tags": "APT,APT36,AresRAT,RAT,TransparentTribe",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565267": [
        {
            "ioc_value": "thalic-tide-turn.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-08-06 19:44:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/31b352f4bc32c341a4f3be06be6f6c29312e1acc6fd8bf18bfe2826b57563ec1/",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565254": [
        {
            "ioc_value": "mrvalets.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565255": [
        {
            "ioc_value": "nmcrlab.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565256": [
        {
            "ioc_value": "pfcitalia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565257": [
        {
            "ioc_value": "resmanio.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565258": [
        {
            "ioc_value": "reviewyoon.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565259": [
        {
            "ioc_value": "ristorobepi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565260": [
        {
            "ioc_value": "saakyanart.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565261": [
        {
            "ioc_value": "scygas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565262": [
        {
            "ioc_value": "sdgoodsam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565263": [
        {
            "ioc_value": "secnw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565264": [
        {
            "ioc_value": "tianagarden.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565235": [
        {
            "ioc_value": "04-zoom.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565236": [
        {
            "ioc_value": "ajoyfulbear.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565237": [
        {
            "ioc_value": "arfzs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565238": [
        {
            "ioc_value": "aspotan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565239": [
        {
            "ioc_value": "avamkwilson.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565240": [
        {
            "ioc_value": "bomdog.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565241": [
        {
            "ioc_value": "brossdeli.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565242": [
        {
            "ioc_value": "comeyco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565243": [
        {
            "ioc_value": "couriontesy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565244": [
        {
            "ioc_value": "cunruivalve.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565245": [
        {
            "ioc_value": "dwbutter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565246": [
        {
            "ioc_value": "estanicci.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565247": [
        {
            "ioc_value": "gfemarket.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565248": [
        {
            "ioc_value": "goatramz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565249": [
        {
            "ioc_value": "haminals.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565250": [
        {
            "ioc_value": "kariyerbak.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565251": [
        {
            "ioc_value": "kihapma.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565252": [
        {
            "ioc_value": "mawebinars.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565253": [
        {
            "ioc_value": "micdapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-08-06 19:24:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://x.com/500mk500/status/1952804029160996939",
            "tags": "AMOS",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565234": [
        {
            "ioc_value": "beta.payoopoint.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-06 19:10:28",
            "last_seen_utc": "2025-08-07 06:10:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1565166": [
        {
            "ioc_value": "cpanel.365axissolution.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-06 18:35:22",
            "last_seen_utc": "2025-08-06 13:15:45",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114981984631441597",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1565181": [
        {
            "ioc_value": "unsuxvxb.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 18:35:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1565217": [
        {
            "ioc_value": "paulushook.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-08-06 18:35:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-s19ryaztcx/behavioral1",
            "tags": "C2,NetSupport,RAT",
            "anonymous": "0",
            "reporter": "Overkill1984zzz"
        }
    ],
    "1564865": [
        {
            "ioc_value": "visokiywkaf.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 18:34:56",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1564866": [
        {
            "ioc_value": "kletkamozga.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 18:34:56",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1564864": [
        {
            "ioc_value": "stolewnica.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 18:34:55",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1564862": [
        {
            "ioc_value": "ordinarniyvrach.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 18:34:54",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1564863": [
        {
            "ioc_value": "yamakrug.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 18:34:54",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1564856": [
        {
            "ioc_value": "idealista.properties-captcha.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 18:34:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking,booking.com,ClickFix,FakeCaptcha",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1565228": [
        {
            "ioc_value": "getting-formed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-06 18:02:23",
            "last_seen_utc": "2025-08-15 12:12:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-rbbyyabn4t",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565229": [
        {
            "ioc_value": "star-voluntary.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-06 18:02:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-q6mhgs1rt8",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565227": [
        {
            "ioc_value": "RUTCHECKER4765-63091.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-08-06 18:02:13",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-vexatszydy",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565225": [
        {
            "ioc_value": "quote-lifetime.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-06 18:01:14",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-wjdvqavkv3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565223": [
        {
            "ioc_value": "23.ip.gl.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 18:00:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-p26vwsxsdy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565224": [
        {
            "ioc_value": "english-decimal.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 18:00:58",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-n659gshp9w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565219": [
        {
            "ioc_value": "hospital-harvest.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 18:00:57",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-vtk64sz1bt",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565220": [
        {
            "ioc_value": "course-admission.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 18:00:57",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-t78nwstm13",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565221": [
        {
            "ioc_value": "single-peninsula.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 18:00:57",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-sq3wmszsfs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565152": [
        {
            "ioc_value": "scontent-cdg4-2.xx.allianz-courtage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-08-06 12:01:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.116.39+scontent-cdg4-2.xx.allianz-courtage.co",
            "tags": "AS401116,C2,censys,Ermac,NYBULA,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565142": [
        {
            "ioc_value": "actwindow.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 12:01:16",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-mma4kayk17",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565143": [
        {
            "ioc_value": "windowsupdatess.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 12:01:16",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-mg9d6sykz4",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565139": [
        {
            "ioc_value": "pasar09enero.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 12:01:10",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-llws7sgm5s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565138": [
        {
            "ioc_value": "act.windowsdriver.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 12:01:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-me1z1svwbz",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565135": [
        {
            "ioc_value": "bbyus.ooguy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 12:00:57",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-mnyw1svwet",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1565112": [
        {
            "ioc_value": "xxxsniper.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-06 11:34:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565113": [
        {
            "ioc_value": "m3afiza7lou9.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-06 11:34:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565110": [
        {
            "ioc_value": "hkr2011.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-06 11:34:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565111": [
        {
            "ioc_value": "mrhackerkine.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-06 11:34:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565107": [
        {
            "ioc_value": "soystrisar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-08-06 11:34:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565108": [
        {
            "ioc_value": "czarthyone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-08-06 11:34:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565109": [
        {
            "ioc_value": "sokesornic.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-08-06 11:34:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565102": [
        {
            "ioc_value": "zxcfiv5pn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-08-06 11:34:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565103": [
        {
            "ioc_value": "obbl.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-06 11:34:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565104": [
        {
            "ioc_value": "mansa19ke.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-06 11:34:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565105": [
        {
            "ioc_value": "yacineoffice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-06 11:34:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565034": [
        {
            "ioc_value": "need-strengthening.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565035": [
        {
            "ioc_value": "levels-dangerous.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565036": [
        {
            "ioc_value": "fitness-locking.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565037": [
        {
            "ioc_value": "rock-indiana.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565038": [
        {
            "ioc_value": "technologies-rid.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565039": [
        {
            "ioc_value": "amiroxs.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565040": [
        {
            "ioc_value": "marocgwassem.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565041": [
        {
            "ioc_value": "12r123df-29575.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565042": [
        {
            "ioc_value": "killer89345.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565043": [
        {
            "ioc_value": "njvo7newlinegov1.ddnsfree.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565044": [
        {
            "ioc_value": "tpc.cloudpub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565045": [
        {
            "ioc_value": "waleedf.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-06 11:33:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565020": [
        {
            "ioc_value": "river-kentucky.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 11:33:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565021": [
        {
            "ioc_value": "either-occurs.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 11:33:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565022": [
        {
            "ioc_value": "finance-over.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 11:33:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565016": [
        {
            "ioc_value": "usa-kruger.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 11:33:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565017": [
        {
            "ioc_value": "term-dimension.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 11:33:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565018": [
        {
            "ioc_value": "richard-down.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 11:33:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565019": [
        {
            "ioc_value": "choice-copyrighted.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 11:33:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565007": [
        {
            "ioc_value": "opjdsavenom.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 11:33:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565008": [
        {
            "ioc_value": "dcgast.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 11:33:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565009": [
        {
            "ioc_value": "umar33myddns.rocks",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 11:33:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565010": [
        {
            "ioc_value": "shyweb.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 11:33:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565011": [
        {
            "ioc_value": "soportesenviojulio.casacam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 11:33:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565012": [
        {
            "ioc_value": "boxyong.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 11:33:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565013": [
        {
            "ioc_value": "kuynfgdasync.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 11:33:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1565014": [
        {
            "ioc_value": "ysdgana.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 11:33:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1564996": [
        {
            "ioc_value": "electronics-albert.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-06 11:33:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1564993": [
        {
            "ioc_value": "oil-thereof.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-06 11:33:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1564994": [
        {
            "ioc_value": "hellokittyballs-53833.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-06 11:33:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1564995": [
        {
            "ioc_value": "dokeb2-50072.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-06 11:33:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "6August2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1564945": [
        {
            "ioc_value": "mx.payoopoint.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-06 11:10:31",
            "last_seen_utc": "2025-08-06 18:10:32",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564939": [
        {
            "ioc_value": "soft-gets.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-06 09:58:59",
            "last_seen_utc": "2025-09-23 23:48:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,vidar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564940": [
        {
            "ioc_value": "reaitek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-06 09:58:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,vidar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564938": [
        {
            "ioc_value": "templfuw.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 09:58:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564935": [
        {
            "ioc_value": "dragones2.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 09:57:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564936": [
        {
            "ioc_value": "komkom.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 09:57:16",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564937": [
        {
            "ioc_value": "lgd8u7dn1.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 09:57:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564933": [
        {
            "ioc_value": "migs.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.orcus_rat",
            "malware_alias": "Schnorchel",
            "malware_printable": "Orcus RAT",
            "first_seen_utc": "2025-08-06 09:56:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,orcus",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564930": [
        {
            "ioc_value": "botnet.zinomc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-06 09:56:01",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564931": [
        {
            "ioc_value": "net.booter.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-06 09:56:01",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564926": [
        {
            "ioc_value": "cell-dated.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-06 09:54:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564850": [
        {
            "ioc_value": "extranet-message.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 08:26:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking,booking.com,ClickFix,FakeCaptcha",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1564851": [
        {
            "ioc_value": "confirmation-id2479.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 08:26:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "booking,booking.com,ClickFix,FakeCaptcha",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1564846": [
        {
            "ioc_value": "80806693.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 08:02:00",
            "last_seen_utc": "2025-12-12 18:37:52",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.191.135+80806693.xyz",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564652": [
        {
            "ioc_value": "when-assumed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 07:32:28",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1564651": [
        {
            "ioc_value": "security.flnaresgurard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-06 07:32:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1564649": [
        {
            "ioc_value": "enterprise-confirm.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 07:32:24",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1564644": [
        {
            "ioc_value": "pudejmoy.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 07:32:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1564612": [
        {
            "ioc_value": "materdvc.beer",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-06 07:32:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1564777": [
        {
            "ioc_value": "gftrefer8jabour3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 06:01:07",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-dw8lrabl3y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564778": [
        {
            "ioc_value": "gftrefer8jabour4.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 06:01:07",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-dw8lrabl3y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564774": [
        {
            "ioc_value": "eevm4ds.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 06:01:06",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-dxckpsbl4s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564775": [
        {
            "ioc_value": "gftrefer8jabour1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 06:01:06",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-dw8lrabl3y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564776": [
        {
            "ioc_value": "gftrefer8jabour2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-06 06:01:06",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-dw8lrabl3y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564772": [
        {
            "ioc_value": "rattix01228-28247.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 06:00:56",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-c7j7vstnt3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564771": [
        {
            "ioc_value": "technical-multi.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-06 06:00:55",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250806-d6yvasbn4t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564761": [
        {
            "ioc_value": "sazwebapiprod.allianz-courtage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-08-06 04:01:35",
            "last_seen_utc": "2025-08-08 04:01:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.116.39+sazwebapiprod.allianz-courtage.co",
            "tags": "AS401116,C2,censys,Ermac,NYBULA,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564744": [
        {
            "ioc_value": "h79.wpherc.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ares",
            "malware_alias": null,
            "malware_printable": "Ares",
            "first_seen_utc": "2025-08-06 04:01:11",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": "https://search.censys.io/hosts/195.201.119.86+h79.wpherc.dev",
            "tags": "AS24940,C2,censys,HETZNER-AS,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1564713": [
        {
            "ioc_value": "sci.micsoloft.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-06 04:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.105.24.242+sci.micsoloft.info",
            "tags": "AS63949,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1564712": [
        {
            "ioc_value": "cdn.assets.as2.micsoloft.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-06 04:00:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.105.24.242+cdn.assets.as2.micsoloft.info",
            "tags": "AS63949,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1564711": [
        {
            "ioc_value": "login-us.micsoloft.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-06 04:00:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.105.24.242+login-us.micsoloft.info",
            "tags": "AS63949,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1564710": [
        {
            "ioc_value": "apm.vpce.gdw55e.micsoloft.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-06 04:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.105.24.242+apm.vpce.gdw55e.micsoloft.info",
            "tags": "AS63949,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1564706": [
        {
            "ioc_value": "c95f137f-7f36-4b18-964c-56d0d113b143-00-dc5usg4e8pkl.kirk.replit.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-06 02:49:43",
            "last_seen_utc": "2025-08-19 01:48:59",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564654": [
        {
            "ioc_value": "api.payoopoint.lk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-05 21:10:35",
            "last_seen_utc": "2025-08-06 10:10:38",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564585": [
        {
            "ioc_value": "ealmaz.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-05 18:01:11",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-t9pnssvyhx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564584": [
        {
            "ioc_value": "ealmaz.loseyourip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-05 18:01:10",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-t9pnssvyhx",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564581": [
        {
            "ioc_value": "derrickdns54303170.ddnsking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-05 18:01:04",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-n8xp5asxdx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564582": [
        {
            "ioc_value": "derrickdns199825.myftp.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-05 18:01:04",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-n8xp5asxdx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564583": [
        {
            "ioc_value": "derrickdns19982531700.myftp.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-05 18:01:04",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-n8xp5asxdx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564579": [
        {
            "ioc_value": "july321.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-05 18:01:03",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-qajrqatthy",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564580": [
        {
            "ioc_value": "derrickdns5430.ddnsking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-05 18:01:03",
            "last_seen_utc": "2025-08-15 12:12:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-n8xp5asxdx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564578": [
        {
            "ioc_value": "berlin101.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-05 18:00:54",
            "last_seen_utc": "2025-09-30 09:07:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-q3adratxct",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564575": [
        {
            "ioc_value": "normal-cheese.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-05 18:00:53",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-tnelpsvwft",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564576": [
        {
            "ioc_value": "florida-enquiries.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-05 18:00:53",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-sngkmawrt3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564577": [
        {
            "ioc_value": "domain-canon.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-05 18:00:53",
            "last_seen_utc": "2025-08-15 12:12:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-rz2jhawn17",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564565": [
        {
            "ioc_value": "ec2-98-86-138-98.compute-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-05 16:01:25",
            "last_seen_utc": "2025-08-06 04:00:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/98.86.138.98+ec2-98-86-138-98.compute-1.amazonaws.com",
            "tags": "AMAZON-AES,AS14618,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564555": [
        {
            "ioc_value": "asdfdsfasdf.p-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-08-05 14:41:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/7223c3a7e002b44f1f50c553f6b1ecaad43f8632dd929266368099895b9c14dc/",
            "tags": "Gafgyt",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564544": [
        {
            "ioc_value": "webrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-08-05 14:25:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/stamparm/maltrail/commit/4ed35ab767d5b6832557bae5254468793e1a9f28",
            "tags": "SalatStealer,WEB-RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564545": [
        {
            "ioc_value": "webrat.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-08-05 14:25:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/stamparm/maltrail/commit/4ed35ab767d5b6832557bae5254468793e1a9f28",
            "tags": "SalatStealer,WEB-RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564546": [
        {
            "ioc_value": "webrat.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-08-05 14:25:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/stamparm/maltrail/commit/4ed35ab767d5b6832557bae5254468793e1a9f28",
            "tags": "SalatStealer,WEB-RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564547": [
        {
            "ioc_value": "webrat.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-08-05 14:25:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/stamparm/maltrail/commit/4ed35ab767d5b6832557bae5254468793e1a9f28",
            "tags": "SalatStealer,WEB-RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564548": [
        {
            "ioc_value": "wrat.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-08-05 14:25:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/stamparm/maltrail/commit/4ed35ab767d5b6832557bae5254468793e1a9f28",
            "tags": "SalatStealer,WEB-RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564543": [
        {
            "ioc_value": "webr.at",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-08-05 14:25:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/stamparm/maltrail/commit/4ed35ab767d5b6832557bae5254468793e1a9f28",
            "tags": "SalatStealer,WEB-RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564540": [
        {
            "ioc_value": "krista-tur.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-08-05 14:25:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/stamparm/maltrail/commit/4ed35ab767d5b6832557bae5254468793e1a9f28",
            "tags": "SalatStealer,WEB-RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564541": [
        {
            "ioc_value": "salat.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-08-05 14:25:01",
            "last_seen_utc": "2025-09-04 23:48:05",
            "confidence_level": 50,
            "reference": "https://github.com/stamparm/maltrail/commit/4ed35ab767d5b6832557bae5254468793e1a9f28",
            "tags": "SalatStealer,WEB-RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564542": [
        {
            "ioc_value": "salator.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.salatstealer",
            "malware_alias": null,
            "malware_printable": "SalatStealer",
            "first_seen_utc": "2025-08-05 14:25:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/stamparm/maltrail/commit/4ed35ab767d5b6832557bae5254468793e1a9f28",
            "tags": "SalatStealer,WEB-RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564539": [
        {
            "ioc_value": "qt.kde.payoopoint.lk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-05 14:10:41",
            "last_seen_utc": "2025-08-06 07:11:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564536": [
        {
            "ioc_value": "secure.groizhosting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-05 13:18:26",
            "last_seen_utc": "2025-08-05 13:15:46",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114976324473712127",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1564535": [
        {
            "ioc_value": "www.chinagasholdings.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-05 12:51:41",
            "last_seen_utc": "2025-12-14 11:48:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564534": [
        {
            "ioc_value": "cdn-88.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-05 12:51:20",
            "last_seen_utc": "2025-08-11 11:49:40",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564529": [
        {
            "ioc_value": "360news10.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-05 12:01:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-ncy83sar6w",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564527": [
        {
            "ioc_value": "shareaz1.allianz-courtage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-08-05 12:01:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.116.39+shareaz1.allianz-courtage.co",
            "tags": "AS401116,C2,censys,Ermac,NYBULA,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564523": [
        {
            "ioc_value": "static.nulltrace.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-05 12:01:24",
            "last_seen_utc": "2025-08-06 04:00:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/98.86.138.98+static.nulltrace.cloud",
            "tags": "AMAZON-AES,AS14618,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564518": [
        {
            "ioc_value": "utoboolusho1.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-05 12:00:51",
            "last_seen_utc": "2025-09-25 13:46:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-l4r8qstl19",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564511": [
        {
            "ioc_value": "up.qp.payoopoint.lk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-05 10:10:33",
            "last_seen_utc": "2025-08-06 07:11:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "reeqc,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564434": [
        {
            "ioc_value": "my.cp.payoopoint.lk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-05 07:19:41",
            "last_seen_utc": "2025-08-05 09:10:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1564389": [
        {
            "ioc_value": "172-233-97-159.ip.linodeusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-05 06:56:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.233.97.159+172-233-97-159.ip.linodeusercontent.com",
            "tags": "AS63949,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1564390": [
        {
            "ioc_value": "update-office.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-05 06:56:56",
            "last_seen_utc": "2025-08-05 04:01:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.178.135+update-office.com",
            "tags": "AS13335,C2,censys,CLOUDFLARENET",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1564373": [
        {
            "ioc_value": "aws.micsoloft.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-05 06:56:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.105.24.242+aws.micsoloft.info",
            "tags": "AS63949,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1564351": [
        {
            "ioc_value": "security.flaxergaurds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-05 06:56:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1564352": [
        {
            "ioc_value": "temopix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-05 06:56:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1564286": [
        {
            "ioc_value": "meadotdk.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-05 06:56:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1564316": [
        {
            "ioc_value": "yrokistorii.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-05 06:56:36",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1564427": [
        {
            "ioc_value": "prince123.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-05 06:04:08",
            "last_seen_utc": "2025-08-15 12:12:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-dtkf5sdq9s",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564424": [
        {
            "ioc_value": "job3.yjctllgcq.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-05 06:03:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-f6fpts1py5",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564423": [
        {
            "ioc_value": "shellexperiencehost.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-05 06:01:20",
            "last_seen_utc": "2025-08-15 12:12:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-bweybszkv3",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564422": [
        {
            "ioc_value": "dooijeweerd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-05 06:01:08",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-d2216aej4w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564420": [
        {
            "ioc_value": "activities-essays.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-05 06:00:58",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-alxvqaypv6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564418": [
        {
            "ioc_value": "he-purchased.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-05 06:00:56",
            "last_seen_utc": "2025-08-15 12:12:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250805-f2tqws1pt8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564368": [
        {
            "ioc_value": "royalmail.com.rx.ns2.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.mimikatz",
            "malware_alias": null,
            "malware_printable": "MimiKatz",
            "first_seen_utc": "2025-08-05 00:01:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.62.56.181+royalmail.com.rx.ns2.name",
            "tags": "AS62370,C2,censys,hacktool,Mimikatz,open-dir,SNEL",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564343": [
        {
            "ioc_value": "santoos-63758.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-04 20:04:37",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564334": [
        {
            "ioc_value": "net-37-119-171-146.cust.vodafonedsl.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-04 20:01:38",
            "last_seen_utc": "2025-08-05 04:01:02",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/37.119.171.146+net-37-119-171-146.cust.vodafonedsl.it",
            "tags": "AS30722,C2,censys,panel,Unam,VODAFONE-IT-ASN",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564278": [
        {
            "ioc_value": "uzamaki.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-08-04 18:03:06",
            "last_seen_utc": "2025-08-15 12:12:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-rvpddaer6t",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564276": [
        {
            "ioc_value": "quite-cs.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-04 18:01:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-n39gqsztey",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564274": [
        {
            "ioc_value": "teen-undo.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-04 18:01:17",
            "last_seen_utc": "2025-08-15 12:12:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-vvq4ras1ft",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564273": [
        {
            "ioc_value": "vaulted-47334.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-04 18:01:10",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-qet39atjw2",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564272": [
        {
            "ioc_value": "sell-underlying.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-04 18:01:09",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-ts598agl3s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564270": [
        {
            "ioc_value": "windeckoloko.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-04 18:01:02",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-s7s3rsfq91",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564271": [
        {
            "ioc_value": "gigle.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-04 18:01:02",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-qg1c2s1sgt",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564268": [
        {
            "ioc_value": "ync9i5fv1.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-pajw2scl6t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564265": [
        {
            "ioc_value": "gnggyurfucked-32857.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:54",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-q53s3stmx8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564266": [
        {
            "ioc_value": "categories-figure.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:54",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-qtzx2stls9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564267": [
        {
            "ioc_value": "releases-nitrogen.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:54",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-pcm2gszway",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564261": [
        {
            "ioc_value": "thought-geology.gl.joinmc.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:53",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-vld3tss1ax",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564262": [
        {
            "ioc_value": "cross-editor.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:53",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-s224gsfq4v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564263": [
        {
            "ioc_value": "assistance-commissions.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:53",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-s1mbmsswcz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564264": [
        {
            "ioc_value": "format-joining.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-rwbhxaer7x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564260": [
        {
            "ioc_value": "hardware-planned.gl.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:52",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-vld3tss1ax",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564259": [
        {
            "ioc_value": "dead-weblogs.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 18:00:51",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-v2vqhsvry4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564244": [
        {
            "ioc_value": "wakilamakila.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-04 15:35:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/7b609924bfb9edfbc69cd7394ce44d944c75ed62ad72465b2710bd4dc59aabc1/",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564234": [
        {
            "ioc_value": "docs.nynovation.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-04 14:19:53",
            "last_seen_utc": "2025-08-04 17:10:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1564236": [
        {
            "ioc_value": "sdkfsf.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-04 14:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1564237": [
        {
            "ioc_value": "jdaklsjdklajsldkjd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-04 14:19:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1564238": [
        {
            "ioc_value": "daskldalkdalskdktktk.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-04 14:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1564239": [
        {
            "ioc_value": "zincheckyou.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-08-04 14:19:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1564232": [
        {
            "ioc_value": "rx.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-04 13:10:28",
            "last_seen_utc": "2025-08-05 07:19:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564227": [
        {
            "ioc_value": "dsswew.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-04 12:50:05",
            "last_seen_utc": "2025-09-06 13:49:42",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564226": [
        {
            "ioc_value": "api.teemaaby.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-04 12:49:56",
            "last_seen_utc": "2025-09-04 15:49:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564223": [
        {
            "ioc_value": "going-documents.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-04 12:02:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-mdqsnaywbt",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564214": [
        {
            "ioc_value": "dazzling-elbakyan.192-227-134-76.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-08-04 12:01:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/192.227.134.76+dazzling-elbakyan.192-227-134-76.plesk.page",
            "tags": "AS-COLOCROSSING,AS36352,C2,censys,Gafgyt,open-dir",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564210": [
        {
            "ioc_value": "obyonlinez.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-04 12:01:09",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-h2ecbaymy5",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564204": [
        {
            "ioc_value": "yoriabd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-04 12:00:54",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-hg7hcsyks9",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564202": [
        {
            "ioc_value": "xwormv7.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 12:00:45",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-klaejaxwfs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1564192": [
        {
            "ioc_value": "mx.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-04 11:10:32",
            "last_seen_utc": "2025-08-05 07:19:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1564163": [
        {
            "ioc_value": "hypnos-api.kapakhost.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-04 08:19:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564162": [
        {
            "ioc_value": "www.yperswapai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564146": [
        {
            "ioc_value": "www.oyukj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564147": [
        {
            "ioc_value": "www.pace-capsule-house.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564148": [
        {
            "ioc_value": "www.qpi.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564149": [
        {
            "ioc_value": "www.r-ing.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564150": [
        {
            "ioc_value": "www.raftdistillery.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564151": [
        {
            "ioc_value": "www.remium5.tokyo",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564152": [
        {
            "ioc_value": "www.sotonic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564153": [
        {
            "ioc_value": "www.sy739.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564154": [
        {
            "ioc_value": "www.sy907.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564155": [
        {
            "ioc_value": "www.tokia.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564156": [
        {
            "ioc_value": "www.umss.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564157": [
        {
            "ioc_value": "www.uputamadre.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564158": [
        {
            "ioc_value": "www.us82.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564159": [
        {
            "ioc_value": "www.utfinpost.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564160": [
        {
            "ioc_value": "www.wdiks.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564161": [
        {
            "ioc_value": "www.yhyqoeziut.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564125": [
        {
            "ioc_value": "www.eshai.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564126": [
        {
            "ioc_value": "www.etlemonlightsite.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564127": [
        {
            "ioc_value": "www.etr3water.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564128": [
        {
            "ioc_value": "www.g51-lzal1646.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": "2025-10-03 14:22:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564129": [
        {
            "ioc_value": "www.gdyej.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564130": [
        {
            "ioc_value": "www.gmqs5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564131": [
        {
            "ioc_value": "www.h123.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564132": [
        {
            "ioc_value": "www.heryl866.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564133": [
        {
            "ioc_value": "www.i1.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564134": [
        {
            "ioc_value": "www.ic-staking.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564135": [
        {
            "ioc_value": "www.ightspotin.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564136": [
        {
            "ioc_value": "www.ijnbedrijfskleding.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564137": [
        {
            "ioc_value": "www.irstcarepartners.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564138": [
        {
            "ioc_value": "www.lujjq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564139": [
        {
            "ioc_value": "www.lvfun.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564140": [
        {
            "ioc_value": "www.m155.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564141": [
        {
            "ioc_value": "www.nayasa.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564142": [
        {
            "ioc_value": "www.odesigngurulabs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564143": [
        {
            "ioc_value": "www.ompira.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564144": [
        {
            "ioc_value": "www.orven.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564145": [
        {
            "ioc_value": "www.ow50p.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564106": [
        {
            "ioc_value": "www.ataract-surgery-15490.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564107": [
        {
            "ioc_value": "www.atinca.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564108": [
        {
            "ioc_value": "www.avannah.ventures",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564109": [
        {
            "ioc_value": "www.aximocastillo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564110": [
        {
            "ioc_value": "www.azeti.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564111": [
        {
            "ioc_value": "www.btreiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564112": [
        {
            "ioc_value": "www.c1365.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564113": [
        {
            "ioc_value": "www.c4829.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564114": [
        {
            "ioc_value": "www.c5217.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564115": [
        {
            "ioc_value": "www.dazi.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564116": [
        {
            "ioc_value": "www.dton.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564117": [
        {
            "ioc_value": "www.dvansebuisness.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564118": [
        {
            "ioc_value": "www.eabook.mobi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": "2025-08-28 06:54:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564119": [
        {
            "ioc_value": "www.ecruittalentteam.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564120": [
        {
            "ioc_value": "www.eebot.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564121": [
        {
            "ioc_value": "www.eet-new-people-69853.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564122": [
        {
            "ioc_value": "www.ellowapp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564123": [
        {
            "ioc_value": "www.encilzanybetazoom.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564124": [
        {
            "ioc_value": "www.ental-implants-22908.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:44",
            "last_seen_utc": "2025-09-10 08:15:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564098": [
        {
            "ioc_value": "www.0sao.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564099": [
        {
            "ioc_value": "www.3779.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564100": [
        {
            "ioc_value": "www.6064.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564101": [
        {
            "ioc_value": "www.9xtver7.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564102": [
        {
            "ioc_value": "www.aapcommerce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564103": [
        {
            "ioc_value": "www.aluechaser.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564104": [
        {
            "ioc_value": "www.aluxuryrealestate.homes",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1564105": [
        {
            "ioc_value": "www.anzocommunityhub.services",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-04 08:19:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563924": [
        {
            "ioc_value": "edge-chat.allianz-courtage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-08-04 08:01:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.116.39+edge-chat.allianz-courtage.co",
            "tags": "AS401116,C2,censys,Ermac,NYBULA,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563910": [
        {
            "ioc_value": "hawkeye.v6.navy",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-04 07:35:32",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/39c325f57379efa8f382ccb552ae22d759ab6115d4ce5e359c631a286cf395da/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563895": [
        {
            "ioc_value": "flipbaker-35783.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 06:00:43",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-ejk6cscl7s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563896": [
        {
            "ioc_value": "similar-meta.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 06:00:43",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-bqds3s11fw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563893": [
        {
            "ioc_value": "wealthyblessed.minhaempresa.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 06:00:42",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-gcg68sej9y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563894": [
        {
            "ioc_value": "union-victor.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-04 06:00:42",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250804-esxwhscn4s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563864": [
        {
            "ioc_value": "ec2-47-129-44-166.ap-southeast-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-04 05:50:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.129.44.166+ec2-47-129-44-166.ap-southeast-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1563870": [
        {
            "ioc_value": "ec2-54-244-199-31.us-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-04 05:50:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/54.244.199.31+ec2-54-244-199-31.us-west-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1563820": [
        {
            "ioc_value": "security.flhurgyard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-04 05:50:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1563821": [
        {
            "ioc_value": "nenziop.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-04 05:50:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1563854": [
        {
            "ioc_value": "ty.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-04 00:10:58",
            "last_seen_utc": "2025-08-21 10:10:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563818": [
        {
            "ioc_value": "vpn294647220.softether.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-08-03 20:01:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/192.227.134.76+vpn294647220.softether.net",
            "tags": "AS-COLOCROSSING,AS36352,C2,censys,Gafgyt,open-dir",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563794": [
        {
            "ioc_value": "ayoub111.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-03 18:03:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-tm529saq8v",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563795": [
        {
            "ioc_value": "hackcoder.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-03 18:03:55",
            "last_seen_utc": "2025-08-15 12:12:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-rrwchstsey",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563791": [
        {
            "ioc_value": "thing-ob.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-03 18:00:45",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-tbsykaan6w",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563790": [
        {
            "ioc_value": "versionestablefinal.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-03 18:00:40",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-sbtz7axjs6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563789": [
        {
            "ioc_value": "follow-absent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-03 18:00:36",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-v85t3ack4s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563783": [
        {
            "ioc_value": "fillettx.xin",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-03 16:56:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/8041ad17-7ad9-4741-bfd9-87059d0af671",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1563762": [
        {
            "ioc_value": "version-affected.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-08-03 12:04:57",
            "last_seen_utc": "2025-08-15 12:13:19",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-hbzwbshn5t",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563761": [
        {
            "ioc_value": "technology-rome.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-03 12:02:58",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-k6yb4asjy6",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563759": [
        {
            "ioc_value": "m.allianz-courtage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-08-03 12:01:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.116.39+m.allianz-courtage.co",
            "tags": "AS401116,C2,censys,Ermac,NYBULA,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563757": [
        {
            "ioc_value": "office304.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-08-03 12:01:10",
            "last_seen_utc": "2025-08-04 04:00:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/5.161.144.140+office304.duckdns.org",
            "tags": "AS213230,C2,censys,Havoc,HETZNER-CLOUD2-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563746": [
        {
            "ioc_value": "bbvlljwwd.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-03 12:00:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-j6l4dsyybw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563745": [
        {
            "ioc_value": "monstr.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-03 12:00:33",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-lpmppsck6w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563743": [
        {
            "ioc_value": "ww.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-03 11:10:29",
            "last_seen_utc": "2025-08-04 07:35:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563718": [
        {
            "ioc_value": "fc.verifiedaccesssecure.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-03 08:00:57",
            "last_seen_utc": "2025-08-04 04:00:30",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.115.244+fc.verifiedaccesssecure.icu",
            "tags": "AS401116,AsyncRAT,C2,censys,NYBULA,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563713": [
        {
            "ioc_value": "Ezlolsrealisgood-64048.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-03 07:28:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563714": [
        {
            "ioc_value": "xfini900.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-03 07:28:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563611": [
        {
            "ioc_value": "ecs-120-46-72-74.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-03 06:51:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/120.46.72.74+ecs-120-46-72-74.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1563612": [
        {
            "ioc_value": "camp.updays.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-03 06:51:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/101.43.139.175+camp.updays.top",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1563610": [
        {
            "ioc_value": "camptesting.updays.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-03 06:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/101.43.139.175+camptesting.updays.top",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1563570": [
        {
            "ioc_value": "security.flerfgurda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-03 06:51:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1563571": [
        {
            "ioc_value": "venciols.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-03 06:51:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1563653": [
        {
            "ioc_value": "hackerboy1111111.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-03 06:06:25",
            "last_seen_utc": "2025-08-15 12:12:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-d642bagk3t",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563649": [
        {
            "ioc_value": "block-reset.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-03 06:00:57",
            "last_seen_utc": "2025-08-06 11:33:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-aaevrsfj3x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563648": [
        {
            "ioc_value": "conditions-ripe.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-03 06:00:34",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250803-evj3faxsgy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563601": [
        {
            "ioc_value": "apis.verifiedaccesssecure.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-03 00:01:07",
            "last_seen_utc": "2025-08-03 04:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.115.244+apis.verifiedaccesssecure.icu",
            "tags": "AS401116,AsyncRAT,C2,censys,NYBULA,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563599": [
        {
            "ioc_value": "sece.verifiedaccesssecure.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-03 00:01:06",
            "last_seen_utc": "2025-08-03 04:00:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.115.244+sece.verifiedaccesssecure.icu",
            "tags": "AS401116,AsyncRAT,C2,censys,NYBULA,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563600": [
        {
            "ioc_value": "play.verifiedaccesssecure.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-03 00:01:06",
            "last_seen_utc": "2025-08-03 04:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.115.244+play.verifiedaccesssecure.icu",
            "tags": "AS401116,AsyncRAT,C2,censys,NYBULA,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563591": [
        {
            "ioc_value": "log.logogogogo.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-02 22:48:49",
            "last_seen_utc": "2025-12-14 11:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563589": [
        {
            "ioc_value": "xxx.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-02 22:10:50",
            "last_seen_utc": "2025-08-04 07:35:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563548": [
        {
            "ioc_value": "araboz.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-02 18:03:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-t67efavlz2",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563547": [
        {
            "ioc_value": "liangpao8541.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-08-02 18:01:45",
            "last_seen_utc": "2025-08-02 18:01:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-rb1x3atlx3",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563546": [
        {
            "ioc_value": "swgood.kro.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-08-02 18:01:32",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-qdvy6asp12",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563543": [
        {
            "ioc_value": "opbrghost-23030.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-02 18:00:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-pfwsssgl7z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563544": [
        {
            "ioc_value": "trackopbr2.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-02 18:00:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-pfwsssgl7z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563541": [
        {
            "ioc_value": "kecfcnyn-29266.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-02 18:00:52",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-sfsb6aam4x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563542": [
        {
            "ioc_value": "1.tcp.eu.cpolar.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-02 18:00:52",
            "last_seen_utc": "2025-09-25 06:16:25",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-vb15lsvms9",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563540": [
        {
            "ioc_value": "kallichox22.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-08-02 18:00:46",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-telzesaq7v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563539": [
        {
            "ioc_value": "co-homeless.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-02 18:00:30",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-spxm8san31",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563518": [
        {
            "ioc_value": "shim2.vurtobix.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-08-02 15:31:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5e72de9f6789a9cda3df9f794ab3e26ff9b24611edf9e0f0cbc4d6a5d8e44bbb/",
            "tags": "Rhadamanthys",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1563519": [
        {
            "ioc_value": "shim2.zyraq.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-08-02 15:31:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5e72de9f6789a9cda3df9f794ab3e26ff9b24611edf9e0f0cbc4d6a5d8e44bbb/",
            "tags": "Rhadamanthys",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1563520": [
        {
            "ioc_value": "shim3.sylviaklop.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-08-02 15:31:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5e72de9f6789a9cda3df9f794ab3e26ff9b24611edf9e0f0cbc4d6a5d8e44bbb/",
            "tags": "Rhadamanthys",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1563521": [
        {
            "ioc_value": "shim4.familygater.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-08-02 15:31:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5e72de9f6789a9cda3df9f794ab3e26ff9b24611edf9e0f0cbc4d6a5d8e44bbb/",
            "tags": "Rhadamanthys",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1563491": [
        {
            "ioc_value": "bittsgly.my",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-08-02 13:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/34cbfa72-86f9-49a7-a1b9-849833dc688e",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1563502": [
        {
            "ioc_value": "mx2.bsqd.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-02 12:49:25",
            "last_seen_utc": "2025-12-14 11:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563501": [
        {
            "ioc_value": "pub.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-02 12:11:09",
            "last_seen_utc": "2025-08-04 07:35:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563499": [
        {
            "ioc_value": "omega2.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-02 12:03:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-nqm3za1rz4",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563494": [
        {
            "ioc_value": "nowwework.3utilities.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-02 12:00:37",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-m88xqa1qt9",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563493": [
        {
            "ioc_value": "programme-newspaper.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-02 12:00:29",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-l4hpasyva1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563321": [
        {
            "ioc_value": "javascriptnest.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-02 09:32:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1563322": [
        {
            "ioc_value": "scriptedfunctions.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-02 09:32:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1563479": [
        {
            "ioc_value": "updatemicfosoft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-02 09:17:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Storm-2603",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563480": [
        {
            "ioc_value": "microsfot.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-02 09:17:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Storm-2603",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563477": [
        {
            "ioc_value": "discussion-announcement.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-02 09:14:42",
            "last_seen_utc": "2025-08-06 11:33:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563478": [
        {
            "ioc_value": "snxppyz.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-02 09:14:42",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563474": [
        {
            "ioc_value": "botnet.fakepay.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-02 09:14:08",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563475": [
        {
            "ioc_value": "sbd.haongmaidong.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-02 09:14:08",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563476": [
        {
            "ioc_value": "xdxd.hoangmaidong.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-08-02 09:14:08",
            "last_seen_utc": "2025-08-15 12:13:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563451": [
        {
            "ioc_value": "www.ntoines.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563452": [
        {
            "ioc_value": "www.olarlights-40039.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563453": [
        {
            "ioc_value": "www.orjaengenharia.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563454": [
        {
            "ioc_value": "www.ouchrajohri.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563455": [
        {
            "ioc_value": "www.owfihjdad.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563456": [
        {
            "ioc_value": "www.qjd2s.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563457": [
        {
            "ioc_value": "www.racktor.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563458": [
        {
            "ioc_value": "www.rain.watch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563459": [
        {
            "ioc_value": "www.reshplate.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563460": [
        {
            "ioc_value": "www.rtservice.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563461": [
        {
            "ioc_value": "www.s2025.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563462": [
        {
            "ioc_value": "www.sint.productions",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563463": [
        {
            "ioc_value": "www.sy442.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563464": [
        {
            "ioc_value": "www.trwedb.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563465": [
        {
            "ioc_value": "www.ubertimer.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563466": [
        {
            "ioc_value": "www.ucoarts.llc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563467": [
        {
            "ioc_value": "www.uno.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563468": [
        {
            "ioc_value": "www.urkifsalife.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563469": [
        {
            "ioc_value": "www.urovisions.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563470": [
        {
            "ioc_value": "www.wxmax.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563471": [
        {
            "ioc_value": "www.yconadminagent231c.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": "2025-08-28 06:54:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563472": [
        {
            "ioc_value": "www.ymt1s.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563473": [
        {
            "ioc_value": "www.zyh8g.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563428": [
        {
            "ioc_value": "www.eg1jy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563429": [
        {
            "ioc_value": "www.ensingtonllc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563430": [
        {
            "ioc_value": "www.estingpodcast.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563431": [
        {
            "ioc_value": "www.et-supplies-64469.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563432": [
        {
            "ioc_value": "www.fok062.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563433": [
        {
            "ioc_value": "www.hickenroadfocusw.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563434": [
        {
            "ioc_value": "www.hs.tokyo",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563435": [
        {
            "ioc_value": "www.hsykj.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563436": [
        {
            "ioc_value": "www.iaochengxuqjzh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563437": [
        {
            "ioc_value": "www.ipralex.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563438": [
        {
            "ioc_value": "www.kc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563439": [
        {
            "ioc_value": "www.lackred.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563440": [
        {
            "ioc_value": "www.lean-room-hl02.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563441": [
        {
            "ioc_value": "www.lgopaht.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563442": [
        {
            "ioc_value": "www.lolaha.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563443": [
        {
            "ioc_value": "www.ltea.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563444": [
        {
            "ioc_value": "www.m-yra.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563445": [
        {
            "ioc_value": "www.m62nx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563446": [
        {
            "ioc_value": "www.masilevich.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": "2025-08-28 06:54:42",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563447": [
        {
            "ioc_value": "www.mlservices.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563448": [
        {
            "ioc_value": "www.ncyxunems.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563449": [
        {
            "ioc_value": "www.ngehladosanttos.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563450": [
        {
            "ioc_value": "www.nlinefreediplom.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563409": [
        {
            "ioc_value": "www.03bub.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563410": [
        {
            "ioc_value": "www.2learn.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563411": [
        {
            "ioc_value": "www.2zpi6.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563412": [
        {
            "ioc_value": "www.58p.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563413": [
        {
            "ioc_value": "www.8051.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563414": [
        {
            "ioc_value": "www.8ight.beauty",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563415": [
        {
            "ioc_value": "www.8tangtang.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563416": [
        {
            "ioc_value": "www.acredmanuscript.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563417": [
        {
            "ioc_value": "www.adespark.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563418": [
        {
            "ioc_value": "www.aisy558.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563419": [
        {
            "ioc_value": "www.ali77vip.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563420": [
        {
            "ioc_value": "www.angxiaopppp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563421": [
        {
            "ioc_value": "www.apakgame.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563422": [
        {
            "ioc_value": "www.arasrm.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563423": [
        {
            "ioc_value": "www.arvanaemplyomentverfi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563424": [
        {
            "ioc_value": "www.ayfaic.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563425": [
        {
            "ioc_value": "www.cngs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563426": [
        {
            "ioc_value": "www.decesi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563427": [
        {
            "ioc_value": "www.e403e.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-08-02 09:13:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563343": [
        {
            "ioc_value": "hiphop13.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-08-02 09:13:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1563320": [
        {
            "ioc_value": "cnm.mom",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-02 08:49:39",
            "last_seen_utc": "2025-09-05 13:51:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563309": [
        {
            "ioc_value": "z-m-static.xx.allianz-courtage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-08-02 08:01:10",
            "last_seen_utc": "2025-08-04 04:01:17",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.116.39+z-m-static.xx.allianz-courtage.co",
            "tags": "AS401116,C2,censys,Ermac,NYBULA,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563310": [
        {
            "ioc_value": "www1.allianz-courtage.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-08-02 08:01:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.116.39+www1.allianz-courtage.co",
            "tags": "AS401116,C2,censys,Ermac,NYBULA,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563219": [
        {
            "ioc_value": "security.flenieregurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-02 07:09:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1563220": [
        {
            "ioc_value": "wensibelo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-02 07:09:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1563267": [
        {
            "ioc_value": "flexreplicahafailoverserver638891307695968072.rs-313704a4e866.postgres.database.azure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-02 07:09:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/20.171.81.135+flexreplicahafailoverserver638891307695968072.rs-313704a4e866.postgres.database.azure.com",
            "tags": "AS8075,C2,censys,MICROSOFT-CORP-MSN-AS-BLOCK,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1563268": [
        {
            "ioc_value": "flexreplicahafailoverserver638891307695968072.postgres.database.azure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-02 07:09:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/20.171.81.135+flexreplicahafailoverserver638891307695968072.postgres.database.azure.com",
            "tags": "AS8075,C2,censys,MICROSOFT-CORP-MSN-AS-BLOCK,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1563147": [
        {
            "ioc_value": "bmw320ikaka.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-08-02 07:09:38",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "screenconnect",
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1563294": [
        {
            "ioc_value": "rahiwex585-45935.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-02 06:00:53",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-d2q9naap8v",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563293": [
        {
            "ioc_value": "hapafix955-45412.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-02 06:00:52",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-fqdkjayjt2",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563291": [
        {
            "ioc_value": "vestcast.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-02 06:00:34",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-gevkcawvcv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563292": [
        {
            "ioc_value": "perfectsemplegas.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-02 06:00:34",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-gevkcawvcv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563288": [
        {
            "ioc_value": "schedule-pci.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-02 06:00:29",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-b3r68saj2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563286": [
        {
            "ioc_value": "pvpz-th.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-02 06:00:28",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-c22jysxkv5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563287": [
        {
            "ioc_value": "study-leasing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-02 06:00:28",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250802-czvnmaak6w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563259": [
        {
            "ioc_value": "logandlog.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-02 02:48:50",
            "last_seen_utc": "2025-10-07 09:51:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563201": [
        {
            "ioc_value": "stat.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-01 18:11:09",
            "last_seen_utc": "2025-08-04 07:35:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563199": [
        {
            "ioc_value": "cgnnzayodgrdwaez5asqw562abwp74tino45k2aeg2wgz6ohuah5rqid.onion",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bit_rat",
            "malware_alias": null,
            "malware_printable": "BitRAT",
            "first_seen_utc": "2025-08-01 18:02:57",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-thrn3sspy2",
            "tags": "bitrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563198": [
        {
            "ioc_value": "ecko12.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-08-01 18:02:15",
            "last_seen_utc": "2025-08-15 12:12:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-tdb3tszyhw",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563197": [
        {
            "ioc_value": "heer-21960.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-01 18:00:45",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-r648zacn71",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563195": [
        {
            "ioc_value": "friendly-mobile.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-08-01 18:00:44",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-vtm1pstkw5",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563191": [
        {
            "ioc_value": "school-everyday.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-01 18:00:27",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-r2spdazvd1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563192": [
        {
            "ioc_value": "should-medications.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-01 18:00:27",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-n7kdeaznv9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563190": [
        {
            "ioc_value": "both-windsor.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-01 18:00:26",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-vepwrasrz6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563117": [
        {
            "ioc_value": "clients.lamusicana.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-08-01 15:01:23",
            "last_seen_utc": "2025-08-01 13:16:03",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114953676216563513",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1563115": [
        {
            "ioc_value": "himself-checks-blood-receptors.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-08-01 12:49:47",
            "last_seen_utc": "2025-09-01 09:51:46",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563103": [
        {
            "ioc_value": "mbadaego1.ddnsgeek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-01 12:00:29",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-n1y8zszmy3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563104": [
        {
            "ioc_value": "server44.mentality.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-08-01 12:00:29",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-llmkjaxrw5",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563102": [
        {
            "ioc_value": "say-domains.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-01 12:00:22",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-nvpscszl19",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563097": [
        {
            "ioc_value": "demo.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-08-01 11:10:30",
            "last_seen_utc": "2025-08-04 07:35:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1563021": [
        {
            "ioc_value": "flexreplicahafailoverserver638889507287292352-r32.postgres.database.azure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-01 06:13:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/20.171.253.80+flexreplicahafailoverserver638889507287292352-r32.postgres.database.azure.com",
            "tags": "AS8075,C2,censys,MICROSOFT-CORP-MSN-AS-BLOCK,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1563022": [
        {
            "ioc_value": "flexreplicahafailoverserver638889507287292352-r32.rs-8fd10fa7e4b4.postgres.database.azure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-01 06:13:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/20.171.253.80+flexreplicahafailoverserver638889507287292352-r32.rs-8fd10fa7e4b4.postgres.database.azure.com",
            "tags": "AS8075,C2,censys,MICROSOFT-CORP-MSN-AS-BLOCK,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1563020": [
        {
            "ioc_value": "ec2-56-228-12-2.eu-north-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-01 06:12:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/56.228.12.2+ec2-56-228-12-2.eu-north-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1562980": [
        {
            "ioc_value": "security.florerguaerd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-01 06:12:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562981": [
        {
            "ioc_value": "monchiels.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-08-01 06:12:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1563066": [
        {
            "ioc_value": "facilities-arizona.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-01 06:00:24",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-adfapsak4x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563064": [
        {
            "ioc_value": "hexa.dnsframe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-01 06:00:23",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-f317cscm5z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1563065": [
        {
            "ioc_value": "late-researcher.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-08-01 06:00:23",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250801-dccpzatnw8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562974": [
        {
            "ioc_value": "web.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-31 21:10:29",
            "last_seen_utc": "2025-08-04 07:35:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562963": [
        {
            "ioc_value": "botnet.m85test.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-31 20:17:10",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562962": [
        {
            "ioc_value": "4myrb8zoe.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-31 20:16:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562961": [
        {
            "ioc_value": "www.yinyang.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-31 20:16:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562919": [
        {
            "ioc_value": "darkstore.pw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-31 18:13:15",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1562926": [
        {
            "ioc_value": "point-technology.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-31 18:00:39",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-tv528scl9t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562923": [
        {
            "ioc_value": "structure-nov.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 18:00:24",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-v645rayqt5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562924": [
        {
            "ioc_value": "lower-sam.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 18:00:24",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-tdy8cswwhz",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562925": [
        {
            "ioc_value": "anything-desired.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 18:00:24",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-rj5k8axmt5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562894": [
        {
            "ioc_value": "download.romeropizza.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-31 13:43:44",
            "last_seen_utc": "2025-07-31 22:13:13",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1562890": [
        {
            "ioc_value": "www.qlchacha.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-31 12:49:43",
            "last_seen_utc": "2025-09-06 13:49:55",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562889": [
        {
            "ioc_value": "web.d-you.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-31 12:49:41",
            "last_seen_utc": "2025-10-21 21:48:21",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562888": [
        {
            "ioc_value": "googlecloudtest.webredirect.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-31 12:49:27",
            "last_seen_utc": "2025-09-20 07:48:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562885": [
        {
            "ioc_value": "infiuyr.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-31 12:29:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1562883": [
        {
            "ioc_value": "de3.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-31 12:20:29",
            "last_seen_utc": "2025-07-31 20:17:24",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/bc4924c116ab07d26fc5e89a68691e9b95a8fd72834bbddde48d55f749afee86/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562867": [
        {
            "ioc_value": "vishneviyjazz.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-31 12:08:20",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1562877": [
        {
            "ioc_value": "ama0899.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-31 12:01:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.64.1+ama0899.shop",
            "tags": "Amatera,AS13335,C2,censys,CLOUDFLARENET,Panel,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562870": [
        {
            "ioc_value": "ec2-3-90-201-175.compute-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-31 12:00:58",
            "last_seen_utc": "2025-08-01 04:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.90.201.175+ec2-3-90-201-175.compute-1.amazonaws.com",
            "tags": "AMAZON-AES,AS14618,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562868": [
        {
            "ioc_value": "subduxxi.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-31 12:00:53",
            "last_seen_utc": "2025-08-06 11:33:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-nz117atxgv",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562862": [
        {
            "ioc_value": "hjanarchydg.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-31 12:00:46",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-lnd16sfk9v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562863": [
        {
            "ioc_value": "yfasynwv.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-31 12:00:46",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-lnd16sfk9v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562864": [
        {
            "ioc_value": "jvenysa.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-31 12:00:46",
            "last_seen_utc": "2025-08-06 11:33:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-lnd16sfk9v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562856": [
        {
            "ioc_value": "davidlee90109.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-31 12:00:38",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-lkk1bastht",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562858": [
        {
            "ioc_value": "angeleviagivenmebestthingsforbetterfeell.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-31 12:00:38",
            "last_seen_utc": "2025-08-06 11:33:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-hdzy4sz1bx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562855": [
        {
            "ioc_value": "nordiska.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-31 12:00:37",
            "last_seen_utc": "2025-08-06 11:33:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-nyhs8ahm2s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562851": [
        {
            "ioc_value": "WhiteShadow1-47388.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 12:00:25",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-h6sqhasnv6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562852": [
        {
            "ioc_value": "LaserJet-32220.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 12:00:25",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-h6sqhasnv6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562847": [
        {
            "ioc_value": "xwormblast6.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 12:00:24",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-nf5v2avrs9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562848": [
        {
            "ioc_value": "multi-designing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 12:00:24",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-na5m3svqw6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562850": [
        {
            "ioc_value": "privatedns.jiahouse.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 12:00:24",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-k6zvxstmx9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562846": [
        {
            "ioc_value": "qwerty1223.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 12:00:23",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-nrywvstwhw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562843": [
        {
            "ioc_value": "smtp.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-31 11:10:28",
            "last_seen_utc": "2025-08-04 07:35:41",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562831": [
        {
            "ioc_value": "comments-jay.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-31 10:39:14",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 50,
            "reference": "https://tria.ge/250731-lc826sfj6t",
            "tags": "AsyncRAT",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1562836": [
        {
            "ioc_value": "mocadia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-31 10:39:13",
            "last_seen_utc": "2025-08-08 14:53:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1562837": [
        {
            "ioc_value": "invest-place.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-31 10:39:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1562840": [
        {
            "ioc_value": "xmas-song-dungeon.world",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-07-31 10:39:11",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1562834": [
        {
            "ioc_value": "ego34.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-31 09:28:18",
            "last_seen_utc": "2025-08-06 11:33:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562833": [
        {
            "ioc_value": "check-ringtones.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-31 09:28:03",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562777": [
        {
            "ioc_value": "gramkintil44.carapicuibacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562778": [
        {
            "ioc_value": "planfensul.santoscidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562779": [
        {
            "ioc_value": "plininransar.carapicuibacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562780": [
        {
            "ioc_value": "plolinfil348.aracajucidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562781": [
        {
            "ioc_value": "prasinsil00.aracajucidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562782": [
        {
            "ioc_value": "prekil.londrinacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562783": [
        {
            "ioc_value": "presar.joinvillecidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562784": [
        {
            "ioc_value": "screzinsanvel.serracidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562785": [
        {
            "ioc_value": "scribil.serracidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562786": [
        {
            "ioc_value": "sprutil50.santoscidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562787": [
        {
            "ioc_value": "staral417.aparecidacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562788": [
        {
            "ioc_value": "stratenconpaz64.londrinacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562773": [
        {
            "ioc_value": "blucal.aparecidacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562774": [
        {
            "ioc_value": "dregonfil.feirasantanacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562775": [
        {
            "ioc_value": "frejantonpor465.joinvillecidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562776": [
        {
            "ioc_value": "glubondingem.feirasantanacidade.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.astaroth",
            "malware_alias": "Guildma",
            "malware_printable": "Astaroth",
            "first_seen_utc": "2025-07-31 06:19:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/dfcc27bb9cd2a597390dbfb7612b5bd5df3ab788a28b3f6867e966150e79fc9a/",
            "tags": "Astaroth,Guildma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562770": [
        {
            "ioc_value": "table-collectors.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-07-31 06:01:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-bxb8tsxyhz",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562769": [
        {
            "ioc_value": "ansyjul28.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-31 06:00:42",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-fhf1pabk6w",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562768": [
        {
            "ioc_value": "nnaeko111.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-31 06:00:27",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-f6xy4sbn71",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562767": [
        {
            "ioc_value": "notes-creates.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 06:00:21",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-a7ldtayps6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562765": [
        {
            "ioc_value": "WindowsManager-53471.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 06:00:20",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-cmbpzsx1az",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562764": [
        {
            "ioc_value": "svhost56.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 06:00:19",
            "last_seen_utc": "2025-08-06 11:33:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250731-c9m2jahm6z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562757": [
        {
            "ioc_value": "numbers-sally.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 05:42:59",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562758": [
        {
            "ioc_value": "suezax50.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 05:42:59",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562759": [
        {
            "ioc_value": "third-threaded.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-31 05:42:59",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562756": [
        {
            "ioc_value": "cancersincura01.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-31 05:42:26",
            "last_seen_utc": "2025-08-06 11:33:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562755": [
        {
            "ioc_value": "udpppp.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-31 05:42:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562752": [
        {
            "ioc_value": "api.hammznetx.kapakhost.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-31 05:42:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562753": [
        {
            "ioc_value": "meow2137.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-31 05:42:09",
            "last_seen_utc": "2025-08-15 12:13:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562754": [
        {
            "ioc_value": "scan.saturnbotnet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-31 05:42:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562747": [
        {
            "ioc_value": "jufcare.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-31 05:38:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562648": [
        {
            "ioc_value": "security.flwaergurdar.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-31 04:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562649": [
        {
            "ioc_value": "lomzikes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-31 04:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562643": [
        {
            "ioc_value": "akkeod.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-31 04:21:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1562705": [
        {
            "ioc_value": "test.betbaidu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-31 02:48:51",
            "last_seen_utc": "2025-08-31 09:50:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562704": [
        {
            "ioc_value": "junk-essex-vocals-stays.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-31 02:48:42",
            "last_seen_utc": "2025-08-01 11:49:36",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562703": [
        {
            "ioc_value": "etcprofile.biying007.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-31 02:48:40",
            "last_seen_utc": "2025-12-14 11:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562702": [
        {
            "ioc_value": "bfm2024.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-31 02:48:36",
            "last_seen_utc": "2025-09-09 15:48:58",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562701": [
        {
            "ioc_value": "api.dnstools.im",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-31 02:48:35",
            "last_seen_utc": "2025-08-31 11:49:48",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562697": [
        {
            "ioc_value": "st.atic.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-31 01:10:36",
            "last_seen_utc": "2025-07-31 10:10:34",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562691": [
        {
            "ioc_value": "test-at.fcsrv.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-31 00:01:45",
            "last_seen_utc": "2025-07-31 04:01:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.92.74.43+test-at.fcsrv.net",
            "tags": "AS200904,C2,censys,FOXCLOUD,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562645": [
        {
            "ioc_value": "6hc2nv7aqaejw.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-30 22:49:01",
            "last_seen_utc": "2025-11-06 11:50:56",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562595": [
        {
            "ioc_value": "systemloop.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-30 19:35:34",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/8d69b718fb4a569523b85f4c86d1a8de5fa557dad8971612f39dd786df4042c0/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562590": [
        {
            "ioc_value": "ns1.shgsfhdjstjsttjgjzddshgrw.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-30 18:49:20",
            "last_seen_utc": "2025-09-14 09:49:36",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562589": [
        {
            "ioc_value": "dns.shgsfhdjstjsttjgjzddshgrw.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-30 18:49:13",
            "last_seen_utc": "2025-09-14 09:49:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562582": [
        {
            "ioc_value": "xxxlll0727.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-30 18:02:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-qamhls1sds",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562577": [
        {
            "ioc_value": "llordiWasHere-55715.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-30 18:00:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-vhvw6svkv4",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562578": [
        {
            "ioc_value": "eg-template.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-30 18:00:46",
            "last_seen_utc": "2025-08-06 11:33:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-t1szvsttax",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562574": [
        {
            "ioc_value": "ngumbitertiary0012.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-30 18:00:30",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-s53t7abl5s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562575": [
        {
            "ioc_value": "christianemma033.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-30 18:00:30",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-s37elabk9x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562573": [
        {
            "ioc_value": "6mzdf1z0w.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 18:00:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-tlrhgss1fs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562569": [
        {
            "ioc_value": "sl1qmc-46509.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 18:00:21",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-wc4skacn5s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562570": [
        {
            "ioc_value": "wedding-outputs.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 18:00:21",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-t2rhesbq81",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562571": [
        {
            "ioc_value": "xworm.webredirect.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 18:00:21",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-t3cqnatrx9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562572": [
        {
            "ioc_value": "ship-miscellaneous.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 18:00:21",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-tlrhgss1fs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562564": [
        {
            "ioc_value": "tl.dr.softlinko.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-30 16:10:33",
            "last_seen_utc": "2025-08-25 13:46:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562554": [
        {
            "ioc_value": "images.therunningink.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-30 13:19:40",
            "last_seen_utc": "2025-07-30 14:00:39",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114942359785216977",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1562552": [
        {
            "ioc_value": "violeet.myddns.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-30 13:11:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562545": [
        {
            "ioc_value": "dev.twcdn.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-30 12:50:12",
            "last_seen_utc": "2025-08-05 11:51:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562544": [
        {
            "ioc_value": "cf.xinxiangnancs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-30 12:50:10",
            "last_seen_utc": "2025-09-10 15:50:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562540": [
        {
            "ioc_value": "lb.twilight.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-30 12:05:54",
            "last_seen_utc": "2025-07-30 12:05:54",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-krxf9aysbs",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562536": [
        {
            "ioc_value": "umsss-31458.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-30 12:01:53",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-kp9c2acq4y",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562534": [
        {
            "ioc_value": "memoryhighan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-30 12:01:33",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-n34aqafr9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562535": [
        {
            "ioc_value": "mohxmaya.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-30 12:01:33",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-n34aqafr9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562532": [
        {
            "ioc_value": "web.colour.fund",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-30 12:01:32",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-n34aqafr9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562533": [
        {
            "ioc_value": "web.vdh-solutions.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-30 12:01:32",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-n34aqafr9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562530": [
        {
            "ioc_value": "fokamoland.stufftoread.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-30 12:01:31",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-n34aqafr9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562531": [
        {
            "ioc_value": "rla.lessentoerisme.be",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-30 12:01:31",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-n34aqafr9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562528": [
        {
            "ioc_value": "muadsd.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-30 12:01:30",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-l9bg6szls6",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562520": [
        {
            "ioc_value": "ci.yourcontentishere.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-30 12:00:55",
            "last_seen_utc": "2025-07-31 04:00:49",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.128.48.155+ci.yourcontentishere.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562517": [
        {
            "ioc_value": "babylon987.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-30 12:00:43",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-hqzh4sap9y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562514": [
        {
            "ioc_value": "longlife.theworkpc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 12:00:23",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-jtajtsbn6z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562512": [
        {
            "ioc_value": "xwormlogs8.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 12:00:22",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-kr7xzscr4s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562513": [
        {
            "ioc_value": "focus-princeton.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 12:00:22",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-j7d46sbr3y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562511": [
        {
            "ioc_value": "fuckrat.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 12:00:21",
            "last_seen_utc": "2025-08-30 07:51:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-n34aqafr9t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562455": [
        {
            "ioc_value": "1.www.richinimpianti.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-30 09:10:36",
            "last_seen_utc": "2025-07-30 15:10:35",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562452": [
        {
            "ioc_value": "xx.xinxiangnancs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-30 08:49:09",
            "last_seen_utc": "2025-09-10 15:50:38",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562436": [
        {
            "ioc_value": "cezgroup.contact",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-30 08:18:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1562437": [
        {
            "ioc_value": "stockwises.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-30 08:18:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1562230": [
        {
            "ioc_value": "mailmaster.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-30 06:13:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.19.222.192+mailmaster.store",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1562198": [
        {
            "ioc_value": "security.flyaergyaurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-30 06:13:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562199": [
        {
            "ioc_value": "gebraud.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-30 06:12:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562419": [
        {
            "ioc_value": "prior-notification.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 06:00:14",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-ckt4jst1aw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562420": [
        {
            "ioc_value": "sale-annie.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 06:00:14",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250730-edm3rsgp5x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562417": [
        {
            "ioc_value": "windows-hold.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 05:32:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562418": [
        {
            "ioc_value": "anti-hardware.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-30 05:32:15",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562413": [
        {
            "ioc_value": "tesoro.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-30 05:31:28",
            "last_seen_utc": "2025-08-06 11:33:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562414": [
        {
            "ioc_value": "www.okglobalconcept.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-30 05:31:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562415": [
        {
            "ioc_value": "www.okglobalconcept1.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-30 05:31:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562412": [
        {
            "ioc_value": "remove-earnings.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-30 05:31:09",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562410": [
        {
            "ioc_value": "www.ynfyn.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562411": [
        {
            "ioc_value": "www.zruddot.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562390": [
        {
            "ioc_value": "www.oremotehiresquad.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562391": [
        {
            "ioc_value": "www.oterecs.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562392": [
        {
            "ioc_value": "www.ountryside.camp",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562393": [
        {
            "ioc_value": "www.p99k.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562394": [
        {
            "ioc_value": "www.qzx00.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562395": [
        {
            "ioc_value": "www.r811.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562396": [
        {
            "ioc_value": "www.reatcustomersbonuses7.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562397": [
        {
            "ioc_value": "www.renkguds.africa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562398": [
        {
            "ioc_value": "www.s0ux2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562399": [
        {
            "ioc_value": "www.sd508.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562400": [
        {
            "ioc_value": "www.slandworx.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562401": [
        {
            "ioc_value": "www.slojy.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562402": [
        {
            "ioc_value": "www.socyipr.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562403": [
        {
            "ioc_value": "www.stanbulfiboz.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562404": [
        {
            "ioc_value": "www.sth9.motorcycles",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562405": [
        {
            "ioc_value": "www.sy223.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562406": [
        {
            "ioc_value": "www.tk2027.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562407": [
        {
            "ioc_value": "www.uro-bat.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562408": [
        {
            "ioc_value": "www.wearitage.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562409": [
        {
            "ioc_value": "www.witzeraccounting.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562371": [
        {
            "ioc_value": "www.hykd7.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562372": [
        {
            "ioc_value": "www.hyoka.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562373": [
        {
            "ioc_value": "www.icobrokers.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562374": [
        {
            "ioc_value": "www.ictureterrific.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562375": [
        {
            "ioc_value": "www.idaluxe.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562376": [
        {
            "ioc_value": "www.ightspotusa.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562377": [
        {
            "ioc_value": "www.ingerie-79230.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562378": [
        {
            "ioc_value": "www.ingerie-91105.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562379": [
        {
            "ioc_value": "www.ini-shopping.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562380": [
        {
            "ioc_value": "www.insanuxiq38.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562381": [
        {
            "ioc_value": "www.irtualchats.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562382": [
        {
            "ioc_value": "www.jsq33.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562383": [
        {
            "ioc_value": "www.lestudy.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562384": [
        {
            "ioc_value": "www.lurpacks.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562385": [
        {
            "ioc_value": "www.milylambert.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562386": [
        {
            "ioc_value": "www.mkmku.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562387": [
        {
            "ioc_value": "www.ofa-br-89.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562388": [
        {
            "ioc_value": "www.oodprincej.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562389": [
        {
            "ioc_value": "www.ordbar.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562353": [
        {
            "ioc_value": "www.7fr2i.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562354": [
        {
            "ioc_value": "www.9304.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562355": [
        {
            "ioc_value": "www.9807.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562356": [
        {
            "ioc_value": "www.a2r.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562357": [
        {
            "ioc_value": "www.addycasino-sek.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562358": [
        {
            "ioc_value": "www.ae-muki.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562359": [
        {
            "ioc_value": "www.aiefk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562360": [
        {
            "ioc_value": "www.amepiece.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562361": [
        {
            "ioc_value": "www.asino-pinco-5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562362": [
        {
            "ioc_value": "www.asinoheyroller.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562363": [
        {
            "ioc_value": "www.avaplay.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562364": [
        {
            "ioc_value": "www.c2687.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562365": [
        {
            "ioc_value": "www.d-899b6.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562366": [
        {
            "ioc_value": "www.ernelhub.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562367": [
        {
            "ioc_value": "www.etcofqur.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562368": [
        {
            "ioc_value": "www.hcic5.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562369": [
        {
            "ioc_value": "www.hertve.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562370": [
        {
            "ioc_value": "www.hp-asp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562348": [
        {
            "ioc_value": "www.0utzm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562349": [
        {
            "ioc_value": "www.2y.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562350": [
        {
            "ioc_value": "www.55124.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562351": [
        {
            "ioc_value": "www.5q.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562352": [
        {
            "ioc_value": "www.7b0a0.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-30 05:30:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562282": [
        {
            "ioc_value": "2825clerkenwell.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-30 05:29:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562281": [
        {
            "ioc_value": "v4lcs-58756.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-30 05:29:30",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1562195": [
        {
            "ioc_value": "cf2.xinxiangnancs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-29 20:49:25",
            "last_seen_utc": "2025-09-10 15:50:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562194": [
        {
            "ioc_value": "cc.xinxiangnancs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-29 20:49:24",
            "last_seen_utc": "2025-09-10 15:50:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562178": [
        {
            "ioc_value": "meils.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcloud",
            "malware_alias": null,
            "malware_printable": "DarkCloud Stealer",
            "first_seen_utc": "2025-07-29 19:48:02",
            "last_seen_utc": "2025-08-26 23:48:05",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=meils.info",
            "tags": "Darkcloud,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562173": [
        {
            "ioc_value": "guosong.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-29 19:15:25",
            "last_seen_utc": "2025-07-29 19:10:39",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114938100744823667",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1562169": [
        {
            "ioc_value": "seputartuban.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-29 19:07:19",
            "last_seen_utc": "2025-07-29 19:10:41",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114938013816597034",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1562165": [
        {
            "ioc_value": "ogash96-53631.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-29 18:03:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-wb5ngazps9",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562163": [
        {
            "ioc_value": "nuevos777.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 18:01:20",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-r2n17aytdw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562144": [
        {
            "ioc_value": "masterdabha02.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-29 15:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562145": [
        {
            "ioc_value": "gasworld.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-29 15:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562146": [
        {
            "ioc_value": "myfactorydocs.ddns.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-29 15:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562134": [
        {
            "ioc_value": "button-genres.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562135": [
        {
            "ioc_value": "browser-kansas.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562127": [
        {
            "ioc_value": "grayhatx69back.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562128": [
        {
            "ioc_value": "etc-probe.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562129": [
        {
            "ioc_value": "french-nasdaq.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562130": [
        {
            "ioc_value": "cell-membership.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562131": [
        {
            "ioc_value": "jun-assist.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562132": [
        {
            "ioc_value": "below-activation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562133": [
        {
            "ioc_value": "jersey-marked.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562126": [
        {
            "ioc_value": "ripakslool.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 15:49:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562111": [
        {
            "ioc_value": "oktorre1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562112": [
        {
            "ioc_value": "diome152511.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562113": [
        {
            "ioc_value": "choncho1.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562103": [
        {
            "ioc_value": "enviodiomdesdiaz11.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562104": [
        {
            "ioc_value": "phentermine-introduced.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562105": [
        {
            "ioc_value": "21dc2025.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562106": [
        {
            "ioc_value": "class-point.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562107": [
        {
            "ioc_value": "envio211.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562108": [
        {
            "ioc_value": "whole-egyptian.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562109": [
        {
            "ioc_value": "diomdes1212.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562110": [
        {
            "ioc_value": "diomedesdiaz.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 15:49:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562088": [
        {
            "ioc_value": "tax-found.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:49:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562089": [
        {
            "ioc_value": "shomitt.3322.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:49:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562090": [
        {
            "ioc_value": "ledivineenfant-59793.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:49:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562091": [
        {
            "ioc_value": "qassar19933.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:49:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562092": [
        {
            "ioc_value": "country-blade.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:49:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562082": [
        {
            "ioc_value": "trust-conditional.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:48:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562083": [
        {
            "ioc_value": "ganga22.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:48:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562084": [
        {
            "ioc_value": "graddsad-24862.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:48:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562085": [
        {
            "ioc_value": "aa.repack4u.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:48:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562086": [
        {
            "ioc_value": "jarcoe02-55163.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:48:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562087": [
        {
            "ioc_value": "sell-musician.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 15:48:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1562061": [
        {
            "ioc_value": "https-keepkey.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 15:46:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/4592d64935081ae03564054fe64de80310dc44ae3e1e7899a004c6d6f6b1ef23/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562062": [
        {
            "ioc_value": "keepkeys.co",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 15:46:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/4592d64935081ae03564054fe64de80310dc44ae3e1e7899a004c6d6f6b1ef23/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562059": [
        {
            "ioc_value": "o.1.richinimpianti.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-29 15:10:33",
            "last_seen_utc": "2025-07-30 08:10:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562030": [
        {
            "ioc_value": "mx.eva-store.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-29 14:11:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1562021": [
        {
            "ioc_value": "m.groiz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-29 13:33:54",
            "last_seen_utc": "2025-07-29 14:13:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1562023": [
        {
            "ioc_value": "arearugs.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-29 13:33:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562013": [
        {
            "ioc_value": "mytan.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 13:03:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562014": [
        {
            "ioc_value": "cpmemes.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 13:03:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562015": [
        {
            "ioc_value": "drectggy.one",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 13:02:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562016": [
        {
            "ioc_value": "noyan.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 13:02:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562017": [
        {
            "ioc_value": "freeworld.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 13:02:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562018": [
        {
            "ioc_value": "silome.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 13:02:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562019": [
        {
            "ioc_value": "heras.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 13:02:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1562012": [
        {
            "ioc_value": "14733sss.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-29 12:02:25",
            "last_seen_utc": "2025-07-29 12:02:25",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-gyj8qadk3s",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562009": [
        {
            "ioc_value": "h43-74.fcsrv.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 12:01:59",
            "last_seen_utc": "2025-07-30 04:00:59",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.92.74.43+h43-74.fcsrv.net",
            "tags": "AS200904,C2,censys,FOXCLOUD,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1562000": [
        {
            "ioc_value": "effect-bedroom.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 12:01:25",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-mpcp6sfq8s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561998": [
        {
            "ioc_value": "lopez789.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-29 12:01:14",
            "last_seen_utc": "2025-08-06 11:33:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-nbat4agk6x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561999": [
        {
            "ioc_value": "bigbelly042.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-29 12:01:14",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-jxtrwawmx2",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561994": [
        {
            "ioc_value": "daily-iraqi.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 12:01:08",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-mpcp6sfq8s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561995": [
        {
            "ioc_value": "mrowx.gaclassics.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 12:01:08",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-kxb3hawtfv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561996": [
        {
            "ioc_value": "modified-rebecca.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 12:01:08",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-kyj5hafl2x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561997": [
        {
            "ioc_value": "prakashjadhav74738.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 12:01:08",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-g1zq7adk9x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561989": [
        {
            "ioc_value": "legalharuka.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 10:25:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561988": [
        {
            "ioc_value": "hoverk.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-29 10:24:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561987": [
        {
            "ioc_value": "meme8.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-29 10:24:26",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561919": [
        {
            "ioc_value": "lfv1zhpwz.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.babadeda",
            "malware_alias": null,
            "malware_printable": "Babadeda",
            "first_seen_utc": "2025-07-29 08:19:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f82e2b1f47b48e26c12c7e00b9d437d67b9b45d228f7be211395239326fa9bcb/",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561841": [
        {
            "ioc_value": "ec2-3-19-222-192.us-east-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-29 06:22:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.19.222.192+ec2-3-19-222-192.us-east-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1561799": [
        {
            "ioc_value": "monclerjackets.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-29 06:22:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561756": [
        {
            "ioc_value": "server-cd2.bipewi2747.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-29 06:22:08",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561759": [
        {
            "ioc_value": "security.fluargueds.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 06:22:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561760": [
        {
            "ioc_value": "menpogisa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-29 06:22:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561757": [
        {
            "ioc_value": "ex-02.ankk.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-29 06:22:06",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "loader,Maison Worm,maisonworm",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561900": [
        {
            "ioc_value": "includes-net.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 06:01:34",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-edqhwscj2t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561897": [
        {
            "ioc_value": "ansy25jul.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 06:01:25",
            "last_seen_utc": "2025-08-06 11:33:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-bapkmssrx7",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561898": [
        {
            "ioc_value": "luisd444.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-29 06:01:25",
            "last_seen_utc": "2025-08-06 11:33:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-adedeasp16",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561893": [
        {
            "ioc_value": "crrypte-23119.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 06:01:10",
            "last_seen_utc": "2025-08-06 11:33:41",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-edqhwscj2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561894": [
        {
            "ioc_value": "animal-expressions.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 06:01:10",
            "last_seen_utc": "2025-08-06 11:33:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-edqhwscj2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561895": [
        {
            "ioc_value": "effective-psychological.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 06:01:10",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-cfvvaabk5v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561896": [
        {
            "ioc_value": "children-hughes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 06:01:10",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-bxhqlssxhw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561890": [
        {
            "ioc_value": "myth0249-43397.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 06:01:09",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-d38kbstnz2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561892": [
        {
            "ioc_value": "zxcmisha5963-26454.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-29 06:01:09",
            "last_seen_utc": "2025-08-06 11:33:42",
            "confidence_level": 100,
            "reference": "https://tria.ge/250729-edqhwscj2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561886": [
        {
            "ioc_value": "test-mariah.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 05:55:17",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561887": [
        {
            "ioc_value": "v4lcs-58756.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-29 05:55:17",
            "last_seen_utc": "2025-08-06 11:33:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561885": [
        {
            "ioc_value": "previous-vietnamese.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-29 05:54:58",
            "last_seen_utc": "2025-08-06 11:34:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,nanocore",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561837": [
        {
            "ioc_value": "test111-1302872009.cos.ap-shanghai.myqcloud.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-29 02:48:50",
            "last_seen_utc": "2025-08-29 09:50:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561836": [
        {
            "ioc_value": "edufinder.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-29 02:48:40",
            "last_seen_utc": "2025-09-12 11:49:19",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561835": [
        {
            "ioc_value": "logrecovery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-07-29 01:00:03",
            "last_seen_utc": "2025-08-27 23:48:05",
            "confidence_level": 50,
            "reference": "https://tracker.viriback.com/index.php?q=logrecovery.com",
            "tags": "Amadey,ViriBack",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561765": [
        {
            "ioc_value": "19.34.eva-store.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-28 21:10:37",
            "last_seen_utc": "2025-07-29 13:10:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561705": [
        {
            "ioc_value": "datahog.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:18:16",
            "last_seen_utc": "2025-07-28 18:18:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561706": [
        {
            "ioc_value": "ac7b2eda6f14.datahog.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561707": [
        {
            "ioc_value": "ac7b2eda6f1.datahog.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561708": [
        {
            "ioc_value": "datacrab-analytics.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561709": [
        {
            "ioc_value": "datalytica.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561710": [
        {
            "ioc_value": "dieorsuffer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561711": [
        {
            "ioc_value": "fileservice.gtainside.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561712": [
        {
            "ioc_value": "firebase.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561713": [
        {
            "ioc_value": "smartscreen-api.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:18:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561704": [
        {
            "ioc_value": "ifyouseethisyouareultragay.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.scavenger",
            "malware_alias": "scavenger,SCVNGR,scvngr",
            "malware_printable": "Scavenger",
            "first_seen_utc": "2025-07-28 18:06:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/be917cb379b9622f56a4d5ec93bf00c20cb76c6646e5919690d0f7c09c956de2/",
            "tags": "Scavenger",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561699": [
        {
            "ioc_value": "ak5.ksdcks2.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-28 18:02:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-vbw6naznw6",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561700": [
        {
            "ioc_value": "ak6.ksdcks2.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-28 18:02:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-skqzwsfk5w",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561696": [
        {
            "ioc_value": "notmalicious-29362.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-28 18:01:21",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-rjg5xsyqz3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561692": [
        {
            "ioc_value": "started-brunswick.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-28 18:01:06",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-vggm6azsez",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561693": [
        {
            "ioc_value": "client-unusual.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-28 18:01:06",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-qcv8jaem4s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561656": [
        {
            "ioc_value": "panel.sineramiel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-28 13:37:53",
            "last_seen_utc": "2025-07-28 13:16:11",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114931035960668297",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1561608": [
        {
            "ioc_value": "boxworld.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-28 12:02:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561611": [
        {
            "ioc_value": "resistantmusic.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-28 12:02:09",
            "last_seen_utc": "2025-08-04 19:03:29",
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1561650": [
        {
            "ioc_value": "pavan001-50933.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-28 12:01:33",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-h9kt3awwhx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561640": [
        {
            "ioc_value": "rx.net.eva-store.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-28 11:10:30",
            "last_seen_utc": "2025-07-29 07:41:59",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561574": [
        {
            "ioc_value": "soberano.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-28 08:22:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561575": [
        {
            "ioc_value": "mastwin.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-28 08:22:45",
            "last_seen_utc": "2025-09-22 14:05:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561576": [
        {
            "ioc_value": "precisionbiomeds.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-28 08:22:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561577": [
        {
            "ioc_value": "physicianusepeptides.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-28 08:22:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561578": [
        {
            "ioc_value": "inkermen.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-28 08:22:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561579": [
        {
            "ioc_value": "htsfhtdrjbyy1bgxbv.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-28 08:22:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561600": [
        {
            "ioc_value": "parisforrent.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-28 08:22:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561569": [
        {
            "ioc_value": "wps.preech.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-28 06:05:38",
            "last_seen_utc": "2025-07-28 06:05:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-a7z7zatnw6",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561568": [
        {
            "ioc_value": "board-vitamins.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-28 06:02:16",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-cnmtmstygs",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561566": [
        {
            "ioc_value": "socmer.baoda-mouid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-28 06:01:13",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-c89txahn4s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561564": [
        {
            "ioc_value": "wedding-camps.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-28 06:01:04",
            "last_seen_utc": "2025-07-29 15:49:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-f7da4aaq6z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561565": [
        {
            "ioc_value": "updates-seal.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-28 06:01:04",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250728-fsj54avq14",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561561": [
        {
            "ioc_value": "jazper-21519.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-28 05:53:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561562": [
        {
            "ioc_value": "dfsfdgsfgdsffdsg-20559.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-28 05:53:30",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561268": [
        {
            "ioc_value": "conaqr.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-28 03:05:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,Lumma",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561263": [
        {
            "ioc_value": "maszgn.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-28 03:05:00",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,Lumma",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561492": [
        {
            "ioc_value": "www.coinhunters.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-28 00:01:54",
            "last_seen_utc": "2025-08-18 04:02:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/188.165.209.68+www.coinhunters.xyz",
            "tags": "AS16276,C2,censys,OVH,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561477": [
        {
            "ioc_value": "anselber.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:49:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561476": [
        {
            "ioc_value": "security.flaweregeards.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:49:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561439": [
        {
            "ioc_value": "tyjfide3.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561440": [
        {
            "ioc_value": "udjnbvuw.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561441": [
        {
            "ioc_value": "uefytjd.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561442": [
        {
            "ioc_value": "uejsdnyer.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561443": [
        {
            "ioc_value": "uidjyda.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561444": [
        {
            "ioc_value": "urjvnisa6.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561445": [
        {
            "ioc_value": "usdericx.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561446": [
        {
            "ioc_value": "utjnvsew.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561447": [
        {
            "ioc_value": "utjvmlsq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561448": [
        {
            "ioc_value": "uwksdnio.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561449": [
        {
            "ioc_value": "vf5t6y.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561450": [
        {
            "ioc_value": "vf6y7.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561451": [
        {
            "ioc_value": "vfr61w.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561452": [
        {
            "ioc_value": "vfrj78i.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561453": [
        {
            "ioc_value": "vgh2t6.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561454": [
        {
            "ioc_value": "vgtj6.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561455": [
        {
            "ioc_value": "vgty6.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561456": [
        {
            "ioc_value": "vmriknvf.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561457": [
        {
            "ioc_value": "vne4jsk.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561458": [
        {
            "ioc_value": "vnxmviap.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561459": [
        {
            "ioc_value": "vtg6y.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561460": [
        {
            "ioc_value": "w2ijk9.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561461": [
        {
            "ioc_value": "wfcmskgm.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561462": [
        {
            "ioc_value": "wib7t5.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561463": [
        {
            "ioc_value": "woskfjvi.my",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561464": [
        {
            "ioc_value": "ydhvdbie.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561465": [
        {
            "ioc_value": "yfdnvwik.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561466": [
        {
            "ioc_value": "yfhbvieks.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561467": [
        {
            "ioc_value": "yfr23.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561468": [
        {
            "ioc_value": "yrfjskmc.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561469": [
        {
            "ioc_value": "yrvbhsjni.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561470": [
        {
            "ioc_value": "ythfxkce.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561471": [
        {
            "ioc_value": "zcewmov.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561472": [
        {
            "ioc_value": "zcmevos.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561473": [
        {
            "ioc_value": "znzxfgf.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561474": [
        {
            "ioc_value": "zxvce3wi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561475": [
        {
            "ioc_value": "zzi3t5.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:46",
            "last_seen_utc": "2025-09-09 11:18:18",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561395": [
        {
            "ioc_value": "ned3i8.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561396": [
        {
            "ioc_value": "nfjienks.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561397": [
        {
            "ioc_value": "nhi83.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561398": [
        {
            "ioc_value": "nhj7y2.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561399": [
        {
            "ioc_value": "njnfjdme.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561400": [
        {
            "ioc_value": "nrfusleio.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561401": [
        {
            "ioc_value": "ondjnsye.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561402": [
        {
            "ioc_value": "pckerihvk.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561403": [
        {
            "ioc_value": "pestuy.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561404": [
        {
            "ioc_value": "plcbvisa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561405": [
        {
            "ioc_value": "plceujmd.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561406": [
        {
            "ioc_value": "plskmqz.my",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561407": [
        {
            "ioc_value": "productpros.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561408": [
        {
            "ioc_value": "qafiersv03.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561409": [
        {
            "ioc_value": "qaxy76.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561410": [
        {
            "ioc_value": "qfcjvniwo.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561411": [
        {
            "ioc_value": "qikb7y.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561412": [
        {
            "ioc_value": "qt56u.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561413": [
        {
            "ioc_value": "range23.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561414": [
        {
            "ioc_value": "rdesct.one",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561415": [
        {
            "ioc_value": "rejfnvow.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561416": [
        {
            "ioc_value": "rievposm.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561417": [
        {
            "ioc_value": "rjfnvsp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561418": [
        {
            "ioc_value": "rover23.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561419": [
        {
            "ioc_value": "ruydsjncq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561420": [
        {
            "ioc_value": "sceivrieo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561421": [
        {
            "ioc_value": "sdaxzm.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561422": [
        {
            "ioc_value": "sdhj89.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561423": [
        {
            "ioc_value": "sdn8i9.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561424": [
        {
            "ioc_value": "sdr56t.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561425": [
        {
            "ioc_value": "sdsft3.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561426": [
        {
            "ioc_value": "silo69i.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561427": [
        {
            "ioc_value": "svnek94n.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561428": [
        {
            "ioc_value": "sxt56i.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561429": [
        {
            "ioc_value": "tanstereasy.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561430": [
        {
            "ioc_value": "tebdogm.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561431": [
        {
            "ioc_value": "teefaa.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561432": [
        {
            "ioc_value": "tfjfviowe.my",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561433": [
        {
            "ioc_value": "thdjms13z.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561434": [
        {
            "ioc_value": "tmnvcenc.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561435": [
        {
            "ioc_value": "tredfhyr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561436": [
        {
            "ioc_value": "ttji82f.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561437": [
        {
            "ioc_value": "tvgu83.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561438": [
        {
            "ioc_value": "tybgf.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:45",
            "last_seen_utc": "2025-09-09 11:18:17",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561355": [
        {
            "ioc_value": "iteslawow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561356": [
        {
            "ioc_value": "jdvniwik.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561357": [
        {
            "ioc_value": "jhedt6.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561358": [
        {
            "ioc_value": "jhfneios.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561359": [
        {
            "ioc_value": "jnvdozwz.my",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561360": [
        {
            "ioc_value": "jscniqk3.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561361": [
        {
            "ioc_value": "jvn8kdla.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561362": [
        {
            "ioc_value": "kefheub.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561363": [
        {
            "ioc_value": "kjsoiejrf.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561364": [
        {
            "ioc_value": "kmcjduo.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561365": [
        {
            "ioc_value": "knveuif.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561366": [
        {
            "ioc_value": "kqv15t.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561367": [
        {
            "ioc_value": "ksdjvieoa.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561368": [
        {
            "ioc_value": "ksdvnskle.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561369": [
        {
            "ioc_value": "ksvnieskv.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561370": [
        {
            "ioc_value": "land023.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561371": [
        {
            "ioc_value": "lcmelwp.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561372": [
        {
            "ioc_value": "ldjbfdklkr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561373": [
        {
            "ioc_value": "ldkmfjr.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561374": [
        {
            "ioc_value": "ldvkerije.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561375": [
        {
            "ioc_value": "lenceiwq.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561376": [
        {
            "ioc_value": "lk9o0.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561377": [
        {
            "ioc_value": "lki1o0.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561378": [
        {
            "ioc_value": "ll1i90.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561379": [
        {
            "ioc_value": "loj8u.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561380": [
        {
            "ioc_value": "lwe6t.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561381": [
        {
            "ioc_value": "mail.getintopc.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561382": [
        {
            "ioc_value": "maximumfile.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561383": [
        {
            "ioc_value": "mbfkjgoa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561384": [
        {
            "ioc_value": "media2add.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561385": [
        {
            "ioc_value": "mediabiickyakk.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561386": [
        {
            "ioc_value": "mj2w3.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561387": [
        {
            "ioc_value": "mjnfhsi.my",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561388": [
        {
            "ioc_value": "mvbg6t.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561389": [
        {
            "ioc_value": "mzcheuqa.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561390": [
        {
            "ioc_value": "ncdjv9mc.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561391": [
        {
            "ioc_value": "ncewb8eo.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561392": [
        {
            "ioc_value": "nciwnkwe.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561393": [
        {
            "ioc_value": "ncvibnlee.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561394": [
        {
            "ioc_value": "ndme2w3.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:44",
            "last_seen_utc": "2025-09-09 11:18:16",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561336": [
        {
            "ioc_value": "ewvnewii.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561337": [
        {
            "ioc_value": "fdolspwa.my",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561338": [
        {
            "ioc_value": "feseed.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561339": [
        {
            "ioc_value": "fghyt71.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561340": [
        {
            "ioc_value": "fhvnsio9.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561341": [
        {
            "ioc_value": "filedlx.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561342": [
        {
            "ioc_value": "fsagjkl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561343": [
        {
            "ioc_value": "getintopc.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561344": [
        {
            "ioc_value": "gfrtgt4e.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561345": [
        {
            "ioc_value": "gnviskoe.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561346": [
        {
            "ioc_value": "gt5t6.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561347": [
        {
            "ioc_value": "hamzi1.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561348": [
        {
            "ioc_value": "hbg6.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561349": [
        {
            "ioc_value": "hdvuewvn.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561350": [
        {
            "ioc_value": "hgvndie.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561351": [
        {
            "ioc_value": "hjdmcoq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561352": [
        {
            "ioc_value": "hvmdooe.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561353": [
        {
            "ioc_value": "ijul90i.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561354": [
        {
            "ioc_value": "ikj3f4.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:35:43",
            "last_seen_utc": "2025-09-09 11:18:15",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561320": [
        {
            "ioc_value": "cxi876.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561321": [
        {
            "ioc_value": "cxwivnwf.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561322": [
        {
            "ioc_value": "dbcyiwk.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561323": [
        {
            "ioc_value": "dceivkso.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561324": [
        {
            "ioc_value": "defsds.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561325": [
        {
            "ioc_value": "deokgi0q.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561326": [
        {
            "ioc_value": "dfuiue1.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561327": [
        {
            "ioc_value": "diskaz.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561328": [
        {
            "ioc_value": "djkdsloja.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561329": [
        {
            "ioc_value": "downloadertop.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561330": [
        {
            "ioc_value": "dtui9.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561331": [
        {
            "ioc_value": "edlp0.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561332": [
        {
            "ioc_value": "ejfirkod.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561333": [
        {
            "ioc_value": "eklzmwo.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561334": [
        {
            "ioc_value": "enjoysetup.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561335": [
        {
            "ioc_value": "erkmfdej.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561300": [
        {
            "ioc_value": "akm92.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561301": [
        {
            "ioc_value": "alfeinvceo.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561302": [
        {
            "ioc_value": "amceowlq.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561303": [
        {
            "ioc_value": "arvskmow.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561304": [
        {
            "ioc_value": "asrt67.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561305": [
        {
            "ioc_value": "avmerojhl.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561306": [
        {
            "ioc_value": "avmrogld.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561307": [
        {
            "ioc_value": "b6y79i.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561308": [
        {
            "ioc_value": "babassd.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561309": [
        {
            "ioc_value": "baev56.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561310": [
        {
            "ioc_value": "bbi87.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561311": [
        {
            "ioc_value": "bnc4gs.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561312": [
        {
            "ioc_value": "bncbjdo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561313": [
        {
            "ioc_value": "bosserxx.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561314": [
        {
            "ioc_value": "btfkdeds.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561315": [
        {
            "ioc_value": "bvuewkc.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561316": [
        {
            "ioc_value": "bvuwjksd.cloud",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561317": [
        {
            "ioc_value": "cceedds.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561318": [
        {
            "ioc_value": "cd4r5.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561319": [
        {
            "ioc_value": "cdfjels.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:32:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561297": [
        {
            "ioc_value": "aeyfjieo.cfd",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:28:49",
            "last_seen_utc": "2025-07-27 21:32:58",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561298": [
        {
            "ioc_value": "afgtbiickyakk.cc",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:28:49",
            "last_seen_utc": "2025-07-27 21:32:58",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561299": [
        {
            "ioc_value": "aklm71.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:28:49",
            "last_seen_utc": "2025-07-27 21:32:58",
            "confidence_level": 100,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561296": [
        {
            "ioc_value": "adgy6y.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561295": [
        {
            "ioc_value": "ad4r5.link",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561294": [
        {
            "ioc_value": "aaxsd.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:18:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561293": [
        {
            "ioc_value": "1ilov6.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:18:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561292": [
        {
            "ioc_value": "1aa2t.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 21:17:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561250": [
        {
            "ioc_value": "lol.0x504.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-27 19:25:53",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,mirai",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1561251": [
        {
            "ioc_value": "botnet.iris-security.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-27 19:25:53",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,mirai",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1561252": [
        {
            "ioc_value": "api.hammz.kapakhost.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-27 19:25:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,mirai",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1561249": [
        {
            "ioc_value": "www.ddos678.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-27 19:25:20",
            "last_seen_utc": "2025-08-15 12:13:12",
            "confidence_level": 100,
            "reference": "",
            "tags": "censys,Mirai",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1561242": [
        {
            "ioc_value": "electronics-peaceful.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 18:01:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-vjxgdszxdv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561244": [
        {
            "ioc_value": "database-bio.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 18:01:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-vffdpszwf1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561239": [
        {
            "ioc_value": "release-deficit.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 18:01:08",
            "last_seen_utc": "2025-07-29 15:49:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-v9g5dscr5w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561240": [
        {
            "ioc_value": "n-colony.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 18:01:08",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-v31yxscq6t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561241": [
        {
            "ioc_value": "between-tank.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 18:01:08",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-v3ze4acq6s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561235": [
        {
            "ioc_value": "british-perfectly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 16:54:23",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561231": [
        {
            "ioc_value": "brycedice0904-24065.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-27 16:53:28",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561232": [
        {
            "ioc_value": "doneloby12131-39622.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-27 16:53:28",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561233": [
        {
            "ioc_value": "xenquz-46850.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-27 16:53:28",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1561168": [
        {
            "ioc_value": "www.expects-crucial-pest-bubble.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-27 12:48:42",
            "last_seen_utc": "2025-08-28 09:50:54",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561163": [
        {
            "ioc_value": "mail.letlama.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-27 12:01:34",
            "last_seen_utc": "2025-07-28 04:00:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/102.209.118.14+mail.letlama.com",
            "tags": "AS329184,C2,censys,Havoc,Host-Africa-AS2",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561159": [
        {
            "ioc_value": "Mareczek123-27222.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 12:00:56",
            "last_seen_utc": "2025-07-29 15:49:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-j1bepswpz9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561136": [
        {
            "ioc_value": "smp.rodeo",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 08:02:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561137": [
        {
            "ioc_value": "xurekodip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 08:02:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561138": [
        {
            "ioc_value": "utvp1.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 08:02:20",
            "last_seen_utc": "2025-08-03 15:57:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561139": [
        {
            "ioc_value": "orienderi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 08:02:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561037": [
        {
            "ioc_value": "thinkrz.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 06:58:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561038": [
        {
            "ioc_value": "integkr.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 06:58:13",
            "last_seen_utc": "2025-07-27 20:42:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561041": [
        {
            "ioc_value": "paramkc.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 06:58:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561039": [
        {
            "ioc_value": "aspecqo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 06:58:11",
            "last_seen_utc": "2025-07-27 20:37:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561042": [
        {
            "ioc_value": "severhi.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 06:58:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561045": [
        {
            "ioc_value": "emageuv.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 06:58:04",
            "last_seen_utc": "2025-10-10 22:24:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561043": [
        {
            "ioc_value": "emapsho.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 06:58:03",
            "last_seen_utc": "2025-10-10 22:24:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561044": [
        {
            "ioc_value": "firiaer.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 06:58:02",
            "last_seen_utc": "2025-10-10 22:24:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561046": [
        {
            "ioc_value": "orekcee.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-27 06:58:02",
            "last_seen_utc": "2025-10-10 22:24:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1561101": [
        {
            "ioc_value": "snjofxs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-27 06:58:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/154.64.245.15+snjofxs.top",
            "tags": "AS979,C2,censys,NETLAB-SDN",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1561108": [
        {
            "ioc_value": "tswelo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-27 06:57:58",
            "last_seen_utc": "2025-07-27 04:01:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/102.209.118.14+tswelo.com",
            "tags": "AS329184,C2,censys,Host-Africa-AS2",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1561106": [
        {
            "ioc_value": "recleau.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 06:57:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/204.48.22.24+recleau.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1561060": [
        {
            "ioc_value": "paxrobot.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-27 06:57:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/7dcd76789f0855c1cbc885ddbe02671d4a5045de157be764a59aec4eff4da420/",
            "tags": "CyberStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1561061": [
        {
            "ioc_value": "cyberdarkduck.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-27 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/7dcd76789f0855c1cbc885ddbe02671d4a5045de157be764a59aec4eff4da420/",
            "tags": "CyberStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1561062": [
        {
            "ioc_value": "security.floiregwaqrd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 06:57:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561063": [
        {
            "ioc_value": "cekipolen.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-27 06:57:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1561117": [
        {
            "ioc_value": "ip70-176-149-88.ph.ph.cox.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.qakbot",
            "malware_alias": "Oakboat,Pinkslipbot,Qbot,Quakbot",
            "malware_printable": "QakBot",
            "first_seen_utc": "2025-07-27 06:57:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/70.176.149.88+ip70-176-149-88.ph.ph.cox.net",
            "tags": "AS22773,ASN-CXA-ALL-CCI-22773-RDC,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1561132": [
        {
            "ioc_value": "svhosted.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-27 06:01:22",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-btk2kaeq3y",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561124": [
        {
            "ioc_value": "is-gas.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 06:01:05",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-e6l16svqy2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561125": [
        {
            "ioc_value": "nov-transport.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 06:01:05",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-eh8j9svqv6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561126": [
        {
            "ioc_value": "realdot.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-27 06:01:05",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250727-amvrraem6y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561081": [
        {
            "ioc_value": "xt.dev.review.technology",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-26 23:10:28",
            "last_seen_utc": "2025-07-28 10:11:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561030": [
        {
            "ioc_value": "dns2.fjhfkjgfoufruyduyd.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-26 18:49:16",
            "last_seen_utc": "2025-07-30 17:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561029": [
        {
            "ioc_value": "dns1.fjhfkjgfoufruyduyd.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-26 18:49:15",
            "last_seen_utc": "2025-07-30 17:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561023": [
        {
            "ioc_value": "helpfandaven.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-07-26 18:05:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "HijackLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561022": [
        {
            "ioc_value": "ploatvoatin.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-26 18:05:40",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/9a1a07caef95485ed3b67cee28cd179755ae10003978601bf3173c31ea5b603b/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561021": [
        {
            "ioc_value": "floataboat.strangled.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-26 18:05:39",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/9a1a07caef95485ed3b67cee28cd179755ae10003978601bf3173c31ea5b603b/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1561013": [
        {
            "ioc_value": "ethefi.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-26 18:03:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1561020": [
        {
            "ioc_value": "hawla2016.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-26 18:02:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-whklwaar2s",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561017": [
        {
            "ioc_value": "updateservice.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-26 18:02:03",
            "last_seen_utc": "2025-08-06 11:34:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-q6gx1azl17",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561018": [
        {
            "ioc_value": "ccc1qarush1ccc.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-26 18:02:03",
            "last_seen_utc": "2025-08-06 11:34:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-r414jahm9s",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1561014": [
        {
            "ioc_value": "uku8541.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-26 18:01:39",
            "last_seen_utc": "2025-07-26 18:01:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-v94nds1ps5",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560994": [
        {
            "ioc_value": "kingmalkawe8.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-26 18:01:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-wjvhga11fy",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560941": [
        {
            "ioc_value": "learn-springfield.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-26 18:01:09",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-v6r57aap6v",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560942": [
        {
            "ioc_value": "vpn-vds22.eleos.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-26 18:01:09",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-q76yhszmt2",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560940": [
        {
            "ioc_value": "states-jc.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-26 18:00:53",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-vlqfvs1mx9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560911": [
        {
            "ioc_value": "ossyqztest.oss-cn-beijing.aliyuncs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-26 12:49:33",
            "last_seen_utc": "2025-08-26 19:49:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560910": [
        {
            "ioc_value": "cioud.nsebseshop.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-26 12:49:21",
            "last_seen_utc": "2025-08-28 09:50:34",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560905": [
        {
            "ioc_value": "vigorous-vaughan.206-123-128-81.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-26 12:01:23",
            "last_seen_utc": "2025-07-27 04:00:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/206.123.128.81+vigorous-vaughan.206-123-128-81.plesk.page",
            "tags": "AS207184,C2,censys,Hookbot,TELCHAK-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560903": [
        {
            "ioc_value": "mosasil583-48581.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-26 12:01:01",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-nt3b3ay1dy",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560902": [
        {
            "ioc_value": "existing-vincent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-26 12:00:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-kw74jsyxbs",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560899": [
        {
            "ioc_value": "ds.web.review.technology",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-26 11:10:33",
            "last_seen_utc": "2025-07-28 06:06:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560892": [
        {
            "ioc_value": "cousmf.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-26 08:35:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560893": [
        {
            "ioc_value": "sabrkqw.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-26 08:35:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560891": [
        {
            "ioc_value": "rndge-2a00-102a-506d-54c6-34d9-4f5e-8f2a-2e91.a.free.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-26 08:33:14",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560889": [
        {
            "ioc_value": "lms-austria.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-26 08:32:37",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560890": [
        {
            "ioc_value": "wormoni.lms-austria.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-26 08:32:37",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560888": [
        {
            "ioc_value": "darkcomet777rat.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-26 08:32:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560745": [
        {
            "ioc_value": "security.flekergauuard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-26 06:54:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560746": [
        {
            "ioc_value": "perxilox.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-26 06:54:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560791": [
        {
            "ioc_value": "dhcp-150-193-129-5.metro86.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-26 06:54:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/5.129.193.150+dhcp-150-193-129-5.metro86.ru",
            "tags": "AS9123,C2,censys,TIMEWEB-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1560827": [
        {
            "ioc_value": "art-infinite.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-26 06:01:38",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-avp68sbp6x",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560824": [
        {
            "ioc_value": "pabla102102.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-26 06:01:04",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-fmb8asdn4s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560823": [
        {
            "ioc_value": "hyteras.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-26 06:00:57",
            "last_seen_utc": "2025-08-13 14:51:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-env65awmx6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560818": [
        {
            "ioc_value": "graphics-discussions.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-26 06:00:52",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-ffth1adl61",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560819": [
        {
            "ioc_value": "carolina-collections.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-26 06:00:52",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-dchafscl3w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560820": [
        {
            "ioc_value": "there-prozac.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-26 06:00:52",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-ddqcfswkx8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560821": [
        {
            "ioc_value": "sixx.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-26 06:00:52",
            "last_seen_utc": "2025-07-29 15:49:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-awcyasbp8s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560822": [
        {
            "ioc_value": "body-conclusion.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-26 06:00:52",
            "last_seen_utc": "2025-07-31 20:17:54",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-awc83abp8t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560817": [
        {
            "ioc_value": "fpvxzvrzz-58282.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-26 06:00:51",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250726-fvtsbaxwew",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560786": [
        {
            "ioc_value": "web.vnpti.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-26 02:48:47",
            "last_seen_utc": "2025-08-29 11:50:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560785": [
        {
            "ioc_value": "5ndg65b68274v.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-26 02:48:29",
            "last_seen_utc": "2025-12-14 11:48:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560708": [
        {
            "ioc_value": "1318387972-34ie6xy56d.ap-guangzhou.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-25 18:48:28",
            "last_seen_utc": "2025-08-26 19:49:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560701": [
        {
            "ioc_value": "parischor.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-25 18:00:57",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250725-wcczvasyew",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560702": [
        {
            "ioc_value": "private.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-25 18:00:57",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250725-pm3vpazzbz",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560700": [
        {
            "ioc_value": "officedesk.4nmn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-25 18:00:51",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250725-ssdpjassgz",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560698": [
        {
            "ioc_value": "survey-push.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-25 18:00:46",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250725-smaqpa1p14",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560692": [
        {
            "ioc_value": "intanschools.py628fxjlk-gok67gvk2652.p.temp-site.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-25 16:45:12",
            "last_seen_utc": "2025-10-01 07:28:27",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560684": [
        {
            "ioc_value": "net1.willomane.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-25 16:01:23",
            "last_seen_utc": "2025-07-26 04:00:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/167.86.110.155+net1.willomane.com",
            "tags": "AS51167,C2,censys,CONTABO,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560642": [
        {
            "ioc_value": "app.dessertshouse.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-25 15:43:17",
            "last_seen_utc": "2025-07-25 13:16:07",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114914035457390826",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1560677": [
        {
            "ioc_value": "ch36efcnia2ct5.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-25 15:23:39",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560678": [
        {
            "ioc_value": "cya8dfhb72hbgc2.dedyn.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-25 15:23:39",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560675": [
        {
            "ioc_value": "www.basetitanuim.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-25 15:23:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560676": [
        {
            "ioc_value": "www.mvchase.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-25 15:23:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560640": [
        {
            "ioc_value": "vericloudz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-25 13:05:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560641": [
        {
            "ioc_value": "mybugyoyayakilith.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-25 13:05:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560621": [
        {
            "ioc_value": "vrfycloudx.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-25 12:24:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560620": [
        {
            "ioc_value": "vericloudx.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-25 12:24:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560633": [
        {
            "ioc_value": "www.dombracht.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-25 12:02:17",
            "last_seen_utc": "2025-07-26 04:00:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/80.149.60.140+www.dombracht.de",
            "tags": "AS3320,C2,censys,DTAG,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560628": [
        {
            "ioc_value": "lost.baoda-mouid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-25 12:01:29",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250725-lr8d7acq2v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560626": [
        {
            "ioc_value": "year-mental.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-25 12:01:17",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250725-mqtebacr81",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560625": [
        {
            "ioc_value": "line-pressing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-25 12:01:12",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250725-n2krzszxav",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560614": [
        {
            "ioc_value": "web.sparkfunding56.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-25 10:49:21",
            "last_seen_utc": "2025-08-25 13:50:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560613": [
        {
            "ioc_value": "timestamp.logogogogo.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-25 10:49:20",
            "last_seen_utc": "2025-12-14 11:48:17",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560612": [
        {
            "ioc_value": "cnd.baiidu.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-25 10:49:06",
            "last_seen_utc": "2025-09-06 13:49:40",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560608": [
        {
            "ioc_value": "log-bi.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-25 10:20:17",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560588": [
        {
            "ioc_value": "nortlmm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 09:20:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560589": [
        {
            "ioc_value": "molefkx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 09:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560590": [
        {
            "ioc_value": "sponfht.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 09:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560591": [
        {
            "ioc_value": "runuxs.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 09:20:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560592": [
        {
            "ioc_value": "follcp.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 09:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560593": [
        {
            "ioc_value": "remotuw.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 09:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560594": [
        {
            "ioc_value": "boltex.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 09:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560595": [
        {
            "ioc_value": "detrewb.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 09:20:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560596": [
        {
            "ioc_value": "berijng.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 09:20:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560587": [
        {
            "ioc_value": "mx.smtp.review.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-25 08:16:06",
            "last_seen_utc": "2025-07-28 06:06:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560569": [
        {
            "ioc_value": "neocskfj.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 07:36:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560568": [
        {
            "ioc_value": "pulsarrr-33300.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-25 07:32:46",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560567": [
        {
            "ioc_value": "procesosnew07.mysynology.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-25 07:32:30",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560566": [
        {
            "ioc_value": "heheszon-32961.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-25 07:32:14",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560565": [
        {
            "ioc_value": "inspector.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-25 07:31:44",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560527": [
        {
            "ioc_value": "ceb2069bc35e64.lhr.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-07-25 06:03:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250725-a4c82afr2v",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560522": [
        {
            "ioc_value": "facilities-queen.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-25 06:01:03",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250725-eg1g9swwds",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560428": [
        {
            "ioc_value": "perpenab.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 05:20:25",
            "last_seen_utc": "2025-10-10 22:26:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560429": [
        {
            "ioc_value": "onyxistn.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 05:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560431": [
        {
            "ioc_value": "keulkgl.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-25 05:20:24",
            "last_seen_utc": "2025-10-10 22:24:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560441": [
        {
            "ioc_value": "passoverstruck.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-25 05:20:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560456": [
        {
            "ioc_value": "vericloudix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-25 05:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560457": [
        {
            "ioc_value": "veriqcloud.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-25 05:20:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560462": [
        {
            "ioc_value": "analyticssnoden.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-25 05:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560463": [
        {
            "ioc_value": "security.flioreshielld.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-25 05:20:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560464": [
        {
            "ioc_value": "homsertip.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-25 05:20:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560491": [
        {
            "ioc_value": "ecs-1-94-134-161.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-25 05:20:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/1.94.134.161+ecs-1-94-134-161.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1560497": [
        {
            "ioc_value": "ec2-35-180-234-10.eu-west-3.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-25 04:01:36",
            "last_seen_utc": "2025-07-25 04:02:22",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/35.180.234.10+ec2-35-180-234-10.eu-west-3.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560474": [
        {
            "ioc_value": "pasttslv.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-25 00:01:26",
            "last_seen_utc": "2025-07-25 04:02:09",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.80.35+pasttslv.click",
            "tags": "AS401120,C2,censys,CHEAPY-HOST,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560461": [
        {
            "ioc_value": "choice.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-24 20:35:33",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/eae91659bc30a6b892103edcf6aeab1a8bd07967f69bc840c35a5209aaf2f68a/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560436": [
        {
            "ioc_value": "fadingannk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-07-24 18:05:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-waa3gabp6x",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560432": [
        {
            "ioc_value": "anasofia.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-24 18:01:43",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-s76c4a1shw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560430": [
        {
            "ioc_value": "released-domain.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-24 18:01:10",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-syq7taz1ht",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560423": [
        {
            "ioc_value": "xx.fu.review.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-24 17:10:29",
            "last_seen_utc": "2025-07-25 07:12:47",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560420": [
        {
            "ioc_value": "test.livepanel.pw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-24 16:43:08",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560344": [
        {
            "ioc_value": "files.businessmondo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-24 16:21:32",
            "last_seen_utc": "2025-07-24 13:16:14",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114908374774857589",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1560348": [
        {
            "ioc_value": "charigelly.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560350": [
        {
            "ioc_value": "ff-exchange.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560349": [
        {
            "ioc_value": "ff-exchange.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560352": [
        {
            "ioc_value": "ff-exchange.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560351": [
        {
            "ioc_value": "ff-exchange.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560353": [
        {
            "ioc_value": "simpleswap.name",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560354": [
        {
            "ioc_value": "slmpleswap.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:27",
            "last_seen_utc": "2025-10-01 21:27:08",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560355": [
        {
            "ioc_value": "cosmochanger.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560356": [
        {
            "ioc_value": "simpieswap.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560357": [
        {
            "ioc_value": "charigelly.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560358": [
        {
            "ioc_value": "simpieswap.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560360": [
        {
            "ioc_value": "charigelly.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560359": [
        {
            "ioc_value": "changenovv.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560361": [
        {
            "ioc_value": "my-exodus.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560362": [
        {
            "ioc_value": "chn-gnow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560364": [
        {
            "ioc_value": "simpleswapweb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560363": [
        {
            "ioc_value": "tr0n.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560365": [
        {
            "ioc_value": "hop-exchange.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560368": [
        {
            "ioc_value": "sushiswap-v2.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560366": [
        {
            "ioc_value": "supereform.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560367": [
        {
            "ioc_value": "aml-checknow.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560369": [
        {
            "ioc_value": "zh-imtoken.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560370": [
        {
            "ioc_value": "wallet-syncing.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:21:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1560394": [
        {
            "ioc_value": "bestproductreviews.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-24 16:21:07",
            "last_seen_utc": "2025-07-24 15:46:26",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114908985924706243",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1560397": [
        {
            "ioc_value": "curemile.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-24 16:21:05",
            "last_seen_utc": "2025-07-24 15:46:30",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114908985924706243",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1560410": [
        {
            "ioc_value": "derppyderpponline.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 16:02:06",
            "last_seen_utc": "2025-07-25 04:02:49",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.94.96.72+derppyderpponline.win",
            "tags": "AS207184,C2,censys,panel,TELCHAK-AS,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560390": [
        {
            "ioc_value": "www.alfapetroluems.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-24 14:58:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560391": [
        {
            "ioc_value": "www.asttoria-trade.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-24 14:58:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560373": [
        {
            "ioc_value": "arewa.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-24 14:25:29",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/e8498d0da81709f85aaebde268ce87ba1a8f9cdcda8143688225b75fedd01259/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560336": [
        {
            "ioc_value": "spain-posters.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-24 12:01:32",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-gbe1gsfp51",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560323": [
        {
            "ioc_value": "biotec-imc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-24 12:00:52",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-nh7seawzgt",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560324": [
        {
            "ioc_value": "kreon.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-24 12:00:52",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-nh7seawzgt",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560315": [
        {
            "ioc_value": "siltapl.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 11:23:39",
            "last_seen_utc": "2025-10-10 22:24:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560316": [
        {
            "ioc_value": "potosuz.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 11:23:39",
            "last_seen_utc": "2025-10-10 22:24:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560317": [
        {
            "ioc_value": "wagnvp.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 11:23:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560272": [
        {
            "ioc_value": "royaltbn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:44:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560273": [
        {
            "ioc_value": "columnez.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:44:43",
            "last_seen_utc": "2025-10-10 22:26:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560274": [
        {
            "ioc_value": "mixp.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:44:43",
            "last_seen_utc": "2025-10-10 22:26:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560275": [
        {
            "ioc_value": "woodenso.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:44:42",
            "last_seen_utc": "2025-10-10 22:26:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560276": [
        {
            "ioc_value": "foundrr.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:44:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560277": [
        {
            "ioc_value": "nanoceus.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:44:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1560310": [
        {
            "ioc_value": "linejjer.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560311": [
        {
            "ioc_value": "porzxgnw.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560312": [
        {
            "ioc_value": "lysandjkd.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560313": [
        {
            "ioc_value": "bumpegq.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560304": [
        {
            "ioc_value": "cosopwx.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560305": [
        {
            "ioc_value": "ellexb.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560306": [
        {
            "ioc_value": "dogtrgc.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560307": [
        {
            "ioc_value": "podhxwf.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560308": [
        {
            "ioc_value": "potppfu.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560309": [
        {
            "ioc_value": "tranfex.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560294": [
        {
            "ioc_value": "genuygpa.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560295": [
        {
            "ioc_value": "idioigsa.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560296": [
        {
            "ioc_value": "exponxb.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560297": [
        {
            "ioc_value": "profityd.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560298": [
        {
            "ioc_value": "tefere.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560299": [
        {
            "ioc_value": "mesovti.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560300": [
        {
            "ioc_value": "trainaj.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560301": [
        {
            "ioc_value": "oesopt.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560302": [
        {
            "ioc_value": "superuu.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560303": [
        {
            "ioc_value": "unswqik.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560290": [
        {
            "ioc_value": "eintek.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560291": [
        {
            "ioc_value": "raincazn.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:04",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560292": [
        {
            "ioc_value": "hardexbo.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560293": [
        {
            "ioc_value": "siluriyt.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560282": [
        {
            "ioc_value": "agrevpud.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560283": [
        {
            "ioc_value": "carptrvo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:03",
            "last_seen_utc": "2025-09-10 08:31:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560284": [
        {
            "ioc_value": "conaarl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560285": [
        {
            "ioc_value": "religxp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560286": [
        {
            "ioc_value": "frowjyx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:03",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560287": [
        {
            "ioc_value": "hobbcxez.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560288": [
        {
            "ioc_value": "grateb.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560289": [
        {
            "ioc_value": "charuhd.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560278": [
        {
            "ioc_value": "eliminhd.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:02",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560279": [
        {
            "ioc_value": "sheddeuh.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:02",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560280": [
        {
            "ioc_value": "blegekei.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:02",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560281": [
        {
            "ioc_value": "newyorwr.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 09:19:02",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560259": [
        {
            "ioc_value": "expressapiwizard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-24 07:40:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560258": [
        {
            "ioc_value": "wppanel.icu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-24 07:25:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdates",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560257": [
        {
            "ioc_value": "pallvlxl.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 06:43:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560256": [
        {
            "ioc_value": "machine-resume.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-24 06:42:52",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560255": [
        {
            "ioc_value": "know-damages.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-24 06:42:28",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560253": [
        {
            "ioc_value": "narrowfemboy.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-24 06:42:01",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1560158": [
        {
            "ioc_value": "security.flaversegaurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 06:28:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560159": [
        {
            "ioc_value": "kacivoped.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 06:28:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1560164": [
        {
            "ioc_value": "wndlogon.itemdb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-24 06:28:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/tag/WinSilc/",
            "tags": "WinSilc",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1560163": [
        {
            "ioc_value": "wndlogon.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-24 06:28:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/tag/WinSilc/",
            "tags": "WinSilc",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1559854": [
        {
            "ioc_value": "delfxus.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 06:28:44",
            "last_seen_utc": "2025-10-10 22:26:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559855": [
        {
            "ioc_value": "jambnwz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 06:28:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559856": [
        {
            "ioc_value": "sparklfm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-24 06:28:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559846": [
        {
            "ioc_value": "app.kefel.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spica",
            "malware_alias": null,
            "malware_printable": "SPICA",
            "first_seen_utc": "2025-07-24 06:28:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://medium.com/@knownascipher/kefel-io-friends-coldriver-c-c-infrastructure-report-84aa041b141a",
            "tags": "APK,APT,C2,CryptoScam,EXE,FakeCryptoDashboard,Fast-Flux,NodeJS,PQ-Hosting,RussianAPT,SSLReuse",
            "anonymous": "0",
            "reporter": "akaCipher"
        }
    ],
    "1559847": [
        {
            "ioc_value": "428d09ca103d2593e3555304a2862f873c70ca7d",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spica",
            "malware_alias": null,
            "malware_printable": "SPICA",
            "first_seen_utc": "2025-07-24 06:28:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://medium.com/@knownascipher/kefel-io-friends-coldriver-c-c-infrastructure-report-84aa041b141a",
            "tags": "APK,APT,C2,CryptoScam,EXE,FakeCryptoDashboard,Fast-Flux,NodeJS,PQ-Hosting,RussianAPT,SSLReuse",
            "anonymous": "0",
            "reporter": "akaCipher"
        }
    ],
    "1559844": [
        {
            "ioc_value": "s3.kefel.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spica",
            "malware_alias": null,
            "malware_printable": "SPICA",
            "first_seen_utc": "2025-07-24 06:28:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://medium.com/@knownascipher/kefel-io-friends-coldriver-c-c-infrastructure-report-84aa041b141a",
            "tags": "APK,APT,C2,CryptoScam,EXE,FakeCryptoDashboard,Fast-Flux,NodeJS,PQ-Hosting,RussianAPT,SSLReuse",
            "anonymous": "0",
            "reporter": "akaCipher"
        }
    ],
    "1559845": [
        {
            "ioc_value": "s4.kefel.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spica",
            "malware_alias": null,
            "malware_printable": "SPICA",
            "first_seen_utc": "2025-07-24 06:28:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://medium.com/@knownascipher/kefel-io-friends-coldriver-c-c-infrastructure-report-84aa041b141a",
            "tags": "APK,APT,C2,CryptoScam,EXE,FakeCryptoDashboard,Fast-Flux,NodeJS,PQ-Hosting,RussianAPT,SSLReuse",
            "anonymous": "0",
            "reporter": "akaCipher"
        }
    ],
    "1559843": [
        {
            "ioc_value": "s2.kefel.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spica",
            "malware_alias": null,
            "malware_printable": "SPICA",
            "first_seen_utc": "2025-07-24 06:28:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://medium.com/@knownascipher/kefel-io-friends-coldriver-c-c-infrastructure-report-84aa041b141a",
            "tags": "APK,APT,C2,CryptoScam,EXE,FakeCryptoDashboard,Fast-Flux,NodeJS,PQ-Hosting,RussianAPT,SSLReuse",
            "anonymous": "0",
            "reporter": "akaCipher"
        }
    ],
    "1559842": [
        {
            "ioc_value": "s1.kefel.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spica",
            "malware_alias": null,
            "malware_printable": "SPICA",
            "first_seen_utc": "2025-07-24 06:28:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://medium.com/@knownascipher/kefel-io-friends-coldriver-c-c-infrastructure-report-84aa041b141a",
            "tags": "APK,APT,C2,CryptoScam,EXE,FakeCryptoDashboard,Fast-Flux,NodeJS,PQ-Hosting,RussianAPT,SSLReuse",
            "anonymous": "0",
            "reporter": "akaCipher"
        }
    ],
    "1559840": [
        {
            "ioc_value": "kefel.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spica",
            "malware_alias": null,
            "malware_printable": "SPICA",
            "first_seen_utc": "2025-07-24 06:28:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://medium.com/@knownascipher/kefel-io-friends-coldriver-c-c-infrastructure-report-84aa041b141a",
            "tags": "APK,APT,C2,CryptoScam,EXE,FakeCryptoDashboard,Fast-Flux,NodeJS,PQ-Hosting,RussianAPT,SSLReuse",
            "anonymous": "0",
            "reporter": "akaCipher"
        }
    ],
    "1559841": [
        {
            "ioc_value": "kefel.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spica",
            "malware_alias": null,
            "malware_printable": "SPICA",
            "first_seen_utc": "2025-07-24 06:28:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://medium.com/@knownascipher/kefel-io-friends-coldriver-c-c-infrastructure-report-84aa041b141a",
            "tags": "APK,APT,C2,CryptoScam,EXE,FakeCryptoDashboard,Fast-Flux,NodeJS,PQ-Hosting,RussianAPT,SSLReuse",
            "anonymous": "0",
            "reporter": "akaCipher"
        }
    ],
    "1560229": [
        {
            "ioc_value": "board-promotes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-24 06:06:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-b16xlsek4x",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560225": [
        {
            "ioc_value": "video-trinity.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-24 06:02:23",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-b556waek6y",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560223": [
        {
            "ioc_value": "ansy2307.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-24 06:01:50",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-c78v8atrt9",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560222": [
        {
            "ioc_value": "l-integrate.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-24 06:01:13",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250724-d8a61ser5w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560199": [
        {
            "ioc_value": "ec2-34-219-119-143.us-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-24 04:03:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.219.119.143+ec2-34-219-119-143.us-west-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1560190": [
        {
            "ioc_value": "fast.mirzazizo.https443.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-24 04:01:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/85.239.55.40+fast.mirzazizo.https443.net",
            "tags": "AS62005,BV-EU-AS,C2,censys,RAT,SpiceRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560185": [
        {
            "ioc_value": "bxmv1taxbxr8p.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-24 02:48:49",
            "last_seen_utc": "2025-12-14 11:48:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560183": [
        {
            "ioc_value": "main.db.review.digital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-24 01:10:29",
            "last_seen_utc": "2025-07-24 16:10:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "5%563,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1560169": [
        {
            "ioc_value": "accounts.secure-verifications.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-24 00:01:42",
            "last_seen_utc": "2025-07-24 04:03:24",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.86.84.43+accounts.secure-verifications.es",
            "tags": "AS14956,C2,censys,Havoc,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560142": [
        {
            "ioc_value": "23-92-20-65.ip.linodeusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-23 20:02:04",
            "last_seen_utc": "2025-07-24 04:03:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.92.20.65+23-92-20-65.ip.linodeusercontent.com",
            "tags": "AKAMAI-LINODE-AP,AS63949,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1560101": [
        {
            "ioc_value": "bedazq.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560102": [
        {
            "ioc_value": "tonmtq.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560103": [
        {
            "ioc_value": "moxqk.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560104": [
        {
            "ioc_value": "deaoee.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560105": [
        {
            "ioc_value": "unfjbw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560106": [
        {
            "ioc_value": "retailrakkbakk.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560107": [
        {
            "ioc_value": "ftgoiv.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560108": [
        {
            "ioc_value": "ngbmrq.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560109": [
        {
            "ioc_value": "baemdk.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560110": [
        {
            "ioc_value": "hylyzb.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560098": [
        {
            "ioc_value": "beqeowc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:56",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560099": [
        {
            "ioc_value": "turnick.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:56",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560092": [
        {
            "ioc_value": "pinywpc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560095": [
        {
            "ioc_value": "escgzk.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560096": [
        {
            "ioc_value": "textmastery.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560097": [
        {
            "ioc_value": "lumma-market.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560091": [
        {
            "ioc_value": "reckdp.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:54",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560081": [
        {
            "ioc_value": "defvj.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:53",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560083": [
        {
            "ioc_value": "electr.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:53",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560079": [
        {
            "ioc_value": "gennqut.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:52",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560080": [
        {
            "ioc_value": "mispiqad.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:52",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560075": [
        {
            "ioc_value": "advancednodefx.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:51",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560077": [
        {
            "ioc_value": "heartny.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:51",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560072": [
        {
            "ioc_value": "skincee.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:49",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560065": [
        {
            "ioc_value": "fayebbc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560066": [
        {
            "ioc_value": "bcjpdb.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560067": [
        {
            "ioc_value": "clarazx.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560068": [
        {
            "ioc_value": "chartri.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560069": [
        {
            "ioc_value": "cgsgwl.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560070": [
        {
            "ioc_value": "batrj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560071": [
        {
            "ioc_value": "ajuyn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560045": [
        {
            "ioc_value": "bqeto.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560046": [
        {
            "ioc_value": "atlakhv.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560047": [
        {
            "ioc_value": "butmxy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560048": [
        {
            "ioc_value": "atqgz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560049": [
        {
            "ioc_value": "teextes.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560050": [
        {
            "ioc_value": "sublimv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560051": [
        {
            "ioc_value": "sndemam.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560052": [
        {
            "ioc_value": "siiqga.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560053": [
        {
            "ioc_value": "siewcl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560054": [
        {
            "ioc_value": "sanitfy.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560055": [
        {
            "ioc_value": "saawzig.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560056": [
        {
            "ioc_value": "plnnozg.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560057": [
        {
            "ioc_value": "pledgxe.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560058": [
        {
            "ioc_value": "misco.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560059": [
        {
            "ioc_value": "joylyzv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560060": [
        {
            "ioc_value": "hovve.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560061": [
        {
            "ioc_value": "ligwkv.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560062": [
        {
            "ioc_value": "aperojk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560063": [
        {
            "ioc_value": "hakyjq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560064": [
        {
            "ioc_value": "fflxah.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:47",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560024": [
        {
            "ioc_value": "banirv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560025": [
        {
            "ioc_value": "alooi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560026": [
        {
            "ioc_value": "aczpy.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560027": [
        {
            "ioc_value": "utiavg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560028": [
        {
            "ioc_value": "ungqnh.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560029": [
        {
            "ioc_value": "rictbxt.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560030": [
        {
            "ioc_value": "prexn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560031": [
        {
            "ioc_value": "fradpf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560032": [
        {
            "ioc_value": "lucufj.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560033": [
        {
            "ioc_value": "cuvcicr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560034": [
        {
            "ioc_value": "butvqr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560035": [
        {
            "ioc_value": "adviykk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560036": [
        {
            "ioc_value": "lilexu.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560037": [
        {
            "ioc_value": "lateged.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560038": [
        {
            "ioc_value": "hotw.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560039": [
        {
            "ioc_value": "gimbrte.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560040": [
        {
            "ioc_value": "appasxp.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560041": [
        {
            "ioc_value": "agnostn.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560042": [
        {
            "ioc_value": "defyhub.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560043": [
        {
            "ioc_value": "currx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560044": [
        {
            "ioc_value": "civijgc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560002": [
        {
            "ioc_value": "dimtl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560003": [
        {
            "ioc_value": "collb.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560004": [
        {
            "ioc_value": "afdzph.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560006": [
        {
            "ioc_value": "tilvfq.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560007": [
        {
            "ioc_value": "sthfna.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560008": [
        {
            "ioc_value": "pantvi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560009": [
        {
            "ioc_value": "migwsy.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560010": [
        {
            "ioc_value": "tooql.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560011": [
        {
            "ioc_value": "picnq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560012": [
        {
            "ioc_value": "madpgk.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560013": [
        {
            "ioc_value": "inswti.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560014": [
        {
            "ioc_value": "chehmk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560015": [
        {
            "ioc_value": "bisci.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560016": [
        {
            "ioc_value": "laoewv.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560017": [
        {
            "ioc_value": "kilcvv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560018": [
        {
            "ioc_value": "euyzh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560019": [
        {
            "ioc_value": "cryrn.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560020": [
        {
            "ioc_value": "coyawl.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560021": [
        {
            "ioc_value": "clotj.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560022": [
        {
            "ioc_value": "cidtpz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560023": [
        {
            "ioc_value": "prgdzp.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:45",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559981": [
        {
            "ioc_value": "stibm.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559982": [
        {
            "ioc_value": "spisd.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559983": [
        {
            "ioc_value": "sopzbd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559984": [
        {
            "ioc_value": "siyju.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559985": [
        {
            "ioc_value": "sckfs.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559986": [
        {
            "ioc_value": "scfyfa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559987": [
        {
            "ioc_value": "pouytr.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559988": [
        {
            "ioc_value": "plsnae.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559989": [
        {
            "ioc_value": "pekyow.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559990": [
        {
            "ioc_value": "mawscf.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559991": [
        {
            "ioc_value": "karapvc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559992": [
        {
            "ioc_value": "insdly.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559993": [
        {
            "ioc_value": "heavdu.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559994": [
        {
            "ioc_value": "germon.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559995": [
        {
            "ioc_value": "genuj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559996": [
        {
            "ioc_value": "gasvej.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559997": [
        {
            "ioc_value": "gaukbj.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559998": [
        {
            "ioc_value": "fiurz.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559999": [
        {
            "ioc_value": "anntiv.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560000": [
        {
            "ioc_value": "elilzy.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1560001": [
        {
            "ioc_value": "ecchs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:44",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559963": [
        {
            "ioc_value": "acqcfc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559964": [
        {
            "ioc_value": "dupufl.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559965": [
        {
            "ioc_value": "selflch.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559966": [
        {
            "ioc_value": "rankibanni.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559967": [
        {
            "ioc_value": "abbcdc.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559968": [
        {
            "ioc_value": "dibb.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559969": [
        {
            "ioc_value": "cb-dd.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559970": [
        {
            "ioc_value": "bannfab.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559971": [
        {
            "ioc_value": "zyihztu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559972": [
        {
            "ioc_value": "wouamhg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559973": [
        {
            "ioc_value": "whirzd.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559974": [
        {
            "ioc_value": "sptegm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559975": [
        {
            "ioc_value": "spifd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559976": [
        {
            "ioc_value": "siaetld.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559977": [
        {
            "ioc_value": "miiuf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559978": [
        {
            "ioc_value": "instbf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559979": [
        {
            "ioc_value": "genxsy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559980": [
        {
            "ioc_value": "erhrwcu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:43",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559943": [
        {
            "ioc_value": "monzb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559944": [
        {
            "ioc_value": "lineyn.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559945": [
        {
            "ioc_value": "ketwue.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559946": [
        {
            "ioc_value": "jalonla.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559947": [
        {
            "ioc_value": "gloob.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559948": [
        {
            "ioc_value": "endtou.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559949": [
        {
            "ioc_value": "elbguy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559950": [
        {
            "ioc_value": "disrgqs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559951": [
        {
            "ioc_value": "civimd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559952": [
        {
            "ioc_value": "inthxt.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559953": [
        {
            "ioc_value": "inspnq.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559954": [
        {
            "ioc_value": "flamkc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559955": [
        {
            "ioc_value": "urizfah.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559956": [
        {
            "ioc_value": "encrnb.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559957": [
        {
            "ioc_value": "mongok.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559958": [
        {
            "ioc_value": "doctqc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559959": [
        {
            "ioc_value": "pinepx.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559960": [
        {
            "ioc_value": "adjvcz.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559961": [
        {
            "ioc_value": "amerox.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559962": [
        {
            "ioc_value": "aixraj.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559926": [
        {
            "ioc_value": "dalwdd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559927": [
        {
            "ioc_value": "cuwewki.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559928": [
        {
            "ioc_value": "conrlim.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559929": [
        {
            "ioc_value": "cawbn.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559930": [
        {
            "ioc_value": "accepkw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559932": [
        {
            "ioc_value": "naveei.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559933": [
        {
            "ioc_value": "dessxc.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559934": [
        {
            "ioc_value": "venatec.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559935": [
        {
            "ioc_value": "sonskhq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559936": [
        {
            "ioc_value": "softanw.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559937": [
        {
            "ioc_value": "sharaqz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559938": [
        {
            "ioc_value": "saviutf.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559939": [
        {
            "ioc_value": "pressm.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559940": [
        {
            "ioc_value": "posteqz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559941": [
        {
            "ioc_value": "notbwd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559942": [
        {
            "ioc_value": "neutee.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:41",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559910": [
        {
            "ioc_value": "coreqdi.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559911": [
        {
            "ioc_value": "consono.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559912": [
        {
            "ioc_value": "castdyt.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559913": [
        {
            "ioc_value": "brotsjom.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": "2025-07-24 09:19:03",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559914": [
        {
            "ioc_value": "autotnyx.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559915": [
        {
            "ioc_value": "allosno.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559916": [
        {
            "ioc_value": "rubeuiq.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559917": [
        {
            "ioc_value": "relqfn.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559918": [
        {
            "ioc_value": "numberv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559919": [
        {
            "ioc_value": "ninaohi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559920": [
        {
            "ioc_value": "neobuvv.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559921": [
        {
            "ioc_value": "mistucr.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559922": [
        {
            "ioc_value": "marixzn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559923": [
        {
            "ioc_value": "loxinxg.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559924": [
        {
            "ioc_value": "iddzjd.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559925": [
        {
            "ioc_value": "fratjo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:40",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559891": [
        {
            "ioc_value": "restauun.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559892": [
        {
            "ioc_value": "pennkavs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559893": [
        {
            "ioc_value": "pandhnyk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559894": [
        {
            "ioc_value": "exodjhbn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": "2025-09-10 08:31:24",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559895": [
        {
            "ioc_value": "caaokan.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559896": [
        {
            "ioc_value": "uvulyxt.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559897": [
        {
            "ioc_value": "unthozx.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": "2025-07-24 09:19:03",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559898": [
        {
            "ioc_value": "spicerb.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559899": [
        {
            "ioc_value": "respluk.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": "2025-07-24 09:19:03",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559900": [
        {
            "ioc_value": "monkevm.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559901": [
        {
            "ioc_value": "insulfm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559902": [
        {
            "ioc_value": "cometopa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559903": [
        {
            "ioc_value": "cenmyrm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559904": [
        {
            "ioc_value": "betidsv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559905": [
        {
            "ioc_value": "acetjjxl.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559906": [
        {
            "ioc_value": "hellkkj.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559907": [
        {
            "ioc_value": "growtfw.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559908": [
        {
            "ioc_value": "cycdjja.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": "2025-07-24 09:19:05",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559909": [
        {
            "ioc_value": "cucjdlc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:39",
            "last_seen_utc": "2025-07-24 09:19:03",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559879": [
        {
            "ioc_value": "personal-bann-fab.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559880": [
        {
            "ioc_value": "squirrvm.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559881": [
        {
            "ioc_value": "dermisrg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559882": [
        {
            "ioc_value": "blastodx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559883": [
        {
            "ioc_value": "artifizz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559884": [
        {
            "ioc_value": "amplitra.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559885": [
        {
            "ioc_value": "hermew.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": "2025-07-24 09:19:03",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559886": [
        {
            "ioc_value": "garmenae.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559887": [
        {
            "ioc_value": "fixoml.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559888": [
        {
            "ioc_value": "antibigi.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559889": [
        {
            "ioc_value": "boylmc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": "2025-07-24 09:19:03",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559890": [
        {
            "ioc_value": "callxgcs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:38",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559869": [
        {
            "ioc_value": "topkkn.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559870": [
        {
            "ioc_value": "stranzv.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559871": [
        {
            "ioc_value": "rebeqax.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559872": [
        {
            "ioc_value": "placlzh.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559873": [
        {
            "ioc_value": "membios.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559874": [
        {
            "ioc_value": "illusgw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559875": [
        {
            "ioc_value": "glidzgs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559876": [
        {
            "ioc_value": "prefilc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559877": [
        {
            "ioc_value": "chocupw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559878": [
        {
            "ioc_value": "dispckg.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 19:18:37",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1559865": [
        {
            "ioc_value": "t.ptib.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-23 18:49:44",
            "last_seen_utc": "2025-08-25 17:49:19",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559866": [
        {
            "ioc_value": "test.c2test.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-23 18:49:44",
            "last_seen_utc": "2025-08-26 07:49:46",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559864": [
        {
            "ioc_value": "2fm7tpwmpc2gd.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-23 18:49:23",
            "last_seen_utc": "2025-09-10 15:50:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559863": [
        {
            "ioc_value": "qu4s4rx.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-23 18:45:32",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/17f1fc182f8d844cbabe3c7c3f22bb6fae8962e6f31d0b2ffe3adc32bdc746e7/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559859": [
        {
            "ioc_value": "given-offense.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-23 18:03:23",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250723-rfgd8agl4w",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559850": [
        {
            "ioc_value": "api.organica.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-23 17:10:28",
            "last_seen_utc": "2025-08-04 12:10:59",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559816": [
        {
            "ioc_value": "markets.globalequity360.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-23 14:56:42",
            "last_seen_utc": "2025-07-23 14:10:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559756": [
        {
            "ioc_value": "nageiaju.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 12:06:34",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1559777": [
        {
            "ioc_value": "htht1-21140.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-23 12:03:18",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250723-lytvdavxdw",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559760": [
        {
            "ioc_value": "another-expedia.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-23 12:00:43",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250723-mqnh3avzgt",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559750": [
        {
            "ioc_value": "moruk.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-23 11:36:52",
            "last_seen_utc": "2025-07-23 11:12:28",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114902246390735094",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1559753": [
        {
            "ioc_value": "eveloungeyyc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-23 11:36:49",
            "last_seen_utc": "2025-07-23 11:12:31",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114902246390735094",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1559744": [
        {
            "ioc_value": "perfoxd.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 10:15:05",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559745": [
        {
            "ioc_value": "stfota.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 10:15:04",
            "last_seen_utc": "2025-07-29 10:24:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559746": [
        {
            "ioc_value": "ondcvxe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 10:15:04",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559740": [
        {
            "ioc_value": "sciencemagazine.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-23 08:50:41",
            "last_seen_utc": "2025-08-23 11:49:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559728": [
        {
            "ioc_value": "pastsslv.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-23 08:01:48",
            "last_seen_utc": "2025-07-24 04:03:12",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.80.35+pastsslv.shop",
            "tags": "AS401120,C2,censys,CHEAPY-HOST,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559707": [
        {
            "ioc_value": "www.chrome-update.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-23 07:32:34",
            "last_seen_utc": "2025-07-23 07:15:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "APK,fakeupdates",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559709": [
        {
            "ioc_value": "randsopskwn.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-23 07:32:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fakeupdates",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559693": [
        {
            "ioc_value": "akwatic-hotel.ci",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-23 06:38:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559691": [
        {
            "ioc_value": "security.guiaodfalear.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-23 06:23:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559692": [
        {
            "ioc_value": "nomgerx.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-23 06:23:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559537": [
        {
            "ioc_value": "jaclwdc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 06:23:39",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "LummaStealer",
            "anonymous": "0",
            "reporter": "burger"
        }
    ],
    "1559539": [
        {
            "ioc_value": "jfbd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-23 06:23:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559546": [
        {
            "ioc_value": "hydrillageardes.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-07-23 06:23:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ACR Stealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559547": [
        {
            "ioc_value": "casulahobbuoies.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-07-23 06:23:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ACR Stealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559548": [
        {
            "ioc_value": "otterspromisdes.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-07-23 06:23:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ACR Stealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559549": [
        {
            "ioc_value": "outdonefurniturders.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-07-23 06:23:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ACR Stealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559552": [
        {
            "ioc_value": "proxybuilderservice.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-23 06:23:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559550": [
        {
            "ioc_value": "stompinggrounders.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-07-23 06:23:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ACR Stealer",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559567": [
        {
            "ioc_value": "eartheea.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 06:23:33",
            "last_seen_utc": "2025-07-24 09:19:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559568": [
        {
            "ioc_value": "glassma.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-23 06:23:33",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559688": [
        {
            "ioc_value": "zg.jackload.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-23 06:01:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250723-cvsy8ssry8",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559687": [
        {
            "ioc_value": "medical-principles.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-23 06:01:01",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250723-dqmr4atlv3",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559684": [
        {
            "ioc_value": "program-neutral.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-23 06:00:32",
            "last_seen_utc": "2025-07-29 15:49:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250723-aet59asly7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559682": [
        {
            "ioc_value": "dev.ip.organica.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-23 05:10:25",
            "last_seen_utc": "2025-07-23 16:10:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559597": [
        {
            "ioc_value": "www.goodle.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-22 20:49:00",
            "last_seen_utc": "2025-09-05 13:51:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559587": [
        {
            "ioc_value": "s798860.foxcdn.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-22 20:01:35",
            "last_seen_utc": "2025-07-23 04:04:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.92.74.43+s798860.foxcdn.net",
            "tags": "AS200904,C2,censys,FOXCLOUD,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559565": [
        {
            "ioc_value": "ns2.vmupdate.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-22 18:49:25",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559564": [
        {
            "ioc_value": "ns1.vmupdate.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-22 18:49:24",
            "last_seen_utc": "2025-12-14 11:48:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559561": [
        {
            "ioc_value": "heo.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-22 18:01:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-tg63dayjs5",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559557": [
        {
            "ioc_value": "selection-links.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-22 18:00:44",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-t8wqqadq3x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559554": [
        {
            "ioc_value": "ygfbasync.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-22 18:00:39",
            "last_seen_utc": "2025-07-29 15:49:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-pqn6psbq5z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559555": [
        {
            "ioc_value": "tvsanarch.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-22 18:00:39",
            "last_seen_utc": "2025-07-29 15:49:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-pqn6psbq5z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559556": [
        {
            "ioc_value": "venomfhd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-22 18:00:39",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-pqn6psbq5z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559553": [
        {
            "ioc_value": "reservamarina0011.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-22 18:00:38",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-scmx9sdj6x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559544": [
        {
            "ioc_value": "test.www.organica.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-22 17:10:27",
            "last_seen_utc": "2025-07-23 07:20:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559351": [
        {
            "ioc_value": "arb-swap.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-22 16:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1559502": [
        {
            "ioc_value": "brainbotfilebeatsave.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-22 16:00:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1559503": [
        {
            "ioc_value": "vericlyd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-22 16:00:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1559348": [
        {
            "ioc_value": "genuschs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 14:01:00",
            "last_seen_utc": "2025-07-23 19:18:38",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1559349": [
        {
            "ioc_value": "throseu.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 14:01:00",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1559350": [
        {
            "ioc_value": "djibbg.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 14:01:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1559343": [
        {
            "ioc_value": "world-safest.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-07-22 13:40:52",
            "last_seen_utc": null,
            "confidence_level": 25,
            "reference": "https://app.any.run/tasks/1f219c99-c9f6-4e26-a9c1-7a543ba22f92",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1559344": [
        {
            "ioc_value": "teplinks.co.ke",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-07-22 13:40:51",
            "last_seen_utc": null,
            "confidence_level": 25,
            "reference": "https://app.any.run/tasks/1f219c99-c9f6-4e26-a9c1-7a543ba22f92",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1559332": [
        {
            "ioc_value": "calc.diversifieddebtsolutions.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-22 13:27:24",
            "last_seen_utc": "2025-07-22 13:15:48",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114897053672038329",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1559335": [
        {
            "ioc_value": "rubidin.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 13:27:23",
            "last_seen_utc": "2025-07-23 19:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "LummaStealer",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1559331": [
        {
            "ioc_value": "download.microsoftwindows.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-22 12:49:37",
            "last_seen_utc": "2025-12-14 11:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559328": [
        {
            "ioc_value": "bkp.mail.organica.tv",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-22 12:11:03",
            "last_seen_utc": "2025-07-23 07:20:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559326": [
        {
            "ioc_value": "kinky82.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-22 12:03:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-htzchsgp2x",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559325": [
        {
            "ioc_value": "phephelipinho.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-22 12:03:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-hycdjsgp6x",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559309": [
        {
            "ioc_value": "mar-vietnamese.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-22 12:00:43",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-kee2fahm5y",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559307": [
        {
            "ioc_value": "procesos2025.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-22 12:00:33",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-msyrtaan7y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559304": [
        {
            "ioc_value": "republic-ins.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-22 12:00:28",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-ltv7mshr21",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559305": [
        {
            "ioc_value": "photography-tools.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-22 12:00:28",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-ll9p3atxgt",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559288": [
        {
            "ioc_value": "genusuvk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 11:10:58",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559290": [
        {
            "ioc_value": "keepnody.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 11:10:58",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559289": [
        {
            "ioc_value": "mosaicia.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 11:10:57",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559291": [
        {
            "ioc_value": "familkqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 11:10:56",
            "last_seen_utc": "2025-07-23 19:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559294": [
        {
            "ioc_value": "headtechnologies.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-22 11:10:55",
            "last_seen_utc": "2025-07-23 06:42:24",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114896570012341513",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1559297": [
        {
            "ioc_value": "clientes.sangrecreativa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-22 11:10:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114896570012341513",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1559284": [
        {
            "ioc_value": "www.split2econd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-22 09:21:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559285": [
        {
            "ioc_value": "mysticaltrekking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-22 09:21:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559286": [
        {
            "ioc_value": "www.airdriediamondcabs.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-22 09:21:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "TA569",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559283": [
        {
            "ioc_value": "eskom.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-22 09:20:31",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559248": [
        {
            "ioc_value": "mnemvlk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 07:24:25",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559249": [
        {
            "ioc_value": "resqtk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 07:24:25",
            "last_seen_utc": "2025-07-23 19:18:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559250": [
        {
            "ioc_value": "swalocf.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 07:24:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559243": [
        {
            "ioc_value": "comprovantt.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-22 07:23:37",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559244": [
        {
            "ioc_value": "girls-projection.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-22 07:23:37",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559245": [
        {
            "ioc_value": "msn-announce.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-22 07:23:37",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559246": [
        {
            "ioc_value": "quick-corner.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-22 07:23:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559242": [
        {
            "ioc_value": "bot.chanbaba.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-22 07:22:52",
            "last_seen_utc": "2025-08-15 12:13:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559222": [
        {
            "ioc_value": "gw62.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-22 06:01:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-b5bbha1p19",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559223": [
        {
            "ioc_value": "helloworid.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-22 06:01:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-b5bbha1p19",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559224": [
        {
            "ioc_value": "pw778.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-22 06:01:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-b5bbha1p19",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559217": [
        {
            "ioc_value": "job2.qaozrzszc.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-22 06:01:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-d1h7naek6x",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559214": [
        {
            "ioc_value": "bwute.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-22 06:00:49",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-fblmlaer9x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559215": [
        {
            "ioc_value": "than-removed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-22 06:00:49",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-a9skxadk8t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559216": [
        {
            "ioc_value": "chaubolitas.ddnsking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-22 06:00:49",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-aagpcscr21",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559211": [
        {
            "ioc_value": "particular-beds.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-22 06:00:26",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-f1s3zastey",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559213": [
        {
            "ioc_value": "usa-objectives.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-22 06:00:26",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250722-ej4ygaem8z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559178": [
        {
            "ioc_value": "static.13.162.4.46.clients.your-server.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-22 05:58:50",
            "last_seen_utc": "2025-07-22 04:00:54",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/46.4.162.13+static.13.162.4.46.clients.your-server.de",
            "tags": "AS24940,C2,censys,HETZNER-AS,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1559182": [
        {
            "ioc_value": "login.teamss.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-22 05:58:47",
            "last_seen_utc": "2025-07-22 04:01:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/80.149.60.140+login.teamss.de",
            "tags": "AS3320,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1559146": [
        {
            "ioc_value": "glossmagazine.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-22 05:58:32",
            "last_seen_utc": "2025-11-22 10:06:36",
            "confidence_level": 100,
            "reference": "https://xss.is/threads/141472/",
            "tags": "AuraStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1559144": [
        {
            "ioc_value": "calioons.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 05:58:31",
            "last_seen_utc": "2025-07-23 19:18:38",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/d659a320-b9d6-4896-81b7-9456f9e323b6",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1559141": [
        {
            "ioc_value": "wlldberries.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-07-22 05:58:29",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1559140": [
        {
            "ioc_value": "akacostanyaszarvas.hu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amadey",
            "malware_alias": null,
            "malware_printable": "Amadey",
            "first_seen_utc": "2025-07-22 05:58:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1559130": [
        {
            "ioc_value": "pelrinsz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-22 05:58:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559129": [
        {
            "ioc_value": "security.floesrgayrd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-22 05:58:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1559008": [
        {
            "ioc_value": "corronxu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 05:58:24",
            "last_seen_utc": "2025-07-23 19:18:38",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559007": [
        {
            "ioc_value": "worlejrc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-22 05:58:23",
            "last_seen_utc": "2025-07-24 09:19:07",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1559175": [
        {
            "ioc_value": "s2.mx.mottogrotto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-22 03:10:26",
            "last_seen_utc": "2025-07-23 07:20:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559173": [
        {
            "ioc_value": "caq71hz7x2ccj.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-22 02:48:28",
            "last_seen_utc": "2025-09-11 09:49:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559149": [
        {
            "ioc_value": "zereoo.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-21 23:00:38",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/4d1a3e3542aa217aa7994e1e3531b1cbf4263908deaaa81e7d8dd9b7c9ca67f2/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559148": [
        {
            "ioc_value": "zereoo.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-21 23:00:37",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/4d1a3e3542aa217aa7994e1e3531b1cbf4263908deaaa81e7d8dd9b7c9ca67f2/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559103": [
        {
            "ioc_value": "snitch2025.pagekite.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-21 18:01:15",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-s7qbwafn4z",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559101": [
        {
            "ioc_value": "silver-teaching.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-21 18:00:49",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-vfxmzssnt8",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559102": [
        {
            "ioc_value": "testinghigger-42471.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-21 18:00:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-q853ls1py6",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1559090": [
        {
            "ioc_value": "s1.mx.mottogrotto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-21 17:10:28",
            "last_seen_utc": "2025-07-23 07:20:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559086": [
        {
            "ioc_value": "address-scholar.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-21 17:09:57",
            "last_seen_utc": "2025-07-29 15:49:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559087": [
        {
            "ioc_value": "go-modems.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-21 17:09:57",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559088": [
        {
            "ioc_value": "sep-needs.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-21 17:09:57",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559083": [
        {
            "ioc_value": "moneycomenow.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-21 17:09:12",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559084": [
        {
            "ioc_value": "vetreosystems.cam",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-21 17:09:12",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559081": [
        {
            "ioc_value": "ccls-co.cam",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-21 17:09:11",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559082": [
        {
            "ioc_value": "graceforexpantion.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-21 17:09:11",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559079": [
        {
            "ioc_value": "pivaco4019-45853.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-21 17:08:40",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559065": [
        {
            "ioc_value": "cin.cinquento.publicvm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-21 17:07:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559066": [
        {
            "ioc_value": "morteone.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-21 17:07:06",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559067": [
        {
            "ioc_value": "netohxxx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-21 17:07:06",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1559006": [
        {
            "ioc_value": "dopk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-21 14:37:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1559004": [
        {
            "ioc_value": "empiricaludder.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-21 14:30:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake,ClickFix",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1558992": [
        {
            "ioc_value": "streaming-films.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-21 13:17:26",
            "last_seen_utc": "2025-07-21 13:08:53",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114891379555369262",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1558995": [
        {
            "ioc_value": "www.austinroofs.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-21 13:17:26",
            "last_seen_utc": "2025-07-22 11:08:57",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114891379555369262",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1558998": [
        {
            "ioc_value": "app.novationseo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-21 13:17:24",
            "last_seen_utc": "2025-07-21 14:00:43",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114891385057336948",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1558937": [
        {
            "ioc_value": "ptdpro-46069.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-21 12:01:56",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-jpnwna1zcw",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558934": [
        {
            "ioc_value": "login.login.x-fit.ch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-21 12:01:42",
            "last_seen_utc": "2025-07-22 04:01:01",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.200.221.24+login.login.x-fit.ch",
            "tags": "AS34146,censys,EvilGinx,ISP-SOLUTIONS-AS,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558932": [
        {
            "ioc_value": "dozyremco.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-21 12:01:28",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-hzjt1s1xax",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558931": [
        {
            "ioc_value": "donjhkkr.kicks-ass.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-21 12:01:23",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-jw2fbsykv8",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558929": [
        {
            "ioc_value": "www.bakerhughas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-21 12:01:19",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-nbnqysal4v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558926": [
        {
            "ioc_value": "www.lcdlcds.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-21 12:01:17",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-nbnqysal4v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558928": [
        {
            "ioc_value": "www.campoyitierra.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-21 12:01:17",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-nbnqysal4v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558920": [
        {
            "ioc_value": "fee-largest.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-21 12:00:39",
            "last_seen_utc": "2025-07-29 15:49:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-l7j2jayqz9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558917": [
        {
            "ioc_value": "heqcare.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-21 11:07:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558916": [
        {
            "ioc_value": "aslive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-21 11:06:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558866": [
        {
            "ioc_value": "broker.nm.xevil.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-21 06:45:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/212.64.38.105+broker.nm.xevil.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1558860": [
        {
            "ioc_value": "vault-360-nexus.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-07-21 06:44:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/0dfddfe6eef1a7787b33c9315482bf01c2519fc026cc36e11f62a02baf91565b/",
            "tags": "Rhadamanthys",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558815": [
        {
            "ioc_value": "theblumiles.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558816": [
        {
            "ioc_value": "misshon.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558807": [
        {
            "ioc_value": "goatramz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558808": [
        {
            "ioc_value": "couriontesy.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558810": [
        {
            "ioc_value": "jupagroup.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558811": [
        {
            "ioc_value": "vivianvalora.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558812": [
        {
            "ioc_value": "redempti.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558814": [
        {
            "ioc_value": "laccalhdc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558809": [
        {
            "ioc_value": "ekochist.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558813": [
        {
            "ioc_value": "scygas.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558806": [
        {
            "ioc_value": "aspotan.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-07-21 06:44:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/browse/signature/AmosStealer/",
            "tags": "AmosStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1558888": [
        {
            "ioc_value": "memory-julia.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-21 06:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-getm2sxkx9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558889": [
        {
            "ioc_value": "person-consumer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-21 06:00:21",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-fk6dcszxgv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558890": [
        {
            "ioc_value": "profile-indians.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-21 06:00:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250721-awgaqafk51",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558822": [
        {
            "ioc_value": "vmi2586980.contaboserver.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-21 00:01:08",
            "last_seen_utc": "2025-07-21 04:00:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/167.86.110.155+vmi2586980.contaboserver.net",
            "tags": "AS51167,C2,censys,CONTABO,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558796": [
        {
            "ioc_value": "willbayley.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-20 20:01:13",
            "last_seen_utc": "2025-07-21 04:01:11",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/147.182.247.191+willbayley.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558793": [
        {
            "ioc_value": "carbonxiv.ooguy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-20 20:00:58",
            "last_seen_utc": "2025-07-21 04:00:47",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.38.251.136+carbonxiv.ooguy.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558772": [
        {
            "ioc_value": "luisnicaragua.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-20 18:01:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250720-qh3vkadm6z",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558770": [
        {
            "ioc_value": "rnbmo-86-189-141-39.a.free.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-20 18:01:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250720-qznrza11bx",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558771": [
        {
            "ioc_value": "rnriw-86-189-141-39.a.free.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-20 18:01:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250720-qw5ajsdq3x",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558766": [
        {
            "ioc_value": "ultra64.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-20 18:00:34",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250720-rymzqazrw6",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558764": [
        {
            "ioc_value": "phone2347.freeddns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-20 18:00:27",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250720-pafjmaykx7",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558761": [
        {
            "ioc_value": "desktop-gvd3u7o-nj.at.remote.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-20 18:00:20",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250720-qag8wsyrx3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558762": [
        {
            "ioc_value": "troia23.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-20 18:00:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250720-pkfx5szzex",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558763": [
        {
            "ioc_value": "kocorex-46341.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-20 18:00:20",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250720-pafjmaykx8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558759": [
        {
            "ioc_value": "research-trivia.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-20 18:00:19",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250720-tebtfs1my9",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558735": [
        {
            "ioc_value": "axiosapiexample.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-20 15:50:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558737": [
        {
            "ioc_value": "vueapiinsights.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-20 15:49:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558731": [
        {
            "ioc_value": "www.helpdeskglobal.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-20 15:07:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558729": [
        {
            "ioc_value": "cnc.netjssaytcpp.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-20 14:54:21",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/493290baf8d059db700e4d9db33891f0942390aaf08f6175ee457d844e2e13eb/",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558717": [
        {
            "ioc_value": "security.felaguueard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-20 14:43:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558718": [
        {
            "ioc_value": "pewbicved.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-20 14:43:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558701": [
        {
            "ioc_value": "1328175548-4zksdftd97.ap-guangzhou.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-20 10:49:29",
            "last_seen_utc": "2025-08-21 17:49:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558695": [
        {
            "ioc_value": "domet.chanbaba.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-20 09:15:52",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558659": [
        {
            "ioc_value": "vegemuoe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-20 07:13:19",
            "last_seen_utc": "2025-07-22 13:18:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558656": [
        {
            "ioc_value": "sworwdcp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-20 07:13:17",
            "last_seen_utc": "2025-07-21 21:24:46",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558657": [
        {
            "ioc_value": "tunenrnc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-20 07:13:17",
            "last_seen_utc": "2025-07-22 13:18:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558658": [
        {
            "ioc_value": "ultracpj.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-20 07:13:16",
            "last_seen_utc": "2025-07-23 19:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558623": [
        {
            "ioc_value": "tip.emailsv.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-20 02:48:25",
            "last_seen_utc": "2025-09-01 09:52:01",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558576": [
        {
            "ioc_value": "startitit2-23969.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-19 18:02:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250719-s2xh1awzcz",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558575": [
        {
            "ioc_value": "mail-eco.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.redline_stealer",
            "malware_alias": "RECORDSTEALER",
            "malware_printable": "RedLine Stealer",
            "first_seen_utc": "2025-07-19 18:01:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250719-r84efsgm4w",
            "tags": "C2,domain,RedLine,RedlineStealer,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558573": [
        {
            "ioc_value": "jptech202.ddnsking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-19 18:00:14",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250719-rqn7tagj9w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558564": [
        {
            "ioc_value": "sso.office.safelogins.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 16:01:03",
            "last_seen_utc": "2025-07-20 04:00:51",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.207.133.122+sso.office.safelogins.su",
            "tags": "AS213877,censys,EvilGinx,panel,Phishing,U1HOST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558561": [
        {
            "ioc_value": "ec2-18-163-127-62.ap-east-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-19 16:00:46",
            "last_seen_utc": "2025-07-20 04:00:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.163.127.62+ec2-18-163-127-62.ap-east-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558553": [
        {
            "ioc_value": "exploreativethinking.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 15:58:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558554": [
        {
            "ioc_value": "geymej.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 15:58:02",
            "last_seen_utc": "2025-07-23 19:18:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558555": [
        {
            "ioc_value": "libdm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 15:58:02",
            "last_seen_utc": "2025-07-23 19:18:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558552": [
        {
            "ioc_value": "alternative-corporate.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-19 15:57:36",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558551": [
        {
            "ioc_value": "crvmi-60976.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xenorat",
            "malware_alias": null,
            "malware_printable": "XenoRAT",
            "first_seen_utc": "2025-07-19 15:57:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xenorat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558547": [
        {
            "ioc_value": "studies-integrated.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-19 15:56:18",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558543": [
        {
            "ioc_value": "artist-presentations.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-19 15:55:40",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558539": [
        {
            "ioc_value": "bot.exayte.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-19 15:55:24",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558540": [
        {
            "ioc_value": "camelboat.n-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-19 15:55:24",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558541": [
        {
            "ioc_value": "cnc.cinquento.publicvm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-19 15:55:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558542": [
        {
            "ioc_value": "cnc.netjssaytcp.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-19 15:55:24",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558510": [
        {
            "ioc_value": "www.panama123456.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558511": [
        {
            "ioc_value": "www.ponyblood.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558512": [
        {
            "ioc_value": "www.qova.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558513": [
        {
            "ioc_value": "www.seedsoffashion.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558514": [
        {
            "ioc_value": "www.shop-kuyou.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558515": [
        {
            "ioc_value": "www.sntzag.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558516": [
        {
            "ioc_value": "www.solucionservihogar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558517": [
        {
            "ioc_value": "www.souzan-haddad.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558518": [
        {
            "ioc_value": "www.styleswithrobin.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558519": [
        {
            "ioc_value": "www.sunsetserenadenc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558520": [
        {
            "ioc_value": "www.talk2ipsos.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558521": [
        {
            "ioc_value": "www.thebucktowntaproom.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558522": [
        {
            "ioc_value": "www.tztauto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558523": [
        {
            "ioc_value": "www.unitedfinancesavings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558524": [
        {
            "ioc_value": "www.watchbracket.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558525": [
        {
            "ioc_value": "www.whdebang.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558526": [
        {
            "ioc_value": "www.whqrsj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558527": [
        {
            "ioc_value": "www.winchesuk.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558528": [
        {
            "ioc_value": "www.xiaoxiaoqi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558529": [
        {
            "ioc_value": "www.xn--0tr47cry2eihq.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558530": [
        {
            "ioc_value": "www.yget.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558531": [
        {
            "ioc_value": "www.yiyangguoji.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558532": [
        {
            "ioc_value": "www.yizhiting.kim",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558533": [
        {
            "ioc_value": "www.yourdiscountrealtor.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558534": [
        {
            "ioc_value": "www.zixuetiandi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558473": [
        {
            "ioc_value": "www.bitcoinwalletco.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558474": [
        {
            "ioc_value": "www.boardwnel.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558475": [
        {
            "ioc_value": "www.c27be5aon.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558476": [
        {
            "ioc_value": "www.cashusa-support.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558477": [
        {
            "ioc_value": "www.chiru-atelier.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558478": [
        {
            "ioc_value": "www.covpsychiz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": "2025-07-19 15:54:33",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558479": [
        {
            "ioc_value": "www.cpab-marbeuf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558480": [
        {
            "ioc_value": "www.creation--site--internet.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558481": [
        {
            "ioc_value": "www.creditreportdr.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558482": [
        {
            "ioc_value": "www.csmtasima.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558483": [
        {
            "ioc_value": "www.despacho360.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558484": [
        {
            "ioc_value": "www.divasofdesignboutique.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558485": [
        {
            "ioc_value": "www.dtoo.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558486": [
        {
            "ioc_value": "www.dyzns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558487": [
        {
            "ioc_value": "www.eiwqcorp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558488": [
        {
            "ioc_value": "www.garanthemedical.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558489": [
        {
            "ioc_value": "www.globale-finance48.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558490": [
        {
            "ioc_value": "www.globe-fish-test.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558491": [
        {
            "ioc_value": "www.go2tips.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558492": [
        {
            "ioc_value": "www.hbcyzmdj.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558493": [
        {
            "ioc_value": "www.hibtp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558494": [
        {
            "ioc_value": "www.imagic-inc.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558495": [
        {
            "ioc_value": "www.iphonex.city",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558496": [
        {
            "ioc_value": "www.itaucard-descontos.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558497": [
        {
            "ioc_value": "www.jbatherholt.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558498": [
        {
            "ioc_value": "www.jinkou-sh.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558499": [
        {
            "ioc_value": "www.karmes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558500": [
        {
            "ioc_value": "www.keepcrueltyhistory.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558501": [
        {
            "ioc_value": "www.llong678.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558502": [
        {
            "ioc_value": "www.lumiereinvestments.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558503": [
        {
            "ioc_value": "www.m2glutenfree.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558504": [
        {
            "ioc_value": "www.missionssummit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558505": [
        {
            "ioc_value": "www.mohecao.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558506": [
        {
            "ioc_value": "www.neteducation4you.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558507": [
        {
            "ioc_value": "www.news3039.gripe",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558508": [
        {
            "ioc_value": "www.nhacaiw88.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558509": [
        {
            "ioc_value": "www.novite-mebeli.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558470": [
        {
            "ioc_value": "www.085097.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558471": [
        {
            "ioc_value": "www.2067lindavista.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558472": [
        {
            "ioc_value": "www.artmaior.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-19 15:54:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558404": [
        {
            "ioc_value": "mz.auth-cn.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 15:53:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,elknot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558400": [
        {
            "ioc_value": "synoacoustic-32033.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-19 15:52:37",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558401": [
        {
            "ioc_value": "testserver444.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-19 15:52:37",
            "last_seen_utc": "2025-08-15 12:13:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1558335": [
        {
            "ioc_value": "tr.optionchain.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-19 13:10:28",
            "last_seen_utc": "2025-07-23 07:20:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558324": [
        {
            "ioc_value": "www.crownmagnetics.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 12:49:18",
            "last_seen_utc": "2025-09-11 09:49:34",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558325": [
        {
            "ioc_value": "www.mediawick.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 12:49:18",
            "last_seen_utc": "2025-09-11 09:49:34",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558326": [
        {
            "ioc_value": "www.queirozdesign.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 12:49:18",
            "last_seen_utc": "2025-09-11 09:49:35",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558327": [
        {
            "ioc_value": "www.smallcartrailer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 12:49:18",
            "last_seen_utc": "2025-09-11 09:49:35",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558322": [
        {
            "ioc_value": "www.ag3battery.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 12:49:17",
            "last_seen_utc": "2025-09-11 09:49:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558323": [
        {
            "ioc_value": "www.cannabispatientcare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 12:49:17",
            "last_seen_utc": "2025-09-11 09:49:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558321": [
        {
            "ioc_value": "update.microsoftwindows.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 12:49:16",
            "last_seen_utc": "2025-12-14 11:48:17",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558320": [
        {
            "ioc_value": "security.microsoftwindows.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 12:49:14",
            "last_seen_utc": "2025-12-10 13:49:45",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558301": [
        {
            "ioc_value": "net.botwork.africa",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.moobot",
            "malware_alias": null,
            "malware_printable": "MooBot",
            "first_seen_utc": "2025-07-19 11:19:38",
            "last_seen_utc": "2025-08-15 12:13:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/da67937c2efde4f8f0e7de6cfd911444c811524fa938355d90193380c2ccec80/",
            "tags": "MooBot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558289": [
        {
            "ioc_value": "rhiuit.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 11:18:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558290": [
        {
            "ioc_value": "srlemnhg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 11:18:25",
            "last_seen_utc": "2025-07-23 19:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558291": [
        {
            "ioc_value": "rootino.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 11:18:24",
            "last_seen_utc": "2025-07-23 19:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558292": [
        {
            "ioc_value": "zxoms.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "apk.joker",
            "malware_alias": "Bread",
            "malware_printable": "Joker",
            "first_seen_utc": "2025-07-19 11:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Joker",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558293": [
        {
            "ioc_value": "anxtaun.fit",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "apk.joker",
            "malware_alias": "Bread",
            "malware_printable": "Joker",
            "first_seen_utc": "2025-07-19 11:18:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Joker",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558294": [
        {
            "ioc_value": "dumv.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "apk.joker",
            "malware_alias": "Bread",
            "malware_printable": "Joker",
            "first_seen_utc": "2025-07-19 11:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Joker",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558295": [
        {
            "ioc_value": "dampg.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "apk.joker",
            "malware_alias": "Bread",
            "malware_printable": "Joker",
            "first_seen_utc": "2025-07-19 11:18:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Joker",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558299": [
        {
            "ioc_value": "siniavzv.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 11:18:22",
            "last_seen_utc": "2025-07-22 13:18:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558296": [
        {
            "ioc_value": "permwgp.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 11:18:21",
            "last_seen_utc": "2025-07-23 19:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558297": [
        {
            "ioc_value": "recopcwr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 11:18:21",
            "last_seen_utc": "2025-07-22 13:18:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558298": [
        {
            "ioc_value": "seruneqy.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 11:18:21",
            "last_seen_utc": "2025-07-22 13:18:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558300": [
        {
            "ioc_value": "strujqwn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-19 11:18:20",
            "last_seen_utc": "2025-07-23 19:18:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558271": [
        {
            "ioc_value": "eplive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-19 07:10:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558272": [
        {
            "ioc_value": "mdycare.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-19 07:10:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558270": [
        {
            "ioc_value": "hblive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-19 07:10:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1484834": [
        {
            "ioc_value": "rose-pole-chip.pages.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:06:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1487082": [
        {
            "ioc_value": "sugarpotfun.fly.storage.tigris.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:06:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1487083": [
        {
            "ioc_value": "vendictio.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1509660": [
        {
            "ioc_value": "manwithedhelp.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-19 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1509663": [
        {
            "ioc_value": "jiezishijie.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-19 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1538747": [
        {
            "ioc_value": "security.gwardfilaer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1538748": [
        {
            "ioc_value": "hopeldo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1552156": [
        {
            "ioc_value": "security.flmesecgaurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1552157": [
        {
            "ioc_value": "fermigz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1553091": [
        {
            "ioc_value": "security.falagyrarde.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1553092": [
        {
            "ioc_value": "oldinax.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1553547": [
        {
            "ioc_value": "security.folagaiurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1553549": [
        {
            "ioc_value": "nenilac.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1553910": [
        {
            "ioc_value": "analyticacnodec.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:37",
            "last_seen_utc": "2025-07-10 21:59:19",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1553911": [
        {
            "ioc_value": "security.flwcereguaard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1553912": [
        {
            "ioc_value": "tepolix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1554073": [
        {
            "ioc_value": "security.fleapecguadr.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1554074": [
        {
            "ioc_value": "repoloik.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1554354": [
        {
            "ioc_value": "security.gvaerdflarle.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1554355": [
        {
            "ioc_value": "kapoleq.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1554644": [
        {
            "ioc_value": "security.fanlareguward.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1554645": [
        {
            "ioc_value": "holandeso.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1555281": [
        {
            "ioc_value": "security.fhaugaaurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1555282": [
        {
            "ioc_value": "nenopizo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556743": [
        {
            "ioc_value": "lebensversicherungvergleich.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-19 07:05:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557981": [
        {
            "ioc_value": "javiergomezmontero.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557982": [
        {
            "ioc_value": "gtl.ci",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557983": [
        {
            "ioc_value": "madeinci.ci",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557984": [
        {
            "ioc_value": "retcap.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557985": [
        {
            "ioc_value": "bleulab.ci",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557986": [
        {
            "ioc_value": "ardiellifornasa.ge",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:22",
            "last_seen_utc": "2025-07-23 06:31:46",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557987": [
        {
            "ioc_value": "clasoftmedia.ci",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557988": [
        {
            "ioc_value": "centroecoformativosanmartin.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557989": [
        {
            "ioc_value": "gomezmontero.eu",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557990": [
        {
            "ioc_value": "rafelink.life",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557991": [
        {
            "ioc_value": "cloudflare.blazing-cloud.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 07:05:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558162": [
        {
            "ioc_value": "security.fjarlegiuard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 06:27:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558163": [
        {
            "ioc_value": "noswexa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-19 06:27:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1558149": [
        {
            "ioc_value": "buildingjobs.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-19 06:27:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1558151": [
        {
            "ioc_value": "ignifugacionsarguix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-19 06:27:33",
            "last_seen_utc": "2025-07-18 20:17:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1558262": [
        {
            "ioc_value": "alekzhero.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-19 06:03:36",
            "last_seen_utc": "2025-08-06 11:34:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250719-b556wax1dy",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558258": [
        {
            "ioc_value": "fnahaga-41990.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-19 06:00:31",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250719-cbyqdaer5w",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558257": [
        {
            "ioc_value": "yessir12.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-19 06:00:30",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250719-e3netszyaw",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558255": [
        {
            "ioc_value": "karenmuir.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-19 06:00:23",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250719-c569lsaj8v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558253": [
        {
            "ioc_value": "anonuevovidanueva20212021.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-19 06:00:22",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250719-ggcsba1wc1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558254": [
        {
            "ioc_value": "guardameplata.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-19 06:00:22",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250719-ealers1kx8",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558189": [
        {
            "ioc_value": "www.haoxueaibang.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 04:00:07",
            "last_seen_utc": "2025-07-21 04:00:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.136.179+www.haoxueaibang.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1558183": [
        {
            "ioc_value": "inventscience.st",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-19 02:48:35",
            "last_seen_utc": "2025-08-19 07:51:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558165": [
        {
            "ioc_value": "gh.optionchain.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-18 23:10:29",
            "last_seen_utc": "2025-07-23 07:20:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558138": [
        {
            "ioc_value": "vmi2330570.contaboserver.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-18 20:01:00",
            "last_seen_utc": "2025-07-19 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/198.7.115.133+vmi2330570.contaboserver.net",
            "tags": "AS51167,C2,censys,CONTABO,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558083": [
        {
            "ioc_value": "socketapiupdates.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-18 19:33:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1558111": [
        {
            "ioc_value": "cichau.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-18 19:33:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558112": [
        {
            "ioc_value": "thoqp.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-18 19:33:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558108": [
        {
            "ioc_value": "552e3ca1f307.ngrok-free.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-18 18:02:09",
            "last_seen_utc": "2025-08-15 12:13:19",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-q7hkxscr8w",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558107": [
        {
            "ioc_value": "mode-civil.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-18 18:01:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-tbaf8azyft",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558105": [
        {
            "ioc_value": "cvv6.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-18 18:01:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-vmeezsskz7",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558103": [
        {
            "ioc_value": "grigori.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-18 18:00:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-rwpers1kx9",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558101": [
        {
            "ioc_value": "sellers-lit.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-18 18:00:48",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-varjsaskv3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558100": [
        {
            "ioc_value": "detalles12.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-18 18:00:33",
            "last_seen_utc": "2025-07-29 15:49:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-q1lzrscr3s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558097": [
        {
            "ioc_value": "www.vidrloscobo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-18 18:00:23",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-qtb6zs1tds",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558095": [
        {
            "ioc_value": "goodfilesvibresgood.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-18 18:00:22",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-t4gq1asjy6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558094": [
        {
            "ioc_value": "select-soma.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-18 18:00:17",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-s5ahmsaj2v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558091": [
        {
            "ioc_value": "sx.optionchain.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-18 16:10:44",
            "last_seen_utc": "2025-07-23 07:20:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558086": [
        {
            "ioc_value": "f-v1-url-fd220acde0-c.marlin-development.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-18 16:01:03",
            "last_seen_utc": "2025-07-19 04:00:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/4.234.184.5+f-v1-url-fd220acde0-c.marlin-development.com",
            "tags": "AS8075,C2,censys,Havoc,MICROSOFT-CORP-MSN-AS-BLOCK",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558080": [
        {
            "ioc_value": "hfdjmoedkjf.asia",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2025-07-18 15:11:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1558076": [
        {
            "ioc_value": "mgmt.studerandson.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-18 14:29:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558072": [
        {
            "ioc_value": "dl.newtoyourgame.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-18 13:14:04",
            "last_seen_utc": "2025-07-18 13:15:52",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114874407979611358",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1558064": [
        {
            "ioc_value": "www.souguo.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-18 12:49:49",
            "last_seen_utc": "2025-07-22 19:49:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1558058": [
        {
            "ioc_value": "bond007.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-18 12:31:01",
            "last_seen_utc": "2025-07-18 12:11:45",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114874167499065098",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1558061": [
        {
            "ioc_value": "getcredentialingdone.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-18 12:31:00",
            "last_seen_utc": "2025-07-18 12:11:49",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114874167499065098",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1558047": [
        {
            "ioc_value": "police-turkish.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-18 12:00:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-mwn2saykx7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558036": [
        {
            "ioc_value": "cooawbi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-18 10:11:50",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558037": [
        {
            "ioc_value": "ourkbpw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-18 10:11:50",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1558042": [
        {
            "ioc_value": "sleaqwad.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-07-18 09:23:25",
            "last_seen_utc": "2025-07-21 21:29:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-e49pfsvnv4",
            "tags": "c2,domain,Stealc,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558028": [
        {
            "ioc_value": "pasotslv.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-18 08:01:18",
            "last_seen_utc": "2025-07-19 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.80.35+pasotslv.shop",
            "tags": "AS401120,C2,censys,CHEAPY-HOST,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1558024": [
        {
            "ioc_value": "tryfancify.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-18 08:01:00",
            "last_seen_utc": "2025-07-19 04:00:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.42+tryfancify.com",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557893": [
        {
            "ioc_value": "security.flegurasec.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-18 06:08:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557894": [
        {
            "ioc_value": "erpoci.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-18 06:08:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557970": [
        {
            "ioc_value": "v2.egrfbumsu.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-18 06:02:37",
            "last_seen_utc": "2025-07-18 06:02:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-gnvayaam4t",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557968": [
        {
            "ioc_value": "test.accendente.tn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-18 06:02:25",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-b6pkhstn19",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557961": [
        {
            "ioc_value": "together-well.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-18 06:01:03",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250718-c7pscavj12",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557924": [
        {
            "ioc_value": "aafastservice.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-18 04:01:06",
            "last_seen_utc": "2025-07-19 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/156.238.243.16+aafastservice.top",
            "tags": "AS142032,C2,censys,HFTCL-AS-AP,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557905": [
        {
            "ioc_value": "m.fbwatch.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-18 00:01:18",
            "last_seen_utc": "2025-07-18 04:01:57",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/159.198.32.118+m.fbwatch.live",
            "tags": "AS22612,censys,EvilGinx,NAMECHEAP-NET,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557897": [
        {
            "ioc_value": "ftp.p4.bukharielectro.pk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-17 23:10:26",
            "last_seen_utc": "2025-07-18 15:10:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557890": [
        {
            "ioc_value": "fk99sqx08gdcw.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-17 20:48:44",
            "last_seen_utc": "2025-08-31 09:49:57",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557866": [
        {
            "ioc_value": "ip-93-115-21-186-122360.vps.hosted-by-mvps.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.mimikatz",
            "malware_alias": null,
            "malware_printable": "MimiKatz",
            "first_seen_utc": "2025-07-17 20:01:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/93.115.21.186+ip-93-115-21-186-122360.vps.hosted-by-mvps.net",
            "tags": "AS202448,C2,censys,hacktool,Mimikatz,MVPS,open-dir",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557838": [
        {
            "ioc_value": "penkridge-television.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-17 18:15:09",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557840": [
        {
            "ioc_value": "pp.portalstatement.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-17 18:15:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1557849": [
        {
            "ioc_value": "ak4.ksdcks2.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-17 18:01:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-pev5wayyaz",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557848": [
        {
            "ioc_value": "thomas-drops.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-17 18:01:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-vhxqrs1xc1",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557846": [
        {
            "ioc_value": "kieixiiXI-25193.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-17 18:00:29",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-q2pgaaer6w",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557845": [
        {
            "ioc_value": "ASEGURARPUERDI2296.casacam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-17 18:00:25",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-pltwdsek9t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557844": [
        {
            "ioc_value": "1718dc.4cloud.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-17 18:00:24",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-t3rvks1wcz",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557842": [
        {
            "ioc_value": "notes-congress.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-17 18:00:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-vhxqrs1xc1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557841": [
        {
            "ioc_value": "geekyamir-60013.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-17 18:00:11",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-t1cb4sznt7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557819": [
        {
            "ioc_value": "mdlive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-17 14:58:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557817": [
        {
            "ioc_value": "plantsstove.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-17 14:56:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557816": [
        {
            "ioc_value": "wastegrape.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-17 14:56:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557807": [
        {
            "ioc_value": "secure.clinchstar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-17 13:29:25",
            "last_seen_utc": "2025-07-17 14:01:08",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114868742174804482",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557799": [
        {
            "ioc_value": "zerolendnow.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-17 12:12:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114868504439058537",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557787": [
        {
            "ioc_value": "city-applicants.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-17 12:02:27",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-lr74esxvhx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557779": [
        {
            "ioc_value": "zinghome.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-17 12:01:50",
            "last_seen_utc": "2025-07-18 04:01:12",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.80.1+zinghome.vn",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557771": [
        {
            "ioc_value": "host0.blockchain-projects.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-17 12:01:15",
            "last_seen_utc": "2025-07-18 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.42+host0.blockchain-projects.com",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557770": [
        {
            "ioc_value": "server.weex-marketing.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-17 12:01:08",
            "last_seen_utc": "2025-08-01 04:00:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.43+server.weex-marketing.com",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557758": [
        {
            "ioc_value": "dogbij.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-17 11:19:08",
            "last_seen_utc": "2025-07-23 19:18:42",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/83e9abec-b2b9-4e92-902a-8a072f9dd461",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1557759": [
        {
            "ioc_value": "famigh.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-17 11:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/83e9abec-b2b9-4e92-902a-8a072f9dd461",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1557760": [
        {
            "ioc_value": "sleevesleeve.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-07-17 11:19:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/83e9abec-b2b9-4e92-902a-8a072f9dd461",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1557764": [
        {
            "ioc_value": "rdmfile.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.purecrypter",
            "malware_alias": null,
            "malware_printable": "PureCrypter",
            "first_seen_utc": "2025-07-17 11:19:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1557757": [
        {
            "ioc_value": "mx.francotamouls.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-17 10:10:28",
            "last_seen_utc": "2025-07-18 06:48:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557714": [
        {
            "ioc_value": "skdgh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-17 08:29:19",
            "last_seen_utc": "2025-07-23 19:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557715": [
        {
            "ioc_value": "unxyng.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-17 08:29:19",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557716": [
        {
            "ioc_value": "trbxlj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-17 08:29:18",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557717": [
        {
            "ioc_value": "gehkmx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-17 08:29:18",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557718": [
        {
            "ioc_value": "sacrp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-17 08:29:17",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557719": [
        {
            "ioc_value": "dktnd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-17 08:29:17",
            "last_seen_utc": "2025-07-23 19:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557731": [
        {
            "ioc_value": "as5yo.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-17 08:29:16",
            "last_seen_utc": "2025-07-17 08:12:05",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114867563467717172",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557734": [
        {
            "ioc_value": "lpdesigns.uk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-17 08:29:14",
            "last_seen_utc": "2025-07-17 12:11:44",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114867563467717172",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557696": [
        {
            "ioc_value": "ageillaxnv.a.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-17 06:01:18",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-azzapssvat",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557695": [
        {
            "ioc_value": "visa.identity-shield.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-17 06:01:16",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-azzapssvat",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557693": [
        {
            "ioc_value": "beblbdzjhs.a.pinggy.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-17 06:01:10",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-azzapssvat",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557692": [
        {
            "ioc_value": "person-vc.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-17 06:01:06",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-datwgadk5y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557691": [
        {
            "ioc_value": "wisk43.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-17 06:01:01",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250717-fbxpvstqv4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557686": [
        {
            "ioc_value": "www.amazonlivenews.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-17 05:17:16",
            "last_seen_utc": "2025-08-19 23:53:15",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557612": [
        {
            "ioc_value": "wemoips.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-17 04:52:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557611": [
        {
            "ioc_value": "security.fcolareguaard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-17 04:52:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557591": [
        {
            "ioc_value": "lumen.radium.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-17 04:52:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Lumen",
            "anonymous": "1",
            "reporter": "hammond1994"
        }
    ],
    "1557635": [
        {
            "ioc_value": "us10.killall.sh",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-17 04:52:00",
            "last_seen_utc": "2025-08-27 16:58:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557644": [
        {
            "ioc_value": "yiyiscrm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-17 04:51:54",
            "last_seen_utc": "2025-08-24 04:00:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.121.136.179+yiyiscrm.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1557659": [
        {
            "ioc_value": "pakistan-itsupport.serveblog.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-17 04:01:44",
            "last_seen_utc": "2025-07-17 04:02:44",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/178.128.48.155+pakistan-itsupport.serveblog.net",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557641": [
        {
            "ioc_value": "news.kaspersky.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-17 02:48:53",
            "last_seen_utc": "2025-08-16 11:48:51",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557640": [
        {
            "ioc_value": "7fsnaewwwq6r3.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-17 02:48:44",
            "last_seen_utc": "2025-08-31 11:49:47",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557625": [
        {
            "ioc_value": "ec2-35-73-179-148.ap-northeast-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-17 00:02:15",
            "last_seen_utc": "2025-07-17 04:02:42",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/35.73.179.148+ec2-35-73-179-148.ap-northeast-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557619": [
        {
            "ioc_value": "ns3.nsebseshop.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-16 22:49:04",
            "last_seen_utc": "2025-12-14 11:48:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557618": [
        {
            "ioc_value": "ns2.nsebseshop.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-16 22:49:03",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557617": [
        {
            "ioc_value": "ns1.nsebseshop.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-16 22:49:02",
            "last_seen_utc": "2025-12-14 11:48:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557569": [
        {
            "ioc_value": "genuine-seahorse-f5e9c4.netlify.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-07-16 18:16:12",
            "last_seen_utc": "2025-07-18 13:10:49",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114863775857862004",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557583": [
        {
            "ioc_value": "cvko-56792.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-16 18:02:59",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-sajstswls6",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557582": [
        {
            "ioc_value": "white-edited.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-16 18:02:58",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-vq6zeaxl12",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557581": [
        {
            "ioc_value": "legacysystemsettings.is-an-engineer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-16 18:02:43",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-vftakaysdt",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557580": [
        {
            "ioc_value": "email-server.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-16 18:02:25",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-sfcxgawmt9",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557579": [
        {
            "ioc_value": "ares25.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-16 18:02:23",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-s12rbsxzbv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557578": [
        {
            "ioc_value": "luciphas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-16 18:02:21",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-tdj4faxjv5",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557577": [
        {
            "ioc_value": "ganggang300182312-32221.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-16 18:02:19",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-wkk1eshq4y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557576": [
        {
            "ioc_value": "Nanoemailing-46446.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 18:01:54",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-rgzbesw1cx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557575": [
        {
            "ioc_value": "drglockz-48262.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 18:01:52",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-sccgjaxwe1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557562": [
        {
            "ioc_value": "login.secure-verifications.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-16 16:02:25",
            "last_seen_utc": "2025-07-17 04:02:38",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.86.84.43+login.secure-verifications.es",
            "tags": "AS14956,C2,censys,Havoc,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557552": [
        {
            "ioc_value": "dev.www.francotamouls.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-16 14:10:28",
            "last_seen_utc": "2025-07-17 09:10:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557447": [
        {
            "ioc_value": "m.awareinsurance.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-16 14:01:41",
            "last_seen_utc": "2025-07-16 13:15:46",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114863090036998709",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557546": [
        {
            "ioc_value": "william-numerical.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 13:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557539": [
        {
            "ioc_value": "hotels-eq.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 13:25:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557540": [
        {
            "ioc_value": "planning-sas.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 13:25:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557541": [
        {
            "ioc_value": "thread-realistic.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 13:25:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557542": [
        {
            "ioc_value": "york-pavilion.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 13:25:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557543": [
        {
            "ioc_value": "because-constitutional.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 13:25:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557544": [
        {
            "ioc_value": "mentirosaputa5-27719.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 13:25:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557545": [
        {
            "ioc_value": "zulo88.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 13:25:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557526": [
        {
            "ioc_value": "vps.tuxy.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-16 13:25:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557527": [
        {
            "ioc_value": "client123.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-16 13:25:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557528": [
        {
            "ioc_value": "funds-ct.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-16 13:25:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557529": [
        {
            "ioc_value": "bay-butterfly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-16 13:25:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1557434": [
        {
            "ioc_value": "wz.stehsuxwy.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-16 12:02:24",
            "last_seen_utc": "2025-07-16 12:02:24",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-gsmrnagn5s",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557433": [
        {
            "ioc_value": "skelet.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-07-16 12:02:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.169.101+skelet.lol",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Gafgyt,open-dir",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557430": [
        {
            "ioc_value": "login.office.safelogins.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-16 12:02:18",
            "last_seen_utc": "2025-07-17 04:03:17",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.207.133.122+login.office.safelogins.su",
            "tags": "AS213877,censys,EvilGinx,panel,Phishing,U1HOST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557419": [
        {
            "ioc_value": "bestevagirlsheisanangelformyfgirlforever.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-16 12:01:29",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-lbcbtasly5",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557417": [
        {
            "ioc_value": "responsibility-occasion.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 12:01:25",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-jqsk8stzby",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557415": [
        {
            "ioc_value": "take-reseller.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 12:01:24",
            "last_seen_utc": "2025-07-29 15:49:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-mmpa7ahr7x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557416": [
        {
            "ioc_value": "entertainment-remembered.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 12:01:24",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-js9yastzdy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557405": [
        {
            "ioc_value": "ashesplayer.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-16 11:37:22",
            "last_seen_utc": "2025-07-16 20:20:33",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114862611067949318",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557408": [
        {
            "ioc_value": "sizzlingcareer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-16 11:37:20",
            "last_seen_utc": "2025-07-16 11:12:46",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114862611067949318",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557399": [
        {
            "ioc_value": "gigohe.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-16 11:37:18",
            "last_seen_utc": "2025-07-23 19:18:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557400": [
        {
            "ioc_value": "blihlo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-16 11:37:17",
            "last_seen_utc": "2025-07-23 19:18:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557395": [
        {
            "ioc_value": "tharq.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-16 09:01:42",
            "last_seen_utc": "2025-07-23 19:18:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557396": [
        {
            "ioc_value": "niazw.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-16 09:01:42",
            "last_seen_utc": "2025-07-23 19:18:44",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557392": [
        {
            "ioc_value": "main.minefarm19.o-r.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-16 09:01:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557389": [
        {
            "ioc_value": "anranapi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-16 09:00:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557390": [
        {
            "ioc_value": "cnc.mutao.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-16 09:00:59",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557391": [
        {
            "ioc_value": "cns.mutao.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-16 09:00:59",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557385": [
        {
            "ioc_value": "www.uziweilai.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557386": [
        {
            "ioc_value": "www.vhlkau0.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557387": [
        {
            "ioc_value": "www.viary.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557388": [
        {
            "ioc_value": "www.wxyn3.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:42",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557369": [
        {
            "ioc_value": "www.olarisfinance.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557370": [
        {
            "ioc_value": "www.oldchain-br037.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557371": [
        {
            "ioc_value": "www.oma.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557372": [
        {
            "ioc_value": "www.ook.photo",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557373": [
        {
            "ioc_value": "www.oungandassociatesmusic.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557374": [
        {
            "ioc_value": "www.ov-imhg.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557375": [
        {
            "ioc_value": "www.ov-pukr.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557376": [
        {
            "ioc_value": "www.pcigieikmfhw.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557377": [
        {
            "ioc_value": "www.pujosa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557378": [
        {
            "ioc_value": "www.rand-bewin.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557379": [
        {
            "ioc_value": "www.rbetano.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557380": [
        {
            "ioc_value": "www.tbi5r.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557381": [
        {
            "ioc_value": "www.uckice.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557382": [
        {
            "ioc_value": "www.uestrasenda.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557383": [
        {
            "ioc_value": "www.uperstar360.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557384": [
        {
            "ioc_value": "www.uxe.rent",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:41",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557354": [
        {
            "ioc_value": "www.ireoverseasgroup.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557355": [
        {
            "ioc_value": "www.itrinkizi20.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557356": [
        {
            "ioc_value": "www.ittledeath.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557357": [
        {
            "ioc_value": "www.j5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557358": [
        {
            "ioc_value": "www.levatedynamics.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557359": [
        {
            "ioc_value": "www.lmj8zx.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557360": [
        {
            "ioc_value": "www.mersdty.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557361": [
        {
            "ioc_value": "www.mphmu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557362": [
        {
            "ioc_value": "www.mstj.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557363": [
        {
            "ioc_value": "www.ndke.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557364": [
        {
            "ioc_value": "www.ndovsjepangkemarin7.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557365": [
        {
            "ioc_value": "www.nerrj.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557366": [
        {
            "ioc_value": "www.nr1fp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557367": [
        {
            "ioc_value": "www.nugglebuds.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557368": [
        {
            "ioc_value": "www.okerdom0398.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557338": [
        {
            "ioc_value": "www.apply.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557339": [
        {
            "ioc_value": "www.aptrailhunterzone.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557340": [
        {
            "ioc_value": "www.aroon.media",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557341": [
        {
            "ioc_value": "www.ataract-surgery-85805.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557342": [
        {
            "ioc_value": "www.atchehub.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557343": [
        {
            "ioc_value": "www.avinnorris.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557344": [
        {
            "ioc_value": "www.awangmburiabang.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557345": [
        {
            "ioc_value": "www.c3471.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557346": [
        {
            "ioc_value": "www.cto.design",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557347": [
        {
            "ioc_value": "www.diryacare.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557348": [
        {
            "ioc_value": "www.edresans.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557349": [
        {
            "ioc_value": "www.emoreplay.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557350": [
        {
            "ioc_value": "www.evxxw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557351": [
        {
            "ioc_value": "www.h44x.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557352": [
        {
            "ioc_value": "www.iberacaaodigital.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557353": [
        {
            "ioc_value": "www.ingerie-22584.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557324": [
        {
            "ioc_value": "www.0qpd5.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": "2025-10-10 06:20:35",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557325": [
        {
            "ioc_value": "www.1f8zn.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557326": [
        {
            "ioc_value": "www.3-155-18-241.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557327": [
        {
            "ioc_value": "www.46.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557328": [
        {
            "ioc_value": "www.66ny5.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557329": [
        {
            "ioc_value": "www.89clubb.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557330": [
        {
            "ioc_value": "www.8vip135.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557331": [
        {
            "ioc_value": "www.ailseent.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557332": [
        {
            "ioc_value": "www.alank.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557333": [
        {
            "ioc_value": "www.amtech.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557334": [
        {
            "ioc_value": "www.ancyglobal.capital",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557335": [
        {
            "ioc_value": "www.anopyops.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557336": [
        {
            "ioc_value": "www.ansenlan.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557337": [
        {
            "ioc_value": "www.apitronis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-16 09:00:38",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557256": [
        {
            "ioc_value": "myhoster123.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-16 08:59:13",
            "last_seen_utc": "2025-08-15 12:13:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557254": [
        {
            "ioc_value": "faho-24634.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-16 08:58:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1557213": [
        {
            "ioc_value": "cdnperf.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-16 07:29:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/eb085b0601e7d719c62a4d9ae994beaeff15493936dbb23476b30275f3be088c/",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557205": [
        {
            "ioc_value": "archivedcnd-s1.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-16 07:28:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/7ca039965c09bbfeaec88bfb409deed86c93dd980823ee686e924e42ee211e89/",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557190": [
        {
            "ioc_value": "landing.kamal1.cs2.dk",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 07:24:43",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "loader,Maison Worm,maisonworm",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557196": [
        {
            "ioc_value": "job3.trnebaiek.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-16 06:03:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-gld6yaek5v",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557193": [
        {
            "ioc_value": "asegurar.mysynology.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-16 06:02:14",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-elnz2azky8",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557192": [
        {
            "ioc_value": "sirlegacy1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 06:01:44",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-fpvgnazm16",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557191": [
        {
            "ioc_value": "sirlegacy.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-16 06:01:42",
            "last_seen_utc": "2025-07-29 15:49:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250716-fpvgnazm16",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557168": [
        {
            "ioc_value": "beni.bigbankorg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-16 04:01:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/138.68.184.166+beni.bigbankorg.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1557166": [
        {
            "ioc_value": "www.blofin.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-16 04:00:39",
            "last_seen_utc": "2025-07-20 04:00:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.43+www.blofin.live",
            "tags": "AS49870,AS49870-BV,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1557163": [
        {
            "ioc_value": "dashboard.nm.xevil.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-16 04:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/212.64.38.105+dashboard.nm.xevil.cn",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1557162": [
        {
            "ioc_value": "ecs-1-94-183-238.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-16 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/1.94.183.238+ecs-1-94-183-238.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1557161": [
        {
            "ioc_value": "eucdn2.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-16 03:58:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e78d5c1530afc8284fa602b221cfe47c25ff7a6d12549d300d61143da67b2aa4/",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557154": [
        {
            "ioc_value": "sleephouses.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 02:57:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1557056": [
        {
            "ioc_value": "ib-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 02:25:01",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556971": [
        {
            "ioc_value": "deathmatchuk.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-07-16 02:13:35",
            "last_seen_utc": "2025-07-15 20:45:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,Landupdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557001": [
        {
            "ioc_value": "warpdrive.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-16 02:13:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557007": [
        {
            "ioc_value": "security.flnwareguward.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-16 02:13:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557008": [
        {
            "ioc_value": "repolix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-16 02:13:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1557015": [
        {
            "ioc_value": "cute-pudding-05af50.netlify.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-07-16 02:13:27",
            "last_seen_utc": "2025-07-16 06:11:27",
            "confidence_level": 100,
            "reference": null,
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557021": [
        {
            "ioc_value": "sos-atlanta.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-16 02:13:24",
            "last_seen_utc": "2025-07-15 21:45:41",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114859435662037961",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1557145": [
        {
            "ioc_value": "prighxzuebb3e.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:06",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557146": [
        {
            "ioc_value": "mnatyvgzy3r.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:06",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557136": [
        {
            "ioc_value": "tibhzuygfuyz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:05",
            "last_seen_utc": "2025-10-10 00:48:28",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557137": [
        {
            "ioc_value": "jbznk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:05",
            "last_seen_utc": "2025-08-27 16:58:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557138": [
        {
            "ioc_value": "test-test-explr-academy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:05",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557139": [
        {
            "ioc_value": "stlrg124.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:05",
            "last_seen_utc": "2025-08-27 16:58:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557140": [
        {
            "ioc_value": "bizu3uvgz3z.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:05",
            "last_seen_utc": "2025-08-27 16:58:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557141": [
        {
            "ioc_value": "bnzuyeubizh3f.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:05",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557142": [
        {
            "ioc_value": "segibuzh3hbz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:05",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557143": [
        {
            "ioc_value": "527newagain.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:05",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557144": [
        {
            "ioc_value": "robnzuwubz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:05",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557135": [
        {
            "ioc_value": "ikhgijabfnkajem.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:03:04",
            "last_seen_utc": "2025-08-27 16:58:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557133": [
        {
            "ioc_value": "www.test-explr-academy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:02:29",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557134": [
        {
            "ioc_value": "fazubuzbw3u2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:02:29",
            "last_seen_utc": "2025-08-27 16:58:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557117": [
        {
            "ioc_value": "sfibhzu3ubhza.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557118": [
        {
            "ioc_value": "dash-server.servertech03.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557119": [
        {
            "ioc_value": "server-cdn.xohahey822.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-14 03:17:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557120": [
        {
            "ioc_value": "server-cdn.sidoke9822.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-14 03:17:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557121": [
        {
            "ioc_value": "server-cdn.jawigaw383.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557122": [
        {
            "ioc_value": "server-cdn.virej10913.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-14 03:17:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557123": [
        {
            "ioc_value": "server-cdn.lafise2419.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557124": [
        {
            "ioc_value": "08us4w0132ps.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.brute_ratel_c4",
            "malware_alias": "BOLDBADGER,BruteRatel",
            "malware_printable": "Brute Ratel C4",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-08-28 03:27:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "brc4,Brute Ratel C4,BruteRatel,c2",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557125": [
        {
            "ioc_value": "br.citrix-connect.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.brute_ratel_c4",
            "malware_alias": "BOLDBADGER,BruteRatel",
            "malware_printable": "Brute Ratel C4",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 100,
            "reference": null,
            "tags": "brc4,Brute Ratel C4,BruteRatel,c2",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557126": [
        {
            "ioc_value": "server-cdn.lecoc56350.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557127": [
        {
            "ioc_value": "smart.mymedhospital.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.brute_ratel_c4",
            "malware_alias": "BOLDBADGER,BruteRatel",
            "malware_printable": "Brute Ratel C4",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "brc4,Brute Ratel C4,BruteRatel,c2",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557128": [
        {
            "ioc_value": "adevsoftinc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.brute_ratel_c4",
            "malware_alias": "BOLDBADGER,BruteRatel",
            "malware_printable": "Brute Ratel C4",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "brc4,Brute Ratel C4,BruteRatel,c2",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557129": [
        {
            "ioc_value": "bugs.jquery.sh",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.brute_ratel_c4",
            "malware_alias": "BOLDBADGER,BruteRatel",
            "malware_printable": "Brute Ratel C4",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-08-28 03:27:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "brc4,Brute Ratel C4,BruteRatel,c2",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557130": [
        {
            "ioc_value": "164-90-144-91.ipv4.staticdns3.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.brute_ratel_c4",
            "malware_alias": "BOLDBADGER,BruteRatel",
            "malware_printable": "Brute Ratel C4",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-08-28 03:27:44",
            "confidence_level": 100,
            "reference": null,
            "tags": "brc4,Brute Ratel C4,BruteRatel,c2",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557131": [
        {
            "ioc_value": "brc4.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.brute_ratel_c4",
            "malware_alias": "BOLDBADGER,BruteRatel",
            "malware_printable": "Brute Ratel C4",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-08-28 03:27:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "brc4,Brute Ratel C4,BruteRatel,c2",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557132": [
        {
            "ioc_value": "cdn1.poyag17470.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:25",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557115": [
        {
            "ioc_value": "cdn-web-server1.techserver01.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:24",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557116": [
        {
            "ioc_value": "soft-base-01.ginigiy117.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokedham",
            "malware_alias": null,
            "malware_printable": "SMOKEDHAM",
            "first_seen_utc": "2025-07-16 01:02:24",
            "last_seen_utc": "2025-10-14 03:17:52",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,SMOKEDHAM",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557105": [
        {
            "ioc_value": "odoo-en.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557106": [
        {
            "ioc_value": "www.seo-rub.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557107": [
        {
            "ioc_value": "microsoftdesktop.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-10-10 03:19:55",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557108": [
        {
            "ioc_value": "youtubedownloading.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-08-19 23:53:15",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557109": [
        {
            "ioc_value": "topmicrosoft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-10-01 07:28:27",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557110": [
        {
            "ioc_value": "www.googleaccount.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-08-19 23:53:15",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557111": [
        {
            "ioc_value": "infallible-tereshkova.199-247-22-187.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-08-19 23:53:15",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557112": [
        {
            "ioc_value": "kasperskyupdate.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-08-19 23:53:15",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557113": [
        {
            "ioc_value": "channels.openvista.ma",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-08-19 23:53:15",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557114": [
        {
            "ioc_value": "cfverclsid.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.mints_loader",
            "malware_alias": null,
            "malware_printable": "MintsLoader",
            "first_seen_utc": "2025-07-16 01:02:22",
            "last_seen_utc": "2025-10-09 16:50:04",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,dga,MintsLoader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557101": [
        {
            "ioc_value": "netsuite-en.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:07",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557102": [
        {
            "ioc_value": "en-aave.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:07",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557103": [
        {
            "ioc_value": "clnemaclty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:07",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557104": [
        {
            "ioc_value": "aave-en.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:07",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557051": [
        {
            "ioc_value": "www.iqe-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:39",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557052": [
        {
            "ioc_value": "app-odoo.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:34",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557053": [
        {
            "ioc_value": "ih-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557054": [
        {
            "ioc_value": "ix-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557055": [
        {
            "ioc_value": "ic-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557057": [
        {
            "ioc_value": "advanced-ip-scanes.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557058": [
        {
            "ioc_value": "ik-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557059": [
        {
            "ioc_value": "calendls.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-08-27 23:27:53",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557060": [
        {
            "ioc_value": "iw-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:33",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557061": [
        {
            "ioc_value": "advanced-ip-scaners.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557062": [
        {
            "ioc_value": "il-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557063": [
        {
            "ioc_value": "www.iqw-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557064": [
        {
            "ioc_value": "cinemaclty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:33",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557065": [
        {
            "ioc_value": "apps.odoo-en.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557066": [
        {
            "ioc_value": "www.ij-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557067": [
        {
            "ioc_value": "ae-salik-pay.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:33",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557068": [
        {
            "ioc_value": "io-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:34",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557069": [
        {
            "ioc_value": "iq-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557070": [
        {
            "ioc_value": "www.dz-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557071": [
        {
            "ioc_value": "www.iu-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557072": [
        {
            "ioc_value": "www.in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557073": [
        {
            "ioc_value": "www.dee-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557074": [
        {
            "ioc_value": "moblierecharge.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557075": [
        {
            "ioc_value": "ii-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557076": [
        {
            "ioc_value": "www.is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557077": [
        {
            "ioc_value": "iqu-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557078": [
        {
            "ioc_value": "zoho-en.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557079": [
        {
            "ioc_value": "ultravlewer.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:34",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557080": [
        {
            "ioc_value": "www.ru-whatsapp-web.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557081": [
        {
            "ioc_value": "iqr-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557082": [
        {
            "ioc_value": "tradlngvlew.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557083": [
        {
            "ioc_value": "jam-software-en.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557084": [
        {
            "ioc_value": "www.iv-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557085": [
        {
            "ioc_value": "iv-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557086": [
        {
            "ioc_value": "www.iqt-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557087": [
        {
            "ioc_value": "en-putty.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:32",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557088": [
        {
            "ioc_value": "advanced-ip-scanner.space",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557089": [
        {
            "ioc_value": "in-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557090": [
        {
            "ioc_value": "di-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:33",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557091": [
        {
            "ioc_value": "es-bet365.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557092": [
        {
            "ioc_value": "www.iz-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557093": [
        {
            "ioc_value": "ae-salik.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:34",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557094": [
        {
            "ioc_value": "angryip.info",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557095": [
        {
            "ioc_value": "wwh-club.shop",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557096": [
        {
            "ioc_value": "dtt-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557097": [
        {
            "ioc_value": "davabux.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:33",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557098": [
        {
            "ioc_value": "ip-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557099": [
        {
            "ioc_value": "is-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557100": [
        {
            "ioc_value": "www.ip-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:06",
            "last_seen_utc": null,
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557040": [
        {
            "ioc_value": "if-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557041": [
        {
            "ioc_value": "denis39.site",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557042": [
        {
            "ioc_value": "iqi-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557043": [
        {
            "ioc_value": "www.anydesk-en.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557044": [
        {
            "ioc_value": "www.iqq-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557045": [
        {
            "ioc_value": "www.ig-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557046": [
        {
            "ioc_value": "iqy-www.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557047": [
        {
            "ioc_value": "irisglobals.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:36",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557048": [
        {
            "ioc_value": "ekspert-audit.ru",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557049": [
        {
            "ioc_value": "bet365x.es",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557050": [
        {
            "ioc_value": "www.anydesk-us.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-16 01:02:05",
            "last_seen_utc": "2025-10-21 07:27:38",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1557034": [
        {
            "ioc_value": "funny-rhodes.194-26-192-12.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-07-16 00:02:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/194.26.192.12+funny-rhodes.194-26-192-12.plesk.page",
            "tags": "AS210558,C2,censys,Gafgyt,open-dir,SERVICES-1337-GMBH",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557035": [
        {
            "ioc_value": "friendly-proskuriakova.194-26-192-12.plesk.page",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-07-16 00:02:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/194.26.192.12+friendly-proskuriakova.194-26-192-12.plesk.page",
            "tags": "AS210558,C2,censys,Gafgyt,open-dir,SERVICES-1337-GMBH",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557033": [
        {
            "ioc_value": "m365.office.safelogins.su",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-16 00:02:21",
            "last_seen_utc": "2025-07-16 04:01:51",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.207.133.122+m365.office.safelogins.su",
            "tags": "AS213877,censys,EvilGinx,panel,Phishing,U1HOST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557025": [
        {
            "ioc_value": "www.quoteconsumer.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-16 00:01:54",
            "last_seen_utc": "2025-07-16 04:00:45",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.42+www.quoteconsumer.net",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1557009": [
        {
            "ioc_value": "blockchain-projects.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 20:01:50",
            "last_seen_utc": "2025-07-21 04:00:36",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.42+blockchain-projects.com",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556986": [
        {
            "ioc_value": "witherisagoat-20650.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-15 18:02:56",
            "last_seen_utc": "2025-07-29 15:48:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-wj8ebsxzbv",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556985": [
        {
            "ioc_value": "8fhd2idhacas.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 18:02:46",
            "last_seen_utc": "2025-11-10 17:12:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-q5re2sel6x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556984": [
        {
            "ioc_value": "8nioqhxciwoqc.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 18:02:44",
            "last_seen_utc": "2025-11-10 17:12:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-q5re2sel6x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556983": [
        {
            "ioc_value": "8hdfiqowchq.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 18:02:41",
            "last_seen_utc": "2025-11-10 17:12:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-q5re2sel6x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556982": [
        {
            "ioc_value": "8eh18dhq9wd.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 18:02:39",
            "last_seen_utc": "2025-11-10 17:12:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-q5re2sel6x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556981": [
        {
            "ioc_value": "8fnuawbfuac.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 18:02:36",
            "last_seen_utc": "2025-11-10 17:12:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-q5re2sel6x",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556980": [
        {
            "ioc_value": "madmrx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 18:02:30",
            "last_seen_utc": "2025-07-15 18:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-wdy9gaxygs",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556979": [
        {
            "ioc_value": "envios25.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 18:02:28",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-vp753svmw2",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556978": [
        {
            "ioc_value": "flyrbeengeek-25127.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-15 18:01:37",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-vxmjcaxxgv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556965": [
        {
            "ioc_value": "ec2-18-168-225-154.eu-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-15 16:02:26",
            "last_seen_utc": "2025-07-16 04:01:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.168.225.154+ec2-18-168-225-154.eu-west-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556939": [
        {
            "ioc_value": "files.tucsonrenovationservices.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-15 14:25:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556914": [
        {
            "ioc_value": "bcdc37vn5vr5t.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-15 12:49:16",
            "last_seen_utc": "2025-08-19 19:49:34",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556913": [
        {
            "ioc_value": "1357504293-h43knumeov.ap-guangzhou.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-15 12:49:12",
            "last_seen_utc": "2025-08-16 11:48:39",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556902": [
        {
            "ioc_value": "omnivva.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-15 12:02:00",
            "last_seen_utc": "2025-07-16 04:01:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.80.35+omnivva.shop",
            "tags": "AS401120,C2,censys,CHEAPY-HOST,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556897": [
        {
            "ioc_value": "host0.quoteconsumers.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 12:01:53",
            "last_seen_utc": "2025-07-16 04:00:41",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.81.23.42+host0.quoteconsumers.biz",
            "tags": "AS49870,AS49870-BV,AsyncRAT,C2,censys,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556895": [
        {
            "ioc_value": "record-examined.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-15 12:01:40",
            "last_seen_utc": "2025-07-29 15:49:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-nhr2ysbp51",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556894": [
        {
            "ioc_value": "rovider.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 12:01:35",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-kncyfazls4",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556864": [
        {
            "ioc_value": "mcaumnb.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-15 11:28:10",
            "last_seen_utc": "2025-07-23 19:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556865": [
        {
            "ioc_value": "daruubs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-15 11:28:09",
            "last_seen_utc": "2025-07-23 19:18:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556866": [
        {
            "ioc_value": "cidtfhh.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-15 11:28:09",
            "last_seen_utc": "2025-07-23 19:18:42",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556867": [
        {
            "ioc_value": "rayrhs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-15 11:28:09",
            "last_seen_utc": "2025-07-23 19:18:41",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556868": [
        {
            "ioc_value": "furwmsx.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-15 11:28:08",
            "last_seen_utc": "2025-07-23 19:18:40",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556877": [
        {
            "ioc_value": "monkkn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-15 11:28:08",
            "last_seen_utc": "2025-07-23 19:18:43",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/9f4feb44-da2d-492d-bc73-3b14f6a03bb3",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1556887": [
        {
            "ioc_value": "jekwuserver.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-15 11:11:11",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556888": [
        {
            "ioc_value": "nwa2323.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-15 11:11:11",
            "last_seen_utc": "2025-07-29 15:49:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556886": [
        {
            "ioc_value": "st.w.sachdevalawpublishers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-15 11:10:30",
            "last_seen_utc": "2025-07-16 13:10:29",
            "confidence_level": 75,
            "reference": null,
            "tags": "ixx,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556856": [
        {
            "ioc_value": "hwsrv-1285168.hostwindsdns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-15 08:01:54",
            "last_seen_utc": "2025-07-16 04:01:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/23.254.215.118+hwsrv-1285168.hostwindsdns.com",
            "tags": "AS54290,C2,censys,Havoc,HOSTWINDS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556848": [
        {
            "ioc_value": "b3kylyu7z.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-15 06:02:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250715-c7q1eadk6z",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556791": [
        {
            "ioc_value": "ecs-124-71-152-57.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-15 05:55:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/124.71.152.57+ecs-124-71-152-57.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1556763": [
        {
            "ioc_value": "pre-order.sodakconcretecoatings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-15 05:55:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556741": [
        {
            "ioc_value": "security.guaerdflfare.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-15 05:55:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556742": [
        {
            "ioc_value": "jemriz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-15 05:55:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556834": [
        {
            "ioc_value": "still-ie.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-15 05:29:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556833": [
        {
            "ioc_value": "alcapulco.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-15 05:29:39",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556830": [
        {
            "ioc_value": "abremeh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-15 05:28:41",
            "last_seen_utc": "2025-07-23 19:18:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556829": [
        {
            "ioc_value": "rdlaw.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-15 05:28:19",
            "last_seen_utc": "2025-07-29 15:49:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556771": [
        {
            "ioc_value": "www.yubo.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-14 22:48:44",
            "last_seen_utc": "2025-08-20 07:49:47",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556720": [
        {
            "ioc_value": "mx.minewise.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-14 19:10:25",
            "last_seen_utc": "2025-07-23 16:10:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "f4%a,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556692": [
        {
            "ioc_value": "flhg.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-14 18:04:37",
            "last_seen_utc": "2025-07-23 19:18:45",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/e83d9d0a-4255-4b29-b927-5cdf1cc36063",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1556711": [
        {
            "ioc_value": "winres-43090.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-14 18:01:58",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-whhsaavqs2",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556706": [
        {
            "ioc_value": "denagautr7jkoms2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-14 18:01:23",
            "last_seen_utc": "2025-07-16 13:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-qbvwdaaj7t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556707": [
        {
            "ioc_value": "denagautr7jkoms3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-14 18:01:23",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-qbvwdaaj7t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556708": [
        {
            "ioc_value": "denagautr7jkoms4.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-14 18:01:23",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-qbvwdaaj7t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556709": [
        {
            "ioc_value": "denagautr7jkoms5.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-14 18:01:23",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-qbvwdaaj7t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556703": [
        {
            "ioc_value": "eleme11.loseyourip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-14 18:01:22",
            "last_seen_utc": "2025-07-16 13:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-rkc8cssrt5",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556704": [
        {
            "ioc_value": "eleme11.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-14 18:01:22",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-rkc8cssrt5",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556705": [
        {
            "ioc_value": "denagautr7jkoms1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-14 18:01:22",
            "last_seen_utc": "2025-07-16 13:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-qbvwdaaj7t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556657": [
        {
            "ioc_value": "cpanel.quantumconcretecoatings.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-14 14:56:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556690": [
        {
            "ioc_value": "bunnybot.ac",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.moobot",
            "malware_alias": null,
            "malware_printable": "MooBot",
            "first_seen_utc": "2025-07-14 14:52:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "mirai,moobot",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1556686": [
        {
            "ioc_value": "botnetnn.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-14 14:17:03",
            "last_seen_utc": "2025-08-15 12:13:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556652": [
        {
            "ioc_value": "last-kernel-update.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-14 12:49:52",
            "last_seen_utc": "2025-11-05 09:49:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556651": [
        {
            "ioc_value": "deepseek.syoik.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-14 12:49:48",
            "last_seen_utc": "2025-08-20 15:49:32",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556650": [
        {
            "ioc_value": "c38ftw1bdzm4g.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-14 12:49:46",
            "last_seen_utc": "2025-08-16 11:48:43",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556636": [
        {
            "ioc_value": "kitchen-english.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-14 12:01:13",
            "last_seen_utc": "2025-07-16 13:25:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-nrs1ls1l13",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556627": [
        {
            "ioc_value": "www.t.minewise.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-14 10:10:27",
            "last_seen_utc": "2025-07-16 06:41:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "f4%a,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556603": [
        {
            "ioc_value": "manager-americans.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-14 07:20:22",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556604": [
        {
            "ioc_value": "our-ukraine.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-14 07:20:22",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556605": [
        {
            "ioc_value": "vecotr.viewdns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-14 07:20:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556602": [
        {
            "ioc_value": "vipcncnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-14 07:19:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556601": [
        {
            "ioc_value": "kk09.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-14 07:19:03",
            "last_seen_utc": "2025-07-16 13:25:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556586": [
        {
            "ioc_value": "her-quest.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-14 06:02:58",
            "last_seen_utc": "2025-08-15 12:13:19",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-c1rclaxthx",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556584": [
        {
            "ioc_value": "ailletll.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-14 06:02:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-evjfxaxqs4",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556585": [
        {
            "ioc_value": "zhuyao.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-14 06:02:30",
            "last_seen_utc": "2025-07-14 06:02:31",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-a8w7pswqv6",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556582": [
        {
            "ioc_value": "vicesmile.loseyourip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-14 06:01:46",
            "last_seen_utc": "2025-07-14 06:01:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-a81j5aan5s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556581": [
        {
            "ioc_value": "kingsddns.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-14 06:01:45",
            "last_seen_utc": "2025-07-14 06:01:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-a81j5aan5s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556579": [
        {
            "ioc_value": "baby-technological.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-14 06:01:13",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-d5pj8sxnz6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556580": [
        {
            "ioc_value": "allinline.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-14 06:01:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250714-ar8t6swpt8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556514": [
        {
            "ioc_value": "security.fralegwaard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-14 05:13:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556515": [
        {
            "ioc_value": "kopewv.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-14 05:13:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556545": [
        {
            "ioc_value": "shipcg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-14 05:13:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/38.12.36.139+shipcg.top",
            "tags": "AROSS-AS,AS400619,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1556546": [
        {
            "ioc_value": "ecs-121-36-27-251.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-14 05:13:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/121.36.27.251+ecs-121-36-27-251.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1556547": [
        {
            "ioc_value": "ec2-34-221-83-3.us-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-14 05:13:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.221.83.3+ec2-34-221-83-3.us-west-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1556553": [
        {
            "ioc_value": "ec2-3-85-192-21.compute-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-14 05:13:26",
            "last_seen_utc": "2025-07-14 04:01:47",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.85.192.21+ec2-3-85-192-21.compute-1.amazonaws.com",
            "tags": "AMAZON-AES,AS14618,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1556541": [
        {
            "ioc_value": "gd-gd.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-14 02:48:30",
            "last_seen_utc": "2025-08-30 07:49:27",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556540": [
        {
            "ioc_value": "1302498057-jifjeq2q25.na-siliconvalley.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-14 02:48:23",
            "last_seen_utc": "2025-08-13 11:49:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556495": [
        {
            "ioc_value": "attack.emocc.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-13 19:01:46",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556460": [
        {
            "ioc_value": "darkhacker07.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-13 18:03:17",
            "last_seen_utc": "2025-08-06 11:34:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250713-v83ppssyhz",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556458": [
        {
            "ioc_value": "already-ibm.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-13 17:16:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250713-r9bqts1zh1",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556457": [
        {
            "ioc_value": "adamha.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-13 17:16:48",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250713-pvpm2abj5s",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556455": [
        {
            "ioc_value": "win2325.webredirect.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-13 17:16:01",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250713-pmzs2a1lw2",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556437": [
        {
            "ioc_value": "sorrij.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-13 13:52:03",
            "last_seen_utc": "2025-07-14 16:13:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556436": [
        {
            "ioc_value": "prvqhm.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-13 13:52:02",
            "last_seen_utc": "2025-07-23 19:18:43",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556438": [
        {
            "ioc_value": "ungryo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-13 13:52:02",
            "last_seen_utc": "2025-07-14 16:13:30",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556439": [
        {
            "ioc_value": "perdvg.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-13 13:52:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1556431": [
        {
            "ioc_value": "ongmanibeimeihong.microsolt.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-13 12:49:39",
            "last_seen_utc": "2025-08-20 15:49:46",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556412": [
        {
            "ioc_value": "page-prostores.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-13 12:01:25",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250713-j7clcayrz6",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556410": [
        {
            "ioc_value": "solutions-samsung.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-13 12:01:08",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250713-h963ashn6x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556294": [
        {
            "ioc_value": "analyticasnodez.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-13 10:45:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556295": [
        {
            "ioc_value": "security.faraleshiaeld.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-13 10:45:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556325": [
        {
            "ioc_value": "xn--2vrub.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-13 10:45:20",
            "last_seen_utc": "2025-07-14 04:00:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.38.81.125+xn--2vrub.cc",
            "tags": "AS137899,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1556296": [
        {
            "ioc_value": "solpendi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-13 10:45:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556331": [
        {
            "ioc_value": "157-230-34-254.cprapid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-13 10:45:16",
            "last_seen_utc": "2025-07-13 04:01:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.230.34.254+157-230-34-254.cprapid.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1556332": [
        {
            "ioc_value": "biaderibra.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-13 10:45:16",
            "last_seen_utc": "2025-07-13 04:01:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/206.189.13.43+biaderibra.info",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1556390": [
        {
            "ioc_value": "partner-expedia.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-13 07:21:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556387": [
        {
            "ioc_value": "second-ep.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xenorat",
            "malware_alias": null,
            "malware_printable": "XenoRAT",
            "first_seen_utc": "2025-07-13 07:21:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xenorat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556386": [
        {
            "ioc_value": "envrem07.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-13 07:20:35",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556385": [
        {
            "ioc_value": "lethaldose.nodns.ca",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-13 07:20:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556384": [
        {
            "ioc_value": "top1miku.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-13 07:20:07",
            "last_seen_utc": "2025-08-23 13:26:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556382": [
        {
            "ioc_value": "names-jelsoft.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-07-13 07:19:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556381": [
        {
            "ioc_value": "bibl129.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-13 07:19:21",
            "last_seen_utc": "2025-08-15 12:13:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556351": [
        {
            "ioc_value": "xntryz.thddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-13 06:02:28",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250713-a358eswyhz",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556349": [
        {
            "ioc_value": "craftsgamer.4cloud.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-13 06:02:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250713-czleysgq6z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556299": [
        {
            "ioc_value": "10.0.minewise.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-12 23:10:27",
            "last_seen_utc": "2025-07-16 06:41:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "f4%a,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556276": [
        {
            "ioc_value": "data.reversesync.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-12 19:22:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556269": [
        {
            "ioc_value": "testermania.theworkpc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-12 18:16:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/435093feae409456b472028b78e5de8132261406c35d0f3dd28a0dc620deae21/",
            "tags": "AsyncRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556264": [
        {
            "ioc_value": "logscomenow.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-12 18:03:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/70a92cdcd65bad4c5ed38adf340d5123944acde22d94c44df7ee8178f778d761/",
            "tags": "dropped-by-DBatLoader,dropped-by-ModiLoader,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556263": [
        {
            "ioc_value": "bambaz0r.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-12 18:02:54",
            "last_seen_utc": "2025-08-06 11:34:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250712-pvmtfa1tdy",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556257": [
        {
            "ioc_value": "dc070925.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-12 18:01:25",
            "last_seen_utc": "2025-07-16 13:25:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250712-tj4d9sttcs",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556256": [
        {
            "ioc_value": "qui.realmensw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-12 18:01:07",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250712-qed22asjx3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556177": [
        {
            "ioc_value": "meosne.fit",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "apk.joker",
            "malware_alias": "Bread",
            "malware_printable": "Joker",
            "first_seen_utc": "2025-07-12 17:36:14",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": "Joker",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556234": [
        {
            "ioc_value": "map.nlscmap.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-12 12:49:23",
            "last_seen_utc": "2025-08-12 15:49:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556233": [
        {
            "ioc_value": "62crwk8ep4k5a.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-12 12:49:14",
            "last_seen_utc": "2025-08-31 09:49:45",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556231": [
        {
            "ioc_value": "employees-churches.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-12 12:25:15",
            "last_seen_utc": "2025-09-13 11:43:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556232": [
        {
            "ioc_value": "small-bend.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-12 12:25:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556230": [
        {
            "ioc_value": "indro.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.tofsee",
            "malware_alias": "Gheg",
            "malware_printable": "Tofsee",
            "first_seen_utc": "2025-07-12 12:24:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,tofsee",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556226": [
        {
            "ioc_value": "app.youroboter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-12 12:24:12",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556227": [
        {
            "ioc_value": "cloud.youroboter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-12 12:24:12",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556224": [
        {
            "ioc_value": "last.galaxias.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-12 12:23:45",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556225": [
        {
            "ioc_value": "net.bolo.gay",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-12 12:23:45",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556223": [
        {
            "ioc_value": "piotr2222-40866.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-07-12 12:23:28",
            "last_seen_utc": "2025-07-16 13:25:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556222": [
        {
            "ioc_value": "alfons.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-12 12:23:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1556188": [
        {
            "ioc_value": "mbc2.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-12 12:02:27",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250712-m569qazpv5",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556186": [
        {
            "ioc_value": "compare-jennifer.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-12 12:02:03",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250712-g72t5axsft",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556179": [
        {
            "ioc_value": "dariusfanXwomrSkiddedaahh-40602.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-12 12:01:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250712-mzktjazvct",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556176": [
        {
            "ioc_value": "iot.stellar-iot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-12 08:49:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "stellar,StellarBot",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1556175": [
        {
            "ioc_value": "server1.stellar-iot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-12 08:49:21",
            "last_seen_utc": "2025-07-12 08:49:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "stellar,StellarBot",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1556159": [
        {
            "ioc_value": "masike4.preech.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-12 06:01:55",
            "last_seen_utc": "2025-07-12 06:01:56",
            "confidence_level": 100,
            "reference": "https://tria.ge/250712-egcq7swvcs",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556155": [
        {
            "ioc_value": "westcnds.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-12 05:55:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/610cf008cceddafb1e7786f8bf0fe3d1d8344dd92e0c2b1b2f2f74b1ccd4e629/",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1556046": [
        {
            "ioc_value": "linkedservlet.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-07-12 05:40:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://app.any.run/tasks/237209eb-af1a-47e5-a2d4-76012f2f33f0",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1556051": [
        {
            "ioc_value": "eyertyn.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-12 05:40:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/315bc97f-69e0-4346-9f68-973f46961f9c",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1556052": [
        {
            "ioc_value": "www.jpchacha.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-07-12 05:40:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/315bc97f-69e0-4346-9f68-973f46961f9c",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1556056": [
        {
            "ioc_value": "ltdvjvr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-12 05:40:01",
            "last_seen_utc": "2025-07-23 19:18:46",
            "confidence_level": 100,
            "reference": "https://app.any.run/tasks/315bc97f-69e0-4346-9f68-973f46961f9c",
            "tags": null,
            "anonymous": "0",
            "reporter": "pitachu"
        }
    ],
    "1556063": [
        {
            "ioc_value": "uponmap.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-12 05:40:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1556064": [
        {
            "ioc_value": "jojo-ent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-12 05:40:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1556066": [
        {
            "ioc_value": "resutato.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-12 05:39:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1556090": [
        {
            "ioc_value": "security.flearengauurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-12 05:39:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556091": [
        {
            "ioc_value": "haciver.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-12 05:39:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556092": [
        {
            "ioc_value": "smithenv.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-07-12 05:39:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke,LandUpdate808",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1556108": [
        {
            "ioc_value": "ecs-123-60-142-31.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-12 04:00:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/123.60.142.31+ecs-123-60-142-31.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1556060": [
        {
            "ioc_value": "included-integration.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-11 18:01:13",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250711-pl2w1agk4z",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556059": [
        {
            "ioc_value": "mybabygirlevangilnegoodfirlgirlbabybgirl.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-11 18:01:05",
            "last_seen_utc": "2025-07-16 13:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250711-q667wsxpw7",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1556058": [
        {
            "ioc_value": "location-caring.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-11 18:01:01",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250711-v9bydahl5z",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555983": [
        {
            "ioc_value": "thederekmainblogportal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555984": [
        {
            "ioc_value": "quikstartmaindiloflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555985": [
        {
            "ioc_value": "fadiomasdpir.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555987": [
        {
            "ioc_value": "bagonamaditrohds.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:03",
            "last_seen_utc": "2025-08-19 20:09:57",
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555986": [
        {
            "ioc_value": "geoternalkoddfiso.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555989": [
        {
            "ioc_value": "rolkdsgwasagt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555988": [
        {
            "ioc_value": "juliavirafoklios.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555990": [
        {
            "ioc_value": "iondrivinos34.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555991": [
        {
            "ioc_value": "tidxuxisudolia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555992": [
        {
            "ioc_value": "trolsfigabubu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555993": [
        {
            "ioc_value": "irectashasdri.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:02:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555994": [
        {
            "ioc_value": "barobgpsa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555996": [
        {
            "ioc_value": "aliondrifdions.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555995": [
        {
            "ioc_value": "wasagtrolkdsg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555998": [
        {
            "ioc_value": "winfrauikol.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555997": [
        {
            "ioc_value": "gorahripliys.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555999": [
        {
            "ioc_value": "hhrrtyusdfar.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556000": [
        {
            "ioc_value": "wilowiklayd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556001": [
        {
            "ioc_value": "klafiokindw.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556002": [
        {
            "ioc_value": "llojikartid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556003": [
        {
            "ioc_value": "larioiokolid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556004": [
        {
            "ioc_value": "ttryiptiytre.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556005": [
        {
            "ioc_value": "titiytreip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556006": [
        {
            "ioc_value": "marokolidoss.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556007": [
        {
            "ioc_value": "titiprostertuk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556008": [
        {
            "ioc_value": "lilasdorycomsik.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556009": [
        {
            "ioc_value": "dosyposycom.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556010": [
        {
            "ioc_value": "visafropik.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556011": [
        {
            "ioc_value": "valifoprofsto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556012": [
        {
            "ioc_value": "higtwebgenis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556013": [
        {
            "ioc_value": "domtrst455.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556014": [
        {
            "ioc_value": "daringdesigners.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556015": [
        {
            "ioc_value": "lofiramegi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556016": [
        {
            "ioc_value": "rofleratom.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556017": [
        {
            "ioc_value": "topguningit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 16:01:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1556037": [
        {
            "ioc_value": "node-leexsirzz.safepanel.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-11 16:01:38",
            "last_seen_utc": "2025-07-12 04:00:31",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.230.34.254+node-leexsirzz.safepanel.my.id",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555982": [
        {
            "ioc_value": "ireblogthedomsiki.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.latrodectus",
            "malware_alias": "BLACKWIDOW,IceNova,Latrodectus,Lotus",
            "malware_printable": "Latrodectus",
            "first_seen_utc": "2025-07-11 15:57:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "latrodectus",
            "anonymous": "1",
            "reporter": "_ik_"
        }
    ],
    "1555976": [
        {
            "ioc_value": "buyedmeds.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-11 15:57:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1555979": [
        {
            "ioc_value": "accountsitte.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-11 15:57:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1555969": [
        {
            "ioc_value": "josyfs.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-11 13:22:01",
            "last_seen_utc": "2025-07-11 17:33:03",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1555971": [
        {
            "ioc_value": "ai-dev.overscaleconsulting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-11 13:22:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1555967": [
        {
            "ioc_value": "3wz63jwcct4de.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-11 12:51:50",
            "last_seen_utc": "2025-08-11 11:49:36",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555954": [
        {
            "ioc_value": "usr-smithsonian.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-11 12:01:22",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250711-lmm8fstvcs",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555951": [
        {
            "ioc_value": "freemadness.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-11 12:01:05",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250711-h7tdesgr7v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555952": [
        {
            "ioc_value": "johngavins12311860.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-11 12:01:05",
            "last_seen_utc": "2025-07-16 13:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250711-h3rc9sgr3w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555953": [
        {
            "ioc_value": "johngavins2311860.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-11 12:01:05",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250711-h3rc9sgr3w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555949": [
        {
            "ioc_value": "atlantqlpt.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-11 09:53:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555948": [
        {
            "ioc_value": "armorratdns.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-11 09:50:08",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555946": [
        {
            "ioc_value": "cameldomain1.n-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-11 09:49:52",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555947": [
        {
            "ioc_value": "cdn.valgap.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-11 09:49:52",
            "last_seen_utc": "2025-08-15 12:13:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555944": [
        {
            "ioc_value": "1.izumisv1.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-11 09:49:51",
            "last_seen_utc": "2025-08-15 12:13:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555945": [
        {
            "ioc_value": "abc.izumisv1.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-11 09:49:51",
            "last_seen_utc": "2025-08-15 12:13:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555943": [
        {
            "ioc_value": "7kmynviev.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-11 09:49:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555941": [
        {
            "ioc_value": "chat.kongfupro.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-11 09:48:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555942": [
        {
            "ioc_value": "dogcsdogcs.js",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-11 09:48:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555940": [
        {
            "ioc_value": "subasyncratlog.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-11 09:48:35",
            "last_seen_utc": "2025-07-16 13:25:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555909": [
        {
            "ioc_value": "correctwion.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-07-11 08:41:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/eec9b4769ab34844f5f6caa304bad459780fe72e337eb8d686f01fcfd3833ac0/",
            "tags": "CHE,ClickFix,geo,HijackLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555910": [
        {
            "ioc_value": "helpfullyk.click",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-07-11 08:41:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/eec9b4769ab34844f5f6caa304bad459780fe72e337eb8d686f01fcfd3833ac0/",
            "tags": "CHE,ClickFix,geo,HijackLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555811": [
        {
            "ioc_value": "discoveronline.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-11 06:33:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1555807": [
        {
            "ioc_value": "altopew.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-11 06:33:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1555808": [
        {
            "ioc_value": "getin.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-11 06:33:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1555806": [
        {
            "ioc_value": "security.fbaregwaurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-11 06:33:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1555739": [
        {
            "ioc_value": "images.mildecommercialrealestate.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-11 06:33:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1555895": [
        {
            "ioc_value": "blue.o7lab.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-11 06:01:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250711-cvndraem4w",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555894": [
        {
            "ioc_value": "brimaganla.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-11 06:01:03",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250711-d8dxxa1wa1",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555855": [
        {
            "ioc_value": "www.cloudpacket.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-11 02:49:16",
            "last_seen_utc": "2025-08-10 15:49:32",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555854": [
        {
            "ioc_value": "pe40.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-11 02:49:12",
            "last_seen_utc": "2025-08-18 15:49:59",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555832": [
        {
            "ioc_value": "a26.nbdsnb2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.fatal_rat",
            "malware_alias": "Sainbox RAT",
            "malware_printable": "FatalRat",
            "first_seen_utc": "2025-07-10 23:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-krypbasvaw",
            "tags": "C2,domain,fatalrat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555833": [
        {
            "ioc_value": "a19.nbdsnb2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.fatal_rat",
            "malware_alias": "Sainbox RAT",
            "malware_printable": "FatalRat",
            "first_seen_utc": "2025-07-10 23:19:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-njjrzafl8s",
            "tags": "C2,domain,fatalrat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555827": [
        {
            "ioc_value": "about-source.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-10 23:18:09",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-27d4aaztfy",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555824": [
        {
            "ioc_value": "hallo2222-49080.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-10 23:17:44",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-ypgjxahr4z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555823": [
        {
            "ioc_value": "2305133156.a1.luyouxia.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-10 23:17:40",
            "last_seen_utc": "2025-07-16 13:25:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-xqvmgswjw9",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555819": [
        {
            "ioc_value": "bestpeoplesaroundtheworldwithbeautifullt.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-10 23:17:34",
            "last_seen_utc": "2025-07-16 13:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-2mr5eazsex",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555772": [
        {
            "ioc_value": "daliascon.ddnsfree.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-10 18:03:04",
            "last_seen_utc": "2025-08-06 11:34:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-q5b1csek8t",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555770": [
        {
            "ioc_value": "filter-load.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-10 18:01:07",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-rwycnsem8t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555769": [
        {
            "ioc_value": "chiwalk79.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-10 18:00:55",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-vhd9escj9z",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555768": [
        {
            "ioc_value": "hi-auto.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-10 18:00:51",
            "last_seen_utc": "2025-07-16 13:25:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-v6ej4axtgw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555730": [
        {
            "ioc_value": "least-crack.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-10 12:51:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555731": [
        {
            "ioc_value": "unit-reproductive.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-10 12:51:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555732": [
        {
            "ioc_value": "bikkiayan-31518.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-10 12:51:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555733": [
        {
            "ioc_value": "show-copy.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-10 12:51:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555734": [
        {
            "ioc_value": "clothing-wooden.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-10 12:51:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555724": [
        {
            "ioc_value": "connect.jssaytcp.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555725": [
        {
            "ioc_value": "pma.jarry.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555726": [
        {
            "ioc_value": "scan.rainb0w69.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555727": [
        {
            "ioc_value": "scan.darkiot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555728": [
        {
            "ioc_value": "seven.nadns.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555729": [
        {
            "ioc_value": "cnc.botbuji.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555714": [
        {
            "ioc_value": "scan.ccie.cash",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555715": [
        {
            "ioc_value": "waitwhatisthis.societynetwork.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555716": [
        {
            "ioc_value": "keke.stolevpn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555717": [
        {
            "ioc_value": "casino1929299910.o-r.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555718": [
        {
            "ioc_value": "scan.atomdata.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555719": [
        {
            "ioc_value": "scan.stolevpn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555720": [
        {
            "ioc_value": "p.x86thx.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555721": [
        {
            "ioc_value": "c.overflow.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555722": [
        {
            "ioc_value": "bot.vac.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555723": [
        {
            "ioc_value": "cnc.301.church",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555705": [
        {
            "ioc_value": "majnon-hack.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.extreme_rat",
            "malware_alias": "ExtRat",
            "malware_printable": "Xtreme RAT",
            "first_seen_utc": "2025-07-10 12:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555706": [
        {
            "ioc_value": "miz.lspmodz.ml",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555707": [
        {
            "ioc_value": "s.overflow.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555708": [
        {
            "ioc_value": "cnc.rainb0w69.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555709": [
        {
            "ioc_value": "bot.skylablool.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555710": [
        {
            "ioc_value": "cnc.404verified.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555711": [
        {
            "ioc_value": "narco.thotiana.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555712": [
        {
            "ioc_value": "cnc.ccie.cash",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555713": [
        {
            "ioc_value": "random.societynetwork.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-10 12:51:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555703": [
        {
            "ioc_value": "winmonitor97435hr463n.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-07-10 12:51:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555704": [
        {
            "ioc_value": "doufou.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.extreme_rat",
            "malware_alias": "ExtRat",
            "malware_printable": "Xtreme RAT",
            "first_seen_utc": "2025-07-10 12:51:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555695": [
        {
            "ioc_value": "phunktech.no-ip.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555696": [
        {
            "ioc_value": "olol.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555697": [
        {
            "ioc_value": "ayyashio.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555698": [
        {
            "ioc_value": "emek.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555683": [
        {
            "ioc_value": "codeeatsass.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555684": [
        {
            "ioc_value": "radhan.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555685": [
        {
            "ioc_value": "bahoi.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555686": [
        {
            "ioc_value": "tri5.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555687": [
        {
            "ioc_value": "foihacked.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555688": [
        {
            "ioc_value": "ufuq51.serveftp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555689": [
        {
            "ioc_value": "hhost5.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555690": [
        {
            "ioc_value": "skywebhost.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555691": [
        {
            "ioc_value": "zerefy99.noip.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555692": [
        {
            "ioc_value": "goulis.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555693": [
        {
            "ioc_value": "beao.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555694": [
        {
            "ioc_value": "radhan.no-ip.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-10 12:51:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555676": [
        {
            "ioc_value": "ftd69ud5g.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-07-10 12:51:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555677": [
        {
            "ioc_value": "bbrendanbl42.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-07-10 12:51:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555678": [
        {
            "ioc_value": "sjk2048emma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-07-10 12:51:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555675": [
        {
            "ioc_value": "fomatic.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-10 12:51:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555672": [
        {
            "ioc_value": "windns.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-10 12:51:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555671": [
        {
            "ioc_value": "photocharges.ddnsgeek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ave_maria",
            "malware_alias": "AVE_MARIA,AveMariaRAT,Warzone RAT,WarzoneRAT,avemaria",
            "malware_printable": "Ave Maria",
            "first_seen_utc": "2025-07-10 12:50:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555667": [
        {
            "ioc_value": "doc.office365update.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-10 12:50:54",
            "last_seen_utc": "2025-08-18 15:49:48",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555664": [
        {
            "ioc_value": "workingmiracles.3utilities.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-10 12:50:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555665": [
        {
            "ioc_value": "ctdt.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-10 12:50:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555666": [
        {
            "ioc_value": "educational-scores.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-10 12:50:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555662": [
        {
            "ioc_value": "cieloo2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-10 12:50:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555658": [
        {
            "ioc_value": "ronymahmoud.camdvr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-10 12:50:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555659": [
        {
            "ioc_value": "envio01.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-10 12:50:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555660": [
        {
            "ioc_value": "sdashboard.ddns-ip.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-10 12:50:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555661": [
        {
            "ioc_value": "news-previous.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-10 12:50:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555654": [
        {
            "ioc_value": "loudpub.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-10 12:50:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555655": [
        {
            "ioc_value": "filelist.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-10 12:50:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555656": [
        {
            "ioc_value": "multi-laid.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-10 12:50:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555657": [
        {
            "ioc_value": "goatdjdj-59021.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-10 12:50:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "10July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1555618": [
        {
            "ioc_value": "artists-drew.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-10 12:01:16",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-m149kaer6t",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555610": [
        {
            "ioc_value": "taker202.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-10 12:01:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-gzg5rahn4y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555611": [
        {
            "ioc_value": "taker202.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-10 12:01:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-gzg5rahn4y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555607": [
        {
            "ioc_value": "newpage44.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-10 12:01:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-g1h4fahp21",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555605": [
        {
            "ioc_value": "iykemonii.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-10 12:01:00",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-hg5zja1wcs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555606": [
        {
            "ioc_value": "kingmethod.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-10 12:01:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-g1vggayqz9",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555585": [
        {
            "ioc_value": "1v6pqsve9hg3gy.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555586": [
        {
            "ioc_value": "7p788ywb3z9fwe.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555587": [
        {
            "ioc_value": "vzf1g0it8gpvq7.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555588": [
        {
            "ioc_value": "oqu78tlfbxcf50.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555589": [
        {
            "ioc_value": "th87nd6s31jke7.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555569": [
        {
            "ioc_value": "54jmh8bnrpha7y.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555570": [
        {
            "ioc_value": "y9e05pr4v7lhp9.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555571": [
        {
            "ioc_value": "o44e59aio5jk9q.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555572": [
        {
            "ioc_value": "u0tkv94vt86y23.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555573": [
        {
            "ioc_value": "q2myvg0j1nna57.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555574": [
        {
            "ioc_value": "x5b6lm11d90dht.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555575": [
        {
            "ioc_value": "invutsz52frzl8.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555576": [
        {
            "ioc_value": "t052317kru670j.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555577": [
        {
            "ioc_value": "011jn31n05qzpp.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555578": [
        {
            "ioc_value": "tqilxwrw5m54pj.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555579": [
        {
            "ioc_value": "pkzwaki575nsll.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555580": [
        {
            "ioc_value": "z3l0kxd46ulurv.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555581": [
        {
            "ioc_value": "z55s2t6ca702es.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555582": [
        {
            "ioc_value": "nrej2ipydbg40k.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555583": [
        {
            "ioc_value": "15eaytwast9oig.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555584": [
        {
            "ioc_value": "560tvzwrobbl2k.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555554": [
        {
            "ioc_value": "gkukvtxlew982a.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555555": [
        {
            "ioc_value": "3h98rycjvt3gj5.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555556": [
        {
            "ioc_value": "xgcibmd1rd21us.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555557": [
        {
            "ioc_value": "kecah03gobzlrt.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555558": [
        {
            "ioc_value": "jpgw5b5zv4vdoy.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555559": [
        {
            "ioc_value": "hnxkyiagzxlvv0.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555560": [
        {
            "ioc_value": "aelovxoinqta4a.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555561": [
        {
            "ioc_value": "ae7a1pbhn5ytpe.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555562": [
        {
            "ioc_value": "fbixeudnf6vbhh.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555563": [
        {
            "ioc_value": "cjlv1576zqgb47.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555564": [
        {
            "ioc_value": "j8plhuz7p6052k.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555565": [
        {
            "ioc_value": "pk743hnddx0nds.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555566": [
        {
            "ioc_value": "3pu8prnkr8v31d.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555567": [
        {
            "ioc_value": "2gdaqm18d6p9d8.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555568": [
        {
            "ioc_value": "avm2dir92zqv9x.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555540": [
        {
            "ioc_value": "acl1omagtzq38v.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555541": [
        {
            "ioc_value": "18xsm4245vgytb.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555542": [
        {
            "ioc_value": "q008rx2d58h76q.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555543": [
        {
            "ioc_value": "cybf5coa1t2xr2.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555544": [
        {
            "ioc_value": "tx6jny2iaea186.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555545": [
        {
            "ioc_value": "3pvk0zw1k7g28h.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555546": [
        {
            "ioc_value": "nrd1qnd4l7tcp9.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555547": [
        {
            "ioc_value": "bvt69kywl2s8rg.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555548": [
        {
            "ioc_value": "0youdp14i4r4h5.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555549": [
        {
            "ioc_value": "r4aadwqq9d2h24.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555550": [
        {
            "ioc_value": "l2q3fkrpgyxr8r.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555551": [
        {
            "ioc_value": "s6mngnfnj9nrfj.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555552": [
        {
            "ioc_value": "2yr46kghd39ise.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555553": [
        {
            "ioc_value": "fo1463oipy7oq8.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555524": [
        {
            "ioc_value": "0jfv3ru6slys8b.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555525": [
        {
            "ioc_value": "mh4bjdyhen3d9z.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555526": [
        {
            "ioc_value": "v3hm711ignzez6.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555527": [
        {
            "ioc_value": "xuixp4uro6pl3z.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555528": [
        {
            "ioc_value": "haq82ih59xa38b.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555529": [
        {
            "ioc_value": "zs2u14kk7bqbn2.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555530": [
        {
            "ioc_value": "zrym1d73kdmimj.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555531": [
        {
            "ioc_value": "r2r3qzjb3bp1ar.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555532": [
        {
            "ioc_value": "z3vni7gw9q1i8p.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555533": [
        {
            "ioc_value": "nlvskzui15vxju.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555534": [
        {
            "ioc_value": "13ov5ypehzqx5l.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555535": [
        {
            "ioc_value": "2x51hwe9cnidu4.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555536": [
        {
            "ioc_value": "gydu03jt8n5e41.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555537": [
        {
            "ioc_value": "gd2i9y77jhbjqb.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555538": [
        {
            "ioc_value": "9g055w2ak8hd6t.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555539": [
        {
            "ioc_value": "x5x2vq5joobqxe.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555508": [
        {
            "ioc_value": "wp67lr8ysypurn.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555509": [
        {
            "ioc_value": "1ge03xy5vtwn5s.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555510": [
        {
            "ioc_value": "958xz3300iu8oe.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555511": [
        {
            "ioc_value": "dlbqduy9gjprko.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555512": [
        {
            "ioc_value": "tycl4o5dep10cd.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555513": [
        {
            "ioc_value": "ui9bex45gw70az.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555514": [
        {
            "ioc_value": "trj1qy559ygvx3.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555515": [
        {
            "ioc_value": "w823niq7veztr9.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555516": [
        {
            "ioc_value": "01t05hb4armbco.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555517": [
        {
            "ioc_value": "igl71zhw25qw3d.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555518": [
        {
            "ioc_value": "j8ku0xu0dqduxr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555519": [
        {
            "ioc_value": "jy3y61q6hyhf4c.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555520": [
        {
            "ioc_value": "s96phai2s1wzen.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555521": [
        {
            "ioc_value": "usguzk6xqox3ss.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555522": [
        {
            "ioc_value": "vfo2q74c1y0x74.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555523": [
        {
            "ioc_value": "tig85m8n7xixaz.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555493": [
        {
            "ioc_value": "8doj8uvx604eck.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555494": [
        {
            "ioc_value": "kwywztxoo2xdot.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555495": [
        {
            "ioc_value": "2rxyt9urhq0bgj.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555496": [
        {
            "ioc_value": "ky1d1p1daahe5t.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555497": [
        {
            "ioc_value": "ovh1kn1tcqw5kp.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555498": [
        {
            "ioc_value": "6cimu4mc085em8.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555499": [
        {
            "ioc_value": "5ka8rxp6t6eup2.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555500": [
        {
            "ioc_value": "ks50ioz9nm3v05.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555501": [
        {
            "ioc_value": "v5rjsdqogstopr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555502": [
        {
            "ioc_value": "epnl524h4k03mu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555503": [
        {
            "ioc_value": "hpzmehtnkk4q22.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555504": [
        {
            "ioc_value": "ygvmhd7ll9v2nu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555505": [
        {
            "ioc_value": "oovlcxvht9kupu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555506": [
        {
            "ioc_value": "1074slp8zafyz3.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555507": [
        {
            "ioc_value": "vfwlzltibeg7ne.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555490": [
        {
            "ioc_value": "ev2sirbd269o5j.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555491": [
        {
            "ioc_value": "ijt0l3i8brit6q.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555492": [
        {
            "ioc_value": "ewujsfb1dp5ran.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bumblebee",
            "malware_alias": "COLDTRAIN,SHELLSTING,Shindig",
            "malware_printable": "BumbleBee",
            "first_seen_utc": "2025-07-10 10:08:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905/",
            "tags": "BumbleBee,grp0002",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555449": [
        {
            "ioc_value": "trendings.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-10 06:07:11",
            "last_seen_utc": "2025-07-10 22:07:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "zphp",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555448": [
        {
            "ioc_value": "privatephotos.online",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-10 06:06:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "keitaro",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555446": [
        {
            "ioc_value": "beenpaidwoo-29303.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-10 06:06:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555447": [
        {
            "ioc_value": "beenpaidwoo-61863.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-10 06:06:24",
            "last_seen_utc": "2025-07-15 05:29:39",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555440": [
        {
            "ioc_value": "canawarz.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-10 06:02:51",
            "last_seen_utc": "2025-08-06 11:34:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-ardzsstrx7",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555441": [
        {
            "ioc_value": "canawarz.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-10 06:02:51",
            "last_seen_utc": "2025-08-06 11:34:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-ardzsstrx7",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555437": [
        {
            "ioc_value": "asadeanjo.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-10 06:02:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-ejvd2aywdw",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555438": [
        {
            "ioc_value": "d0ngol.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-10 06:02:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-c7yegsbj8v",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555439": [
        {
            "ioc_value": "canawarz.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-10 06:02:50",
            "last_seen_utc": "2025-08-06 11:34:11",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-ardzsstrx7",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555436": [
        {
            "ioc_value": "user11ghost.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-10 06:02:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-f8d9sael5v",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555433": [
        {
            "ioc_value": "a.zqycftmex.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-10 06:02:33",
            "last_seen_utc": "2025-07-10 06:02:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-fzffgszxd1",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555434": [
        {
            "ioc_value": "yk.ggdy.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-10 06:02:33",
            "last_seen_utc": "2025-07-10 06:02:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-ege7bsxjw8",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555432": [
        {
            "ioc_value": "privateone.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-10 06:02:22",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250710-e3vtxaxmw8",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555403": [
        {
            "ioc_value": "ent.santutxuht.eus",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-10 04:01:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/167.86.110.179+ent.santutxuht.eus",
            "tags": "AS51167,C2,censys,CONTABO,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1555280": [
        {
            "ioc_value": "xp.w.minewise.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-09 22:10:27",
            "last_seen_utc": "2025-07-12 22:10:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "f4%a,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1555124": [
        {
            "ioc_value": "karlosar.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-09 18:02:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-saffeaypw8",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555121": [
        {
            "ioc_value": "siembonik-44853.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-09 18:01:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-tp4l8azlv3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555117": [
        {
            "ioc_value": "UID2024-28522.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-09 18:01:06",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-wb7sts11cx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555118": [
        {
            "ioc_value": "UID2024-24182.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-09 18:01:06",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-wb7sts11cx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555119": [
        {
            "ioc_value": "UID2024-49856.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-09 18:01:06",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-wb7sts11cx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555120": [
        {
            "ioc_value": "UID2024-24218.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-09 18:01:06",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-wb7sts11cx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555115": [
        {
            "ioc_value": "beenpaidwoo-20559.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-09 18:01:05",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-wehywa11ew",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555116": [
        {
            "ioc_value": "UID2024-48532.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-09 18:01:05",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-wb7sts11cx",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555114": [
        {
            "ioc_value": "30.ip.gl.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-09 18:00:48",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-py1vgaxjw3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555111": [
        {
            "ioc_value": "enter-sierra.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-09 18:00:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-tp4l8azlv3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555112": [
        {
            "ioc_value": "pa-speech.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-09 18:00:47",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-qyzsvaxqs4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555090": [
        {
            "ioc_value": "c-cure.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-09 14:42:29",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555089": [
        {
            "ioc_value": "german-exhibitions.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-09 14:42:12",
            "last_seen_utc": "2025-07-16 13:25:39",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555088": [
        {
            "ioc_value": "abel2024-29427.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-09 14:41:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555087": [
        {
            "ioc_value": "ducktipo.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-09 14:41:40",
            "last_seen_utc": "2025-08-06 11:34:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,nanocore",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555085": [
        {
            "ioc_value": "bot.nightbotnet.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-09 14:41:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555086": [
        {
            "ioc_value": "cnnetwork.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-09 14:41:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1555063": [
        {
            "ioc_value": "assets.studermfg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-09 14:40:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1555014": [
        {
            "ioc_value": "novermber12.dynamic-dns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-09 12:01:06",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-k9qfnafq5x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555008": [
        {
            "ioc_value": "goodhost.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-09 12:00:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-gylrjswpz3",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555009": [
        {
            "ioc_value": "late-starting.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-09 12:00:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-gt8qhswnx5",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1555007": [
        {
            "ioc_value": "game-charleston.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-09 12:00:58",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-hes7ysvvg1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554978": [
        {
            "ioc_value": "108.8.sarijayaco.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-09 08:11:08",
            "last_seen_utc": "2025-07-10 07:28:44",
            "confidence_level": 75,
            "reference": null,
            "tags": "f4%a,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554958": [
        {
            "ioc_value": "secfileshare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-09 07:22:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,NordDragonScan",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554959": [
        {
            "ioc_value": "kpuszkiev.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-09 07:22:43",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,NordDragonScan",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554957": [
        {
            "ioc_value": "fiuylj.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-09 07:22:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554955": [
        {
            "ioc_value": "jqueryapishelpers.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-09 07:21:53",
            "last_seen_utc": "2025-08-23 21:34:35",
            "confidence_level": 50,
            "reference": "",
            "tags": "keitaro",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554956": [
        {
            "ioc_value": "fetchapiutility.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-09 07:21:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "keitaro",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554949": [
        {
            "ioc_value": "www.uochantanhua.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554950": [
        {
            "ioc_value": "www.vow0bfd7z3-wc8g.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554951": [
        {
            "ioc_value": "www.x06n.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554952": [
        {
            "ioc_value": "www.yfamily.bar",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554939": [
        {
            "ioc_value": "www.q8ocuz2.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554940": [
        {
            "ioc_value": "www.rolan.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554941": [
        {
            "ioc_value": "www.rtprinthop.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554942": [
        {
            "ioc_value": "www.shfgr.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554943": [
        {
            "ioc_value": "www.sy609.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554944": [
        {
            "ioc_value": "www.trezcip.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554945": [
        {
            "ioc_value": "www.txbx2.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554946": [
        {
            "ioc_value": "www.ubuly.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554947": [
        {
            "ioc_value": "www.ucnso.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554948": [
        {
            "ioc_value": "www.unseokyang.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554930": [
        {
            "ioc_value": "www.omagugra.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554931": [
        {
            "ioc_value": "www.otholez.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554932": [
        {
            "ioc_value": "www.ov-fze-pay.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554933": [
        {
            "ioc_value": "www.ov-vdotbt.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554934": [
        {
            "ioc_value": "www.ovapeptide.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554935": [
        {
            "ioc_value": "www.ovie-tickets-89216.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554936": [
        {
            "ioc_value": "www.pennatelindhq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554937": [
        {
            "ioc_value": "www.pkmagic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554938": [
        {
            "ioc_value": "www.q0.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554922": [
        {
            "ioc_value": "www.lphacustcareapp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554923": [
        {
            "ioc_value": "www.lphagatherhappyhoney.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554924": [
        {
            "ioc_value": "www.m444.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554925": [
        {
            "ioc_value": "www.obgil.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554926": [
        {
            "ioc_value": "www.occpit.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554927": [
        {
            "ioc_value": "www.ocumessage.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554928": [
        {
            "ioc_value": "www.oldenapple.studio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554929": [
        {
            "ioc_value": "www.ollectionss.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:08",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554914": [
        {
            "ioc_value": "www.hlbfs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554915": [
        {
            "ioc_value": "www.iendaahorro.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554916": [
        {
            "ioc_value": "www.ifodsiffl.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554917": [
        {
            "ioc_value": "www.jalki123fa.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554918": [
        {
            "ioc_value": "www.kv16ybq7qm.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554919": [
        {
            "ioc_value": "www.landestinecreations.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554920": [
        {
            "ioc_value": "www.latformjago89servervip.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554921": [
        {
            "ioc_value": "www.limaxholdings.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:07",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554906": [
        {
            "ioc_value": "www.estcleaningquote.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554907": [
        {
            "ioc_value": "www.etabeauty.clinic",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554908": [
        {
            "ioc_value": "www.etmagneticmessaging.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554909": [
        {
            "ioc_value": "www.ffoik.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554910": [
        {
            "ioc_value": "www.g-farcaster.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554911": [
        {
            "ioc_value": "www.hamarhqh.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554912": [
        {
            "ioc_value": "www.henhuazhai.food",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554913": [
        {
            "ioc_value": "www.hepio.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554898": [
        {
            "ioc_value": "www.atamspa.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554899": [
        {
            "ioc_value": "www.c0518.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554900": [
        {
            "ioc_value": "www.creenboard.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554901": [
        {
            "ioc_value": "www.d25124166.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554902": [
        {
            "ioc_value": "www.del.business",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554903": [
        {
            "ioc_value": "www.eboldbraverobot.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554904": [
        {
            "ioc_value": "www.electsoftwarereviewshub.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554905": [
        {
            "ioc_value": "www.eraka189sleepguy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554891": [
        {
            "ioc_value": "www.88865.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554892": [
        {
            "ioc_value": "www.ababakh.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554893": [
        {
            "ioc_value": "www.acking-jobs-17785.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554894": [
        {
            "ioc_value": "www.ai8866.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554895": [
        {
            "ioc_value": "www.andirussell.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554896": [
        {
            "ioc_value": "www.anguage-courses-93435.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554897": [
        {
            "ioc_value": "www.apecash88.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554889": [
        {
            "ioc_value": "www.8293.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554890": [
        {
            "ioc_value": "www.868com643.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554888": [
        {
            "ioc_value": "www.-sky.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-09 07:20:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554821": [
        {
            "ioc_value": "newxx.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-09 06:54:29",
            "last_seen_utc": "2025-08-06 11:34:08",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-chwvcsfp2s",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554814": [
        {
            "ioc_value": "natural-hide.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-09 06:50:36",
            "last_seen_utc": "2025-08-06 11:33:55",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-c55qsazyax",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554783": [
        {
            "ioc_value": "autodiscover.ransomed.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-09 06:16:34",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/TheRavenFile/Daily-Hunt/blob/main/RansomedVC",
            "tags": "ransomedvc,ransomware",
            "anonymous": "0",
            "reporter": "TheRavenFile"
        }
    ],
    "1554782": [
        {
            "ioc_value": "autoconfig.ransomed.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-09 06:16:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/TheRavenFile/Daily-Hunt/blob/main/RansomedVC",
            "tags": "ransomedvc,ransomware",
            "anonymous": "0",
            "reporter": "TheRavenFile"
        }
    ],
    "1554784": [
        {
            "ioc_value": "cdn.ransomed.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-09 06:16:31",
            "last_seen_utc": "2025-07-09 06:09:46",
            "confidence_level": 50,
            "reference": "https://github.com/TheRavenFile/Daily-Hunt/blob/main/RansomedVC",
            "tags": "ransomedvc,ransomware",
            "anonymous": "0",
            "reporter": "TheRavenFile"
        }
    ],
    "1554785": [
        {
            "ioc_value": "mail.ransomed.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-09 06:16:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/TheRavenFile/Daily-Hunt/blob/main/RansomedVC",
            "tags": "ransomedvc,ransomware",
            "anonymous": "0",
            "reporter": "TheRavenFile"
        }
    ],
    "1554786": [
        {
            "ioc_value": "market.ransomed.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-09 06:16:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://github.com/TheRavenFile/Daily-Hunt/blob/main/RansomedVC",
            "tags": "ransomedvc,ransomware",
            "anonymous": "0",
            "reporter": "TheRavenFile"
        }
    ],
    "1554801": [
        {
            "ioc_value": "wd11.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-09 06:12:06",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-d5xkvabp7s",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554769": [
        {
            "ioc_value": "verfycash.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-09 06:08:17",
            "last_seen_utc": "2025-07-16 13:25:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-afgasa1nw4",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554763": [
        {
            "ioc_value": "dczip7.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-09 06:08:07",
            "last_seen_utc": "2025-07-16 13:25:30",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-et66ks1zdz",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554742": [
        {
            "ioc_value": "ms-office1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-09 06:04:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-ekd4fa1whs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554741": [
        {
            "ioc_value": "ms-office.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-09 06:04:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-ekd4fa1whs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554740": [
        {
            "ioc_value": "hajouts8koumis12.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-09 06:04:34",
            "last_seen_utc": "2025-07-16 13:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-gghnkaem3x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554739": [
        {
            "ioc_value": "hajouts8koumis11.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-09 06:04:29",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-gghnkaem3x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554738": [
        {
            "ioc_value": "hajouts8koumis10.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-09 06:04:25",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-gghnkaem3x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554737": [
        {
            "ioc_value": "casino.ddnss.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-09 06:04:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-gdknraszaz",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554732": [
        {
            "ioc_value": "anonsim.pw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-09 06:02:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-eltkhstpv7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554725": [
        {
            "ioc_value": "regone.dnsframe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-09 06:02:09",
            "last_seen_utc": "2025-07-16 13:25:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250709-gj5k4sen8w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554676": [
        {
            "ioc_value": "baidu-cdn29.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-09 02:56:07",
            "last_seen_utc": "2025-08-09 07:49:17",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554648": [
        {
            "ioc_value": "test10.scacasdxc.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-08 22:57:14",
            "last_seen_utc": "2025-08-17 09:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554647": [
        {
            "ioc_value": "edge3.bsqb.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-08 22:56:43",
            "last_seen_utc": "2025-08-13 07:50:05",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554504": [
        {
            "ioc_value": "www.thelist2win.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-08 21:28:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1554507": [
        {
            "ioc_value": "bruconriz72.futurox.store",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.umbral",
            "malware_alias": null,
            "malware_printable": "Umbral",
            "first_seen_utc": "2025-07-08 21:28:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "umbral",
            "anonymous": "0",
            "reporter": "Felipe"
        }
    ],
    "1554524": [
        {
            "ioc_value": "iwine.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-08 21:28:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1554626": [
        {
            "ioc_value": "www.bonusnewmember.fyi",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-08 20:01:39",
            "last_seen_utc": "2025-07-17 04:02:40",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/128.199.152.169+www.bonusnewmember.fyi",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554603": [
        {
            "ioc_value": "hosts32.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-08 18:04:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-pnjs7stry5",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554602": [
        {
            "ioc_value": "www.dddddddguashjdka.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-08 18:03:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-vc24asvvhx",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554593": [
        {
            "ioc_value": "google-com-site-backup.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-08 18:01:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-r3rtgawlw3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554594": [
        {
            "ioc_value": "codingoffensive.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-08 18:01:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-r3rtgawlw3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554590": [
        {
            "ioc_value": "hciagriitec.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-08 18:00:51",
            "last_seen_utc": "2025-07-16 13:25:37",
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-ql4k9sgj6t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554533": [
        {
            "ioc_value": "technovisionpromaxx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-08 16:37:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e9eec0c02ac6d8b13332cc14ce7a035572f9d45080e817bd7e30e5e6f46bdc6d/",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554532": [
        {
            "ioc_value": "116b1bac-dcea-42f0-befb-e4383be4037a.k8s.ondigitalocean.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-08 16:01:19",
            "last_seen_utc": "2025-07-09 04:00:52",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/138.197.32.49+116b1bac-dcea-42f0-befb-e4383be4037a.k8s.ondigitalocean.com",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554523": [
        {
            "ioc_value": "gbotupdate19xx.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.strelastealer",
            "malware_alias": null,
            "malware_printable": "StrelaStealer",
            "first_seen_utc": "2025-07-08 15:21:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "StrelaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554520": [
        {
            "ioc_value": "draw.treetrauma.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-08 14:37:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/2e7de86fcb5a87a88da4c49d3d388d84194c95a791b2b1587daa5955056451e5/",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554517": [
        {
            "ioc_value": "xiaoshihou13.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-08 14:36:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/57f0888ec2f3eb3643c91761e5ca62fd9cad22ea3f029826c935e07ff3aa8344/",
            "tags": "AnyDesk",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554515": [
        {
            "ioc_value": "mail.operationesim.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-08 14:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5f77465a62a1535e103ff32f3a922959661ba5e8b0b385384d507dc4be8f299a/",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554514": [
        {
            "ioc_value": "relay.colonjars.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-08 14:33:37",
            "last_seen_utc": "2025-07-08 14:33:37",
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554512": [
        {
            "ioc_value": "hitmanzok.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-08 14:32:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/572e5a0ade76ea6f4e8a8e3150b30c0b5fe37361f6f70d39f1ac3eded46cffaa/",
            "tags": "NetSupport,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554509": [
        {
            "ioc_value": "jareyo.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "jar.strrat",
            "malware_alias": null,
            "malware_printable": "STRRAT",
            "first_seen_utc": "2025-07-08 14:06:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-laytesem5z",
            "tags": "c2,domain,STRRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554491": [
        {
            "ioc_value": "hunterbry.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-08 12:03:43",
            "last_seen_utc": "2025-07-10 12:51:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-ngnm5swwa1",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554469": [
        {
            "ioc_value": "webdevs.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-08 12:00:59",
            "last_seen_utc": "2025-07-16 13:25:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-l5172aep3w",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554459": [
        {
            "ioc_value": "security-malware.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 11:15:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma,validin",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554460": [
        {
            "ioc_value": "citadelcdn.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 11:15:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma,validin",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554461": [
        {
            "ioc_value": "hotroutingcdn.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 11:15:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma,validin",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554462": [
        {
            "ioc_value": "filedisterbuter.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 11:15:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma,validin",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554457": [
        {
            "ioc_value": "perkoj.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 11:15:10",
            "last_seen_utc": "2025-07-08 11:15:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma,virustotal",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554458": [
        {
            "ioc_value": "metopypv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 11:15:10",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma,virustotal",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554454": [
        {
            "ioc_value": "idrnmk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 11:15:09",
            "last_seen_utc": "2025-09-10 08:31:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma,virustotal",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554455": [
        {
            "ioc_value": "whitfmz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 11:15:09",
            "last_seen_utc": "2025-07-24 09:19:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma,virustotal",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554456": [
        {
            "ioc_value": "anfdfq.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 11:15:09",
            "last_seen_utc": "2025-07-23 19:18:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma,virustotal",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554311": [
        {
            "ioc_value": "qeel.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 06:59:45",
            "last_seen_utc": "2025-07-13 19:03:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1554313": [
        {
            "ioc_value": "lnofi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 06:59:44",
            "last_seen_utc": "2025-07-13 19:03:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1554314": [
        {
            "ioc_value": "ryxpq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 06:59:44",
            "last_seen_utc": "2025-07-13 19:03:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1554315": [
        {
            "ioc_value": "dzyzb.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 06:59:44",
            "last_seen_utc": "2025-07-13 19:03:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1554317": [
        {
            "ioc_value": "dkkig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 06:59:43",
            "last_seen_utc": "2025-07-13 19:03:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1554318": [
        {
            "ioc_value": "lodib.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 06:59:43",
            "last_seen_utc": "2025-07-13 19:03:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1554319": [
        {
            "ioc_value": "genmkh.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-08 06:59:42",
            "last_seen_utc": "2025-07-13 19:03:49",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1554429": [
        {
            "ioc_value": "vaykhon.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-08 06:07:52",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554415": [
        {
            "ioc_value": "mokveid.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-08 06:01:11",
            "last_seen_utc": "2025-07-16 13:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-fbtm7szqs6",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554413": [
        {
            "ioc_value": "page4work.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-08 06:00:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250708-c3qh3sfk6x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554399": [
        {
            "ioc_value": "net-2-45-246-28.cust.vodafonedsl.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-08 04:01:03",
            "last_seen_utc": "2025-07-08 04:01:32",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/2.45.246.28+net-2-45-246-28.cust.vodafonedsl.it",
            "tags": "AS30722,C2,censys,Unam,VODAFONE-IT-ASN",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1554378": [
        {
            "ioc_value": "personal.regpad.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-08 02:55:49",
            "last_seen_utc": "2025-10-21 07:49:48",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554377": [
        {
            "ioc_value": "cdn.bitttrrix.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-08 02:55:04",
            "last_seen_utc": "2025-09-22 09:49:42",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554376": [
        {
            "ioc_value": "apiprod.regpad.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-08 02:54:59",
            "last_seen_utc": "2025-10-21 07:49:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554375": [
        {
            "ioc_value": "api.regpad.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-08 02:54:58",
            "last_seen_utc": "2025-10-21 07:49:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554329": [
        {
            "ioc_value": "17.5.exifit.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-07 20:10:33",
            "last_seen_utc": "2025-07-14 18:10:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "t^ld,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554297": [
        {
            "ioc_value": "support.desktop.wales",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-07 18:57:25",
            "last_seen_utc": "2025-08-09 07:49:31",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554296": [
        {
            "ioc_value": "ns3.bsetop.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-07 18:57:18",
            "last_seen_utc": "2025-07-16 21:49:20",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554295": [
        {
            "ioc_value": "ns2.bsetop.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-07 18:57:14",
            "last_seen_utc": "2025-07-16 21:49:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554294": [
        {
            "ioc_value": "ns1.bsetop.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-07 18:57:10",
            "last_seen_utc": "2025-07-16 21:49:16",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554293": [
        {
            "ioc_value": "login.ictstudents.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-07 18:57:06",
            "last_seen_utc": "2025-08-19 07:51:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554292": [
        {
            "ioc_value": "dns2.e-twfpg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-07 18:57:00",
            "last_seen_utc": "2025-09-24 09:49:46",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554291": [
        {
            "ioc_value": "blog.ictstudents.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-07 18:56:55",
            "last_seen_utc": "2025-08-19 07:51:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554277": [
        {
            "ioc_value": "tarek777.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-07 18:04:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-wezavsvmx3",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554278": [
        {
            "ioc_value": "reportedfall.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-07 18:04:23",
            "last_seen_utc": "2025-07-10 12:51:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-wezavsvmx3",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554276": [
        {
            "ioc_value": "amazon.capeturk.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-07-07 18:03:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-prwxyaszbt",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554271": [
        {
            "ioc_value": "nglocalhost.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-07 18:02:35",
            "last_seen_utc": "2025-07-10 12:51:02",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-v4z31sbq8w",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554267": [
        {
            "ioc_value": "rem.specialtyfoodnetwork.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-07 18:01:10",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-qfp6patxax",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554266": [
        {
            "ioc_value": "slitterline.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-07 18:01:09",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-r7aezswvbs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554264": [
        {
            "ioc_value": "windows11.webredirect.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-07 18:01:08",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-tvmwnatq12",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554263": [
        {
            "ioc_value": "ambakgroup.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-07 18:01:07",
            "last_seen_utc": "2025-07-10 12:50:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-tvgdwaw1fx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554260": [
        {
            "ioc_value": "en.earthen.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.shadowpad",
            "malware_alias": "POISONPLUG.SHADOW,XShellGhost",
            "malware_printable": "ShadowPad",
            "first_seen_utc": "2025-07-07 17:13:53",
            "last_seen_utc": "2025-10-01 07:28:27",
            "confidence_level": 95,
            "reference": null,
            "tags": "APT41,ShadowPad",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1554231": [
        {
            "ioc_value": "anoteryo.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-07 16:54:54",
            "last_seen_utc": "2025-07-07 15:59:52",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114812329868677874",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1554232": [
        {
            "ioc_value": "videoproduction.demostagingserver.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-07 16:54:53",
            "last_seen_utc": "2025-07-07 14:05:29",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114812329868677874",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1554253": [
        {
            "ioc_value": "c83-249-230-189.bredband.tele2.se",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-07 16:01:21",
            "last_seen_utc": "2025-07-08 04:00:28",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.249.230.189+c83-249-230-189.bredband.tele2.se",
            "tags": "AS1257,AsyncRAT,C2,censys,RAT,TELE2",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554237": [
        {
            "ioc_value": "mugu3.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-07 14:55:24",
            "last_seen_utc": "2025-07-16 13:25:29",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/932d3e1b5f653616a3966076c81c716b4fea3aef9026b85eb1a7ce93f907f957/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554226": [
        {
            "ioc_value": "stable.lanpdt.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-07 13:34:38",
            "last_seen_utc": "2025-07-07 14:01:00",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114812126037096709",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1554217": [
        {
            "ioc_value": "wisedreams-53895.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-07 12:01:27",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-mvm34a1ygs",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554212": [
        {
            "ioc_value": "hajouts8koumis910.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-07 12:01:04",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-nnec2sgr4t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554211": [
        {
            "ioc_value": "hajouts8koumis9.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-07 12:01:02",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-nnec2sgr4t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554209": [
        {
            "ioc_value": "remdynu2.accesscam.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-07 12:00:59",
            "last_seen_utc": "2025-07-10 12:50:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-nnec2sgr4t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554208": [
        {
            "ioc_value": "remdynu1.accesscam.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-07 12:00:56",
            "last_seen_utc": "2025-07-10 12:50:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-nnec2sgr4t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554207": [
        {
            "ioc_value": "farahsaamer.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-07 12:00:55",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-j8qjlazxcy",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554205": [
        {
            "ioc_value": "summer25hot.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-07 11:34:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/JAMESWT_WT/status/1942184882358084048",
            "tags": "NetSupport",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554184": [
        {
            "ioc_value": "lbkequityexchange.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-07 09:22:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "contrxl"
        }
    ],
    "1554179": [
        {
            "ioc_value": "node.ozzytzy-anomali-adminjomok.panel-store-pterodactyl.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-07 08:01:14",
            "last_seen_utc": "2025-07-08 04:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/206.189.13.43+node.ozzytzy-anomali-adminjomok.panel-store-pterodactyl.my.id",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554061": [
        {
            "ioc_value": "servicezqp.lol",
            "ioc_type": "domain",
            "threat_type": "cc_skimming",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-07 06:40:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "fake-ups,smishing",
            "anonymous": "1",
            "reporter": "halcyondream"
        }
    ],
    "1554168": [
        {
            "ioc_value": "uranet.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-07 06:24:01",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554167": [
        {
            "ioc_value": "madara21-54023.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-07 06:23:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554166": [
        {
            "ioc_value": "296azure-64092.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-07 06:23:02",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554143": [
        {
            "ioc_value": "nuevboprogreso.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-07 06:01:14",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-agxzxshp3v",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554141": [
        {
            "ioc_value": "NNNNSSSS-64548.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-07 06:00:41",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250707-beftasfp5v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554139": [
        {
            "ioc_value": "legder-live-desktop.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-07 05:54:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554140": [
        {
            "ioc_value": "forbescheck.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-07 05:54:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1554137": [
        {
            "ioc_value": "b1.a.exifit.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-07 05:08:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1554060": [
        {
            "ioc_value": "ratosorrateiro.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-06 18:02:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-svaewsyzd1",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554059": [
        {
            "ioc_value": "cantante1.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-06 18:02:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-vll4faaj9t",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554053": [
        {
            "ioc_value": "ak1.ksdcks2.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-06 18:02:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-thbmvs1jz4",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554042": [
        {
            "ioc_value": "ec2-34-219-200-70.us-west-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-06 16:01:10",
            "last_seen_utc": "2025-07-07 04:01:00",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.219.200.70+ec2-34-219-200-70.us-west-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554030": [
        {
            "ioc_value": "mohooooo.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-06 12:02:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-l5na6swlz4",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554029": [
        {
            "ioc_value": "mohamedmmk.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-06 12:02:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-m1hqkavzhz",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554020": [
        {
            "ioc_value": "WizWormSkiddoLeakExpose-22797.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-06 12:00:59",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-nz8e9sxlw8",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554019": [
        {
            "ioc_value": "urchamadi.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-06 12:00:43",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-jvmksaer21",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554018": [
        {
            "ioc_value": "jmaxx2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-06 12:00:42",
            "last_seen_utc": "2025-07-10 12:50:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-mdk76sdm61",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1554014": [
        {
            "ioc_value": "chernobyl.webhop.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-06 09:36:12",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554015": [
        {
            "ioc_value": "hacking702-35743.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-06 09:36:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554013": [
        {
            "ioc_value": "shitfaced.tk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-06 09:34:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554011": [
        {
            "ioc_value": "360.huiyuan8.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-06 09:33:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,elknot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554009": [
        {
            "ioc_value": "dubstep33.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-07-06 09:33:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554008": [
        {
            "ioc_value": "ec2-13-250-159-36.ap-southeast-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-06 09:32:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554005": [
        {
            "ioc_value": "island-towns.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-06 09:32:33",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554006": [
        {
            "ioc_value": "kingdom-nu.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-06 09:32:33",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1554007": [
        {
            "ioc_value": "unique-heard.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-06 09:32:33",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553881": [
        {
            "ioc_value": "yu.troutbunion.bet",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-07-06 08:22:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-xgmkhsdn8w/behavioral1",
            "tags": "ACRStealer,AmateraStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1553940": [
        {
            "ioc_value": "31.213.176.34.bc.googleusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-06 08:22:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.176.213.31+31.213.176.34.bc.googleusercontent.com",
            "tags": "AS396982,C2,censys,GOOGLE-CLOUD-PLATFORM,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1553973": [
        {
            "ioc_value": "thecrazyboyyy.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-06 06:03:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-b75ywsel7y",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553969": [
        {
            "ioc_value": "hacker9393.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-06 06:01:41",
            "last_seen_utc": "2025-07-10 12:51:02",
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-drgx8sen6s",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553968": [
        {
            "ioc_value": "sidalibelkercha.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-06 06:01:40",
            "last_seen_utc": "2025-07-10 12:51:02",
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-d47pesgl2y",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553967": [
        {
            "ioc_value": "rrs123.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-06 06:01:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-egt1gszxfz",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553965": [
        {
            "ioc_value": "1ms0rry-35873.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-06 06:01:23",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-fgg7cs1sa1",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553964": [
        {
            "ioc_value": "respaldofinal.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-06 06:00:54",
            "last_seen_utc": "2025-07-10 12:50:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-bqxwysdp9y",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553963": [
        {
            "ioc_value": "nsxauth.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-06 06:00:36",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250706-d84hkagm2y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553941": [
        {
            "ioc_value": "ozzytzy-anomali-adminjomok.panel-store-pterodactyl.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-06 04:01:00",
            "last_seen_utc": "2025-07-06 04:01:02",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/206.189.13.43+ozzytzy-anomali-adminjomok.panel-store-pterodactyl.my.id",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553934": [
        {
            "ioc_value": "h.yangthousand.hair",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-06 02:57:23",
            "last_seen_utc": "2025-08-05 17:49:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553933": [
        {
            "ioc_value": "dadanyohoocloud.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-06 02:57:18",
            "last_seen_utc": "2025-08-20 09:50:36",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553932": [
        {
            "ioc_value": "analytics.digitalflowcloud.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-06 02:57:11",
            "last_seen_utc": "2025-08-12 09:49:43",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553897": [
        {
            "ioc_value": "ec2-3-121-114-119.eu-central-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-05 20:01:12",
            "last_seen_utc": "2025-07-06 04:01:03",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.121.114.119+ec2-3-121-114-119.eu-central-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553879": [
        {
            "ioc_value": "mainsdos.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-05 18:02:31",
            "last_seen_utc": "2025-07-10 12:51:04",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-sjgptszrv4",
            "tags": "C2,domain,nanocore,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553878": [
        {
            "ioc_value": "hugo123.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-05 18:02:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-rnxq6sgk9x",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553877": [
        {
            "ioc_value": "danyjosy.ddns.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-05 18:02:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-sn6vhsdn4t",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553871": [
        {
            "ioc_value": "spardra-59711.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-05 18:01:12",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-vz54ga1xfv",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553870": [
        {
            "ioc_value": "activistascol25.myonlineportal.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-05 18:00:50",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-t8xm1s1tbs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553869": [
        {
            "ioc_value": "capreconlmtdafull.dedyn.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-05 18:00:49",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-t8xm1s1tbs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553868": [
        {
            "ioc_value": "televisor1.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-05 18:00:48",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-t8xm1s1tbs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553867": [
        {
            "ioc_value": "cannonistanbulsskys.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-05 18:00:47",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-pcdstayqy4",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553864": [
        {
            "ioc_value": "cell-submitted.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-05 18:00:27",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-r77eqazqs7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553840": [
        {
            "ioc_value": "acc.jybhelp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-05 13:15:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553836": [
        {
            "ioc_value": "loveharmony.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.smokeloader",
            "malware_alias": "Dofoil,Sharik,Smoke,Smoke Loader",
            "malware_printable": "SmokeLoader",
            "first_seen_utc": "2025-07-05 13:06:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Dofoil,Smoke Loader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553834": [
        {
            "ioc_value": "banana.quatrocliche.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-05 13:05:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553826": [
        {
            "ioc_value": "blogmail.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-05 12:01:06",
            "last_seen_utc": "2025-07-06 04:00:49",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.186.190+blogmail.pro",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Hookbot",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553809": [
        {
            "ioc_value": "Evil-Inc.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-05 10:33:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-l45h3axl16",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553805": [
        {
            "ioc_value": "person-files.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-05 10:32:24",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-kfdvrswn17",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553803": [
        {
            "ioc_value": "hold-mayre.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-05 10:32:02",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-mffepsdk6s",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553802": [
        {
            "ioc_value": "something-relation.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-05 10:31:47",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-lfkhzswvdx",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553797": [
        {
            "ioc_value": "format-associations.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-05 09:53:37",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553798": [
        {
            "ioc_value": "senior-biology.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-05 09:53:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553799": [
        {
            "ioc_value": "xm.lnpntkd9vth0tup2.rest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-05 09:53:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553796": [
        {
            "ioc_value": "wendigagah212.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-05 09:52:28",
            "last_seen_utc": "2025-07-10 12:51:01",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553793": [
        {
            "ioc_value": "bot.networkbot.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-05 09:52:14",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553794": [
        {
            "ioc_value": "botnet.eu.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-05 09:52:14",
            "last_seen_utc": "2025-07-10 12:51:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553795": [
        {
            "ioc_value": "jbvpshosti.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-05 09:52:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553784": [
        {
            "ioc_value": "www.yingyuelawyer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553785": [
        {
            "ioc_value": "www.z4666.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553760": [
        {
            "ioc_value": "www.opebet516.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553761": [
        {
            "ioc_value": "www.opensourcepsychedelics.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553762": [
        {
            "ioc_value": "www.painlessassignments.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553763": [
        {
            "ioc_value": "www.paripassuboutique.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553764": [
        {
            "ioc_value": "www.phtileind.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553765": [
        {
            "ioc_value": "www.physicalwebmedia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553766": [
        {
            "ioc_value": "www.printtheprinter.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553767": [
        {
            "ioc_value": "www.protectionaustralia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553768": [
        {
            "ioc_value": "www.readjusthealth.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553769": [
        {
            "ioc_value": "www.relate.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553770": [
        {
            "ioc_value": "www.rosetta-contract.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553771": [
        {
            "ioc_value": "www.sanitok.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553772": [
        {
            "ioc_value": "www.shenxianqinyuan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553773": [
        {
            "ioc_value": "www.sienagirls1984.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553774": [
        {
            "ioc_value": "www.sieuthiionkiem.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553775": [
        {
            "ioc_value": "www.solarvalued.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553776": [
        {
            "ioc_value": "www.sonarclaims.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553777": [
        {
            "ioc_value": "www.supermeczo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553778": [
        {
            "ioc_value": "www.surcultural.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553779": [
        {
            "ioc_value": "www.tapinadvert.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553780": [
        {
            "ioc_value": "www.totalmicro.systems",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553781": [
        {
            "ioc_value": "www.vnailw.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553782": [
        {
            "ioc_value": "www.waychanging.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553783": [
        {
            "ioc_value": "www.wori.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553733": [
        {
            "ioc_value": "www.coinvenient.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553734": [
        {
            "ioc_value": "www.cryptoworld.review",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553735": [
        {
            "ioc_value": "www.electriccar.rent",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553736": [
        {
            "ioc_value": "www.exent.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553737": [
        {
            "ioc_value": "www.faraoneshop.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553738": [
        {
            "ioc_value": "www.fernandosqualitypainting.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553739": [
        {
            "ioc_value": "www.fyffn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553740": [
        {
            "ioc_value": "www.gdleen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553741": [
        {
            "ioc_value": "www.gengshijiapu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553742": [
        {
            "ioc_value": "www.getdemystified.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553743": [
        {
            "ioc_value": "www.gozofarms.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553744": [
        {
            "ioc_value": "www.gzljkt.men",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553745": [
        {
            "ioc_value": "www.haowan.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553746": [
        {
            "ioc_value": "www.hdfysp.men",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553747": [
        {
            "ioc_value": "www.hellogorgeoushopping.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553748": [
        {
            "ioc_value": "www.hsqqs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553749": [
        {
            "ioc_value": "www.icehelp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553750": [
        {
            "ioc_value": "www.iqtsc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553751": [
        {
            "ioc_value": "www.jaysnbrwn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553752": [
        {
            "ioc_value": "www.juntide.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553753": [
        {
            "ioc_value": "www.kannbann.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553754": [
        {
            "ioc_value": "www.khwdel.men",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553755": [
        {
            "ioc_value": "www.krystaboehm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553756": [
        {
            "ioc_value": "www.marijuanadoctor.clinic",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553757": [
        {
            "ioc_value": "www.megatopo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553758": [
        {
            "ioc_value": "www.merkabahspa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553759": [
        {
            "ioc_value": "www.nuopex.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553721": [
        {
            "ioc_value": "www.201851.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553722": [
        {
            "ioc_value": "www.330321.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553723": [
        {
            "ioc_value": "www.79cregarroad.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553724": [
        {
            "ioc_value": "www.alexisderrien.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553725": [
        {
            "ioc_value": "www.alinasalo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553726": [
        {
            "ioc_value": "www.allvoices.foundation",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553727": [
        {
            "ioc_value": "www.altura.coffee",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553728": [
        {
            "ioc_value": "www.atelierrizzi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553729": [
        {
            "ioc_value": "www.bestrestaurant.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553730": [
        {
            "ioc_value": "www.bnshd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553731": [
        {
            "ioc_value": "www.btgjjg.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553732": [
        {
            "ioc_value": "www.cogigo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-05 09:50:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553653": [
        {
            "ioc_value": "ad15.bootcdn.net.dsa.dnsv1.com.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-05 09:49:04",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553654": [
        {
            "ioc_value": "help.clickckckck.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-05 09:49:04",
            "last_seen_utc": "2025-12-14 11:48:08",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553575": [
        {
            "ioc_value": "jwapi.junnwei.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-05 09:48:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.96.224.76+jwapi.junnwei.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1553576": [
        {
            "ioc_value": "ivxtest.junnwei.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-05 09:48:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.96.224.76+ivxtest.junnwei.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1553577": [
        {
            "ioc_value": "m83-186-111-162.cust.tele2.se",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-05 09:48:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.186.111.162+m83-186-111-162.cust.tele2.se",
            "tags": "AS1257,C2,censys,TELE2",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1553583": [
        {
            "ioc_value": "www.battle.plasticshark.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-05 09:48:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.76.122.60+www.battle.plasticshark.shop",
            "tags": "AS151734,Banking,C2,censys,KrakenRAT,RAT",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1553624": [
        {
            "ioc_value": "tipperopal.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-05 08:01:05",
            "last_seen_utc": "2025-07-06 04:01:04",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.155.163+tipperopal.icu",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553612": [
        {
            "ioc_value": "ahmadkiswani.myftp.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-05 06:03:32",
            "last_seen_utc": "2025-07-10 12:51:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-cg2dfs1vgw",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553611": [
        {
            "ioc_value": "hostservice.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-07-05 06:03:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-ctjdeacl4w",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553610": [
        {
            "ioc_value": "job2.fdwehzitx.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-05 06:02:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-gajmaavkw2",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553609": [
        {
            "ioc_value": "exchange-reasonably.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-05 06:02:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-adwbxs1nx8",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553606": [
        {
            "ioc_value": "ratit.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-05 06:01:49",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-e872esak4x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553604": [
        {
            "ioc_value": "brave.webredirect.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-05 06:01:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-cxbgza1xdz",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553602": [
        {
            "ioc_value": "www.documentfliers.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-05 06:01:05",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-eavnfaap3v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553603": [
        {
            "ioc_value": "www.documentflies.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-05 06:01:05",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250705-eavnfaap3v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553521": [
        {
            "ioc_value": "204.178.153.160.host.secureserver.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.umbral",
            "malware_alias": null,
            "malware_printable": "Umbral",
            "first_seen_utc": "2025-07-05 02:54:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "umbral",
            "anonymous": "0",
            "reporter": "Felipe"
        }
    ],
    "1553562": [
        {
            "ioc_value": "azuredbclitest-tkbum.postgres.database.azure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-05 00:01:07",
            "last_seen_utc": "2025-07-05 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/74.235.58.46+azuredbclitest-tkbum.postgres.database.azure.com",
            "tags": "AS8075,C2,censys,Hookbot,MICROSOFT-CORP-MSN-AS-BLOCK",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553551": [
        {
            "ioc_value": "probrad.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-04 22:39:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-cjzmmswp17",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553550": [
        {
            "ioc_value": "maxo.4cloud.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-04 22:38:10",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-rf53kst1ct",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553548": [
        {
            "ioc_value": "tutatara.no-ip.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-04 22:32:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-lktmfs1kx6",
            "tags": "c2,CyberGate,domain,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553546": [
        {
            "ioc_value": "changeintoafly.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-04 22:31:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-c9dsvswrv6",
            "tags": "c2,CyberGate,domain,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553544": [
        {
            "ioc_value": "r3nt3r.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-04 22:27:48",
            "last_seen_utc": "2025-07-10 12:51:05",
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-3xatjsvtcs",
            "tags": "c2,CyberGate,domain,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553543": [
        {
            "ioc_value": "sonytester.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-04 22:26:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-152acstsbv",
            "tags": "c2,CyberGate,domain,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553542": [
        {
            "ioc_value": "stpmarche.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-04 22:25:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-gpg21aaj91",
            "tags": "c2,CyberGate,domain,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553540": [
        {
            "ioc_value": "city-communicate.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-04 22:12:27",
            "last_seen_utc": "2025-07-10 12:51:13",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-1y283sznv6",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553539": [
        {
            "ioc_value": "got-incurred.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-07-04 22:12:26",
            "last_seen_utc": "2025-07-10 12:51:01",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-1yz4qaznt9",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553537": [
        {
            "ioc_value": "Let12345-61544.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-04 22:10:58",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-1y1egsznv2",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553536": [
        {
            "ioc_value": "connecetwise.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-04 22:10:51",
            "last_seen_utc": "2025-07-10 12:50:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-xk7pvsxtfw",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553532": [
        {
            "ioc_value": "rates-north.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-04 22:10:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-xk7pvsxtfw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553533": [
        {
            "ioc_value": "second-spyware.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-04 22:10:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-xk7pvsxtfw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553504": [
        {
            "ioc_value": "azuredbclitest-tkbum.rs-f815c4c85fb6.postgres.database.azure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-07-04 20:00:56",
            "last_seen_utc": "2025-07-05 04:00:56",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/74.235.58.46+azuredbclitest-tkbum.rs-f815c4c85fb6.postgres.database.azure.com",
            "tags": "AS8075,C2,censys,Hookbot,MICROSOFT-CORP-MSN-AS-BLOCK",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553482": [
        {
            "ioc_value": "omgwtfbbq123.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-04 18:03:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-r7mejsvvft",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553475": [
        {
            "ioc_value": "not-sized.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-04 18:00:17",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-vfglrswvgv",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553455": [
        {
            "ioc_value": "rathole.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553456": [
        {
            "ioc_value": "dmaap.link",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553457": [
        {
            "ioc_value": "selmanaged.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553452": [
        {
            "ioc_value": "rasteks.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:31",
            "last_seen_utc": "2025-07-04 14:56:32",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553448": [
        {
            "ioc_value": "knv.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:30",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553439": [
        {
            "ioc_value": "gazladder.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:28",
            "last_seen_utc": "2025-07-04 14:56:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553423": [
        {
            "ioc_value": "optica.expert",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:26",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553416": [
        {
            "ioc_value": "dltc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:23",
            "last_seen_utc": "2025-07-04 14:56:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553414": [
        {
            "ioc_value": "strah.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:22",
            "last_seen_utc": "2025-07-04 14:56:31",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553415": [
        {
            "ioc_value": "feredo.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:22",
            "last_seen_utc": "2025-07-04 14:56:31",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553410": [
        {
            "ioc_value": "iroibk.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553411": [
        {
            "ioc_value": "pupkvw.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:11",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553412": [
        {
            "ioc_value": "duxoq.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:11",
            "last_seen_utc": "2025-07-23 19:18:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553409": [
        {
            "ioc_value": "dupldaw.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:10",
            "last_seen_utc": "2025-07-23 19:19:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553406": [
        {
            "ioc_value": "bouzxme.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:09",
            "last_seen_utc": "2025-07-24 09:19:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553407": [
        {
            "ioc_value": "bitjbpc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:09",
            "last_seen_utc": "2025-07-23 19:18:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553399": [
        {
            "ioc_value": "uneqclj.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:08",
            "last_seen_utc": "2025-07-23 19:19:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553400": [
        {
            "ioc_value": "jumpkwo.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:08",
            "last_seen_utc": "2025-07-23 19:19:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553401": [
        {
            "ioc_value": "halnbb.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:08",
            "last_seen_utc": "2025-07-23 19:19:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553402": [
        {
            "ioc_value": "jumclx.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:08",
            "last_seen_utc": "2025-07-23 19:19:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553403": [
        {
            "ioc_value": "cennqq.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:08",
            "last_seen_utc": "2025-07-08 11:15:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553392": [
        {
            "ioc_value": "fifdtm.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:07",
            "last_seen_utc": "2025-07-04 14:56:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553394": [
        {
            "ioc_value": "creewuh.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:07",
            "last_seen_utc": "2025-07-23 19:19:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553395": [
        {
            "ioc_value": "delnsc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:07",
            "last_seen_utc": "2025-07-23 19:18:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553396": [
        {
            "ioc_value": "deepvqy.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:07",
            "last_seen_utc": "2025-07-23 19:19:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553397": [
        {
            "ioc_value": "cucujxc.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:07",
            "last_seen_utc": "2025-07-13 19:03:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553398": [
        {
            "ioc_value": "concvek.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:07",
            "last_seen_utc": "2025-07-23 19:19:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553386": [
        {
            "ioc_value": "blisao.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:06",
            "last_seen_utc": "2025-07-23 19:18:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553387": [
        {
            "ioc_value": "vegwrwv.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:06",
            "last_seen_utc": "2025-07-23 19:18:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553388": [
        {
            "ioc_value": "gaylw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:06",
            "last_seen_utc": "2025-07-23 19:18:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553389": [
        {
            "ioc_value": "gastrci.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:06",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553390": [
        {
            "ioc_value": "gamtxto.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:06",
            "last_seen_utc": "2025-07-23 19:18:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553376": [
        {
            "ioc_value": "marktth.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:05",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553377": [
        {
            "ioc_value": "trarzcr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:05",
            "last_seen_utc": "2025-07-23 19:18:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553380": [
        {
            "ioc_value": "loxmbi.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:05",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553381": [
        {
            "ioc_value": "kgqxaa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:05",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553382": [
        {
            "ioc_value": "letoxtk.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:05",
            "last_seen_utc": "2025-07-23 19:18:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553383": [
        {
            "ioc_value": "lelurr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:05",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553384": [
        {
            "ioc_value": "invdfgq.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:05",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553385": [
        {
            "ioc_value": "imasau.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:05",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553365": [
        {
            "ioc_value": "shiqgvx.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-23 19:18:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553366": [
        {
            "ioc_value": "riamoyi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-23 19:18:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553367": [
        {
            "ioc_value": "radlomr.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-04 14:56:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553368": [
        {
            "ioc_value": "quaagq.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-04 14:56:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553369": [
        {
            "ioc_value": "prkovy.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553370": [
        {
            "ioc_value": "poioblz.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-23 19:18:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553371": [
        {
            "ioc_value": "pilqdx.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553372": [
        {
            "ioc_value": "nooinys.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-08 11:15:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553374": [
        {
            "ioc_value": "mieydn.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-04 14:56:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553375": [
        {
            "ioc_value": "masmkl.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:04",
            "last_seen_utc": "2025-07-04 14:56:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553356": [
        {
            "ioc_value": "whiydg.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:03",
            "last_seen_utc": "2025-07-23 19:18:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553357": [
        {
            "ioc_value": "werdqs.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:03",
            "last_seen_utc": "2025-07-04 14:56:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553358": [
        {
            "ioc_value": "wesajkh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:03",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553359": [
        {
            "ioc_value": "venxvrc.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:03",
            "last_seen_utc": "2025-07-08 11:15:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553360": [
        {
            "ioc_value": "varjdih.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:03",
            "last_seen_utc": "2025-07-23 19:18:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553361": [
        {
            "ioc_value": "vafonp.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:03",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553362": [
        {
            "ioc_value": "unsmka.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:03",
            "last_seen_utc": "2025-07-23 19:18:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553363": [
        {
            "ioc_value": "tamwzen.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:03",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553364": [
        {
            "ioc_value": "spiioyt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 14:56:03",
            "last_seen_utc": "2025-07-23 19:18:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1553353": [
        {
            "ioc_value": "feedback.bigsightsystems.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-04 13:47:59",
            "last_seen_utc": "2025-07-04 13:15:44",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114795137991751447",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1553349": [
        {
            "ioc_value": "countryview.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-04 12:57:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553350": [
        {
            "ioc_value": "middleshape.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-04 12:57:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553351": [
        {
            "ioc_value": "sonplane.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-04 12:57:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553352": [
        {
            "ioc_value": "boytheory.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-04 12:57:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553336": [
        {
            "ioc_value": "xt.exifit.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-04 12:10:34",
            "last_seen_utc": "2025-07-14 18:10:23",
            "confidence_level": 75,
            "reference": null,
            "tags": "7_%7,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553333": [
        {
            "ioc_value": "funmusic.servebeer.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-04 12:03:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-g6em7sal7z",
            "tags": "C2,cybergate,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553332": [
        {
            "ioc_value": "risk.preech.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-07-04 12:02:34",
            "last_seen_utc": "2025-07-04 12:02:35",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-kwer1azxa1",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553330": [
        {
            "ioc_value": "ksa-h4ck.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-04 12:02:27",
            "last_seen_utc": "2025-07-10 12:51:02",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-jr2waszses",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553328": [
        {
            "ioc_value": "results-sand.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-04 12:01:07",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-l2766s1l12",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553319": [
        {
            "ioc_value": "securityhealthsystrays.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-04 12:00:49",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-hnnntsyqz3",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553318": [
        {
            "ioc_value": "securityhealthmonitorgiize.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-04 12:00:48",
            "last_seen_utc": "2025-07-10 12:50:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-hnnc3ayqz2",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553317": [
        {
            "ioc_value": "windowsupdatetoasticon.issmarterthanyou.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-04 12:00:47",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-nwy3esstax",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553313": [
        {
            "ioc_value": "vietololm.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-04 12:00:37",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-hch9zaytes",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553301": [
        {
            "ioc_value": "staman.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:31:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553302": [
        {
            "ioc_value": "swigddmb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:31:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553303": [
        {
            "ioc_value": "impvmg.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:31:47",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553295": [
        {
            "ioc_value": "foqdra.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:31:46",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553296": [
        {
            "ioc_value": "sulfvo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:31:46",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553297": [
        {
            "ioc_value": "foqmpk.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:31:46",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553298": [
        {
            "ioc_value": "giyewf.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:31:46",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553299": [
        {
            "ioc_value": "tomxlw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:31:46",
            "last_seen_utc": "2025-07-23 19:19:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553300": [
        {
            "ioc_value": "jewbhl.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:31:46",
            "last_seen_utc": "2025-07-23 19:18:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553279": [
        {
            "ioc_value": "bumualu.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-23 19:19:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553280": [
        {
            "ioc_value": "clehygs.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553281": [
        {
            "ioc_value": "leehpfe.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-08 11:15:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553282": [
        {
            "ioc_value": "talkrt.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-08 11:15:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553283": [
        {
            "ioc_value": "bidafgs.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553284": [
        {
            "ioc_value": "foospjo.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553285": [
        {
            "ioc_value": "grkuek.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553286": [
        {
            "ioc_value": "rumidk.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-23 19:18:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553287": [
        {
            "ioc_value": "majvkra.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553288": [
        {
            "ioc_value": "upgrazz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-23 19:18:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553289": [
        {
            "ioc_value": "wonxw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-08 11:15:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553290": [
        {
            "ioc_value": "gilyesu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553291": [
        {
            "ioc_value": "folshvs.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-23 19:18:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553292": [
        {
            "ioc_value": "pitqhms.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-08 11:15:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553293": [
        {
            "ioc_value": "dusjnnn.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-23 19:19:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553294": [
        {
            "ioc_value": "almzsff.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:38",
            "last_seen_utc": "2025-07-23 19:19:04",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553264": [
        {
            "ioc_value": "untuia.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-04 09:31:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553265": [
        {
            "ioc_value": "whaagd.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553266": [
        {
            "ioc_value": "absqln.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553267": [
        {
            "ioc_value": "dealbht.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-23 19:19:05",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553268": [
        {
            "ioc_value": "iswxch.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-23 19:19:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553269": [
        {
            "ioc_value": "pltefd.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553270": [
        {
            "ioc_value": "pofnxk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-04 09:31:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553271": [
        {
            "ioc_value": "ponqcf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-23 19:18:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553272": [
        {
            "ioc_value": "senezqj.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553273": [
        {
            "ioc_value": "smoskp.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-04 09:31:46",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553274": [
        {
            "ioc_value": "suhvqq.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553275": [
        {
            "ioc_value": "diseysy.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553276": [
        {
            "ioc_value": "vetbe.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-23 19:18:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553277": [
        {
            "ioc_value": "freqbkv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553278": [
        {
            "ioc_value": "braoto.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:37",
            "last_seen_utc": "2025-07-23 19:18:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553247": [
        {
            "ioc_value": "somfhz.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-08 11:15:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553248": [
        {
            "ioc_value": "whilhi.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-23 19:18:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553249": [
        {
            "ioc_value": "8diaprinzpistpe.blogspot.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553250": [
        {
            "ioc_value": "cloud839v3.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553251": [
        {
            "ioc_value": "media.cloud839v3.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553252": [
        {
            "ioc_value": "londonoffvisit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553253": [
        {
            "ioc_value": "ripple-legal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553254": [
        {
            "ioc_value": "ripple-regulation.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553255": [
        {
            "ioc_value": "ripple-regulatory.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553256": [
        {
            "ioc_value": "ferjpn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-23 19:18:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553257": [
        {
            "ioc_value": "gecoea.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-08 11:15:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553258": [
        {
            "ioc_value": "nbwihi.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553259": [
        {
            "ioc_value": "odetgw.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-23 19:18:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553260": [
        {
            "ioc_value": "saleone.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-04 09:31:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553261": [
        {
            "ioc_value": "stabkkf.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-23 19:19:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553262": [
        {
            "ioc_value": "stefeu.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553263": [
        {
            "ioc_value": "thiyntf.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:36",
            "last_seen_utc": "2025-07-23 19:18:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553230": [
        {
            "ioc_value": "casupfi.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553231": [
        {
            "ioc_value": "calxzg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553232": [
        {
            "ioc_value": "cljaln.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553233": [
        {
            "ioc_value": "emegln.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553234": [
        {
            "ioc_value": "flotzi.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553235": [
        {
            "ioc_value": "grkozh.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:18:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553236": [
        {
            "ioc_value": "harmst.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-04 09:31:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553237": [
        {
            "ioc_value": "havyfad.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:18:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553238": [
        {
            "ioc_value": "invjzc.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553239": [
        {
            "ioc_value": "londqx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-04 09:31:45",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553240": [
        {
            "ioc_value": "meyks.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-04 14:56:14",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553241": [
        {
            "ioc_value": "mjfqq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553242": [
        {
            "ioc_value": "omahpy.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:19:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553243": [
        {
            "ioc_value": "paggdt.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-08 11:15:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553244": [
        {
            "ioc_value": "pnpxsc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553245": [
        {
            "ioc_value": "powdgl.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553246": [
        {
            "ioc_value": "rejpqb.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-04 09:28:35",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553228": [
        {
            "ioc_value": "request-bosnia.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-04 09:23:27",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553229": [
        {
            "ioc_value": "wickpinto.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-04 09:23:27",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553227": [
        {
            "ioc_value": "rvbwtbeitwjeitv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ramnit",
            "malware_alias": "Nimnul",
            "malware_printable": "Ramnit",
            "first_seen_utc": "2025-07-04 09:23:09",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,ramnit",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553224": [
        {
            "ioc_value": "oskolko.uno",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.icedid",
            "malware_alias": "BokBot,IceID",
            "malware_printable": "IcedID",
            "first_seen_utc": "2025-07-04 09:22:05",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,icedid",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1553204": [
        {
            "ioc_value": "1c.exifit.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-04 09:10:37",
            "last_seen_utc": "2025-07-04 11:10:32",
            "confidence_level": 75,
            "reference": null,
            "tags": "7_%7,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553199": [
        {
            "ioc_value": "server.pikachull.ip-ddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-04 09:05:55",
            "last_seen_utc": "2025-08-14 11:50:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553187": [
        {
            "ioc_value": "updatemsdnserver.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.strelastealer",
            "malware_alias": null,
            "malware_printable": "StrelaStealer",
            "first_seen_utc": "2025-07-04 08:44:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/3ef0230b95c4a10afe29a332bf5c2617b5feacda4284958bce2b86078d3588be/",
            "tags": "StrelaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553184": [
        {
            "ioc_value": "myaccount.secured-authentication.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-04 08:00:52",
            "last_seen_utc": "2025-07-05 04:01:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.86.84.43+myaccount.secured-authentication.ru",
            "tags": "AS14956,C2,censys,Havoc,ROUTERHOSTING",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553178": [
        {
            "ioc_value": "pulsaratlogs.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-04 07:35:27",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/87e199ab25831f23a346b9b3714c418217fc2ed6e450b3606186d597c3f8d348/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553177": [
        {
            "ioc_value": "pulsa2ndrdplogs.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-04 07:35:25",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/87e199ab25831f23a346b9b3714c418217fc2ed6e450b3606186d597c3f8d348/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553121": [
        {
            "ioc_value": "mer.b2b.9zt.hk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-04 06:46:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/43.133.217.169+mer.b2b.9zt.hk",
            "tags": "AS132203,C2,censys,Supershell",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1553126": [
        {
            "ioc_value": "68.227.0.34.bc.googleusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-04 06:46:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.0.227.68+68.227.0.34.bc.googleusercontent.com",
            "tags": "AS15169,C2,censys,GOOGLE,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1553086": [
        {
            "ioc_value": "mobatek.pro",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-04 06:46:27",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1553158": [
        {
            "ioc_value": "mailing-iv.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-04 06:00:57",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-elxxyaxmy8",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553157": [
        {
            "ioc_value": "dsasinject-58214.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-04 06:00:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250704-b7rfhawny6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553113": [
        {
            "ioc_value": "nas.gddsw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-04 02:54:19",
            "last_seen_utc": "2025-09-18 13:49:52",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553065": [
        {
            "ioc_value": "whitegambit.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-03 19:22:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://urlscan.io/result/0197d1bb-678d-760a-b5c8-4a69630d125d/",
            "tags": "AS40021,Byakugan,c2,domain,NL-811-40021,panel,stealer,urlscan",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553044": [
        {
            "ioc_value": "degene000-47221.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-03 18:01:10",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-wc51mafr9x",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553045": [
        {
            "ioc_value": "63tefarz8.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-03 18:01:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-tyedpafp2z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553043": [
        {
            "ioc_value": "ratlordvc.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-03 18:00:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-qwf8qayqs7",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553042": [
        {
            "ioc_value": "evidence-ecommerce.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-03 18:00:35",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-qmx5wabl5z",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553041": [
        {
            "ioc_value": "newjewel.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-03 18:00:34",
            "last_seen_utc": "2025-07-10 12:50:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-skxgnseq6z",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553040": [
        {
            "ioc_value": "sound-vietnam.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-03 18:00:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-qwf8qayqs7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1553035": [
        {
            "ioc_value": "test8.scacasdxc.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 16:57:15",
            "last_seen_utc": "2025-08-17 09:49:29",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553036": [
        {
            "ioc_value": "test9.scacasdxc.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 16:57:15",
            "last_seen_utc": "2025-08-17 09:49:29",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553030": [
        {
            "ioc_value": "test3.scacasdxc.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 16:57:14",
            "last_seen_utc": "2025-08-17 09:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553031": [
        {
            "ioc_value": "test4.scacasdxc.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 16:57:14",
            "last_seen_utc": "2025-08-17 09:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553032": [
        {
            "ioc_value": "test5.scacasdxc.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 16:57:14",
            "last_seen_utc": "2025-08-17 09:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553033": [
        {
            "ioc_value": "test6.scacasdxc.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 16:57:14",
            "last_seen_utc": "2025-08-17 09:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553034": [
        {
            "ioc_value": "test7.scacasdxc.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 16:57:14",
            "last_seen_utc": "2025-08-17 09:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553029": [
        {
            "ioc_value": "test2.scacasdxc.love",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 16:57:13",
            "last_seen_utc": "2025-08-17 09:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553028": [
        {
            "ioc_value": "vertex0110.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-03 16:52:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1553027": [
        {
            "ioc_value": "ssaspeed.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-03 16:50:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552983": [
        {
            "ioc_value": "roccbqw.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-03 16:04:27",
            "last_seen_utc": "2025-07-23 19:18:53",
            "confidence_level": 66,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1552984": [
        {
            "ioc_value": "cbakk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-03 16:04:26",
            "last_seen_utc": "2025-07-08 11:15:59",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1552985": [
        {
            "ioc_value": "git.xtertexter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-03 16:04:25",
            "last_seen_utc": "2025-07-03 15:00:48",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114789477911039908",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1553014": [
        {
            "ioc_value": "backupjs.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-03 15:26:54",
            "last_seen_utc": "2025-09-17 10:27:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552979": [
        {
            "ioc_value": "myhost.servepics.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-07-03 12:03:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-kcfj7ahj5t",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552978": [
        {
            "ioc_value": "myhost.misecure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-07-03 12:03:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250703-kcfj7ahj5t",
            "tags": "C2,domain,rat,RevengeRAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552971": [
        {
            "ioc_value": "ec2-13-114-32-108.ap-northeast-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-03 12:01:13",
            "last_seen_utc": "2025-07-04 04:01:15",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.114.32.108+ec2-13-114-32-108.ap-northeast-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552970": [
        {
            "ioc_value": "show.thailisting.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-03 12:01:12",
            "last_seen_utc": "2025-07-04 04:01:15",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/27.254.164.212+show.thailisting.net",
            "tags": "AS59374,BANGMODENTERPRISE-AS-AP,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552959": [
        {
            "ioc_value": "80.t.exifit.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-03 11:10:32",
            "last_seen_utc": "2025-07-04 08:10:33",
            "confidence_level": 75,
            "reference": null,
            "tags": "7_%7,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552935": [
        {
            "ioc_value": "rabby.en-web3.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-03 09:03:50",
            "last_seen_utc": "2025-07-10 16:51:22",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1552908": [
        {
            "ioc_value": "add-adolescent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-03 06:16:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552907": [
        {
            "ioc_value": "katanaa.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-03 06:15:52",
            "last_seen_utc": "2025-07-10 12:51:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552906": [
        {
            "ioc_value": "n-survivors.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-07-03 06:15:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552902": [
        {
            "ioc_value": "1ri7zwh3k.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-03 06:14:33",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552903": [
        {
            "ioc_value": "namit-37666.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-03 06:14:33",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552811": [
        {
            "ioc_value": "perjaxs.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-03 05:09:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1552810": [
        {
            "ioc_value": "security.folapegiaurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-03 05:09:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1552807": [
        {
            "ioc_value": "partopikoto.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-07-03 05:09:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.youtube.com/watch?v=69Qro5swuGU",
            "tags": "rhadamanthys",
            "anonymous": "1",
            "reporter": "3123123"
        }
    ],
    "1552833": [
        {
            "ioc_value": "user.thinkg.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 02:54:15",
            "last_seen_utc": "2025-11-22 07:48:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552832": [
        {
            "ioc_value": "api.xiaomis.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-03 02:53:42",
            "last_seen_utc": "2025-08-08 07:50:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552789": [
        {
            "ioc_value": "admin.027dzjl.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 18:47:25",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552790": [
        {
            "ioc_value": "pan.crooods.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 18:47:23",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552786": [
        {
            "ioc_value": "dilin2345-47228.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-02 18:01:33",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-s7ns2sypy5",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552771": [
        {
            "ioc_value": "net.botwork.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.moobot",
            "malware_alias": null,
            "malware_printable": "MooBot",
            "first_seen_utc": "2025-07-02 17:43:04",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f5d3076dd4b687c32def189c69869d7d7b9661c10964662bb57770491604c2f7/",
            "tags": "MooBot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552765": [
        {
            "ioc_value": "musicdownloader.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-02 16:57:38",
            "last_seen_utc": "2025-07-02 16:10:27",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114784509884973159",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1552766": [
        {
            "ioc_value": "kabarbhayangkara.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-07-02 16:57:38",
            "last_seen_utc": "2025-07-02 16:10:30",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114784509884973159",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1552754": [
        {
            "ioc_value": "continue-relationships.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-02 13:45:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-pt3hhadp3t",
            "tags": "C2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552732": [
        {
            "ioc_value": "images.venthalpyapp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-02 13:12:36",
            "last_seen_utc": "2025-07-02 13:16:06",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114783805034638291",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1552733": [
        {
            "ioc_value": "265ea973-18d6-47d2-8796-29db4decc888-00-lq5hf5va4e7m.pike.replit.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 13:11:39",
            "last_seen_utc": "2025-09-14 09:49:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552722": [
        {
            "ioc_value": "3.s.exifit.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-02 12:11:09",
            "last_seen_utc": "2025-07-03 10:10:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "7_%7,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552719": [
        {
            "ioc_value": "kardan35.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-02 12:03:11",
            "last_seen_utc": "2025-07-17 10:37:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-nltpysxks5",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552714": [
        {
            "ioc_value": "www.denisa.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-07-02 12:02:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/196.251.87.244+www.denisa.shop",
            "tags": "AS401120,C2,censys,CHEAPY-HOST,Gafgyt,open-dir",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552706": [
        {
            "ioc_value": "leading-calculator.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-02 12:01:45",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-jw8jmstyav",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552705": [
        {
            "ioc_value": "better-allan.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-02 12:01:44",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-jyq3davk18",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552676": [
        {
            "ioc_value": "sfr90.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-02 10:21:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552677": [
        {
            "ioc_value": "4morphis.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-02 10:21:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552678": [
        {
            "ioc_value": "the07ayoub.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-02 10:21:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552679": [
        {
            "ioc_value": "alfoo.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-02 10:21:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552680": [
        {
            "ioc_value": "edwardian.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-02 10:21:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552681": [
        {
            "ioc_value": "italo2011.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-02 10:21:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552682": [
        {
            "ioc_value": "juttrdx.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-02 10:21:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552671": [
        {
            "ioc_value": "cutaylorpascale.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-07-02 10:21:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552672": [
        {
            "ioc_value": "sdorthyyantonietta.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-07-02 10:21:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552673": [
        {
            "ioc_value": "jpearl26kacey.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-07-02 10:21:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552674": [
        {
            "ioc_value": "alfo.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-02 10:21:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552675": [
        {
            "ioc_value": "zielony.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-07-02 10:21:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552667": [
        {
            "ioc_value": "phenoms.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-02 10:21:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552668": [
        {
            "ioc_value": "moneybag042.warzonedns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-02 10:21:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552669": [
        {
            "ioc_value": "contact-japan.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-07-02 10:21:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552662": [
        {
            "ioc_value": "duoohr71.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-07-02 10:21:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552663": [
        {
            "ioc_value": "morttttf08.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-07-02 10:21:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552664": [
        {
            "ioc_value": "kypersar42.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-07-02 10:21:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552665": [
        {
            "ioc_value": "morfev07.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-07-02 10:21:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552652": [
        {
            "ioc_value": "gallery-article.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-02 10:21:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552653": [
        {
            "ioc_value": "1221.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-02 10:21:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552654": [
        {
            "ioc_value": "nokta147.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-02 10:21:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552655": [
        {
            "ioc_value": "both-burlington.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-02 10:21:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552656": [
        {
            "ioc_value": "mosabedz.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-02 10:21:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552657": [
        {
            "ioc_value": "ckimo.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-02 10:21:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552650": [
        {
            "ioc_value": "markscott.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-02 10:21:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552648": [
        {
            "ioc_value": "btoast.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bit_rat",
            "malware_alias": null,
            "malware_printable": "BitRAT",
            "first_seen_utc": "2025-07-02 10:21:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552641": [
        {
            "ioc_value": "magazine-tattoo.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-02 10:21:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552642": [
        {
            "ioc_value": "names-compatibility.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-02 10:21:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552643": [
        {
            "ioc_value": "superwx.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-02 10:21:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552640": [
        {
            "ioc_value": "xw.lnpntkd9vth0tup2.rest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-02 10:21:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552630": [
        {
            "ioc_value": "conhostlogsdown2.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-02 10:21:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552631": [
        {
            "ioc_value": "josemansory980.4cloud.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-02 10:21:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552625": [
        {
            "ioc_value": "alexmoro.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-02 10:21:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552626": [
        {
            "ioc_value": "servicesdrivres1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-02 10:21:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552627": [
        {
            "ioc_value": "gomezgomez.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-02 10:21:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552628": [
        {
            "ioc_value": "mistico2032.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-02 10:21:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552629": [
        {
            "ioc_value": "conhostlogsdown1.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-02 10:21:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552613": [
        {
            "ioc_value": "evilc6604-54395.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-02 10:21:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552614": [
        {
            "ioc_value": "qquasar.lnpntkd9vth0tup2.rest",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-02 10:21:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552615": [
        {
            "ioc_value": "ever-transparent.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-02 10:21:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552616": [
        {
            "ioc_value": "done-gather.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-02 10:21:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552617": [
        {
            "ioc_value": "clairos-34961.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-02 10:21:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552618": [
        {
            "ioc_value": "fall-islam.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-02 10:21:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "2July2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1552573": [
        {
            "ioc_value": "synchronization.rayanconfnet.ir",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 10:08:28",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552574": [
        {
            "ioc_value": "techwhispers.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 10:08:28",
            "last_seen_utc": "2025-07-02 09:34:51",
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552575": [
        {
            "ioc_value": "update.markets-news.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 10:08:28",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552572": [
        {
            "ioc_value": "smtp.dkairsystems.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 10:08:27",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552571": [
        {
            "ioc_value": "ithzb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 10:08:26",
            "last_seen_utc": "2025-07-02 09:34:51",
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552569": [
        {
            "ioc_value": "cbots.m.crooods.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 10:08:25",
            "last_seen_utc": "2025-07-02 09:34:51",
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552570": [
        {
            "ioc_value": "cdn.burbankskincancercenter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 10:08:25",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552566": [
        {
            "ioc_value": "www.shopecxw.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.plugx",
            "malware_alias": "Destroy RAT,Kaba,Korplug,Sogu,TIGERPLUG,RedDelta",
            "malware_printable": "PlugX",
            "first_seen_utc": "2025-07-02 10:08:23",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/hunting-pandas",
            "tags": "plugx,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552564": [
        {
            "ioc_value": "gjsccxw.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.plugx",
            "malware_alias": "Destroy RAT,Kaba,Korplug,Sogu,TIGERPLUG,RedDelta",
            "malware_printable": "PlugX",
            "first_seen_utc": "2025-07-02 10:08:22",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/hunting-pandas",
            "tags": "plugx,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552565": [
        {
            "ioc_value": "www.f-r-a-kuten.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.plugx",
            "malware_alias": "Destroy RAT,Kaba,Korplug,Sogu,TIGERPLUG,RedDelta",
            "malware_printable": "PlugX",
            "first_seen_utc": "2025-07-02 10:08:22",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/hunting-pandas",
            "tags": "plugx,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552563": [
        {
            "ioc_value": "fakutenshop.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.plugx",
            "malware_alias": "Destroy RAT,Kaba,Korplug,Sogu,TIGERPLUG,RedDelta",
            "malware_printable": "PlugX",
            "first_seen_utc": "2025-07-02 10:08:21",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/hunting-pandas",
            "tags": "plugx,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1552521": [
        {
            "ioc_value": "img.responsive.pstatic.autos",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-02 07:25:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/Cyberteam008/status/1940265872402403341",
            "tags": "APT,APT37,RicochetChollima,ScarCruft",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552522": [
        {
            "ioc_value": "img.smartnords.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-02 07:25:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/Cyberteam008/status/1940265872402403341",
            "tags": "APT,APT37,RicochetChollima,ScarCruft",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552523": [
        {
            "ioc_value": "img.worksongo.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-02 07:25:27",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/Cyberteam008/status/1940265872402403341",
            "tags": "APT,APT37,RicochetChollima,ScarCruft",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552524": [
        {
            "ioc_value": "show.grip-cdns.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-02 07:25:27",
            "last_seen_utc": "2025-07-02 07:25:27",
            "confidence_level": 50,
            "reference": "https://x.com/Cyberteam008/status/1940265872402403341",
            "tags": "APT,APT37,RicochetChollima,ScarCruft",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552520": [
        {
            "ioc_value": "admin.primgs.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-02 07:25:26",
            "last_seen_utc": "2025-07-02 07:25:27",
            "confidence_level": 50,
            "reference": "https://x.com/Cyberteam008/status/1940265872402403341",
            "tags": "APT,APT37,RicochetChollima,ScarCruft",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552518": [
        {
            "ioc_value": "ycvduc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-02 07:17:59",
            "last_seen_utc": "2025-07-06 15:10:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1552519": [
        {
            "ioc_value": "nbcsfar.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-07-02 07:17:59",
            "last_seen_utc": "2025-07-06 15:10:19",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1552512": [
        {
            "ioc_value": "mythstealer.win",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-02 06:09:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "MythStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552513": [
        {
            "ioc_value": "combatshell.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-02 06:09:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "MythStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552514": [
        {
            "ioc_value": "luraka-game.github.io",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-02 06:09:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "MythStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552515": [
        {
            "ioc_value": "yomiragame.blogspot.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-02 06:09:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "MythStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552516": [
        {
            "ioc_value": "combatsouls.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-02 06:09:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "MythStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552517": [
        {
            "ioc_value": "myth.cocukporno.lol",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-02 06:09:37",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "MythStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552510": [
        {
            "ioc_value": "plaquist-simulator.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-02 06:09:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "MythStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552511": [
        {
            "ioc_value": "everlight-beta.netlify.app",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-02 06:09:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "MythStealer",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552508": [
        {
            "ioc_value": "bot.hiddenlists.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-02 06:08:33",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552509": [
        {
            "ioc_value": "phubotnet.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-02 06:08:33",
            "last_seen_utc": "2025-07-10 12:51:10",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552496": [
        {
            "ioc_value": "www.t722.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552497": [
        {
            "ioc_value": "www.tgroup.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552498": [
        {
            "ioc_value": "www.ukangzhe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552499": [
        {
            "ioc_value": "www.uposttracked.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552500": [
        {
            "ioc_value": "www.vjii.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552501": [
        {
            "ioc_value": "www.w-vshop7-eleven.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552502": [
        {
            "ioc_value": "www.xbet-bet-mu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552503": [
        {
            "ioc_value": "www.xrfeg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552504": [
        {
            "ioc_value": "www.y7dld.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552505": [
        {
            "ioc_value": "www.yudsbnfdg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552506": [
        {
            "ioc_value": "www.yvnub.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:20",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552481": [
        {
            "ioc_value": "www.px.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552482": [
        {
            "ioc_value": "www.qbrn.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552483": [
        {
            "ioc_value": "www.rafttrd.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552484": [
        {
            "ioc_value": "www.ramthrish.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552485": [
        {
            "ioc_value": "www.randperfumer.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552486": [
        {
            "ioc_value": "www.reace.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552487": [
        {
            "ioc_value": "www.remium5.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552488": [
        {
            "ioc_value": "www.riaaccounting.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552489": [
        {
            "ioc_value": "www.ronostic.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552490": [
        {
            "ioc_value": "www.rownandcleatco.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552491": [
        {
            "ioc_value": "www.sfglar.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552492": [
        {
            "ioc_value": "www.sgzg.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552493": [
        {
            "ioc_value": "www.sxzvkf8.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552494": [
        {
            "ioc_value": "www.sy884.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552495": [
        {
            "ioc_value": "www.t2025.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552466": [
        {
            "ioc_value": "www.nxzlb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552467": [
        {
            "ioc_value": "www.obertdavid.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552468": [
        {
            "ioc_value": "www.odallmikn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552469": [
        {
            "ioc_value": "www.odhod.cafe",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552470": [
        {
            "ioc_value": "www.olygon.llc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552471": [
        {
            "ioc_value": "www.om-etcklb.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552472": [
        {
            "ioc_value": "www.ome-portable-1hi3jo.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552473": [
        {
            "ioc_value": "www.onsultacaixa.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552474": [
        {
            "ioc_value": "www.oonlagoon.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552475": [
        {
            "ioc_value": "www.ooyoo.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552476": [
        {
            "ioc_value": "www.oreigndept.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552477": [
        {
            "ioc_value": "www.orwarderp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552478": [
        {
            "ioc_value": "www.oulscripts.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552479": [
        {
            "ioc_value": "www.ourstoreworld.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552480": [
        {
            "ioc_value": "www.pkooity.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552452": [
        {
            "ioc_value": "www.kf5bb.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552453": [
        {
            "ioc_value": "www.kgvuz.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552454": [
        {
            "ioc_value": "www.kk72g.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552455": [
        {
            "ioc_value": "www.leuthly.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552456": [
        {
            "ioc_value": "www.lingan.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552457": [
        {
            "ioc_value": "www.lockbuilder.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552458": [
        {
            "ioc_value": "www.lovemygod.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552459": [
        {
            "ioc_value": "www.lsdh33.lol",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552460": [
        {
            "ioc_value": "www.m5qfk.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552461": [
        {
            "ioc_value": "www.mar1.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552462": [
        {
            "ioc_value": "www.nfq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552463": [
        {
            "ioc_value": "www.nhojejagfsmoon482rapid.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552464": [
        {
            "ioc_value": "www.nviodigitallive.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552465": [
        {
            "ioc_value": "www.nviodigitalsstore.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552437": [
        {
            "ioc_value": "www.herightmoment.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552438": [
        {
            "ioc_value": "www.herripalmer.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552439": [
        {
            "ioc_value": "www.hetrxio.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552440": [
        {
            "ioc_value": "www.hklbx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552441": [
        {
            "ioc_value": "www.hristopher559.forum",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552442": [
        {
            "ioc_value": "www.idgxq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552443": [
        {
            "ioc_value": "www.iewm0.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552444": [
        {
            "ioc_value": "www.inebreak.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552445": [
        {
            "ioc_value": "www.ingitchyvisitwhistle.christmas",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552446": [
        {
            "ioc_value": "www.iongciyuan.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552447": [
        {
            "ioc_value": "www.iotrax.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552448": [
        {
            "ioc_value": "www.iq73j.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552449": [
        {
            "ioc_value": "www.ir-condition-49726.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552450": [
        {
            "ioc_value": "www.j-turismopg.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552451": [
        {
            "ioc_value": "www.kclub.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552421": [
        {
            "ioc_value": "www.egundaviareservista.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552422": [
        {
            "ioc_value": "www.elegxzpw.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552423": [
        {
            "ioc_value": "www.ellness360.services",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552424": [
        {
            "ioc_value": "www.enior-living-64812.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552425": [
        {
            "ioc_value": "www.erm-life-insurance-guide.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552426": [
        {
            "ioc_value": "www.ermech.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552427": [
        {
            "ioc_value": "www.erora.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552428": [
        {
            "ioc_value": "www.eshi.qpon",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552429": [
        {
            "ioc_value": "www.est-gd-888.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552430": [
        {
            "ioc_value": "www.estsafe.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552431": [
        {
            "ioc_value": "www.etnow-system.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552432": [
        {
            "ioc_value": "www.f1e3c.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552433": [
        {
            "ioc_value": "www.g-899b8.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552434": [
        {
            "ioc_value": "www.g51-lfoc1640.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552435": [
        {
            "ioc_value": "www.gstore.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552436": [
        {
            "ioc_value": "www.haymaa.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552404": [
        {
            "ioc_value": "www.ayfairoutlet.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552405": [
        {
            "ioc_value": "www.bhvpf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552406": [
        {
            "ioc_value": "www.c.vacations",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552407": [
        {
            "ioc_value": "www.c0739.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552408": [
        {
            "ioc_value": "www.c1395.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552409": [
        {
            "ioc_value": "www.c2081.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552410": [
        {
            "ioc_value": "www.c3162.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552411": [
        {
            "ioc_value": "www.c4809.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552412": [
        {
            "ioc_value": "www.c5073.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552413": [
        {
            "ioc_value": "www.c5349.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552414": [
        {
            "ioc_value": "www.cottengland.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552415": [
        {
            "ioc_value": "www.cty.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552416": [
        {
            "ioc_value": "www.dd0rf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552417": [
        {
            "ioc_value": "www.dl5ue.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552418": [
        {
            "ioc_value": "www.ds-adguard.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552419": [
        {
            "ioc_value": "www.dtr.website",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552420": [
        {
            "ioc_value": "www.eadisadev.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:14",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552385": [
        {
            "ioc_value": "www.8ksbtrf.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552386": [
        {
            "ioc_value": "www.adisson003.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552387": [
        {
            "ioc_value": "www.aichuan.group",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552388": [
        {
            "ioc_value": "www.ainianoffice.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552389": [
        {
            "ioc_value": "www.aisoncalme.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552390": [
        {
            "ioc_value": "www.alentabroadgroup.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552391": [
        {
            "ioc_value": "www.alentedgegrouphq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552392": [
        {
            "ioc_value": "www.allantit.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552393": [
        {
            "ioc_value": "www.amily-doctor-96553.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552394": [
        {
            "ioc_value": "www.andsbyen-nh.art",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552395": [
        {
            "ioc_value": "www.antwedding.food",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552396": [
        {
            "ioc_value": "www.aoik.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552397": [
        {
            "ioc_value": "www.apakliescort.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552398": [
        {
            "ioc_value": "www.arrel.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552399": [
        {
            "ioc_value": "www.artechs.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552400": [
        {
            "ioc_value": "www.arung065.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552401": [
        {
            "ioc_value": "www.aser-eye-surgery-gb-ro.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552402": [
        {
            "ioc_value": "www.astech223.tech",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552403": [
        {
            "ioc_value": "www.auuiqoq.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:13",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552378": [
        {
            "ioc_value": "www.06.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552379": [
        {
            "ioc_value": "www.0z442.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552380": [
        {
            "ioc_value": "www.2zyo6w.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552381": [
        {
            "ioc_value": "www.63bitcoin.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552382": [
        {
            "ioc_value": "www.7o.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552383": [
        {
            "ioc_value": "www.88.fan",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552384": [
        {
            "ioc_value": "www.8dqy8.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-07-02 06:08:12",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552245": [
        {
            "ioc_value": "tel-dv.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-07-02 06:07:16",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1552213": [
        {
            "ioc_value": "j3ru5al3m.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-02 06:01:34",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-ehd1naej7v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552212": [
        {
            "ioc_value": "sheddinho1122.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-02 06:01:33",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-ezdq8asnz2",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552211": [
        {
            "ioc_value": "developer1.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-02 06:01:20",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-cee3faeq9s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552210": [
        {
            "ioc_value": "andre21.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-02 06:01:19",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-cee3faeq9s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552209": [
        {
            "ioc_value": "imagoatlowk-58420.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-02 06:01:18",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250702-fth97aeq2t",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552178": [
        {
            "ioc_value": "m83-189-135-177.cust.tele2.se",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 04:00:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/83.189.135.177+m83-189-135-177.cust.tele2.se",
            "tags": "AS1257,C2,censys,TELE2",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1552177": [
        {
            "ioc_value": "ecs-113-45-47-3.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-02 04:00:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/113.45.47.3+ecs-113-45-47-3.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1552159": [
        {
            "ioc_value": "73w6tr0x1tnay.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-01 22:54:34",
            "last_seen_utc": "2025-08-09 07:49:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552140": [
        {
            "ioc_value": "malahh.oixrv2gn.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-01 18:56:54",
            "last_seen_utc": "2025-08-19 07:51:09",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552130": [
        {
            "ioc_value": "suchdevil-25933.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-07-01 18:01:51",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-snxa3swves",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552126": [
        {
            "ioc_value": "exper.mywire.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-01 18:01:22",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-ttvvwawyd1",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552127": [
        {
            "ioc_value": "dczip3.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-01 18:01:22",
            "last_seen_utc": "2025-07-10 12:50:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-rnh8saam9s",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552124": [
        {
            "ioc_value": "vltalmex.com.mx",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-01 18:01:13",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-wc1qxaxtdt",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552125": [
        {
            "ioc_value": "00283643bbm.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-01 18:01:13",
            "last_seen_utc": "2025-07-10 12:50:57",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-vql91adj21",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552006": [
        {
            "ioc_value": "cpanel.thekooljack.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-07-01 16:21:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1552115": [
        {
            "ioc_value": "amaprox.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-01 16:02:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.62.59+amaprox.shop",
            "tags": "Amatera,AS13335,C2,censys,CLOUDFLARENET,Panel,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552112": [
        {
            "ioc_value": "fbsvm.cam",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 16:02:08",
            "last_seen_utc": "2025-07-02 04:01:27",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/159.198.32.118+fbsvm.cam",
            "tags": "AS22612,censys,EvilGinx,NAMECHEAP-NET,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552109": [
        {
            "ioc_value": "accounts.directllinegroup.co.uk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-01 16:01:52",
            "last_seen_utc": "2025-07-10 04:01:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/18.168.225.154+accounts.directllinegroup.co.uk",
            "tags": "AMAZON-02,AS16509,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1552004": [
        {
            "ioc_value": "0.x.exifit.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-07-01 13:10:34",
            "last_seen_utc": "2025-07-02 11:10:42",
            "confidence_level": 75,
            "reference": null,
            "tags": "7_%7,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1552000": [
        {
            "ioc_value": "www.autoauctionsdirect.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-07-01 13:03:45",
            "last_seen_utc": "2025-10-14 03:17:53",
            "confidence_level": 100,
            "reference": null,
            "tags": "loader,Maison Worm,maisonworm",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1552001": [
        {
            "ioc_value": "47sqwjxze4941.cfc-execute.su.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-01 12:58:40",
            "last_seen_utc": "2025-09-12 11:49:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551984": [
        {
            "ioc_value": "mdnsserver.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-01 12:01:32",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-h79emsgr3v",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551982": [
        {
            "ioc_value": "lionvs.gotdns.ch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-01 12:01:31",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-h8l1qs1yfw",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551983": [
        {
            "ioc_value": "mxsunamz.gotdns.ch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-01 12:01:31",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-h8l1qs1yfw",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551981": [
        {
            "ioc_value": "wigroups.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-01 12:01:30",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-lsxdbatqw4",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551980": [
        {
            "ioc_value": "weneedverysweetgirlwholovesmebetterthana.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-01 12:01:29",
            "last_seen_utc": "2025-07-11 18:22:56",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-mcna5svjx3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551975": [
        {
            "ioc_value": "zenforexpvtltd.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-01 12:01:09",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-g4p16a1we1",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551954": [
        {
            "ioc_value": "ofkkfd24.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-01 11:38:54",
            "last_seen_utc": "2025-07-02 10:21:39",
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1939444228154946002",
            "tags": "AsyncRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551953": [
        {
            "ioc_value": "djlmwd9b-80.euw.devtunnels.ms",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-07-01 11:36:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/G60930953/status/1939506390692774384",
            "tags": "geo,Havoc,PAK",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551942": [
        {
            "ioc_value": "greenpop.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 10:18:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1939692023310586269",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551943": [
        {
            "ioc_value": "hreatlittleheaven.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 10:18:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1939692023310586269",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551944": [
        {
            "ioc_value": "ksecure.bio",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 10:18:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1939692023310586269",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551945": [
        {
            "ioc_value": "pineappleworld.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 10:18:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1939692023310586269",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551946": [
        {
            "ioc_value": "plumpinr.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 10:18:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1939692023310586269",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551947": [
        {
            "ioc_value": "sunmelonontheway.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 10:18:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1939692023310586269",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551948": [
        {
            "ioc_value": "vibrantforest.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 10:18:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1939692023310586269",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551941": [
        {
            "ioc_value": "islamabadpolice.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:14:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/volrant136/status/1939737733024415965",
            "tags": "APT,geo,PAK,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551940": [
        {
            "ioc_value": "safecityctd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/volrant136/status/1939744960170885468",
            "tags": "APT,geo,PAK",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551938": [
        {
            "ioc_value": "mofa.gov.bd.mofa-govbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551939": [
        {
            "ioc_value": "mofa-govbd.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551934": [
        {
            "ioc_value": "yahoo.com.mofa-govbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551935": [
        {
            "ioc_value": "mail.mofa-govbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551936": [
        {
            "ioc_value": "mod.mofa-govbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551937": [
        {
            "ioc_value": "mhapsd.gov.bd.mofa-govbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:02",
            "last_seen_utc": "2025-07-01 10:13:03",
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551930": [
        {
            "ioc_value": "mofa-govbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551931": [
        {
            "ioc_value": "tod.treasury.gov.lk.mofa-govbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:01",
            "last_seen_utc": "2025-07-01 10:13:02",
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551932": [
        {
            "ioc_value": "erd.gov.lk.mofa-govbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:01",
            "last_seen_utc": "2025-07-01 10:13:02",
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551933": [
        {
            "ioc_value": "ftp.mofa-govbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551927": [
        {
            "ioc_value": "mofagovbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551928": [
        {
            "ioc_value": "nvloi.mofagovbd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551929": [
        {
            "ioc_value": "mofa-gov-bd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:13:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/volrant136/status/1939225148021784776",
            "tags": "APT,BGD,geo,LKA,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551926": [
        {
            "ioc_value": "mofa-govpk.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:12:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/volrant136/status/1939739683023421890",
            "tags": "APT,geo,PAK,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551924": [
        {
            "ioc_value": "mofagovpk-hq.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:11:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/volrant136/status/1939739683023421890",
            "tags": "APT,geo,PAK,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551925": [
        {
            "ioc_value": "cons.mofagovpk.co",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.sidewinder",
            "malware_alias": null,
            "malware_printable": "SideWinder",
            "first_seen_utc": "2025-07-01 10:11:59",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/volrant136/status/1939739683023421890",
            "tags": "APT,geo,PAK,SideWinder",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551923": [
        {
            "ioc_value": "cuttingedgetechworks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-07-01 09:55:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1861ce0df386218501fea79fd5481d0102e3bc918313d7288bee0941c07876e5/",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551918": [
        {
            "ioc_value": "languagenose.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-01 09:44:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551917": [
        {
            "ioc_value": "cnm.h0xtopsec.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-01 08:56:14",
            "last_seen_utc": "2025-07-02 12:09:32",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551887": [
        {
            "ioc_value": "intelligentopennetworkingawards.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-01 06:24:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "BRA,geo",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551888": [
        {
            "ioc_value": "storeshomeestudiosfluworks.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-07-01 06:24:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "BRA,geo",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551886": [
        {
            "ioc_value": "buukas.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-07-01 06:21:45",
            "last_seen_utc": "2025-07-10 12:50:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551884": [
        {
            "ioc_value": "bulon.trumdvfb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-01 06:21:30",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551885": [
        {
            "ioc_value": "vip.jbvipnetwork.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-07-01 06:21:30",
            "last_seen_utc": "2025-10-10 07:13:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551879": [
        {
            "ioc_value": "hot-filing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-07-01 06:20:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551856": [
        {
            "ioc_value": "NULLTRACES-38627.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-01 06:01:39",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-dagk5sbm7z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551857": [
        {
            "ioc_value": "NULLTRACES-62756.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-07-01 06:01:39",
            "last_seen_utc": "2025-07-10 12:50:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-dagk5sbm7z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551853": [
        {
            "ioc_value": "along-rid.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-07-01 06:01:09",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250701-c1xjlszwgw",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551750": [
        {
            "ioc_value": "web-rabby.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 05:50:16",
            "last_seen_utc": "2025-08-25 20:37:39",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1551770": [
        {
            "ioc_value": "security.fsealengurrad.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 05:48:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1551771": [
        {
            "ioc_value": "poqers.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 05:48:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1551801": [
        {
            "ioc_value": "susni-swap.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 05:48:23",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1551802": [
        {
            "ioc_value": "dexsceerner.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 05:48:23",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "ninjacatcher"
        }
    ],
    "1551809": [
        {
            "ioc_value": "play.rubyhall.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 04:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/139.59.16.42+play.rubyhall.in.net",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551810": [
        {
            "ioc_value": "win2officialgray.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 04:00:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.92.157+win2officialgray.win",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551797": [
        {
            "ioc_value": "360sec-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-07-01 02:53:30",
            "last_seen_utc": "2025-07-31 13:49:35",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551793": [
        {
            "ioc_value": "accounts.podform.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-07-01 00:01:59",
            "last_seen_utc": "2025-07-01 04:01:09",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/85.239.53.250+accounts.podform.site",
            "tags": "AS62005,BV-EU-AS,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551779": [
        {
            "ioc_value": "www.csgo-csgo-go.it.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-30 22:52:42",
            "last_seen_utc": "2025-08-07 07:50:50",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551776": [
        {
            "ioc_value": "ns2.nmd5.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-30 20:52:36",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551775": [
        {
            "ioc_value": "ns1.nmd5.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-30 20:52:33",
            "last_seen_utc": "2025-12-14 11:48:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551774": [
        {
            "ioc_value": "ns1.cooke-int.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-30 20:52:32",
            "last_seen_utc": "2025-10-02 07:49:50",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551722": [
        {
            "ioc_value": "events.api.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:05",
            "last_seen_utc": "2025-07-01 04:01:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+events.api.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551723": [
        {
            "ioc_value": "ssl.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:05",
            "last_seen_utc": "2025-07-01 04:01:09",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+ssl.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551724": [
        {
            "ioc_value": "ok.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:05",
            "last_seen_utc": "2025-07-01 04:01:09",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+ok.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551720": [
        {
            "ioc_value": "account.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:04",
            "last_seen_utc": "2025-07-01 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+account.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551721": [
        {
            "ioc_value": "live.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:04",
            "last_seen_utc": "2025-07-01 04:01:08",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+live.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551718": [
        {
            "ioc_value": "apm.vpce.gdw55e.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:03",
            "last_seen_utc": "2025-07-01 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+apm.vpce.gdw55e.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551719": [
        {
            "ioc_value": "sso.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:03",
            "last_seen_utc": "2025-07-01 04:01:08",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+sso.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551716": [
        {
            "ioc_value": "csp.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:02",
            "last_seen_utc": "2025-07-01 04:01:08",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+csp.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551717": [
        {
            "ioc_value": "acc.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:02",
            "last_seen_utc": "2025-07-01 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+acc.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551715": [
        {
            "ioc_value": "gui.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:01",
            "last_seen_utc": "2025-07-01 04:01:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+gui.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551712": [
        {
            "ioc_value": "outlook.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:00",
            "last_seen_utc": "2025-07-01 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+outlook.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551713": [
        {
            "ioc_value": "okta.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:00",
            "last_seen_utc": "2025-07-01 04:01:08",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+okta.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551714": [
        {
            "ioc_value": "g.sst.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:02:00",
            "last_seen_utc": "2025-07-01 04:01:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+g.sst.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551711": [
        {
            "ioc_value": "reporting.teams.m365.acenm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 20:01:59",
            "last_seen_utc": "2025-07-01 04:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.110.226.40+reporting.teams.m365.acenm.com",
            "tags": "AS14061,censys,DIGITALOCEAN-ASN,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551694": [
        {
            "ioc_value": "6.p.exifit.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-30 19:10:29",
            "last_seen_utc": "2025-07-01 12:10:43",
            "confidence_level": 75,
            "reference": null,
            "tags": "7_%7,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551685": [
        {
            "ioc_value": "mike-ie.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-30 18:01:55",
            "last_seen_utc": "2025-07-02 10:21:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-t2cn9s1tes",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551684": [
        {
            "ioc_value": "syqkar3wt.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-30 18:01:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-vp44es1waz",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551682": [
        {
            "ioc_value": "newstartagain.servequake.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-30 18:01:20",
            "last_seen_utc": "2025-06-30 18:01:20",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-snvr9asnw3",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551683": [
        {
            "ioc_value": "newstartagain50.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-30 18:01:20",
            "last_seen_utc": "2025-06-30 18:01:21",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-snvr9asnw3",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551679": [
        {
            "ioc_value": "asy5858d.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-30 18:01:19",
            "last_seen_utc": "2025-07-10 12:50:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-v9pt8stnv9",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551680": [
        {
            "ioc_value": "asy5858b.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-30 18:01:19",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-v9pt8stnv9",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551681": [
        {
            "ioc_value": "asy5858a.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-30 18:01:19",
            "last_seen_utc": "2025-07-10 12:50:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-v9pt8stnv9",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551678": [
        {
            "ioc_value": "asy5858c.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-30 18:01:18",
            "last_seen_utc": "2025-07-10 12:50:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-v9pt8stnv9",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551665": [
        {
            "ioc_value": "juslcl.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551666": [
        {
            "ioc_value": "centbua.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551667": [
        {
            "ioc_value": "nybzxz.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": "2025-07-23 19:18:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551668": [
        {
            "ioc_value": "senylup.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": "2025-07-23 19:19:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551669": [
        {
            "ioc_value": "usecdvo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": "2025-07-04 14:56:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551670": [
        {
            "ioc_value": "tretpn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": "2025-09-10 08:31:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551671": [
        {
            "ioc_value": "darkibn.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": "2025-09-10 08:31:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551672": [
        {
            "ioc_value": "yufxt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551673": [
        {
            "ioc_value": "decyzz.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": "2025-07-04 14:56:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551674": [
        {
            "ioc_value": "couamcs.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:25",
            "last_seen_utc": "2025-07-04 14:56:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551661": [
        {
            "ioc_value": "lighri.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:24",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551662": [
        {
            "ioc_value": "glhvps.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:24",
            "last_seen_utc": "2025-07-04 14:56:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551663": [
        {
            "ioc_value": "renoex.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:24",
            "last_seen_utc": "2025-09-10 08:31:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551664": [
        {
            "ioc_value": "parlqo.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:24",
            "last_seen_utc": "2025-09-10 08:31:27",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551660": [
        {
            "ioc_value": "grhod.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:22",
            "last_seen_utc": "2025-07-04 14:56:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551656": [
        {
            "ioc_value": "nysux.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:20",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551657": [
        {
            "ioc_value": "aligey.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:20",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551658": [
        {
            "ioc_value": "schiad.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:20",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551659": [
        {
            "ioc_value": "papsklg.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:20",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551637": [
        {
            "ioc_value": "couplpx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551638": [
        {
            "ioc_value": "flizsf.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551639": [
        {
            "ioc_value": "northav.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-23 19:18:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551640": [
        {
            "ioc_value": "piejfw.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-09-10 08:31:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551641": [
        {
            "ioc_value": "liqz.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-09-10 08:31:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551642": [
        {
            "ioc_value": "irremr.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551643": [
        {
            "ioc_value": "imperfl.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-23 19:18:52",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551644": [
        {
            "ioc_value": "smoozof.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-04 14:56:13",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551645": [
        {
            "ioc_value": "thicpl.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551646": [
        {
            "ioc_value": "theuid.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-09-10 08:31:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551647": [
        {
            "ioc_value": "uponou.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-04 14:56:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551648": [
        {
            "ioc_value": "strupc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551649": [
        {
            "ioc_value": "enadpn.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-23 19:18:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551650": [
        {
            "ioc_value": "cryswfn.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-04 14:56:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551651": [
        {
            "ioc_value": "cziv.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551652": [
        {
            "ioc_value": "falsiu.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-23 19:18:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551653": [
        {
            "ioc_value": "jaizmf.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-09-10 08:31:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551654": [
        {
            "ioc_value": "isstdd.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": "2025-07-04 14:56:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551655": [
        {
            "ioc_value": "heojy.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551632": [
        {
            "ioc_value": "marketlumma.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:18",
            "last_seen_utc": "2025-07-13 19:03:49",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551633": [
        {
            "ioc_value": "prezud.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:18",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551634": [
        {
            "ioc_value": "moslet.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:18",
            "last_seen_utc": "2025-07-04 14:56:15",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551635": [
        {
            "ioc_value": "mahrox.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:18",
            "last_seen_utc": "2025-07-23 19:18:58",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551636": [
        {
            "ioc_value": "takefhq.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 16:16:18",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551598": [
        {
            "ioc_value": "sample.tcroadgear.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-30 14:48:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1551624": [
        {
            "ioc_value": "chukwunweikefrankokiteamaekeibeku.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-30 14:42:20",
            "last_seen_utc": "2025-07-10 12:50:58",
            "confidence_level": 100,
            "reference": "https://www.joesandbox.com/analysis/1725621/0/html",
            "tags": "c2,domain,joesandbox,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551622": [
        {
            "ioc_value": "c2.atomdata.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-30 14:33:13",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551623": [
        {
            "ioc_value": "motre.jbvpshosti.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-30 14:33:13",
            "last_seen_utc": "2025-07-10 12:51:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551589": [
        {
            "ioc_value": "auth.bobbleflatfoot.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-06-30 12:41:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/bbc8db645229fd5880895f1717f3d3776602b77f4709f423e9b213edceffdfee/",
            "tags": "ACRStealer,AmateraStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1551588": [
        {
            "ioc_value": "iujqdwh-61305.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-30 12:02:57",
            "last_seen_utc": "2025-07-10 12:50:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-nqz3jaxyb1",
            "tags": "android,C2,domain,spynote,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551585": [
        {
            "ioc_value": "java-romance.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-30 12:01:52",
            "last_seen_utc": "2025-07-02 10:21:54",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-nydjhazpt4",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551586": [
        {
            "ioc_value": "advertising-mary.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-30 12:01:52",
            "last_seen_utc": "2025-07-02 10:21:53",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-mx13qszjt9",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551573": [
        {
            "ioc_value": "backupindvy.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-30 12:01:09",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-ne5hwazkz8",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551572": [
        {
            "ioc_value": "bit-bathrooms.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-30 12:01:01",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-nydjhazpt4",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551561": [
        {
            "ioc_value": "rbmlh.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-30 10:35:56",
            "last_seen_utc": "2025-07-07 09:55:50",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1551562": [
        {
            "ioc_value": "osetigolumdede.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-30 10:02:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551559": [
        {
            "ioc_value": "b0dnyoxrn.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-30 09:59:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-ed2wxsgl6s",
            "tags": "C2,domain,njrat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551556": [
        {
            "ioc_value": "uwammunachimso.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-30 09:59:03",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-k5fqnadn91",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551554": [
        {
            "ioc_value": "put-ladder.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-30 09:58:48",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-gfz68ahn3v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551555": [
        {
            "ioc_value": "ads-teachers.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-30 09:58:48",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250630-b5qq7ayqt6",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551552": [
        {
            "ioc_value": "odyssey1.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-06-30 09:10:18",
            "last_seen_utc": "2025-10-09 05:09:19",
            "confidence_level": 50,
            "reference": "https://www.cyfirma.com/research/odyssey-stealer-the-rebrand-of-poseidon-stealer/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551553": [
        {
            "ioc_value": "odyssey-st.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-06-30 09:10:18",
            "last_seen_utc": "2025-10-09 05:09:19",
            "confidence_level": 50,
            "reference": "https://www.cyfirma.com/research/odyssey-stealer-the-rebrand-of-poseidon-stealer/",
            "tags": "c2,odyssey",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551535": [
        {
            "ioc_value": "17.aa.4t.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-30 07:56:18",
            "last_seen_utc": "2025-10-29 01:10:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "jaa3n,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551533": [
        {
            "ioc_value": "qr.ap.4t.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-30 07:56:17",
            "last_seen_utc": "2025-10-15 01:10:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "b1p0p,Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551525": [
        {
            "ioc_value": "ds.exifit.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-30 06:08:57",
            "last_seen_utc": "2025-07-08 06:10:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/a201aadbdc9598fa87dead52c0f5ab406e3bc391b10e56d328cf6841a3036aeb/",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551521": [
        {
            "ioc_value": "12.35.redc.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-30 05:57:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/a201aadbdc9598fa87dead52c0f5ab406e3bc391b10e56d328cf6841a3036aeb/",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1551377": [
        {
            "ioc_value": "security.flqergoaurd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 05:54:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1551378": [
        {
            "ioc_value": "pobikc.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 05:54:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1551520": [
        {
            "ioc_value": "galilaospa.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.purelogs",
            "malware_alias": null,
            "malware_printable": "PureLogs Stealer",
            "first_seen_utc": "2025-06-30 05:51:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,PureLogs",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551519": [
        {
            "ioc_value": "built-punch.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-30 05:50:19",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551517": [
        {
            "ioc_value": "wizzyandrichy.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-30 05:49:17",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551516": [
        {
            "ioc_value": "rrfasdsa-27990.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-30 05:48:48",
            "last_seen_utc": "2025-07-02 10:21:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551515": [
        {
            "ioc_value": "myaw.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-30 05:48:32",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551513": [
        {
            "ioc_value": "robinmmadi.servehumour.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-06-30 05:48:04",
            "last_seen_utc": "2025-07-10 12:51:09",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,netwire",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551511": [
        {
            "ioc_value": "important-ala.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-30 05:47:35",
            "last_seen_utc": "2025-07-02 10:21:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,nanocore",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551506": [
        {
            "ioc_value": "abc.galaxias.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-30 05:47:21",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551507": [
        {
            "ioc_value": "api.chanlevip.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-30 05:47:21",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551508": [
        {
            "ioc_value": "fearoxe.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-30 05:47:21",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551509": [
        {
            "ioc_value": "hellocamel.p-e.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-30 05:47:21",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551510": [
        {
            "ioc_value": "mafia.trumdvfb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-30 05:47:21",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551503": [
        {
            "ioc_value": "securityhealthsystray.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-30 05:46:20",
            "last_seen_utc": "2025-07-02 10:21:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1551441": [
        {
            "ioc_value": "ec2-3-145-32-11.us-east-2.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-30 04:00:40",
            "last_seen_utc": "2025-06-30 04:01:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/3.145.32.11+ec2-3-145-32-11.us-east-2.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551436": [
        {
            "ioc_value": "114.138.61.34.bc.googleusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 04:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.61.138.114+114.138.61.34.bc.googleusercontent.com",
            "tags": "AS396982,C2,censys,GOOGLE-CLOUD-PLATFORM,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551437": [
        {
            "ioc_value": "apis.rubyhall.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 04:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/139.59.16.42+apis.rubyhall.in.net",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551434": [
        {
            "ioc_value": "notifications.rubyhall.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 04:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/139.59.16.42+notifications.rubyhall.in.net",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551435": [
        {
            "ioc_value": "www3.accounts.rubyhall.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-30 04:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/139.59.16.42+www3.accounts.rubyhall.in.net",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551396": [
        {
            "ioc_value": "sssssoj9u99uy-54788.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 20:30:24",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-yqdjmsgr2w",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551397": [
        {
            "ioc_value": "screen-squad.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 20:30:24",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-xwbfsswq18",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551398": [
        {
            "ioc_value": "country-suggesting.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 20:30:24",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-tccb7swms7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551297": [
        {
            "ioc_value": "entoiz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-29 13:34:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1551351": [
        {
            "ioc_value": "ow5dirasuek.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.neconyd",
            "malware_alias": null,
            "malware_printable": "Neconyd",
            "first_seen_utc": "2025-06-29 13:34:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-qh8e2syvaw",
            "tags": "Neconyd",
            "anonymous": "0",
            "reporter": "malwareanalayser"
        }
    ],
    "1551352": [
        {
            "ioc_value": "mkkuei4kdsz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.neconyd",
            "malware_alias": null,
            "malware_printable": "Neconyd",
            "first_seen_utc": "2025-06-29 13:34:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-qh8e2syvaw",
            "tags": "Neconyd",
            "anonymous": "0",
            "reporter": "malwareanalayser"
        }
    ],
    "1551353": [
        {
            "ioc_value": "lousta.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.neconyd",
            "malware_alias": null,
            "malware_printable": "Neconyd",
            "first_seen_utc": "2025-06-29 13:34:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-qh8e2syvaw",
            "tags": "Neconyd",
            "anonymous": "0",
            "reporter": "malwareanalayser"
        }
    ],
    "1551347": [
        {
            "ioc_value": "standard-suited.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 12:39:55",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-pqfjkavl17",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551344": [
        {
            "ioc_value": "dofucks.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-29 12:32:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-ny734svjv3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551345": [
        {
            "ioc_value": "private115.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-29 12:32:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-ny734svjv3",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551342": [
        {
            "ioc_value": "onedrive-office.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-29 12:01:30",
            "last_seen_utc": "2025-06-30 04:00:40",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.12.249+onedrive-office.com",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551331": [
        {
            "ioc_value": "laiu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-06-29 11:38:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-jj7ftasnz3",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551318": [
        {
            "ioc_value": "danger2026.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-29 11:38:12",
            "last_seen_utc": "2025-07-02 10:21:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-mel6vswzgs",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551317": [
        {
            "ioc_value": "real9.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-29 11:38:04",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-bxnxmazpx3",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551315": [
        {
            "ioc_value": "w-grant.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 11:37:52",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-d2fg6ahm3x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551316": [
        {
            "ioc_value": "approach-connection.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 11:37:52",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-aqj5eszmv7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551311": [
        {
            "ioc_value": "rockstar.dnsframe.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 11:37:51",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-k4a4satks2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551312": [
        {
            "ioc_value": "any-arctic.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 11:37:51",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-kmhgjabm81",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551313": [
        {
            "ioc_value": "half-exhibit.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 11:37:51",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-hfe2qavzdy",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551314": [
        {
            "ioc_value": "develop-francis.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 11:37:51",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-d38kbshm4x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551310": [
        {
            "ioc_value": "yourself-snowboard.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-29 11:37:50",
            "last_seen_utc": "2025-07-06 09:36:12",
            "confidence_level": 100,
            "reference": "https://tria.ge/250629-ldmwbstkt8",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550884": [
        {
            "ioc_value": "abtsi.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-29 06:32:58",
            "last_seen_utc": "2025-07-07 22:00:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "LandUpdate808",
            "anonymous": "0",
            "reporter": "MalasadaTech"
        }
    ],
    "1551259": [
        {
            "ioc_value": "login.1ms.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-29 04:00:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.211.97.137+login.1ms.zip",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551258": [
        {
            "ioc_value": "static.login.microsoftonline.1ms.zip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-29 04:00:29",
            "last_seen_utc": "2025-06-30 04:00:32",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/13.211.97.137+static.login.microsoftonline.1ms.zip",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551254": [
        {
            "ioc_value": "jiuweida.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-29 04:00:08",
            "last_seen_utc": "2025-07-02 04:00:07",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.109.83.84+jiuweida.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551252": [
        {
            "ioc_value": "hcyp.shebeib.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-29 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/120.26.126.224+hcyp.shebeib.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551253": [
        {
            "ioc_value": "hcypapiprod.shebeib.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-29 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/120.26.126.224+hcypapiprod.shebeib.com",
            "tags": "AS37963,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1551240": [
        {
            "ioc_value": "leexsirzz.safepanel.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-29 00:01:41",
            "last_seen_utc": "2025-06-29 04:00:37",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/157.230.34.254+leexsirzz.safepanel.my.id",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1551205": [
        {
            "ioc_value": "spyroid.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551206": [
        {
            "ioc_value": "susimsusim8-45617.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551207": [
        {
            "ioc_value": "apphiller-43156.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551208": [
        {
            "ioc_value": "flash-difficulty.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551209": [
        {
            "ioc_value": "add-athletic.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551210": [
        {
            "ioc_value": "spynote1111.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551211": [
        {
            "ioc_value": "fttpspech-20855.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551212": [
        {
            "ioc_value": "they-enemies.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551213": [
        {
            "ioc_value": "early-rca.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551214": [
        {
            "ioc_value": "my-usa.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551215": [
        {
            "ioc_value": "response-agents.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551216": [
        {
            "ioc_value": "m-email.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551217": [
        {
            "ioc_value": "her-workshops.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551218": [
        {
            "ioc_value": "video-tanks.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551204": [
        {
            "ioc_value": "l-broadcast.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.spynote",
            "malware_alias": "CypherRat",
            "malware_printable": "SpyNote",
            "first_seen_utc": "2025-06-28 22:26:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551199": [
        {
            "ioc_value": "cnc.tacobellfordinner.tk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551200": [
        {
            "ioc_value": "scan.tacobellfordinner.tk",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551201": [
        {
            "ioc_value": "cnc.whiteace.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551202": [
        {
            "ioc_value": "5k5kat1ka1tna4n6ns.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551203": [
        {
            "ioc_value": "5k5kat1ka1tna4n6nsm.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551185": [
        {
            "ioc_value": "ts4.kir22.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551186": [
        {
            "ioc_value": "dc.xteamking.ga",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551187": [
        {
            "ioc_value": "scan.phazerproxy.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551188": [
        {
            "ioc_value": "booterbotscan.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551189": [
        {
            "ioc_value": "cute.trumdvfb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551190": [
        {
            "ioc_value": "scan.301.church",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551191": [
        {
            "ioc_value": "cnc.jssaytcp.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551192": [
        {
            "ioc_value": "scan.jssaytcp.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551193": [
        {
            "ioc_value": "x.purgepots.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551194": [
        {
            "ioc_value": "denemebuba31.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551195": [
        {
            "ioc_value": "www.1vex.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551196": [
        {
            "ioc_value": "booterbotbins.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551197": [
        {
            "ioc_value": "booterbot.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551198": [
        {
            "ioc_value": "scan.yiffgallery.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551182": [
        {
            "ioc_value": "server-me.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.extreme_rat",
            "malware_alias": "ExtRat",
            "malware_printable": "Xtreme RAT",
            "first_seen_utc": "2025-06-28 22:26:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551183": [
        {
            "ioc_value": "oxe14.myftp.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.extreme_rat",
            "malware_alias": "ExtRat",
            "malware_printable": "Xtreme RAT",
            "first_seen_utc": "2025-06-28 22:26:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551184": [
        {
            "ioc_value": "cnc.phazerproxy.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 22:26:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551178": [
        {
            "ioc_value": "kw9d0.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-06-28 22:26:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551179": [
        {
            "ioc_value": "sepp101.chickenkiller.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netwire",
            "malware_alias": "NetWeird,NetWire,Recam",
            "malware_printable": "NetWire RC",
            "first_seen_utc": "2025-06-28 22:26:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551176": [
        {
            "ioc_value": "strang39fudq.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551158": [
        {
            "ioc_value": "kc365.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551159": [
        {
            "ioc_value": "pink2010.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551160": [
        {
            "ioc_value": "metin2.noip.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551161": [
        {
            "ioc_value": "prova0010.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551162": [
        {
            "ioc_value": "infectorgfdp.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551163": [
        {
            "ioc_value": "hit007.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551164": [
        {
            "ioc_value": "llllxxxxxxxllll.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551165": [
        {
            "ioc_value": "abdou99.no-ip.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551166": [
        {
            "ioc_value": "hashem555.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551167": [
        {
            "ioc_value": "hahaaha.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551168": [
        {
            "ioc_value": "mizar25.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551169": [
        {
            "ioc_value": "ratbob50500.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551170": [
        {
            "ioc_value": "root90.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551171": [
        {
            "ioc_value": "kingking12344.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551172": [
        {
            "ioc_value": "darkcomet14515486.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551173": [
        {
            "ioc_value": "crazytrain6.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551174": [
        {
            "ioc_value": "salak.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551175": [
        {
            "ioc_value": "thewin.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551148": [
        {
            "ioc_value": "growtopiahecks.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551149": [
        {
            "ioc_value": "istoday.serveftp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551150": [
        {
            "ioc_value": "sipi.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551151": [
        {
            "ioc_value": "kmiho96.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551152": [
        {
            "ioc_value": "hawlery991.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551153": [
        {
            "ioc_value": "darktrojan.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551154": [
        {
            "ioc_value": "gweilo.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551155": [
        {
            "ioc_value": "id12.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551156": [
        {
            "ioc_value": "l54.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551157": [
        {
            "ioc_value": "ksfkhettr.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-28 22:26:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551102": [
        {
            "ioc_value": "ctiemoni.bounceme.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551103": [
        {
            "ioc_value": "k2xblazer.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551104": [
        {
            "ioc_value": "cjk.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551105": [
        {
            "ioc_value": "blazer.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551106": [
        {
            "ioc_value": "kingsagan.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551107": [
        {
            "ioc_value": "mokspy666.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551108": [
        {
            "ioc_value": "mispynet2.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551109": [
        {
            "ioc_value": "morphos.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551110": [
        {
            "ioc_value": "frog0alghack.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551111": [
        {
            "ioc_value": "adm-spynet.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551112": [
        {
            "ioc_value": "ybiwarez.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551113": [
        {
            "ioc_value": "facecat5.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551114": [
        {
            "ioc_value": "heavenfire.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551115": [
        {
            "ioc_value": "karim.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cybergate",
            "malware_alias": "Rebhip",
            "malware_printable": "CyberGate",
            "first_seen_utc": "2025-06-28 22:26:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551093": [
        {
            "ioc_value": "students-motherboard.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-28 22:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551094": [
        {
            "ioc_value": "zkc5kelvin.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-06-28 22:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551095": [
        {
            "ioc_value": "krnrw15waino.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-06-28 22:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551096": [
        {
            "ioc_value": "vzaria83wharvid.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-06-28 22:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551097": [
        {
            "ioc_value": "c39mfueiy72e.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-06-28 22:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551098": [
        {
            "ioc_value": "jr49341miguel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-06-28 22:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551099": [
        {
            "ioc_value": "junglestyle.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-06-28 22:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551100": [
        {
            "ioc_value": "w6948qzoila.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.gozi",
            "malware_alias": "CRM,Gozi CRM,Papras,Snifula,Ursnif",
            "malware_printable": "Gozi",
            "first_seen_utc": "2025-06-28 22:26:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551088": [
        {
            "ioc_value": "cjnano.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-28 22:26:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551089": [
        {
            "ioc_value": "leenux.freemyip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-28 22:26:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551090": [
        {
            "ioc_value": "nugeri-62154.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-28 22:26:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551091": [
        {
            "ioc_value": "xenid.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-28 22:26:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551092": [
        {
            "ioc_value": "nazareen.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-28 22:26:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551082": [
        {
            "ioc_value": "kypersaw52.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-06-28 22:26:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551079": [
        {
            "ioc_value": "frotzero.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-06-28 22:26:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551080": [
        {
            "ioc_value": "mortttty09.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-06-28 22:26:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551081": [
        {
            "ioc_value": "frotzero1.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cryptbot",
            "malware_alias": null,
            "malware_printable": "CryptBot",
            "first_seen_utc": "2025-06-28 22:26:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551061": [
        {
            "ioc_value": "v-cancel.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551062": [
        {
            "ioc_value": "waleed20.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551063": [
        {
            "ioc_value": "cempresarial.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551064": [
        {
            "ioc_value": "sp1d3rn3t1.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551065": [
        {
            "ioc_value": "444444444440-29763.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551066": [
        {
            "ioc_value": "zaman.myvnc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551067": [
        {
            "ioc_value": "brolyx94.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551068": [
        {
            "ioc_value": "hostps1177.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551069": [
        {
            "ioc_value": "swats.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551070": [
        {
            "ioc_value": "med99.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551071": [
        {
            "ioc_value": "elmodeer.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551072": [
        {
            "ioc_value": "dneesyschool.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551073": [
        {
            "ioc_value": "googl32.myddns.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551074": [
        {
            "ioc_value": "moneymoneymoney.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551053": [
        {
            "ioc_value": "myhost844.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551054": [
        {
            "ioc_value": "wall-bottle.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551055": [
        {
            "ioc_value": "bytenjs-32028.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551056": [
        {
            "ioc_value": "meet-influenced.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551057": [
        {
            "ioc_value": "090005.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551058": [
        {
            "ioc_value": "moradoff1.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551059": [
        {
            "ioc_value": "north-dad.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551060": [
        {
            "ioc_value": "psj07.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-28 22:26:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551052": [
        {
            "ioc_value": "piter-korobka.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-06-28 22:26:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551032": [
        {
            "ioc_value": "uheri234.4cloud.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551033": [
        {
            "ioc_value": "glag.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551034": [
        {
            "ioc_value": "newremco.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551035": [
        {
            "ioc_value": "medusa.blogdns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551036": [
        {
            "ioc_value": "finalrmcbk.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551037": [
        {
            "ioc_value": "suporteokx.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551014": [
        {
            "ioc_value": "ozoemenabk.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551015": [
        {
            "ioc_value": "keenwood.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551016": [
        {
            "ioc_value": "jenniffersmith1986.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551017": [
        {
            "ioc_value": "shieldmain.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551018": [
        {
            "ioc_value": "ozoemena.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551019": [
        {
            "ioc_value": "delamanodedios.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551020": [
        {
            "ioc_value": "fasout1999tasry01.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551021": [
        {
            "ioc_value": "xietaoesongbk.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551022": [
        {
            "ioc_value": "finalrmc.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551023": [
        {
            "ioc_value": "workgroup.myvnc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551024": [
        {
            "ioc_value": "demoncity1.dynalias.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551025": [
        {
            "ioc_value": "boysmain.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551026": [
        {
            "ioc_value": "xietaoesong.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551027": [
        {
            "ioc_value": "1x178p1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551028": [
        {
            "ioc_value": "salutcoc.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551029": [
        {
            "ioc_value": "fasout1999tasry02.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551030": [
        {
            "ioc_value": "sonicpanbugs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551031": [
        {
            "ioc_value": "msdigitportal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551012": [
        {
            "ioc_value": "rogerferer.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bit_rat",
            "malware_alias": null,
            "malware_printable": "BitRAT",
            "first_seen_utc": "2025-06-28 22:25:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1551013": [
        {
            "ioc_value": "justfuckme.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-28 22:25:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550986": [
        {
            "ioc_value": "themew.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550985": [
        {
            "ioc_value": "secured1040online.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550971": [
        {
            "ioc_value": "may2425.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550972": [
        {
            "ioc_value": "package-gardens.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550973": [
        {
            "ioc_value": "standards-heights.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550974": [
        {
            "ioc_value": "blog-attitudes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550975": [
        {
            "ioc_value": "thanks-volvo.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550976": [
        {
            "ioc_value": "ok-sense.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550977": [
        {
            "ioc_value": "bobawo2587-64007.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550978": [
        {
            "ioc_value": "includes-au.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550979": [
        {
            "ioc_value": "natural-profit.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550980": [
        {
            "ioc_value": "elysianstanmore.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550981": [
        {
            "ioc_value": "quotes-blair.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550982": [
        {
            "ioc_value": "afatibrahimove.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550983": [
        {
            "ioc_value": "problem-cooperative.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550984": [
        {
            "ioc_value": "american-simulations.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550959": [
        {
            "ioc_value": "bill-wav.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550960": [
        {
            "ioc_value": "knowledge-compatible.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550961": [
        {
            "ioc_value": "subjects-cookie.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550962": [
        {
            "ioc_value": "nomorelife29-46869.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550963": [
        {
            "ioc_value": "yourmomishighoncrack-26691.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550964": [
        {
            "ioc_value": "too-retired.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550965": [
        {
            "ioc_value": "table-proposal.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550966": [
        {
            "ioc_value": "original-do.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550967": [
        {
            "ioc_value": "free-educational.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550968": [
        {
            "ioc_value": "current-clip.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550969": [
        {
            "ioc_value": "fivemgame.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550970": [
        {
            "ioc_value": "xwor1528.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550953": [
        {
            "ioc_value": "updates.tplinkdns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550954": [
        {
            "ioc_value": "rookie789-22310.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550955": [
        {
            "ioc_value": "website-md.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550956": [
        {
            "ioc_value": "angelflying555.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550957": [
        {
            "ioc_value": "useful-bookings.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550958": [
        {
            "ioc_value": "significant-storage.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 22:25:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550915": [
        {
            "ioc_value": "inc-stake.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550916": [
        {
            "ioc_value": "envio26-05.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550917": [
        {
            "ioc_value": "jasyncdg.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550918": [
        {
            "ioc_value": "ruthasync.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550919": [
        {
            "ioc_value": "sotoxic.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550920": [
        {
            "ioc_value": "chadwhiteford.theworkpc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550921": [
        {
            "ioc_value": "lasyusex.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550922": [
        {
            "ioc_value": "kbsapm.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550923": [
        {
            "ioc_value": "tueisolmkc.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550909": [
        {
            "ioc_value": "camilohernandez20301.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550910": [
        {
            "ioc_value": "doncu2030.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550911": [
        {
            "ioc_value": "shripzone.bumbleshrimp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550912": [
        {
            "ioc_value": "carolina-mother.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550913": [
        {
            "ioc_value": "janachye.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550914": [
        {
            "ioc_value": "deadpoolstart2060.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 22:25:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550897": [
        {
            "ioc_value": "ideas-ks.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550898": [
        {
            "ioc_value": "portport.gleeze.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550899": [
        {
            "ioc_value": "port6.gleeze.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550900": [
        {
            "ioc_value": "band-floppy.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550901": [
        {
            "ioc_value": "care-reports.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550902": [
        {
            "ioc_value": "maxim228hacker-58676.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550903": [
        {
            "ioc_value": "diddy1234-40020.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550891": [
        {
            "ioc_value": "starwors.bumbleshrimp.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550892": [
        {
            "ioc_value": "college-directors.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550893": [
        {
            "ioc_value": "clairoz-57631.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550894": [
        {
            "ioc_value": "port1.gleeze.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550895": [
        {
            "ioc_value": "port3.gleeze.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550896": [
        {
            "ioc_value": "actually-packets.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-28 22:25:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "29June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1550820": [
        {
            "ioc_value": "write-document.freedynamicdns.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-28 15:40:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1937500035345797528",
            "tags": "APT,Gamaredon,PrimitiveBear,TridentUrsa,UAC0010",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550815": [
        {
            "ioc_value": "document-downloads.ddns.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-28 15:40:04",
            "last_seen_utc": "2025-06-28 15:40:04",
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1937500035345797528",
            "tags": "APT,Gamaredon,PrimitiveBear,TridentUrsa,UAC0010",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550816": [
        {
            "ioc_value": "document-prok.freedynamicdns.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-28 15:40:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1937500035345797528",
            "tags": "APT,Gamaredon,PrimitiveBear,TridentUrsa,UAC0010",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550817": [
        {
            "ioc_value": "downloads-document.freedynamicdns.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-28 15:40:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1937500035345797528",
            "tags": "APT,Gamaredon,PrimitiveBear,TridentUrsa,UAC0010",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550818": [
        {
            "ioc_value": "google-pdf.redirectme.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-28 15:40:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1937500035345797528",
            "tags": "APT,Gamaredon,PrimitiveBear,TridentUrsa,UAC0010",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550819": [
        {
            "ioc_value": "print-documents.freedynamicdns.net",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-28 15:40:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1937500035345797528",
            "tags": "APT,Gamaredon,PrimitiveBear,TridentUrsa,UAC0010",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550812": [
        {
            "ioc_value": "eu.p.redc.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-28 14:48:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550803": [
        {
            "ioc_value": "rodicicle.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-06-28 14:13:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550804": [
        {
            "ioc_value": "robinkiss.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-06-28 14:13:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550797": [
        {
            "ioc_value": "airportmonth.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-06-28 14:05:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550798": [
        {
            "ioc_value": "producesound.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-06-28 14:05:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550231": [
        {
            "ioc_value": "c2.zerotr4ce.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-28 13:07:12",
            "last_seen_utc": "2025-06-28 04:01:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/37.59.108.112+c2.zerotr4ce.online",
            "tags": "AS16276,C2,censys,OVH",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1550232": [
        {
            "ioc_value": "azelsan.com.tr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-28 13:07:11",
            "last_seen_utc": "2025-06-28 04:01:26",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.134.8+azelsan.com.tr",
            "tags": "AS13335,C2,censys,CLOUDFLARENET",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1550186": [
        {
            "ioc_value": "security.fpwereguared.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-28 13:06:59",
            "last_seen_utc": "2025-06-29 08:21:38",
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1550187": [
        {
            "ioc_value": "deopins.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-28 13:06:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1550181": [
        {
            "ioc_value": "protocol.stakesolv.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-28 13:06:56",
            "last_seen_utc": "2025-07-10 16:51:06",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "PunisherRip"
        }
    ],
    "1550167": [
        {
            "ioc_value": "legacyshare.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-28 13:06:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250627-vfpblsyqt2/behavioral1",
            "tags": "screenconnect",
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1550783": [
        {
            "ioc_value": "dns1.globalcdn.autos",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-28 10:53:12",
            "last_seen_utc": "2025-12-14 11:48:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550293": [
        {
            "ioc_value": "dsh.fvsrchps.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-06-28 10:05:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250628-cbm9mscp4z",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550291": [
        {
            "ioc_value": "ttkks.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-06-28 10:05:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250628-kr39ssylz4",
            "tags": "C2,domain,rat,triage,valleyrat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550290": [
        {
            "ioc_value": "zuiopppkurban.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 10:04:29",
            "last_seen_utc": "2025-07-02 10:21:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250628-kkj8ca1ycy",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550289": [
        {
            "ioc_value": "return-min.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-28 10:04:28",
            "last_seen_utc": "2025-07-02 10:21:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250628-lzqjcahr4t",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550286": [
        {
            "ioc_value": "federal-jewel.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 10:03:47",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250628-k8wlaacl5y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550287": [
        {
            "ioc_value": "held-prozac.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-28 10:03:47",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250628-e7c5nael9y",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550260": [
        {
            "ioc_value": "hypixelproxy.gooning.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-28 07:56:28",
            "last_seen_utc": "2025-07-10 12:51:10",
            "confidence_level": 100,
            "reference": "",
            "tags": "Mirai",
            "anonymous": "0",
            "reporter": "NDA0E"
        }
    ],
    "1550178": [
        {
            "ioc_value": "taketh.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.ermac",
            "malware_alias": null,
            "malware_printable": "ERMAC",
            "first_seen_utc": "2025-06-27 20:01:31",
            "last_seen_utc": "2025-06-28 04:00:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/172.67.144.155+taketh.org",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,Ermac,panel",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550140": [
        {
            "ioc_value": "ketxsuz.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 16:25:51",
            "last_seen_utc": "2025-06-30 16:16:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550141": [
        {
            "ioc_value": "pacwpw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 16:25:50",
            "last_seen_utc": "2025-06-30 16:16:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550142": [
        {
            "ioc_value": "comkxjs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 16:25:49",
            "last_seen_utc": "2025-06-30 16:16:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550143": [
        {
            "ioc_value": "unurew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 16:25:49",
            "last_seen_utc": "2025-06-30 16:16:24",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550144": [
        {
            "ioc_value": "trsuv.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 16:25:49",
            "last_seen_utc": "2025-07-06 15:10:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550145": [
        {
            "ioc_value": "sqgzl.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 16:25:49",
            "last_seen_utc": "2025-07-06 15:10:25",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550146": [
        {
            "ioc_value": "cexpxg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 16:25:48",
            "last_seen_utc": "2025-07-06 15:10:21",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550147": [
        {
            "ioc_value": "urarfx.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 16:25:48",
            "last_seen_utc": "2025-07-11 14:12:48",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550148": [
        {
            "ioc_value": "liaxn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 16:25:48",
            "last_seen_utc": "2025-07-06 15:10:20",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550164": [
        {
            "ioc_value": "vps-4f7bd7bb.vps.ovh.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-27 16:02:11",
            "last_seen_utc": "2025-06-28 04:00:45",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/37.59.108.112+vps-4f7bd7bb.vps.ovh.net",
            "tags": "AS16276,C2,censys,Havoc,OVH",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550154": [
        {
            "ioc_value": "107.41.mastermaths.com.sg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-27 15:18:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1550137": [
        {
            "ioc_value": "m.cpa2go.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-27 13:16:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1550104": [
        {
            "ioc_value": "10x07.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-27 13:04:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "LummaStealer",
            "anonymous": "0",
            "reporter": "Chamindu_X"
        }
    ],
    "1550133": [
        {
            "ioc_value": "dq54wdwq5d4.jocker.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-27 12:52:55",
            "last_seen_utc": "2025-08-01 07:49:55",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550094": [
        {
            "ioc_value": "subpulsaratlog.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-27 08:45:05",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/b158022f681fb614c0e0721cb762dcfac1d1286dd82892d7e65b85fb32534bb1/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550093": [
        {
            "ioc_value": "pulsaratlog.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-27 08:45:03",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/b158022f681fb614c0e0721cb762dcfac1d1286dd82892d7e65b85fb32534bb1/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550092": [
        {
            "ioc_value": "pulsa2ndrdpview.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-27 08:45:02",
            "last_seen_utc": "2025-06-28 22:25:33",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/b158022f681fb614c0e0721cb762dcfac1d1286dd82892d7e65b85fb32534bb1/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550091": [
        {
            "ioc_value": "kingso.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-27 08:45:00",
            "last_seen_utc": "2025-07-02 10:21:36",
            "confidence_level": 75,
            "reference": "https://bazaar.abuse.ch/sample/be3568e2d6ff6b7326ea86cae430e71ec756f5faebc38799775ed775b5b311f2/",
            "tags": "quasar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1550080": [
        {
            "ioc_value": "oog07m.easypanel.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-27 08:01:27",
            "last_seen_utc": "2025-06-28 04:00:44",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.244.181.199+oog07m.easypanel.host",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1550072": [
        {
            "ioc_value": "a7.69.mastermaths.com.sg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-27 07:19:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1550068": [
        {
            "ioc_value": "cirugia4k.con-ip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-27 07:06:49",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550067": [
        {
            "ioc_value": "asdasd23-23269.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-27 07:06:36",
            "last_seen_utc": "2025-07-02 10:21:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550062": [
        {
            "ioc_value": "www.wwwq47.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550063": [
        {
            "ioc_value": "www.xue.ltd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550064": [
        {
            "ioc_value": "www.zhaofu-duanzi.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550065": [
        {
            "ioc_value": "www.zurich-host.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550048": [
        {
            "ioc_value": "www.sebister.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550049": [
        {
            "ioc_value": "www.simpleloansutah.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550050": [
        {
            "ioc_value": "www.sonorandesertenvironmental.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550051": [
        {
            "ioc_value": "www.squaremeed.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550052": [
        {
            "ioc_value": "www.stevehurtz.photography",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550053": [
        {
            "ioc_value": "www.swissed.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550054": [
        {
            "ioc_value": "www.thinkalease.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550055": [
        {
            "ioc_value": "www.tunisiemploi.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550056": [
        {
            "ioc_value": "www.turboserviceindia.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550057": [
        {
            "ioc_value": "www.twwdserve.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550058": [
        {
            "ioc_value": "www.victoria-brand.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550059": [
        {
            "ioc_value": "www.vienyhocthuocnam.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550060": [
        {
            "ioc_value": "www.wns6698.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550061": [
        {
            "ioc_value": "www.www7817v.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:49",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550033": [
        {
            "ioc_value": "www.mmgiuaz.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550034": [
        {
            "ioc_value": "www.mmluav52.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550035": [
        {
            "ioc_value": "www.mobi-phone.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550036": [
        {
            "ioc_value": "www.monkeyswithdice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550037": [
        {
            "ioc_value": "www.mydownloaddomain.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550038": [
        {
            "ioc_value": "www.nexanix.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550039": [
        {
            "ioc_value": "www.nisenkeji.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550040": [
        {
            "ioc_value": "www.ozon-avia.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550041": [
        {
            "ioc_value": "www.playmymood.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550042": [
        {
            "ioc_value": "www.poiiun.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550043": [
        {
            "ioc_value": "www.pontosappareltrading.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550044": [
        {
            "ioc_value": "www.ptabu.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550045": [
        {
            "ioc_value": "www.rfnpt.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550046": [
        {
            "ioc_value": "www.rnbsc.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550047": [
        {
            "ioc_value": "www.sanwealth.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550019": [
        {
            "ioc_value": "www.gee-ac.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550020": [
        {
            "ioc_value": "www.georgieos.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550021": [
        {
            "ioc_value": "www.gilkeycky.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550022": [
        {
            "ioc_value": "www.granadoespadavis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550023": [
        {
            "ioc_value": "www.happyjpin.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550024": [
        {
            "ioc_value": "www.jasminetsonblog.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550025": [
        {
            "ioc_value": "www.jonathandrainey.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550026": [
        {
            "ioc_value": "www.kalacng.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550027": [
        {
            "ioc_value": "www.leechandlerbusinessloans.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550028": [
        {
            "ioc_value": "www.lemai-china.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550029": [
        {
            "ioc_value": "www.manpukutokyo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550030": [
        {
            "ioc_value": "www.mansiobbok.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": "2025-06-27 07:05:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550031": [
        {
            "ioc_value": "www.marijuanasmokingaccessories.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550032": [
        {
            "ioc_value": "www.mauirpm.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550005": [
        {
            "ioc_value": "www.afromystique.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550006": [
        {
            "ioc_value": "www.alluklifeinsurancesok.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550007": [
        {
            "ioc_value": "www.artbymarigold.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550008": [
        {
            "ioc_value": "www.bikinitennis.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550009": [
        {
            "ioc_value": "www.broparking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550010": [
        {
            "ioc_value": "www.buffaloeld.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550011": [
        {
            "ioc_value": "www.cablingdepot.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550012": [
        {
            "ioc_value": "www.cantstopwontstoprealestate.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550013": [
        {
            "ioc_value": "www.cash-vip.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550014": [
        {
            "ioc_value": "www.cc1418.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550015": [
        {
            "ioc_value": "www.chuyennhathanhhung247vn.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550016": [
        {
            "ioc_value": "www.discoverthepoweroftouch.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550017": [
        {
            "ioc_value": "www.eec-lean.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550018": [
        {
            "ioc_value": "www.energy-miracle.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550000": [
        {
            "ioc_value": "www.-dealt.sb",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550001": [
        {
            "ioc_value": "www.10s4life.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550002": [
        {
            "ioc_value": "www.65way.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550003": [
        {
            "ioc_value": "www.6n8c.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1550004": [
        {
            "ioc_value": "www.a88a888.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-27 07:05:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549933": [
        {
            "ioc_value": "acc3nturefederal.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-27 07:04:45",
            "last_seen_utc": "2025-07-10 12:51:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549932": [
        {
            "ioc_value": "chat.svc.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-27 07:04:31",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549859": [
        {
            "ioc_value": "212-83-148-39.rev.poneytelecom.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-27 05:51:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/212.83.148.39+212-83-148-39.rev.poneytelecom.eu",
            "tags": "AS12876,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1549819": [
        {
            "ioc_value": "security.frarenguaced.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-27 05:50:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1549820": [
        {
            "ioc_value": "kapefex.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-27 05:50:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1549818": [
        {
            "ioc_value": "analyticznodec.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-27 05:50:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1549847": [
        {
            "ioc_value": "jobs.qtelcloud.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-27 02:52:45",
            "last_seen_utc": "2025-10-14 07:51:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1549825": [
        {
            "ioc_value": "image-oieeodlcsb.cn-hangzhou.fcapp.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-26 22:53:04",
            "last_seen_utc": "2025-08-19 07:51:08",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1549810": [
        {
            "ioc_value": "sander123321-63281.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-26 21:01:15",
            "last_seen_utc": "2025-07-02 10:21:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250626-zjry5acn2z",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549805": [
        {
            "ioc_value": "fee-lu.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-26 21:00:55",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250626-y1pdwscj6v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549772": [
        {
            "ioc_value": "ogash96-21208.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-26 15:49:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-3gdv9sbl8z",
            "tags": "c2,domain,neptunerat,RAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549771": [
        {
            "ioc_value": "or-ourselves.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-26 15:48:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-r9lwssal2x",
            "tags": "c2,domain,neptunerat,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549757": [
        {
            "ioc_value": "franquicias.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-06-26 14:13:46",
            "last_seen_utc": "2025-06-26 14:11:32",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114750067482123300",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1549760": [
        {
            "ioc_value": "certifiedhackerindia.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-06-26 14:13:44",
            "last_seen_utc": "2025-06-26 14:11:46",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114750067482123300",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1549754": [
        {
            "ioc_value": "biseo-48321.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-26 14:03:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250626-qwls7swqz5",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549753": [
        {
            "ioc_value": "syria3.ddnsfree.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-26 14:03:07",
            "last_seen_utc": "2025-07-02 10:21:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250626-qwls7swqz5",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549492": [
        {
            "ioc_value": "ai.lanpdt.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-26 13:26:20",
            "last_seen_utc": "2025-06-26 13:15:39",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114749829319939688",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1549748": [
        {
            "ioc_value": "muzesd.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549749": [
        {
            "ioc_value": "multiport.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549747": [
        {
            "ioc_value": "nightdelicatekols.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549740": [
        {
            "ioc_value": "lumma.web.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549741": [
        {
            "ioc_value": "chatterscalded.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549742": [
        {
            "ioc_value": "h4.chatterscalded.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549743": [
        {
            "ioc_value": "bevm.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549744": [
        {
            "ioc_value": "calpewawd.run",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549745": [
        {
            "ioc_value": "dhl-lhome.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549746": [
        {
            "ioc_value": "naturelovet.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549739": [
        {
            "ioc_value": "supihk.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:52",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549721": [
        {
            "ioc_value": "backbx.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-09-27 11:10:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549722": [
        {
            "ioc_value": "endoda.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-04 14:56:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549723": [
        {
            "ioc_value": "feelgf.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-04 14:56:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549724": [
        {
            "ioc_value": "fpxawz.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-04 14:56:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549725": [
        {
            "ioc_value": "letfp.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-09-10 08:31:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549726": [
        {
            "ioc_value": "meajo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549727": [
        {
            "ioc_value": "tenbiw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549728": [
        {
            "ioc_value": "carrqp.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549729": [
        {
            "ioc_value": "castcp.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-04 14:56:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549730": [
        {
            "ioc_value": "crawbu.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-04 14:56:19",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549731": [
        {
            "ioc_value": "crocfz.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549732": [
        {
            "ioc_value": "fedes.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-23 19:18:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549733": [
        {
            "ioc_value": "herell.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549734": [
        {
            "ioc_value": "keevg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549735": [
        {
            "ioc_value": "megiz.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-23 19:18:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549736": [
        {
            "ioc_value": "olqrw.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-09-10 08:31:26",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549737": [
        {
            "ioc_value": "reallr.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-23 19:18:57",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549738": [
        {
            "ioc_value": "skepcb.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:51",
            "last_seen_utc": "2025-07-23 19:19:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549710": [
        {
            "ioc_value": "antiqez.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549711": [
        {
            "ioc_value": "argentiy.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549712": [
        {
            "ioc_value": "atlantm.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": "2025-07-23 19:19:02",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549713": [
        {
            "ioc_value": "earlyew.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549714": [
        {
            "ioc_value": "familyh.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549715": [
        {
            "ioc_value": "hucwjx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": "2025-07-23 19:19:03",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549716": [
        {
            "ioc_value": "prepaxre.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": "2025-07-04 14:56:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549717": [
        {
            "ioc_value": "rebout.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549718": [
        {
            "ioc_value": "redacpq.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549719": [
        {
            "ioc_value": "unctyou.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": "2025-09-28 20:20:53",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549720": [
        {
            "ioc_value": "appqzk.pics",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-26 13:24:50",
            "last_seen_utc": "2025-07-23 19:19:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549709": [
        {
            "ioc_value": "northumbra.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-26 13:20:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,Lapdogs",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549705": [
        {
            "ioc_value": "baza.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.transferloader",
            "malware_alias": null,
            "malware_printable": "TransferLoader",
            "first_seen_utc": "2025-06-26 13:19:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TransferLoader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549706": [
        {
            "ioc_value": "sharemoc.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.transferloader",
            "malware_alias": null,
            "malware_printable": "TransferLoader",
            "first_seen_utc": "2025-06-26 13:19:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TransferLoader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549707": [
        {
            "ioc_value": "mainstomp.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.transferloader",
            "malware_alias": null,
            "malware_printable": "TransferLoader",
            "first_seen_utc": "2025-06-26 13:19:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TransferLoader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549708": [
        {
            "ioc_value": "temptransfer.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.transferloader",
            "malware_alias": null,
            "malware_printable": "TransferLoader",
            "first_seen_utc": "2025-06-26 13:19:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,TransferLoader",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549704": [
        {
            "ioc_value": "privatedns.huishengzhang.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-26 13:19:29",
            "last_seen_utc": "2025-07-02 10:45:36",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549693": [
        {
            "ioc_value": "danielbetterfuturewithbestlifegivenmefor.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 13:18:39",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549694": [
        {
            "ioc_value": "edgardocarrascal904050.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 13:18:39",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549695": [
        {
            "ioc_value": "gotkeeptryn.ignorelist.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 13:18:39",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549696": [
        {
            "ioc_value": "letseehowitgoes.mooo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 13:18:39",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549697": [
        {
            "ioc_value": "maxpressure.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 13:18:39",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549698": [
        {
            "ioc_value": "newwave.strangled.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 13:18:39",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549699": [
        {
            "ioc_value": "optimizeeltd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 13:18:39",
            "last_seen_utc": "2025-06-28 22:26:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549700": [
        {
            "ioc_value": "talkabt.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 13:18:39",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549692": [
        {
            "ioc_value": "lififi8273-50238.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-26 13:18:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549690": [
        {
            "ioc_value": "workeazyment1.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-26 13:17:56",
            "last_seen_utc": "2025-06-28 22:26:17",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,nanocore",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549680": [
        {
            "ioc_value": "deneme.chanbaba.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:40",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549681": [
        {
            "ioc_value": "dolphincode.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:40",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549682": [
        {
            "ioc_value": "iotkit.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:40",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549683": [
        {
            "ioc_value": "mdnsucchim.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:40",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549684": [
        {
            "ioc_value": "mr.diicotsec.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:40",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549685": [
        {
            "ioc_value": "nmsl.i20.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:40",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549686": [
        {
            "ioc_value": "vagner.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:40",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549687": [
        {
            "ioc_value": "wavecarried.vietnamddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:40",
            "last_seen_utc": "2025-07-10 12:51:11",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549673": [
        {
            "ioc_value": "api.trumdvfb.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:39",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549674": [
        {
            "ioc_value": "b0tn3t.mong666.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:39",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549675": [
        {
            "ioc_value": "botnet.topshield.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:39",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549676": [
        {
            "ioc_value": "bunker-net.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:39",
            "last_seen_utc": "2025-06-28 07:56:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549677": [
        {
            "ioc_value": "cnc.ibypasser.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:39",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549678": [
        {
            "ioc_value": "cnc2.jssaytcp.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:39",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549679": [
        {
            "ioc_value": "cskcncsus.vietnamddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-26 13:17:39",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549639": [
        {
            "ioc_value": "www.t-fajo819.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549640": [
        {
            "ioc_value": "www.uchuang.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549641": [
        {
            "ioc_value": "www.urokogepan.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:57",
            "last_seen_utc": "2025-09-29 18:25:24",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549642": [
        {
            "ioc_value": "www.utodealmemo.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549643": [
        {
            "ioc_value": "www.verypartypop.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549644": [
        {
            "ioc_value": "www.ww515602.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549645": [
        {
            "ioc_value": "www.zeqsz.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549646": [
        {
            "ioc_value": "www.znueag.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:57",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549624": [
        {
            "ioc_value": "www.nti-aging-57998.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549625": [
        {
            "ioc_value": "www.ntreegainfo.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549626": [
        {
            "ioc_value": "www.obilskater.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549627": [
        {
            "ioc_value": "www.oicdickely.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549628": [
        {
            "ioc_value": "www.olaoutfitters.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549629": [
        {
            "ioc_value": "www.ortalsee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549630": [
        {
            "ioc_value": "www.ov-vdotzb.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549631": [
        {
            "ioc_value": "www.ovvsv.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549632": [
        {
            "ioc_value": "www.pinsantoto4d.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549633": [
        {
            "ioc_value": "www.righton.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549634": [
        {
            "ioc_value": "www.rintalia.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549635": [
        {
            "ioc_value": "www.roxgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549636": [
        {
            "ioc_value": "www.rqghr.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549637": [
        {
            "ioc_value": "www.rwt2v.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549638": [
        {
            "ioc_value": "www.sy808.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:56",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549609": [
        {
            "ioc_value": "www.ffshoretalentco.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549610": [
        {
            "ioc_value": "www.gkaa.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549611": [
        {
            "ioc_value": "www.homasyangarchive.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549612": [
        {
            "ioc_value": "www.iaozhewaimai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549613": [
        {
            "ioc_value": "www.ijikontol.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549614": [
        {
            "ioc_value": "www.innwmbo.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549615": [
        {
            "ioc_value": "www.inystars.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549616": [
        {
            "ioc_value": "www.irtualreality.estate",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549617": [
        {
            "ioc_value": "www.jba2e.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549618": [
        {
            "ioc_value": "www.legriak4.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549619": [
        {
            "ioc_value": "www.linebeauty.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549620": [
        {
            "ioc_value": "www.lzuvh.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549621": [
        {
            "ioc_value": "www.martteamslab.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549622": [
        {
            "ioc_value": "www.mgf.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549623": [
        {
            "ioc_value": "www.n7d73.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:55",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549592": [
        {
            "ioc_value": "www.aucis.city",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549593": [
        {
            "ioc_value": "www.bhug9.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549594": [
        {
            "ioc_value": "www.bp8el.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549595": [
        {
            "ioc_value": "www.c4091.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549596": [
        {
            "ioc_value": "www.c776.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549597": [
        {
            "ioc_value": "www.d-899b30.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549598": [
        {
            "ioc_value": "www.d-899b50.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549599": [
        {
            "ioc_value": "www.eadinghaven.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549600": [
        {
            "ioc_value": "www.ealthcare11.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549601": [
        {
            "ioc_value": "www.eatriceonyango.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549602": [
        {
            "ioc_value": "www.echpipi.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549603": [
        {
            "ioc_value": "www.eon5315.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549604": [
        {
            "ioc_value": "www.eramicstyle.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549605": [
        {
            "ioc_value": "www.et-alphacustcare-team.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549606": [
        {
            "ioc_value": "www.et88.care",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549607": [
        {
            "ioc_value": "www.etterthancex.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549608": [
        {
            "ioc_value": "www.fem2d.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:54",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549582": [
        {
            "ioc_value": "www.-dealt.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": "2025-07-02 06:08:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549583": [
        {
            "ioc_value": "www.1qpwvgnhesa.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549584": [
        {
            "ioc_value": "www.6110.town",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549585": [
        {
            "ioc_value": "www.8t5wv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549586": [
        {
            "ioc_value": "www.adog.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549587": [
        {
            "ioc_value": "www.adshead.design",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549588": [
        {
            "ioc_value": "www.aishiwu.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549589": [
        {
            "ioc_value": "www.andajagomakan.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549590": [
        {
            "ioc_value": "www.andy-girl.gold",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549591": [
        {
            "ioc_value": "www.athtubs-80046.bond",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-26 13:15:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549512": [
        {
            "ioc_value": "qzp3.f3322.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-26 13:14:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,elknot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549513": [
        {
            "ioc_value": "www.cl-1998.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-26 13:14:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,elknot",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549511": [
        {
            "ioc_value": "xxnxxxx-38365.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-26 13:14:07",
            "last_seen_utc": "2025-07-02 10:21:39",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549507": [
        {
            "ioc_value": "qdmgsb0og.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-26 13:13:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549508": [
        {
            "ioc_value": "romerinotraderpt.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-26 13:13:35",
            "last_seen_utc": "2025-07-10 12:51:07",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549509": [
        {
            "ioc_value": "waal085.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-26 13:13:35",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549506": [
        {
            "ioc_value": "oss-as.x1go.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-26 13:13:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549502": [
        {
            "ioc_value": "deadpoolstart2061.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-26 13:12:41",
            "last_seen_utc": "2025-07-02 10:21:40",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549503": [
        {
            "ioc_value": "issouchat.freeboxos.fr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-26 13:12:41",
            "last_seen_utc": "2025-06-28 22:25:39",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1549413": [
        {
            "ioc_value": "cloud-flaer-verif.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-06-26 12:29:47",
            "last_seen_utc": "2025-06-26 15:09:02",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114749586769320585",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1549414": [
        {
            "ioc_value": "newstartnewjournyevamygirllovesalotwithm.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 12:14:28",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250626-nfpttasshv",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549387": [
        {
            "ioc_value": "mountsys.ddnsking.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-26 11:07:06",
            "last_seen_utc": "2025-07-02 10:21:36",
            "confidence_level": 100,
            "reference": "https://tria.ge/250626-me2ljs1wgz",
            "tags": "C2,domain,quasar,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549386": [
        {
            "ioc_value": "jw8ndw9ev.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-26 11:06:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250626-lzmgpatly5",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549385": [
        {
            "ioc_value": "obomo.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-26 11:06:43",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250626-dn63ysdn5t",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549383": [
        {
            "ioc_value": "overall-bachelor.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-26 11:06:34",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250626-llejxsck7v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549367": [
        {
            "ioc_value": "quickswap-us.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-26 08:19:16",
            "last_seen_utc": "2025-07-10 16:51:01",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2",
            "anonymous": "0",
            "reporter": "Wazup"
        }
    ],
    "1549360": [
        {
            "ioc_value": "112.ip-37-59-108.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-26 08:01:24",
            "last_seen_utc": "2025-06-27 04:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/37.59.108.112+112.ip-37-59-108.eu",
            "tags": "AS16276,C2,censys,Havoc,OVH",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549354": [
        {
            "ioc_value": "11.c.mastermaths.com.sg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-26 07:26:27",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1549352": [
        {
            "ioc_value": "2025.ip138.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.ghost_rat",
            "malware_alias": "Farfli,Gh0st RAT,PCRat",
            "malware_printable": "Ghost RAT",
            "first_seen_utc": "2025-06-26 06:59:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/096d5e1b254aadd10aa5e86735914f4697674018b63c19a150daecdd0690f4a7/",
            "tags": "Gh0stRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1549348": [
        {
            "ioc_value": "pub-0d6190b2679343a7816c69b4460b0c0c.r2.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-26 06:20:01",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.bleepingcomputer.com/news/security/hackers-turn-screenconnect-into-malware-using-authenticode-stuffing/",
            "tags": "Cloudflare,ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1549349": [
        {
            "ioc_value": "pub-dd31af7a3b8d488ea6d842df5958ec46.r2.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-26 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.bleepingcomputer.com/news/security/hackers-turn-screenconnect-into-malware-using-authenticode-stuffing/",
            "tags": "Cloudflare,ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1549350": [
        {
            "ioc_value": "pub-24faabfae89041cda3b7cdd7318e9acb.r2.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-26 06:20:00",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://www.bleepingcomputer.com/news/security/hackers-turn-screenconnect-into-malware-using-authenticode-stuffing/",
            "tags": "Cloudflare,ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1549308": [
        {
            "ioc_value": "mythic.mustansirg.in",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-26 04:18:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.0.227.68+mythic.mustansirg.in",
            "tags": "AS15169,C2,censys,GOOGLE,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1549277": [
        {
            "ioc_value": "security.fgewrgoald.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-26 03:53:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1549278": [
        {
            "ioc_value": "kerewz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-26 03:53:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1549292": [
        {
            "ioc_value": "dev-testprvpgfextext2bdc1c5-pg1.postgres.database.azure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "apk.hook",
            "malware_alias": null,
            "malware_printable": "Hook",
            "first_seen_utc": "2025-06-26 00:01:22",
            "last_seen_utc": "2025-06-26 04:00:49",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/98.71.173.119+dev-testprvpgfextext2bdc1c5-pg1.postgres.database.azure.com",
            "tags": "AS8075,C2,censys,Hookbot,MICROSOFT-CORP-MSN-AS-BLOCK",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549269": [
        {
            "ioc_value": "nickman12-46565.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-25 21:33:43",
            "last_seen_utc": "2025-06-25 21:33:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-zxyzlael5z",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549267": [
        {
            "ioc_value": "models-diesel.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-25 21:33:29",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-zf7keavqs2",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549236": [
        {
            "ioc_value": "chingru.direct.quickconnect.to",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-25 20:00:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/114.34.241.92+chingru.direct.quickconnect.to",
            "tags": "AS3462,C2,censys,HINET,PenTera",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549231": [
        {
            "ioc_value": "wedemkioa.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-25 19:07:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/wedemkioa.duckdns.org",
            "tags": "c2,domain,remcos,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549227": [
        {
            "ioc_value": "b1.discernchevron.world",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-06-25 18:59:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/9bbc3a96714e70cbfc17ca8f50cd11b1c6d7ab737f52fd3b0f882ef6332fc6d6/",
            "tags": null,
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1549203": [
        {
            "ioc_value": "weight-q.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-25 14:53:38",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-re8r3sbr2v",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549202": [
        {
            "ioc_value": "dczip.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-25 14:45:01",
            "last_seen_utc": "2025-07-02 10:21:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-crj7xshl6w",
            "tags": "asyncrat,C2,domain,rat,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549200": [
        {
            "ioc_value": "mannieha246.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-25 14:44:52",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-hq2y8ss1cs",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549198": [
        {
            "ioc_value": "www.holzbrenaaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-25 14:44:51",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-nae3esgk8x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549199": [
        {
            "ioc_value": "chido246.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-25 14:44:51",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-hraldas1cx",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549196": [
        {
            "ioc_value": "www.holzbrenzii.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-25 14:44:50",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-nae3esgk8x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549197": [
        {
            "ioc_value": "www.holzbrenzzz.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-25 14:44:50",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-nae3esgk8x",
            "tags": "C2,domain,rat,remcos,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549193": [
        {
            "ioc_value": "martin-servers.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-25 14:36:38",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-pm114agn7s",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549194": [
        {
            "ioc_value": "shopping-bundle.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-25 14:36:38",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-pe2bwsymt7",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549195": [
        {
            "ioc_value": "archives-cnet.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-25 14:36:38",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250625-grsxaahk2x",
            "tags": "C2,domain,triage,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549185": [
        {
            "ioc_value": "cpanel.productdevelopmentplan.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-25 13:57:21",
            "last_seen_utc": "2025-06-25 13:15:58",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114744165589059468",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1549167": [
        {
            "ioc_value": "8k8hj9277yjde.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-25 10:53:35",
            "last_seen_utc": "2025-12-14 11:48:00",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1549162": [
        {
            "ioc_value": "event-time-microsoft.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.interlock",
            "malware_alias": null,
            "malware_printable": "Interlock",
            "first_seen_utc": "2025-06-25 09:51:58",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://infosec.exchange/@netresec/114739120040883261",
            "tags": "cloudflare",
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1549164": [
        {
            "ioc_value": "event-datamicrosoft.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.interlock",
            "malware_alias": null,
            "malware_printable": "Interlock",
            "first_seen_utc": "2025-06-25 09:51:57",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://infosec.exchange/@netresec/114739120040883261",
            "tags": "cloudflare",
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1549163": [
        {
            "ioc_value": "windows-msgas.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.interlock",
            "malware_alias": null,
            "malware_printable": "Interlock",
            "first_seen_utc": "2025-06-25 09:51:56",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://infosec.exchange/@netresec/114739120040883261",
            "tags": "cloudflare",
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1549165": [
        {
            "ioc_value": "eventdata-microsoft.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.interlock",
            "malware_alias": null,
            "malware_printable": "Interlock",
            "first_seen_utc": "2025-06-25 09:51:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://infosec.exchange/@netresec/114739120040883261",
            "tags": "cloudflare",
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1549166": [
        {
            "ioc_value": "varying-rentals-calgary-predict.trycloudflare.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.interlock",
            "malware_alias": null,
            "malware_printable": "Interlock",
            "first_seen_utc": "2025-06-25 09:51:55",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://infosec.exchange/@netresec/114739120040883261",
            "tags": "cloudflare",
            "anonymous": "0",
            "reporter": "netresec"
        }
    ],
    "1549121": [
        {
            "ioc_value": "cdnhelofin.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-06-25 06:50:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/37496159ac808c407eb06a14cc9ed22bfd63c6b09eb1be5e95527b256a866a0b/",
            "tags": "HijackLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1549118": [
        {
            "ioc_value": "michikodom.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-25 06:42:10",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/2de0fc74956ca3b6288da3b35969836378239da91dbdd09ac060713aa0b767f4/",
            "tags": "madness,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548994": [
        {
            "ioc_value": "security.fjaregarads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-25 05:58:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1548995": [
        {
            "ioc_value": "oswyka.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-25 05:58:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1549037": [
        {
            "ioc_value": "114-34-241-92.hinet-ip.hinet.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-25 04:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/114.34.241.92+114-34-241-92.hinet-ip.hinet.net",
            "tags": "AS3462,C2,censys,HINET,PenTera",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1549033": [
        {
            "ioc_value": "fls-na.rubyhall.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-25 04:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/139.59.16.42+fls-na.rubyhall.in.net",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1549034": [
        {
            "ioc_value": "ogs.accounts.rubyhall.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-25 04:00:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/139.59.16.42+ogs.accounts.rubyhall.in.net",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1549032": [
        {
            "ioc_value": "www2.rubyhall.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-25 04:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/139.59.16.42+www2.rubyhall.in.net",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1549025": [
        {
            "ioc_value": "barniclespine.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-25 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/45.141.233.66+barniclespine.com",
            "tags": "AS214943,C2,censys,RAILNET",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1549024": [
        {
            "ioc_value": "huxpurak.xjslsd.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-25 04:00:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/122.152.232.215+huxpurak.xjslsd.com",
            "tags": "AS45090,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1549016": [
        {
            "ioc_value": "mujust.fenmila.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-25 00:01:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.136.150.48+mujust.fenmila.me",
            "tags": "AS26383,ASNET,c2,c2-redirector,censys,RedGuard",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548973": [
        {
            "ioc_value": "cdn.panggexxx9823.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-24 16:53:45",
            "last_seen_utc": "2025-07-26 07:48:47",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548969": [
        {
            "ioc_value": "b2.xs.mastermaths.com.sg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-24 16:17:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1548957": [
        {
            "ioc_value": "deepholeintheworld.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-06-24 15:58:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "clickfix,netsupportmanager",
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1548956": [
        {
            "ioc_value": "newdayplss.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-24 15:22:17",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-l6s8tazpz5",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548951": [
        {
            "ioc_value": "security-territory.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-24 15:19:20",
            "last_seen_utc": "2025-07-02 10:21:43",
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-pf6b8ss1ft",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548950": [
        {
            "ioc_value": "talk-chief.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-24 15:18:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-matp5saj8t",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548949": [
        {
            "ioc_value": "skido.hopto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-24 15:18:00",
            "last_seen_utc": "2025-07-02 10:21:44",
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-mg4tpa1xew",
            "tags": "c2,domain,nanocore,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548948": [
        {
            "ioc_value": "lohoainam2008-36048.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-24 15:16:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-fxp7xacq2x",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548946": [
        {
            "ioc_value": "noneeds.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-24 15:15:17",
            "last_seen_utc": "2025-07-02 10:21:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-q94wyatjy8",
            "tags": "AsyncRAT,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548947": [
        {
            "ioc_value": "zip.mysynology.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-24 15:15:17",
            "last_seen_utc": "2025-07-02 10:21:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-q94wyatjy8",
            "tags": "AsyncRAT,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548944": [
        {
            "ioc_value": "basefashionsbd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-24 15:10:05",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-gnzknaytcw",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548943": [
        {
            "ioc_value": "www.screence.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-24 15:09:19",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-gqechaytdz",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548942": [
        {
            "ioc_value": "www.ferrylin.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-24 15:09:18",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-gqechaytdz",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548941": [
        {
            "ioc_value": "connectdadad.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-24 15:06:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-matp5saj8t",
            "tags": "c2,domain,quasar,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548940": [
        {
            "ioc_value": "yzs-42879.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-24 15:05:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-fxp7xacq2x",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548935": [
        {
            "ioc_value": "dez3452-33187.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-24 14:59:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-fhvtvaxjt4",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548934": [
        {
            "ioc_value": "microsoftsys.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-24 14:58:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-fhvtvaxjt4",
            "tags": "c2,domain,quasar,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548932": [
        {
            "ioc_value": "letsqooo-62766.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-24 14:56:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-dp8m6sxtfy",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548930": [
        {
            "ioc_value": "tpinauskas-54803.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-24 14:52:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250624-cslr5sar5s",
            "tags": "c2,domain,Quasar,RAT,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548928": [
        {
            "ioc_value": "dgost5.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-24 14:40:15",
            "last_seen_utc": "2025-07-02 10:21:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-xta29abl2t",
            "tags": "AsyncRAT,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548927": [
        {
            "ioc_value": "top-inform.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-24 14:39:31",
            "last_seen_utc": "2025-07-02 10:21:40",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-xr9ssstkt9",
            "tags": "AsyncRAT,c2,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548922": [
        {
            "ioc_value": "folders.emeraldpinesolutions.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-24 14:36:22",
            "last_seen_utc": "2025-06-24 15:00:44",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114738505200271847",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1548918": [
        {
            "ioc_value": "profile.kerneltaskmanager.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-24 13:09:19",
            "last_seen_utc": "2025-08-03 09:49:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548917": [
        {
            "ioc_value": "owa.kerneltaskmanager.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-24 13:09:17",
            "last_seen_utc": "2025-08-03 09:49:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548916": [
        {
            "ioc_value": "kerneltaskmanager.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-24 13:08:41",
            "last_seen_utc": "2025-08-03 09:49:18",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548915": [
        {
            "ioc_value": "28k85x5jb1k9a.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-24 13:08:04",
            "last_seen_utc": "2025-08-06 07:49:36",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548914": [
        {
            "ioc_value": "1357965137-hnjcoxitoz.ap-guangzhou.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-24 13:08:03",
            "last_seen_utc": "2025-09-12 09:49:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548867": [
        {
            "ioc_value": "securityhealthsystray.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-24 08:01:41",
            "last_seen_utc": "2025-07-02 10:21:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/d1a018205829c2252642f0b38e61f88819df1c5a2b64825a38fa53dbe2b9198b/",
            "tags": "AsyncRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548866": [
        {
            "ioc_value": "adiobast.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-06-24 08:01:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.21.80.1+adiobast.icu",
            "tags": "Amatera,AS13335,C2,censys,CLOUDFLARENET,Panel,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548854": [
        {
            "ioc_value": "wmieventlogonlinehelp.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-24 06:29:14",
            "last_seen_utc": "2025-07-02 10:21:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6cef2a9dfe5e84b67c901ff1e8d8544ed3f763b47a462f9014f3674db182e464/",
            "tags": "AsyncRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548853": [
        {
            "ioc_value": "kamdum.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-24 06:23:45",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1bac3ca72f25881a8e0a8ba5a9708a69f100c08c07f050a9922751183c481918/",
            "tags": "RAT,RemcosRAT,X-TRAILER",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548852": [
        {
            "ioc_value": "kamdumbk.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-24 06:22:11",
            "last_seen_utc": "2025-07-02 10:21:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1bac3ca72f25881a8e0a8ba5a9708a69f100c08c07f050a9922751183c481918/",
            "tags": "RAT,RemcosRAT,X-TRAILER",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548851": [
        {
            "ioc_value": "systemcopilotdriver.ydns.eu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-24 06:19:57",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/1311aed7b08093746c808edea41d40fb2e8547a1bd86a2516cf7bf4f1f2075fd/",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548850": [
        {
            "ioc_value": "rem.aaahorneswll.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-24 06:16:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c9721ed0815c8d3c11b77bb6f6ce4e18f2886629e44d3c1c8e279ce5e699dd1d/",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548847": [
        {
            "ioc_value": "eyeagreement.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-06-24 05:29:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "OffLoader",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548805": [
        {
            "ioc_value": "ecs-1-94-41-160.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-24 05:05:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/1.94.41.160+ecs-1-94-41-160.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1548806": [
        {
            "ioc_value": "imap.dkairsystems.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-24 05:05:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/38.55.129.94+imap.dkairsystems.com",
            "tags": "AS54600,C2,censys,PEG-SV",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1548807": [
        {
            "ioc_value": "arni110.painhealingcenter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-24 05:05:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/31.59.185.111+arni110.painhealingcenter.com",
            "tags": "AS56594,C2,CB-BYO-IP,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1548817": [
        {
            "ioc_value": "ec2-100-25-215-41.compute-1.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-24 05:05:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/100.25.215.41+ec2-100-25-215-41.compute-1.amazonaws.com",
            "tags": "AMAZON-AES,AS14618,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1548733": [
        {
            "ioc_value": "security.fhqreagurard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-24 05:04:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1548734": [
        {
            "ioc_value": "dovlica.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-24 05:04:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1548698": [
        {
            "ioc_value": "devindicator.dev",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-06-24 05:04:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114733926756560906",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1548670": [
        {
            "ioc_value": "webdatacache.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-24 05:03:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1548768": [
        {
            "ioc_value": "owa.printermaintenanceservice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-23 22:54:13",
            "last_seen_utc": "2025-09-18 07:49:40",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548769": [
        {
            "ioc_value": "profile.printermaintenanceservice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-23 22:54:13",
            "last_seen_utc": "2025-08-07 07:50:45",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548767": [
        {
            "ioc_value": "ns3.ceshi897.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-23 22:54:11",
            "last_seen_utc": "2025-12-14 11:48:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548766": [
        {
            "ioc_value": "ns2.ceshi897.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-23 22:54:08",
            "last_seen_utc": "2025-12-14 11:48:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548765": [
        {
            "ioc_value": "ns1.ceshi897.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-23 22:54:04",
            "last_seen_utc": "2025-12-14 11:48:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548764": [
        {
            "ioc_value": "mail.printermaintenanceservice.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-23 22:54:00",
            "last_seen_utc": "2025-09-18 07:49:44",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548763": [
        {
            "ioc_value": "cdn.feilvbing111.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-23 22:53:51",
            "last_seen_utc": "2025-06-24 15:55:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548717": [
        {
            "ioc_value": "mythcc.evilpony.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-23 20:01:06",
            "last_seen_utc": "2025-06-24 04:00:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/173.249.45.65+mythcc.evilpony.win",
            "tags": "AS51167,C2,censys,CONTABO,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548690": [
        {
            "ioc_value": "olympiwurer.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2025-06-23 16:17:40",
            "last_seen_utc": "2025-06-28 22:26:09",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-jrtjxsxqv2",
            "tags": "AS14956,c2,domain,ROUTERHOSTING,stealc,stealer,triage",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548680": [
        {
            "ioc_value": "vmi1705427.contaboserver.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-23 16:01:41",
            "last_seen_utc": "2025-06-24 04:00:46",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/173.249.45.65+vmi1705427.contaboserver.net",
            "tags": "AS51167,C2,censys,CONTABO,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548673": [
        {
            "ioc_value": "s4ntiselac0m3-44679.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-23 15:59:21",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-mj23waaj5y",
            "tags": "c2,domain,quasar,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548672": [
        {
            "ioc_value": "am164aa.kro.kr",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-23 15:58:34",
            "last_seen_utc": "2025-06-28 22:25:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-aewdbagn5z",
            "tags": "c2,domain,quasar,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548667": [
        {
            "ioc_value": "selectbackup.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-23 15:45:35",
            "last_seen_utc": "2025-07-02 10:21:36",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/18.230.228.127",
            "tags": "c2,domain,quasar,rat,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548666": [
        {
            "ioc_value": "vselectbrasil.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-23 15:44:23",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-rc4ekscm3y",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548659": [
        {
            "ioc_value": "conhostlogsdown.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-23 15:38:30",
            "last_seen_utc": "2025-06-28 22:25:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-endbbaxlz5",
            "tags": "AsyncRAT,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548658": [
        {
            "ioc_value": "apple-go.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-23 15:36:29",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-qj9dqszqv2",
            "tags": "c2,domain,XWorm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548657": [
        {
            "ioc_value": "would-pepper.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-23 15:35:42",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-kh3xnsyjs5",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548656": [
        {
            "ioc_value": "people-climbing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-23 15:34:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-jf2q6axpv2",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548655": [
        {
            "ioc_value": "kids-indeed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-23 15:34:18",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250623-dlzabsbm5z",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548640": [
        {
            "ioc_value": "wwwsec.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-23 14:18:41",
            "last_seen_utc": "2025-07-25 05:50:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548639": [
        {
            "ioc_value": "search.2y3rn846.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-23 14:13:34",
            "last_seen_utc": "2025-10-20 09:49:10",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548609": [
        {
            "ioc_value": "surfshark.pw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-06-23 12:07:39",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1548629": [
        {
            "ioc_value": "shallowrepurpose.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-23 12:02:30",
            "last_seen_utc": "2025-06-24 04:00:47",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.193.127.252+shallowrepurpose.top",
            "tags": "ABSTRACT,AS39287,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548606": [
        {
            "ioc_value": "f3.xo.mastermaths.com.sg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-23 08:06:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1548576": [
        {
            "ioc_value": "security.flinaregaozrd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-23 06:58:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1548577": [
        {
            "ioc_value": "faospe.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-23 06:58:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1548574": [
        {
            "ioc_value": "onmolatori.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-23 06:47:21",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548548": [
        {
            "ioc_value": "static.161.152.69.159.clients.your-server.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-23 06:46:24",
            "last_seen_utc": "2025-06-23 04:00:55",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/159.69.152.161+static.161.152.69.159.clients.your-server.de",
            "tags": "AS24940,C2,censys,HETZNER-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1548491": [
        {
            "ioc_value": "photo.suziestuder.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-23 06:46:06",
            "last_seen_utc": "2025-06-22 18:11:05",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1548489": [
        {
            "ioc_value": "app2.symphoniabags.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-23 06:46:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1548524": [
        {
            "ioc_value": "fazstpgnpnqb0.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-22 22:53:13",
            "last_seen_utc": "2025-07-31 09:49:21",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548523": [
        {
            "ioc_value": "1357965137-bafd04zr1t.ap-guangzhou.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-22 22:53:00",
            "last_seen_utc": "2025-06-23 21:53:32",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548514": [
        {
            "ioc_value": "sp.b0t.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-22 20:54:55",
            "last_seen_utc": "2025-08-03 09:49:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548513": [
        {
            "ioc_value": "ns2.ns.xiaotusu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-22 20:54:50",
            "last_seen_utc": "2025-08-30 07:49:34",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548512": [
        {
            "ioc_value": "ns1.ns.xiaotusu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-22 20:54:47",
            "last_seen_utc": "2025-08-30 07:49:32",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548494": [
        {
            "ioc_value": "johncollins55-29335.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-22 19:01:44",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-tjk8paskx2",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548493": [
        {
            "ioc_value": "espinyskibidi-40205.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-22 19:00:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-r7xkhsep9z",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548465": [
        {
            "ioc_value": "b1.cornmealjustly.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-06-22 16:05:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/81bf8b4610651c67525d252b642db81a7dd881180ca4ec41aaba42e108958ec3/",
            "tags": "ACRStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1548484": [
        {
            "ioc_value": "panel333222111.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-22 16:01:11",
            "last_seen_utc": "2025-06-23 04:01:00",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/2606:4700:3037:0:0:0:6815:3856+panel333222111.icu",
            "tags": "AS13335,C2,censys,CLOUDFLARENET,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548463": [
        {
            "ioc_value": "holycrappycrap.no-ip.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-22 13:14:31",
            "last_seen_utc": "2025-06-28 22:26:25",
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-p6gfssgl2w",
            "tags": "c2,DarkComet,domain",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548462": [
        {
            "ioc_value": "snezze-27701.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-22 13:13:33",
            "last_seen_utc": "2025-06-28 22:25:33",
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-p1h3fagk2w",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548459": [
        {
            "ioc_value": "hackblue.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-22 12:43:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-psx7dssvct",
            "tags": "c2,DarkComet,domain",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548458": [
        {
            "ioc_value": "myhost5.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-22 12:36:20",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-n99fbazm19",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548457": [
        {
            "ioc_value": "asasas44-58548.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-22 12:24:37",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-ermddsaj21",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548456": [
        {
            "ioc_value": "season-clothes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-22 12:21:33",
            "last_seen_utc": "2025-06-28 22:25:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-gfnheszsas",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548455": [
        {
            "ioc_value": "waohsfs-48136.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-22 12:20:18",
            "last_seen_utc": "2025-06-28 22:25:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-dmd1safp6t",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548439": [
        {
            "ioc_value": "de5.localto.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-22 10:48:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-ly1ypaynx6",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548438": [
        {
            "ioc_value": "regional-evaluate.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-22 10:46:29",
            "last_seen_utc": "2025-07-29 15:49:10",
            "confidence_level": 100,
            "reference": "https://tria.ge/250622-l9gzys1thw",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548431": [
        {
            "ioc_value": "trezor-io-start.typedream.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-22 08:40:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,LummaStealer",
            "anonymous": "0",
            "reporter": "PUNISHERD"
        }
    ],
    "1548427": [
        {
            "ioc_value": "justhk.saoken.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-22 08:01:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/103.136.150.48+justhk.saoken.me",
            "tags": "AS26383,ASNET,c2,c2-redirector,censys,RedGuard",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548426": [
        {
            "ioc_value": "www.dulcidora.com.br",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-22 08:00:52",
            "last_seen_utc": "2025-06-23 04:00:39",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/143.244.181.199+www.dulcidora.com.br",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548320": [
        {
            "ioc_value": "ns1.basicvitals.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.brute_ratel_c4",
            "malware_alias": "BOLDBADGER,BruteRatel",
            "malware_printable": "Brute Ratel C4",
            "first_seen_utc": "2025-06-22 06:44:31",
            "last_seen_utc": "2025-10-21 07:27:37",
            "confidence_level": 100,
            "reference": null,
            "tags": "brc4,Brute Ratel C4,BruteRatel,c2",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1548338": [
        {
            "ioc_value": "security.gyredoflzares.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-22 06:44:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1548339": [
        {
            "ioc_value": "gowqpaz.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-22 06:44:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1548350": [
        {
            "ioc_value": "test.manageenglne.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-06-22 06:44:27",
            "last_seen_utc": "2025-10-21 07:27:35",
            "confidence_level": 90,
            "reference": null,
            "tags": "Fake Software,fakeapp,loader",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1548384": [
        {
            "ioc_value": "elgg.santutxuht.eus",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-22 04:00:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/167.86.110.179+elgg.santutxuht.eus",
            "tags": "AS51167,C2,censys,CONTABO,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1548380": [
        {
            "ioc_value": "ecs-113-44-139-80.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-22 04:00:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/113.44.139.80+ecs-113-44-139-80.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1548368": [
        {
            "ioc_value": "ms-pupils.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-21 23:05:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250621-feaz9swrz5",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548359": [
        {
            "ioc_value": "ansy10jun.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-21 22:53:58",
            "last_seen_utc": "2025-06-28 22:25:39",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/178.73.192.15",
            "tags": "asyncrat,c2,domain,rat,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548360": [
        {
            "ioc_value": "asegurar3octubre.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-21 22:53:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/178.73.192.15",
            "tags": "asyncrat,c2,domain,rat,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548361": [
        {
            "ioc_value": "asegurar2octubre.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-21 22:53:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/178.73.192.15",
            "tags": "asyncrat,c2,domain,rat,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548358": [
        {
            "ioc_value": "zombiedomain.sytes.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-21 22:52:29",
            "last_seen_utc": "2025-06-28 22:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250621-q73k4abn8v",
            "tags": "AsyncRAT,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548355": [
        {
            "ioc_value": "catherinekey1965-28715.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-21 22:44:04",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250621-n5rppsaj4x",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548354": [
        {
            "ioc_value": "ratforme.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-21 22:42:53",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250621-qbybhazqw8",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548333": [
        {
            "ioc_value": "ns3.admlistdel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 18:55:13",
            "last_seen_utc": "2025-11-27 09:49:59",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548332": [
        {
            "ioc_value": "ns2.todesks.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 18:55:12",
            "last_seen_utc": "2025-08-22 07:49:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548331": [
        {
            "ioc_value": "ns2.mailinfo.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 18:55:11",
            "last_seen_utc": "2025-07-27 09:49:27",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548330": [
        {
            "ioc_value": "ns2.admlistdel.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 18:55:10",
            "last_seen_utc": "2025-11-27 09:49:57",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548328": [
        {
            "ioc_value": "ns1.mailinfo.life",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 18:55:08",
            "last_seen_utc": "2025-07-27 09:49:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548329": [
        {
            "ioc_value": "ns1.todesks.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 18:55:08",
            "last_seen_utc": "2025-08-22 07:49:28",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548327": [
        {
            "ioc_value": "api.todesks.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 18:54:46",
            "last_seen_utc": "2025-08-22 07:49:15",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548318": [
        {
            "ioc_value": "mkidech.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-21 16:57:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250621-vbld6ahq2v",
            "tags": "c2,DarkComet,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548309": [
        {
            "ioc_value": "foncar.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-21 15:27:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250621-feaz9swrz5",
            "tags": "AsyncRAT,c2,domain",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548303": [
        {
            "ioc_value": "pzbx.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:37",
            "last_seen_utc": "2025-07-06 15:10:25",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548298": [
        {
            "ioc_value": "abgzg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:36",
            "last_seen_utc": "2025-07-06 15:10:21",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548299": [
        {
            "ioc_value": "gumkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:36",
            "last_seen_utc": "2025-07-06 15:10:18",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548300": [
        {
            "ioc_value": "pluepf.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:36",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548301": [
        {
            "ioc_value": "ferzja.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:36",
            "last_seen_utc": "2025-09-27 11:10:41",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548302": [
        {
            "ioc_value": "shfsz.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:36",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548295": [
        {
            "ioc_value": "clgsh.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:35",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548296": [
        {
            "ioc_value": "siplv.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:35",
            "last_seen_utc": "2025-07-06 15:10:17",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548297": [
        {
            "ioc_value": "roaein.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:35",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548291": [
        {
            "ioc_value": "tuead.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:34",
            "last_seen_utc": "2025-09-27 11:10:38",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548292": [
        {
            "ioc_value": "bardj.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:34",
            "last_seen_utc": "2025-07-14 16:13:30",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548293": [
        {
            "ioc_value": "basmsz.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:34",
            "last_seen_utc": "2025-07-06 15:10:23",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548294": [
        {
            "ioc_value": "geczs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:34",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548286": [
        {
            "ioc_value": "insye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:33",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548287": [
        {
            "ioc_value": "eboknt.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:33",
            "last_seen_utc": "2025-07-06 15:10:20",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548288": [
        {
            "ioc_value": "przqv.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:33",
            "last_seen_utc": "2025-09-10 08:31:29",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548289": [
        {
            "ioc_value": "regkjw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:33",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548290": [
        {
            "ioc_value": "lifyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:33",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548281": [
        {
            "ioc_value": "adsay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:32",
            "last_seen_utc": "2025-09-27 11:10:36",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548282": [
        {
            "ioc_value": "tymvd.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:32",
            "last_seen_utc": "2025-07-06 15:10:19",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548283": [
        {
            "ioc_value": "nafuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:32",
            "last_seen_utc": "2025-09-01 09:41:58",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548284": [
        {
            "ioc_value": "gizqt.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:32",
            "last_seen_utc": "2025-07-06 15:10:24",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548285": [
        {
            "ioc_value": "didli.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:32",
            "last_seen_utc": "2025-09-10 08:31:27",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548278": [
        {
            "ioc_value": "vervzv.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:31",
            "last_seen_utc": "2025-07-14 16:13:30",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548279": [
        {
            "ioc_value": "mflqsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:31",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548280": [
        {
            "ioc_value": "genhqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:31",
            "last_seen_utc": "2025-09-27 11:10:40",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548275": [
        {
            "ioc_value": "beyxm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:30",
            "last_seen_utc": "2025-07-06 15:10:24",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548276": [
        {
            "ioc_value": "squafu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:30",
            "last_seen_utc": "2025-09-27 11:10:37",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548277": [
        {
            "ioc_value": "opcez.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:30",
            "last_seen_utc": "2025-09-01 09:41:58",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548268": [
        {
            "ioc_value": "cojcx.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:29",
            "last_seen_utc": "2025-07-06 15:10:24",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548269": [
        {
            "ioc_value": "thigk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:29",
            "last_seen_utc": "2025-09-27 11:10:42",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548270": [
        {
            "ioc_value": "antvu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:29",
            "last_seen_utc": "2025-07-06 15:10:22",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548271": [
        {
            "ioc_value": "titco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:29",
            "last_seen_utc": "2025-09-27 11:10:38",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548272": [
        {
            "ioc_value": "battrf.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:29",
            "last_seen_utc": "2025-09-10 08:31:27",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548273": [
        {
            "ioc_value": "annwt.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:29",
            "last_seen_utc": "2025-07-17 10:55:00",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548274": [
        {
            "ioc_value": "maroui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:29",
            "last_seen_utc": "2025-07-06 15:10:17",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548266": [
        {
            "ioc_value": "nepjz.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:28",
            "last_seen_utc": "2025-07-06 15:10:20",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548267": [
        {
            "ioc_value": "dryzc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:28",
            "last_seen_utc": "2025-07-14 16:13:30",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548264": [
        {
            "ioc_value": "detru.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:27",
            "last_seen_utc": "2025-07-06 15:10:18",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548265": [
        {
            "ioc_value": "capxw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:27",
            "last_seen_utc": "2025-07-06 15:10:19",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548263": [
        {
            "ioc_value": "contnm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-21 13:27:26",
            "last_seen_utc": "2025-09-10 08:31:29",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1548257": [
        {
            "ioc_value": "www.commicaute.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 12:56:29",
            "last_seen_utc": "2025-07-30 15:51:06",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548119": [
        {
            "ioc_value": "security.fpwergwavrd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-21 12:53:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1548120": [
        {
            "ioc_value": "posugxa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-21 12:53:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1548124": [
        {
            "ioc_value": "microsoftcdnlicense.putinswin.es",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-21 12:53:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "screenconnect",
            "anonymous": "0",
            "reporter": "tanner"
        }
    ],
    "1548240": [
        {
            "ioc_value": "hamster-exchange.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-21 11:57:15",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250621-dzv5tswnx9",
            "tags": "AsyncRAT,c2,domain",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548239": [
        {
            "ioc_value": "return-aug.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-21 11:53:35",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250621-eahc4sfk5w",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548227": [
        {
            "ioc_value": "anyukov-43802.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-21 11:18:35",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250621-m59pvayqw2",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548221": [
        {
            "ioc_value": "webapi.360se.dpdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 08:55:38",
            "last_seen_utc": "2025-08-07 01:49:20",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548189": [
        {
            "ioc_value": "ec2-54-250-175-201.ap-northeast-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 04:01:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/54.250.175.201+ec2-54-250-175-201.ap-northeast-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,CobaltStrike,open-dir",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548164": [
        {
            "ioc_value": "120.32.198.104.bc.googleusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-21 04:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/104.198.32.120+120.32.198.104.bc.googleusercontent.com",
            "tags": "AS396982,C2,censys,GOOGLE-CLOUD-PLATFORM,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1548163": [
        {
            "ioc_value": "172.91.188.35.bc.googleusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-21 04:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/35.188.91.172+172.91.188.35.bc.googleusercontent.com",
            "tags": "AS396982,C2,censys,GOOGLE-CLOUD-PLATFORM,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1548153": [
        {
            "ioc_value": "dd.tstcs888.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-21 02:53:55",
            "last_seen_utc": "2025-10-06 07:50:14",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548133": [
        {
            "ioc_value": "ns4.jk001.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 22:54:37",
            "last_seen_utc": "2025-08-05 01:49:10",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548134": [
        {
            "ioc_value": "office.soft-storelive.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 22:54:37",
            "last_seen_utc": "2025-08-01 07:50:11",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548132": [
        {
            "ioc_value": "ns3.jk001.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 22:54:36",
            "last_seen_utc": "2025-08-05 01:49:10",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548130": [
        {
            "ioc_value": "ns1.asdxxcg.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 22:54:30",
            "last_seen_utc": "2025-07-30 07:49:03",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548131": [
        {
            "ioc_value": "ns1.asianinvasion.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 22:54:30",
            "last_seen_utc": "2025-07-22 07:49:21",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548128": [
        {
            "ioc_value": "jk002.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 22:54:26",
            "last_seen_utc": "2025-08-05 01:49:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548129": [
        {
            "ioc_value": "log.nongfushan.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 22:54:26",
            "last_seen_utc": "2025-07-28 19:49:49",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548127": [
        {
            "ioc_value": "apps.soft-storelive.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 22:54:16",
            "last_seen_utc": "2025-08-01 07:49:50",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548115": [
        {
            "ioc_value": "www.ddddddddguashjdka.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2025-06-20 20:52:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250620-zfqlwsgr6t",
            "tags": "c2,domain,RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548081": [
        {
            "ioc_value": "2tuff-33336.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-20 19:22:57",
            "last_seen_utc": "2025-06-28 22:25:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250620-xczdhstvex",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548064": [
        {
            "ioc_value": "junie15.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-20 16:14:13",
            "last_seen_utc": "2025-06-28 22:26:00",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/172.111.168.228",
            "tags": "c2,domain,virustotal,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548063": [
        {
            "ioc_value": "lespencer.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-20 16:12:20",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250620-svfxnsdk4z",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548061": [
        {
            "ioc_value": "district-graphical.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-20 16:08:38",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250620-te6c3aek4s",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1548044": [
        {
            "ioc_value": "0.0.mastermaths.com.sg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-20 14:12:47",
            "last_seen_utc": "2025-06-30 15:10:28",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1548035": [
        {
            "ioc_value": "app.symphoniabags.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-20 13:23:20",
            "last_seen_utc": "2025-06-20 13:15:58",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114715857650303913",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1548029": [
        {
            "ioc_value": "gitlab.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 13:09:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1936048194292687212",
            "tags": "CobaltStrike,cs-watermark-100000000",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548030": [
        {
            "ioc_value": "r-cdn.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 13:09:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1936048194292687212",
            "tags": "CobaltStrike,cs-watermark-100000000",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548031": [
        {
            "ioc_value": "api.googleapi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 13:09:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1936048194292687212",
            "tags": "CobaltStrike,cs-watermark-100000000",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548032": [
        {
            "ioc_value": "api.r-cdn.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 13:09:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1936048194292687212",
            "tags": "CobaltStrike,cs-watermark-100000000",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548033": [
        {
            "ioc_value": "down.gitlab.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 13:09:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/500mk500/status/1936048194292687212",
            "tags": "CobaltStrike,cs-watermark-100000000",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548028": [
        {
            "ioc_value": "d.tstcs888.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 12:56:29",
            "last_seen_utc": "2025-10-05 11:50:26",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548023": [
        {
            "ioc_value": "www.googleapi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 12:25:32",
            "last_seen_utc": "2025-06-20 13:09:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/91e851f8cd9a32f9077f9fbbf1a64278e6be460ed5908778e4b45e62e495167e/",
            "tags": "CobaltStrike,cs-watermark-100000000",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1548024": [
        {
            "ioc_value": "api.micosoftr.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 12:25:32",
            "last_seen_utc": "2025-06-20 13:09:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/91e851f8cd9a32f9077f9fbbf1a64278e6be460ed5908778e4b45e62e495167e/",
            "tags": "CobaltStrike,cs-watermark-100000000",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547987": [
        {
            "ioc_value": "cf.testcs888.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 08:55:30",
            "last_seen_utc": "2025-10-06 07:50:13",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547986": [
        {
            "ioc_value": "cf.1v5sd1c2ds.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 08:55:29",
            "last_seen_utc": "2025-10-06 07:50:12",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547985": [
        {
            "ioc_value": "8vz75cfcfmey5.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 08:55:18",
            "last_seen_utc": "2025-07-31 13:49:36",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547950": [
        {
            "ioc_value": "reason-tribal.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-20 07:20:57",
            "last_seen_utc": "2025-06-28 22:25:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1547951": [
        {
            "ioc_value": "we-referring.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-20 07:20:57",
            "last_seen_utc": "2025-06-28 22:25:51",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1547948": [
        {
            "ioc_value": "yn.eoow.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-20 07:20:10",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1547946": [
        {
            "ioc_value": "us.worldisendmail.ml",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 07:19:16",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1547943": [
        {
            "ioc_value": "tax-warrior.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-20 07:18:18",
            "last_seen_utc": "2025-09-04 07:51:29",
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1547831": [
        {
            "ioc_value": "analytticasnoden.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-20 06:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1547833": [
        {
            "ioc_value": "security.fweragyrads.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-20 06:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1547834": [
        {
            "ioc_value": "foepsa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-20 06:12:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1547896": [
        {
            "ioc_value": "update.applefilesync.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-20 04:00:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/135.222.128.238+update.applefilesync.com",
            "tags": "AS8075,C2,censys,MICROSOFT-CORP-MSN-AS-BLOCK,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1547897": [
        {
            "ioc_value": "mathiasputzola.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-20 04:00:40",
            "last_seen_utc": "2025-06-25 04:00:33",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/212.83.148.39+mathiasputzola.com",
            "tags": "AS12876,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1547883": [
        {
            "ioc_value": "c.testcs888.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 02:53:00",
            "last_seen_utc": "2025-12-14 11:48:17",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547884": [
        {
            "ioc_value": "c2.moustartline.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-20 02:53:00",
            "last_seen_utc": "2025-08-20 15:49:30",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547876": [
        {
            "ioc_value": "v361422.hosted-by-vdsina.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-06-20 00:03:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/91.84.109.91+v361422.hosted-by-vdsina.com",
            "tags": "Amatera,AS216071,C2,censys,Panel,Stealer,VDSINA",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547850": [
        {
            "ioc_value": "www.uyghur.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-19 22:54:27",
            "last_seen_utc": "2025-07-21 07:50:24",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547849": [
        {
            "ioc_value": "8xney90cqcr5m.cfc-execute.su.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-19 22:53:57",
            "last_seen_utc": "2025-09-23 09:50:07",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547837": [
        {
            "ioc_value": "sleach.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-19 21:26:56",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-ylwjnabl61",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547836": [
        {
            "ioc_value": "nyzzrat-64271.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-19 21:24:41",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-yn8l1abm3w",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547830": [
        {
            "ioc_value": "catherinekey1965-40831.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-19 21:13:17",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-y8ngkazmy3",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547829": [
        {
            "ioc_value": "finix.newsnewth365.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.poshc2",
            "malware_alias": null,
            "malware_printable": "PoshC2",
            "first_seen_utc": "2025-06-19 21:11:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-zawkysbr3v/behavioral1",
            "tags": "c2,domain,Posh",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547828": [
        {
            "ioc_value": "mygokerman.casacam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-19 21:08:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-zlkylafk2t",
            "tags": "c2,domain,NjRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547821": [
        {
            "ioc_value": "wedbest02.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-19 21:07:12",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-zpynvsx1b1",
            "tags": "c2,domain,RAT,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547822": [
        {
            "ioc_value": "wedbest001.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-19 21:07:12",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-zpynvsx1b1",
            "tags": "c2,domain,RAT,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547823": [
        {
            "ioc_value": "wedbest002.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-19 21:07:12",
            "last_seen_utc": "2025-06-28 22:26:00",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-zpynvsx1b1",
            "tags": "c2,domain,RAT,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547824": [
        {
            "ioc_value": "wedbest004.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-19 21:07:12",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-zpynvsx1b1",
            "tags": "c2,domain,RAT,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547825": [
        {
            "ioc_value": "wedbest004.camdvr.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-19 21:07:12",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-zpynvsx1b1",
            "tags": "c2,domain,RAT,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547826": [
        {
            "ioc_value": "wedbest012.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-19 21:07:12",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-zpynvsx1b1",
            "tags": "c2,domain,RAT,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547827": [
        {
            "ioc_value": "wedbest021.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-19 21:07:12",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-zpynvsx1b1",
            "tags": "c2,domain,RAT,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547819": [
        {
            "ioc_value": "amaprox.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-06-19 21:01:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/194.48.248.57+amaprox.icu",
            "tags": "ALEXHOST,Amatera,AS200019,C2,censys,Panel,Stealer",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547790": [
        {
            "ioc_value": "nmsl.onen.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.moobot",
            "malware_alias": null,
            "malware_printable": "MooBot",
            "first_seen_utc": "2025-06-19 19:40:13",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/b0b3f18e27da4b15829af6b95e3273b1f109b2543114c20fec97e631cab8c580/",
            "tags": "MooBot",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547777": [
        {
            "ioc_value": "aave-crypto.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-19 19:34:31",
            "last_seen_utc": "2025-07-10 16:51:00",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,LummaStealer",
            "anonymous": "0",
            "reporter": "PUNISHERD"
        }
    ],
    "1547770": [
        {
            "ioc_value": "baseswap-new.typedream.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-19 19:34:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,LummaStealer",
            "anonymous": "0",
            "reporter": "PUNISHERD"
        }
    ],
    "1547738": [
        {
            "ioc_value": "swedrent.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-06-19 19:34:29",
            "last_seen_utc": "2025-07-03 16:14:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "Kongtuke",
            "anonymous": "0",
            "reporter": "rmceoin"
        }
    ],
    "1547786": [
        {
            "ioc_value": "b1.gawkheading.lat",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-06-19 19:34:17",
            "last_seen_utc": "2025-06-22 14:36:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/b26a5ee987461beab66a64d82ef48d37ad75e9108938d71f553003199cc12c28/",
            "tags": "ACRStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1547788": [
        {
            "ioc_value": "talktuahthehand-42154.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-19 18:21:30",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-wjh5fawyaz",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547787": [
        {
            "ioc_value": "behind-welcome.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-19 18:14:22",
            "last_seen_utc": "2025-06-28 22:25:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-ctvrfazly9",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547785": [
        {
            "ioc_value": "source-determination.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-19 17:51:39",
            "last_seen_utc": "2025-06-28 22:25:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250618-zjk6ksxlz7",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547784": [
        {
            "ioc_value": "calendar-background.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-19 17:50:51",
            "last_seen_utc": "2025-06-28 22:25:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-g2sn9szvbw",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547783": [
        {
            "ioc_value": "fat-changes.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-19 17:49:02",
            "last_seen_utc": "2025-06-28 22:25:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-nzl72afp9s",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547782": [
        {
            "ioc_value": "other-mins.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-19 17:48:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-p2a38aszht",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547767": [
        {
            "ioc_value": "kalitest.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-19 17:45:49",
            "last_seen_utc": "2025-08-07 16:02:06",
            "confidence_level": 100,
            "reference": "https://tria.ge/250619-sf1crsel9s",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547759": [
        {
            "ioc_value": "doc.sougou365.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-19 16:56:10",
            "last_seen_utc": "2025-08-25 13:50:04",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547756": [
        {
            "ioc_value": "www.domainup6l9.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-19 16:03:30",
            "last_seen_utc": "2025-06-20 04:01:13",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/203.161.45.11+www.domainup6l9.xyz",
            "tags": "AS22612,C2,censys,NAMECHEAP-NET,panel,Unam",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547733": [
        {
            "ioc_value": "sleach.dns.army",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-19 13:52:49",
            "last_seen_utc": "2025-06-28 22:26:12",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1547718": [
        {
            "ioc_value": "www.stirngo.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-19 13:19:12",
            "last_seen_utc": "2025-06-19 13:15:38",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114710198570959381",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1547717": [
        {
            "ioc_value": "lumma-market.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-19 13:03:18",
            "last_seen_utc": "2025-08-13 23:48:06",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1547716": [
        {
            "ioc_value": "reexmv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-19 13:03:17",
            "last_seen_utc": "2025-06-26 13:24:56",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1547663": [
        {
            "ioc_value": "macxapp.org",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-06-19 12:19:04",
            "last_seen_utc": "2025-06-30 09:10:29",
            "confidence_level": 75,
            "reference": "",
            "tags": "amos",
            "anonymous": "0",
            "reporter": "solostalking"
        }
    ],
    "1547664": [
        {
            "ioc_value": "cryptonews-info.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-06-19 12:19:03",
            "last_seen_utc": "2025-06-30 09:10:29",
            "confidence_level": 75,
            "reference": "",
            "tags": "amos",
            "anonymous": "0",
            "reporter": "solostalking"
        }
    ],
    "1547665": [
        {
            "ioc_value": "gewgb.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-19 12:19:03",
            "last_seen_utc": "2025-06-26 13:24:55",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1547666": [
        {
            "ioc_value": "skjgx.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-19 12:19:02",
            "last_seen_utc": "2025-06-26 13:24:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1547667": [
        {
            "ioc_value": "ropyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-19 12:19:01",
            "last_seen_utc": "2025-06-26 13:24:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1547668": [
        {
            "ioc_value": "spjeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-19 12:19:00",
            "last_seen_utc": "2025-06-26 13:24:56",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1547705": [
        {
            "ioc_value": "accounts.accountsgooogle.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-19 12:02:54",
            "last_seen_utc": "2025-06-20 04:00:49",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+accounts.accountsgooogle.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,Havoc,IST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547706": [
        {
            "ioc_value": "myaccount.google.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-19 12:02:54",
            "last_seen_utc": "2025-06-20 04:00:50",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+myaccount.google.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,Havoc,IST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1547484": [
        {
            "ioc_value": "overplanteasiest.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.amatera",
            "malware_alias": null,
            "malware_printable": "Amatera",
            "first_seen_utc": "2025-06-19 08:40:43",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.proofpoint.com/us/blog/threat-insight/amatera-stealer-rebranded-acr-stealer-improved-evasion-sophistication",
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1547629": [
        {
            "ioc_value": "productnews.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bluenoroff",
            "malware_alias": null,
            "malware_printable": "BlueNoroff",
            "first_seen_utc": "2025-06-19 08:40:40",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1547630": [
        {
            "ioc_value": "firstfromsep.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bluenoroff",
            "malware_alias": null,
            "malware_printable": "BlueNoroff",
            "first_seen_utc": "2025-06-19 08:40:40",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1547631": [
        {
            "ioc_value": "safefor.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bluenoroff",
            "malware_alias": null,
            "malware_printable": "BlueNoroff",
            "first_seen_utc": "2025-06-19 08:40:39",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1547632": [
        {
            "ioc_value": "readysafe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.bluenoroff",
            "malware_alias": null,
            "malware_printable": "BlueNoroff",
            "first_seen_utc": "2025-06-19 08:40:39",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1547655": [
        {
            "ioc_value": "voucher.io.vn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.bashlite",
            "malware_alias": "gayfgt,Gafgyt,qbot,torlus,lizkebab",
            "malware_printable": "Bashlite",
            "first_seen_utc": "2025-06-19 08:28:55",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/5ca891bb3e31791da64653a47c63f4da566dfaf7d894056b1caec4dc528b1b56/",
            "tags": "Bashlite,Gafgyt",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547651": [
        {
            "ioc_value": "maxmusttry.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-19 08:10:22",
            "last_seen_utc": "2025-07-02 10:21:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/29021b0dbdecb926b5212abbb729a51378a79fca5455bc5434a24fdd5a2742a7/",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547620": [
        {
            "ioc_value": "caquoaeiiscyamug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:42",
            "last_seen_utc": "2025-09-02 07:17:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547621": [
        {
            "ioc_value": "qcgwqwugqoayqeya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:42",
            "last_seen_utc": "2025-09-02 07:17:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547622": [
        {
            "ioc_value": "gissasmeseyaeaew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:42",
            "last_seen_utc": "2025-09-02 07:17:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547623": [
        {
            "ioc_value": "giiskyyiggyiywwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:42",
            "last_seen_utc": "2025-09-02 07:17:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547624": [
        {
            "ioc_value": "kqsqsausqsgioeca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:42",
            "last_seen_utc": "2025-09-02 07:17:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547625": [
        {
            "ioc_value": "sgqgkciiqcgwagmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:42",
            "last_seen_utc": "2025-09-02 07:17:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547626": [
        {
            "ioc_value": "ysgcqiiuwmkiyqgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:42",
            "last_seen_utc": "2025-09-02 07:17:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547627": [
        {
            "ioc_value": "ysuyucuwgcwimiwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:42",
            "last_seen_utc": "2025-09-02 07:17:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547601": [
        {
            "ioc_value": "mucqqseqiyymgyku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547602": [
        {
            "ioc_value": "kqcssgeeayeqkqkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547603": [
        {
            "ioc_value": "oymceywyewasuwio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547604": [
        {
            "ioc_value": "giewyyeuioikyieo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547605": [
        {
            "ioc_value": "cauoakkyaoqacaqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547606": [
        {
            "ioc_value": "caayuwgoeuqgaaiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547607": [
        {
            "ioc_value": "qcweageieakeocqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547608": [
        {
            "ioc_value": "ysayiugaeyaiygas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547609": [
        {
            "ioc_value": "kqecseocquiksguy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547610": [
        {
            "ioc_value": "qcieigeasmiuusua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547611": [
        {
            "ioc_value": "sgeokwakwuiquema.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547612": [
        {
            "ioc_value": "woqkowiiyuomycoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547613": [
        {
            "ioc_value": "kqkwwmeqeggqossi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547614": [
        {
            "ioc_value": "eeagyiasuqmigwse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547615": [
        {
            "ioc_value": "ukomiosecyegcyww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547616": [
        {
            "ioc_value": "mugagwgsmioysuuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547617": [
        {
            "ioc_value": "eekqsqeogggckiog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547618": [
        {
            "ioc_value": "sgiqcceysaemqwky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547619": [
        {
            "ioc_value": "cagoaomqmqgmysaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:41",
            "last_seen_utc": "2025-09-02 07:17:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547583": [
        {
            "ioc_value": "mucmoccqkaesauky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547584": [
        {
            "ioc_value": "sgcuyoowcucgweqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547585": [
        {
            "ioc_value": "ukqqmosmcswkisuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547586": [
        {
            "ioc_value": "mueiysmqsosumkym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547587": [
        {
            "ioc_value": "womyqymoeosgcmec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547588": [
        {
            "ioc_value": "woyoukcwsowkikmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547589": [
        {
            "ioc_value": "kqksagyygwyaqcio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547590": [
        {
            "ioc_value": "imkaiuqeimsyguys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547591": [
        {
            "ioc_value": "giqqysyeuqesakym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547592": [
        {
            "ioc_value": "giycygikyewcuios.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547593": [
        {
            "ioc_value": "ysqqgoougusgyioy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547594": [
        {
            "ioc_value": "oyekaukuaouosigk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547595": [
        {
            "ioc_value": "eewioyucgwcgyway.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547596": [
        {
            "ioc_value": "awqmaiugqmkyeisc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547597": [
        {
            "ioc_value": "oycciaicmmscuoog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547598": [
        {
            "ioc_value": "qcmqcmgguaiiswea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547599": [
        {
            "ioc_value": "ysssuwmiyscemqqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547600": [
        {
            "ioc_value": "oyaoeoqegmuwumse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:40",
            "last_seen_utc": "2025-09-02 07:17:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547563": [
        {
            "ioc_value": "sgykiuqcgmuewosw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547564": [
        {
            "ioc_value": "muieswoowgqkikmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547565": [
        {
            "ioc_value": "kqqiuqseuiwwossw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547566": [
        {
            "ioc_value": "sgcioewuwiaqwaim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547567": [
        {
            "ioc_value": "oycckaucqgiygkou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547568": [
        {
            "ioc_value": "imsgciugwykoaewi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547569": [
        {
            "ioc_value": "kquqegqcwukumsoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547570": [
        {
            "ioc_value": "caoeqyaesewiiqkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547571": [
        {
            "ioc_value": "ysmseskusowesoue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547572": [
        {
            "ioc_value": "oysuwiuuaisayuyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547573": [
        {
            "ioc_value": "ukmysmikomycycoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547574": [
        {
            "ioc_value": "ysseweueemmcgesk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547575": [
        {
            "ioc_value": "qcyeoeqmywsimaag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547576": [
        {
            "ioc_value": "eeaymiyqkwuooiug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547577": [
        {
            "ioc_value": "wokwawuucyoyekqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547578": [
        {
            "ioc_value": "imsauwceaemssmkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547579": [
        {
            "ioc_value": "aweweioiisaskswg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547580": [
        {
            "ioc_value": "muqeiwmseegkwcuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547581": [
        {
            "ioc_value": "eeyogwweekkyiqok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547582": [
        {
            "ioc_value": "caoqcqqagugossuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:39",
            "last_seen_utc": "2025-09-02 07:17:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547542": [
        {
            "ioc_value": "imawmqououqcyysi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547543": [
        {
            "ioc_value": "aweseqkgmsaeigam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547544": [
        {
            "ioc_value": "muaeqaaoigsoascc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547545": [
        {
            "ioc_value": "ukoeskiugusiqaes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547546": [
        {
            "ioc_value": "muiiouigkukuiqwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547547": [
        {
            "ioc_value": "awwekuyieseksuse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547548": [
        {
            "ioc_value": "sgcggasyiawgmuck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547549": [
        {
            "ioc_value": "mumwceccoycguwio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547550": [
        {
            "ioc_value": "imqukqmswyeimaqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547551": [
        {
            "ioc_value": "oyqqmqwyiesmwiaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547552": [
        {
            "ioc_value": "sgeagmoeqywkmcsa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547553": [
        {
            "ioc_value": "gicoeamoksqqeqky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547554": [
        {
            "ioc_value": "awgekegsqcccsscc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547555": [
        {
            "ioc_value": "awkksaesouewumui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547556": [
        {
            "ioc_value": "wocgicwuuqieyoya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547557": [
        {
            "ioc_value": "immaioaiqsaewqie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547558": [
        {
            "ioc_value": "gigewaikmesuigau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547559": [
        {
            "ioc_value": "imyeoooikwsgsmse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547560": [
        {
            "ioc_value": "mucigikcaykwsaoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547561": [
        {
            "ioc_value": "eeoayqkgegesggye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547562": [
        {
            "ioc_value": "mumoimyscggwgqsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:38",
            "last_seen_utc": "2025-09-02 07:17:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547521": [
        {
            "ioc_value": "qcuckowoimeowmuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547522": [
        {
            "ioc_value": "sgiesocqcacokysy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547523": [
        {
            "ioc_value": "cawagammososayya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547524": [
        {
            "ioc_value": "imwgoomsgyyaocuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547525": [
        {
            "ioc_value": "awamiqaskaiacegs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547526": [
        {
            "ioc_value": "qcgicmmgmcuokscg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547527": [
        {
            "ioc_value": "caaqysawocgqckmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547528": [
        {
            "ioc_value": "eewacscwiisoqiyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547529": [
        {
            "ioc_value": "qcsmuuwgcqyeysuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547530": [
        {
            "ioc_value": "imawcuaaoycgqsgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547531": [
        {
            "ioc_value": "ysewqcgcaywyksio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547532": [
        {
            "ioc_value": "immqawysuecyikwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547533": [
        {
            "ioc_value": "imgwmoaqyucgseeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547534": [
        {
            "ioc_value": "oyecsqkmkigcigca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547535": [
        {
            "ioc_value": "caauqcumeweakwuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547536": [
        {
            "ioc_value": "oyymueyysmeagssk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547537": [
        {
            "ioc_value": "eemaeaqqkokysayk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547538": [
        {
            "ioc_value": "cacyiumeeuoqsmui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547539": [
        {
            "ioc_value": "mumggwigmoywaouw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547540": [
        {
            "ioc_value": "eeioeesikqqemsoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547541": [
        {
            "ioc_value": "muqqiaaukqsswayu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:37",
            "last_seen_utc": "2025-09-02 07:17:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547499": [
        {
            "ioc_value": "muqoqqueyugikiiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547500": [
        {
            "ioc_value": "sgycgiaskoigqqmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547501": [
        {
            "ioc_value": "sgkuoemiwayemygq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547502": [
        {
            "ioc_value": "caickuekcuqemwwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547503": [
        {
            "ioc_value": "oyyiicioqsgisegi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547504": [
        {
            "ioc_value": "yscaismukucqeawu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547505": [
        {
            "ioc_value": "ysicgacuccquayoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547506": [
        {
            "ioc_value": "muayeqaygiyecyiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547507": [
        {
            "ioc_value": "sgmqaeaoewkigimq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547508": [
        {
            "ioc_value": "gimowqomimieegyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547509": [
        {
            "ioc_value": "mukkocaaqqeoawsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547510": [
        {
            "ioc_value": "sgkyuuowaweykacw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547511": [
        {
            "ioc_value": "woykciueuuosiywm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547512": [
        {
            "ioc_value": "sgkkacaeawwywwuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547513": [
        {
            "ioc_value": "eegmeiywwywauiew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547514": [
        {
            "ioc_value": "mucqisowiyeiakui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547515": [
        {
            "ioc_value": "kqueaoiicymaauyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547516": [
        {
            "ioc_value": "yskowogigugkqsoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547517": [
        {
            "ioc_value": "qcgwmcawooigwqai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547518": [
        {
            "ioc_value": "immgsukksgqgomia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547519": [
        {
            "ioc_value": "ukgcgckggkoksscy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547520": [
        {
            "ioc_value": "awwmmgykcmaumusi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:36",
            "last_seen_utc": "2025-09-02 07:17:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547476": [
        {
            "ioc_value": "sgqqusuykameiyow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547477": [
        {
            "ioc_value": "awcecauiaykgkauc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547478": [
        {
            "ioc_value": "sgiqswsausgayomw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547479": [
        {
            "ioc_value": "eeosqkmusmumuegm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547480": [
        {
            "ioc_value": "wookmykcukoiywoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547481": [
        {
            "ioc_value": "kqugcoegcgioeces.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547482": [
        {
            "ioc_value": "ysocquogqswowkes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547483": [
        {
            "ioc_value": "qcoiaueyqeqiwgyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547485": [
        {
            "ioc_value": "wowsoqwcyskaagys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547486": [
        {
            "ioc_value": "sgeuyswcacwkigcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547487": [
        {
            "ioc_value": "qcaemscemeaoeooo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547488": [
        {
            "ioc_value": "imuugswekyussyma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547489": [
        {
            "ioc_value": "awaawyuiwayiekuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547490": [
        {
            "ioc_value": "qcagcasyiwygywum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547491": [
        {
            "ioc_value": "cacmkwqckmcsyekm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547492": [
        {
            "ioc_value": "oyusycykkgukiiwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547493": [
        {
            "ioc_value": "qcceyiiicaasygew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547494": [
        {
            "ioc_value": "ysyqkoimkuskaawi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547495": [
        {
            "ioc_value": "yssmmmggamcuykmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547496": [
        {
            "ioc_value": "kqeqicugqimuyyga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547497": [
        {
            "ioc_value": "eeikuakguecuuica.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547498": [
        {
            "ioc_value": "yseaswcywsoqueou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:35",
            "last_seen_utc": "2025-09-02 07:17:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547453": [
        {
            "ioc_value": "qcgiuuosekaicmwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547454": [
        {
            "ioc_value": "woqysyiqogucwgiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547455": [
        {
            "ioc_value": "awuyucgqyiesqsmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547456": [
        {
            "ioc_value": "eeksqwmsykswoeci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547457": [
        {
            "ioc_value": "kqqugkqwoakkqsmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547458": [
        {
            "ioc_value": "imsqmkqomkyeiusq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547459": [
        {
            "ioc_value": "sgqaaocysyaigeas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547460": [
        {
            "ioc_value": "eekoiecesciwgqis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547461": [
        {
            "ioc_value": "qccwuioemiqckwau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547462": [
        {
            "ioc_value": "qcwseewisismmwia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547463": [
        {
            "ioc_value": "qckgweuwiuikqiem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547464": [
        {
            "ioc_value": "awakokyeqwswickc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547465": [
        {
            "ioc_value": "mukqakeuyaoyeugm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547466": [
        {
            "ioc_value": "ysieigcowsgywgow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547467": [
        {
            "ioc_value": "caieoaqsgmkywsye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547468": [
        {
            "ioc_value": "imgqqiaeygskguyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547469": [
        {
            "ioc_value": "caygocskiyksegss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547470": [
        {
            "ioc_value": "awymuwyuaswocyks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547471": [
        {
            "ioc_value": "oyswamuowamewicy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547472": [
        {
            "ioc_value": "oyeuagiusmqyiwmk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547473": [
        {
            "ioc_value": "eeocwioyokagwusa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547474": [
        {
            "ioc_value": "kqmqcwkyseseyski.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547475": [
        {
            "ioc_value": "sgegusawwqiiawum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:34",
            "last_seen_utc": "2025-09-02 07:17:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547431": [
        {
            "ioc_value": "ysysyqksuumwemca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547432": [
        {
            "ioc_value": "ysyogswmocegsksm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547433": [
        {
            "ioc_value": "kqyoiaqwcseakmgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547434": [
        {
            "ioc_value": "sggeookckwsekoks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547435": [
        {
            "ioc_value": "awquesgyeqqmqqgs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547436": [
        {
            "ioc_value": "awguccgcgmuyqoeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547437": [
        {
            "ioc_value": "gigaaweskgaeioom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547438": [
        {
            "ioc_value": "sgkkgmuewqmaqyiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547439": [
        {
            "ioc_value": "womiucmyqyueyiig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547440": [
        {
            "ioc_value": "woguwkeoeicqgkqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547441": [
        {
            "ioc_value": "caqogokqewassqww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547442": [
        {
            "ioc_value": "ukyoauqcwyycaqqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547443": [
        {
            "ioc_value": "kqueyywoiaioqyma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547444": [
        {
            "ioc_value": "ysicoameikemakec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547445": [
        {
            "ioc_value": "mumsicwaiyiwokeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547446": [
        {
            "ioc_value": "oykqiuuimqekcyau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547447": [
        {
            "ioc_value": "kqqcoywqmkquqawm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547448": [
        {
            "ioc_value": "gioqeeayymoiqyag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547449": [
        {
            "ioc_value": "sgaaaasaoycouyom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547450": [
        {
            "ioc_value": "gimgaqawugoakqyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547451": [
        {
            "ioc_value": "caamysuikiquqkam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547452": [
        {
            "ioc_value": "imymyosyqmyumkgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:33",
            "last_seen_utc": "2025-09-02 07:17:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547410": [
        {
            "ioc_value": "ukqcuoqgkicgcmgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547411": [
        {
            "ioc_value": "awaoscimysuwemss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547412": [
        {
            "ioc_value": "imaqucwgiiiseeyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547413": [
        {
            "ioc_value": "giwqmowqykiqaasg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547414": [
        {
            "ioc_value": "caakomcagigcuygu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547415": [
        {
            "ioc_value": "kqwoskaoauyaawuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547416": [
        {
            "ioc_value": "oyqcucgusmmmeagg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547417": [
        {
            "ioc_value": "awcscwqgyowgssym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547418": [
        {
            "ioc_value": "imyemguycegmukgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547419": [
        {
            "ioc_value": "kqayocokmigqcyyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547420": [
        {
            "ioc_value": "oywkwewsgweoaasq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547421": [
        {
            "ioc_value": "oyymgccwysiiawam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547422": [
        {
            "ioc_value": "sgscmuaewymaimiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547423": [
        {
            "ioc_value": "qcyumceykqwowkyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547424": [
        {
            "ioc_value": "oyycummgmemqkoaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547425": [
        {
            "ioc_value": "eeayoewoqsmuimeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547426": [
        {
            "ioc_value": "wouooioicoskusqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547427": [
        {
            "ioc_value": "qcoumkaqcomigwek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547428": [
        {
            "ioc_value": "giuqskyyuommmswi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547429": [
        {
            "ioc_value": "woquuimogaicqace.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547430": [
        {
            "ioc_value": "yssyuqoqkogsoayi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:32",
            "last_seen_utc": "2025-09-02 07:17:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547387": [
        {
            "ioc_value": "cakyqggmqeecucuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547388": [
        {
            "ioc_value": "imieiakiswqqaiew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547389": [
        {
            "ioc_value": "gikoqqaqaaagoqqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547390": [
        {
            "ioc_value": "gikyaygmskkcgcsw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547391": [
        {
            "ioc_value": "sgesmecksaoemcoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547392": [
        {
            "ioc_value": "sgwggweawomomuok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547393": [
        {
            "ioc_value": "ukumosooosiioeik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547394": [
        {
            "ioc_value": "wosyqgmueokaecis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547395": [
        {
            "ioc_value": "qcuaymwmqyuuygcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547396": [
        {
            "ioc_value": "sgakmcyuweqogyei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547397": [
        {
            "ioc_value": "qcwquysiguyqausc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547398": [
        {
            "ioc_value": "muuqeaqkgqiyimac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547399": [
        {
            "ioc_value": "imwckyiaumigyysq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547400": [
        {
            "ioc_value": "ukiakymggawsoskk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547401": [
        {
            "ioc_value": "gigumycoiqsmyeko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547402": [
        {
            "ioc_value": "mukyokwgcyciqqeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547403": [
        {
            "ioc_value": "giuwawcyooiggwmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547404": [
        {
            "ioc_value": "eeksciowemqcemes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547405": [
        {
            "ioc_value": "qcwogckuqymyaesq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547406": [
        {
            "ioc_value": "kqyoyciosmqyeiog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547407": [
        {
            "ioc_value": "oyqsoiaciiawsyig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547408": [
        {
            "ioc_value": "giqawqysmgogaoku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547409": [
        {
            "ioc_value": "giwggewcciwkawws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:31",
            "last_seen_utc": "2025-09-02 07:17:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547365": [
        {
            "ioc_value": "awmaqaiauiskkagw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547366": [
        {
            "ioc_value": "eekwgaeqagowymyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547367": [
        {
            "ioc_value": "imwwyooyyccwaaqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547368": [
        {
            "ioc_value": "ysiseugsgeqokmqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547369": [
        {
            "ioc_value": "kqouuycueoemawcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547370": [
        {
            "ioc_value": "qcqgggiqmoyqgwac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547371": [
        {
            "ioc_value": "wommqqkowkaouscm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547372": [
        {
            "ioc_value": "muwiegqmgeqgyqew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547373": [
        {
            "ioc_value": "yseuaqgqggaswswa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547374": [
        {
            "ioc_value": "giciaeogkakyqyyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547375": [
        {
            "ioc_value": "awgkocmugwswokga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547376": [
        {
            "ioc_value": "caaqqokmkakkmegq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547377": [
        {
            "ioc_value": "oyuowiaieggiemci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547378": [
        {
            "ioc_value": "sgaowgiaqgkyuoee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547379": [
        {
            "ioc_value": "woouaiiuuqqmsggu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547380": [
        {
            "ioc_value": "wooosaiugcuiqaug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547381": [
        {
            "ioc_value": "sgqayowgokcweekk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547382": [
        {
            "ioc_value": "eeiqgyaoqwiyoiws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547383": [
        {
            "ioc_value": "oygamecwssqkwyaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547384": [
        {
            "ioc_value": "ysekucokywikcmwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547385": [
        {
            "ioc_value": "eeegewmoogggcege.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547386": [
        {
            "ioc_value": "kqqwiaausoweekye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:30",
            "last_seen_utc": "2025-09-02 07:17:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547343": [
        {
            "ioc_value": "giacaioecwawccui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:02",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547344": [
        {
            "ioc_value": "qcackmuageoqiuky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:02",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547345": [
        {
            "ioc_value": "sgweamwqcgsuyiqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:02",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547346": [
        {
            "ioc_value": "wokmoemsqekyaoqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547347": [
        {
            "ioc_value": "kqyiyiwaqceukesy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547348": [
        {
            "ioc_value": "eecaucqogogsaqmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547349": [
        {
            "ioc_value": "kqcyuusqiawuoqqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547350": [
        {
            "ioc_value": "kqomkawamowuoeuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547351": [
        {
            "ioc_value": "giugswaiqemkeyyu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547352": [
        {
            "ioc_value": "awsoyawawiosygao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547353": [
        {
            "ioc_value": "sgcyqyuseagykmwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547354": [
        {
            "ioc_value": "qcmcswwuscwaaiwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547355": [
        {
            "ioc_value": "sgowoyskkigyqsos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547356": [
        {
            "ioc_value": "wokckmmwakeqoqgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547357": [
        {
            "ioc_value": "giwqmeomwqcwicgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547358": [
        {
            "ioc_value": "imuqggmaiewekeok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547359": [
        {
            "ioc_value": "kqeqcmqgquqeoimo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547360": [
        {
            "ioc_value": "muyeuggqwsmaycqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547361": [
        {
            "ioc_value": "oycecoysmuwcoooe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547362": [
        {
            "ioc_value": "gikqwmikcgayakuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547363": [
        {
            "ioc_value": "giqaewgckgaaaagg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547364": [
        {
            "ioc_value": "qcgugesowmiuwyik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:29",
            "last_seen_utc": "2025-09-02 07:17:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547320": [
        {
            "ioc_value": "imwcwwqmgggeemac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547321": [
        {
            "ioc_value": "awgukiguesccgiwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547322": [
        {
            "ioc_value": "imicaqqkwweiquuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547323": [
        {
            "ioc_value": "oycysoegwukuaagm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547324": [
        {
            "ioc_value": "woaswgqqkwuqicom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547325": [
        {
            "ioc_value": "gissaiicmwgokwiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547326": [
        {
            "ioc_value": "qcwwmsqwkosiossy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547327": [
        {
            "ioc_value": "wokyyusaagemwiui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547328": [
        {
            "ioc_value": "caaqamqceycagkwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547329": [
        {
            "ioc_value": "awimiogamosimqus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547330": [
        {
            "ioc_value": "ysacwiaywqaueogu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547331": [
        {
            "ioc_value": "kqgscsmaqaaiyyie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547332": [
        {
            "ioc_value": "oymyaaaqcwqsumom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547333": [
        {
            "ioc_value": "sgcmaumcweuemucy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547334": [
        {
            "ioc_value": "womcmaccoqiuaqcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:16:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547335": [
        {
            "ioc_value": "oywqaqaoccyyqioc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:17:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547336": [
        {
            "ioc_value": "awwygkyqycmqgugk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:17:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547337": [
        {
            "ioc_value": "oymiowiwewgicgcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:17:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547338": [
        {
            "ioc_value": "ysogqakmkqswcswm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:17:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547339": [
        {
            "ioc_value": "ysgymkwscuqwioyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:17:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547340": [
        {
            "ioc_value": "gisaeemmwaaiikso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:17:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547341": [
        {
            "ioc_value": "caaeskmaqeosswcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:17:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547342": [
        {
            "ioc_value": "giwkggayukciwguk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:28",
            "last_seen_utc": "2025-09-02 07:17:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547298": [
        {
            "ioc_value": "ukuqsiagiykewuuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547299": [
        {
            "ioc_value": "qcuykmyuuioiyuuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547300": [
        {
            "ioc_value": "yscyaumwkuiyseuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547301": [
        {
            "ioc_value": "imwmkaieauqkgaiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547302": [
        {
            "ioc_value": "ysocaeyauygyumea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547303": [
        {
            "ioc_value": "ysaaieqiiwciguus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547304": [
        {
            "ioc_value": "imykokwqaccqgqyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547305": [
        {
            "ioc_value": "ukogookcyaewkggg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547306": [
        {
            "ioc_value": "aweeyycgeamusmsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547307": [
        {
            "ioc_value": "oymgyoceiuiecwyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547308": [
        {
            "ioc_value": "ukoywwyywyqsggem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547309": [
        {
            "ioc_value": "aweykmykscoksgag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547310": [
        {
            "ioc_value": "eeiymeikqaaecsis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547311": [
        {
            "ioc_value": "giakuuumgqqoqiyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547312": [
        {
            "ioc_value": "oyqwqkykwoysogsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547313": [
        {
            "ioc_value": "gimsayogsmmquoiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547314": [
        {
            "ioc_value": "sguwgakwokaeymgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547315": [
        {
            "ioc_value": "kqkcuyugegwgwoem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547316": [
        {
            "ioc_value": "womaeiookaqmguag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547317": [
        {
            "ioc_value": "yscmkuusgccskeoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547318": [
        {
            "ioc_value": "qcamcewswumkiyio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547319": [
        {
            "ioc_value": "awumwygiqmuuaukm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:27",
            "last_seen_utc": "2025-09-02 07:16:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547276": [
        {
            "ioc_value": "qaeigmguckwweway.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547277": [
        {
            "ioc_value": "yqseaesicyaoqmos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547278": [
        {
            "ioc_value": "cyyciuukqqyoseui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547279": [
        {
            "ioc_value": "ecmcosiwqkmsqgii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547280": [
        {
            "ioc_value": "auywyuqcueqgyqms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547281": [
        {
            "ioc_value": "wmwgiigquicemois.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547282": [
        {
            "ioc_value": "yqiycmcwecmauswm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547283": [
        {
            "ioc_value": "cyisewgsccacawmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547284": [
        {
            "ioc_value": "ggyskukuawimwsam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547285": [
        {
            "ioc_value": "owwckgmwkeqgoqmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547286": [
        {
            "ioc_value": "yqyysakuyaowsmqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547287": [
        {
            "ioc_value": "seusacsiogqakeci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547288": [
        {
            "ioc_value": "iksygyaokioeisyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547289": [
        {
            "ioc_value": "muwwwaskuceaiise.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547290": [
        {
            "ioc_value": "imeegaieiycgqekk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547291": [
        {
            "ioc_value": "oyyoqeqessiiugqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547292": [
        {
            "ioc_value": "giigqicwisocigay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547293": [
        {
            "ioc_value": "gikeoiqiieqoaaem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547294": [
        {
            "ioc_value": "giuqmskemieuyows.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547295": [
        {
            "ioc_value": "ysgguacuecyayyqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547296": [
        {
            "ioc_value": "qcumewaigkiuayaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547297": [
        {
            "ioc_value": "sgwmgouygkkmuyay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:26",
            "last_seen_utc": "2025-09-02 07:16:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547255": [
        {
            "ioc_value": "qaqmmukqyqgsaoou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547256": [
        {
            "ioc_value": "ecaqiqiwkksoioso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547257": [
        {
            "ioc_value": "seeywoeueeseeyms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547258": [
        {
            "ioc_value": "ggwkeuyosgcgocka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547259": [
        {
            "ioc_value": "cyycgkyuseeyugyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547260": [
        {
            "ioc_value": "ggaiiqmymygmacyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547261": [
        {
            "ioc_value": "wmukqkgkgumisgcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547262": [
        {
            "ioc_value": "owiuayueksggsiik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547263": [
        {
            "ioc_value": "koumqsgugsaikwcw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547264": [
        {
            "ioc_value": "ggeuocgsimamyeki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547265": [
        {
            "ioc_value": "qaekyoyqywekkywe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547266": [
        {
            "ioc_value": "cyggsecisegqeewg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547267": [
        {
            "ioc_value": "wmksmwcwqkqwucio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547268": [
        {
            "ioc_value": "eckaoiumeeugkweg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547269": [
        {
            "ioc_value": "seiwagkiawqyqgmm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547270": [
        {
            "ioc_value": "uiayswmqyugiomws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547271": [
        {
            "ioc_value": "cyeisesessoycmki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547272": [
        {
            "ioc_value": "auoqmasauscuewma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547273": [
        {
            "ioc_value": "uiwwkogwsccikgeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547274": [
        {
            "ioc_value": "wmwicikqsyamgwew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547275": [
        {
            "ioc_value": "sewosyiueuicoeiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:25",
            "last_seen_utc": "2025-09-02 07:16:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547235": [
        {
            "ioc_value": "auceayweqwmymewg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547236": [
        {
            "ioc_value": "uimgiiaweycasqwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547237": [
        {
            "ioc_value": "kogyyyokasqsmcqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547238": [
        {
            "ioc_value": "wmskigigmacimeqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547239": [
        {
            "ioc_value": "yquiuwykiumkgaek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547240": [
        {
            "ioc_value": "koqgaksoosqisuki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547241": [
        {
            "ioc_value": "wmuqwusyeoucsggu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547242": [
        {
            "ioc_value": "ecsyaauokgaimkcm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547243": [
        {
            "ioc_value": "uimciaewocmmueao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547244": [
        {
            "ioc_value": "oweegqkkcagaygue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547245": [
        {
            "ioc_value": "ggucmyykgmmcmmsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547246": [
        {
            "ioc_value": "mskyskqsiiiaeiie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547247": [
        {
            "ioc_value": "kowmcysumyeiyywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547248": [
        {
            "ioc_value": "ggeiescaoooeqmys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547249": [
        {
            "ioc_value": "seqskgcoeuceasam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547250": [
        {
            "ioc_value": "owsgwsacosoccuai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547251": [
        {
            "ioc_value": "komaccoiwkosakqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547252": [
        {
            "ioc_value": "ggkoiqaqueeagiao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547253": [
        {
            "ioc_value": "ikqmksmywgcosymy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547254": [
        {
            "ioc_value": "wmwiooiusaowgkki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:24",
            "last_seen_utc": "2025-09-02 07:16:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547215": [
        {
            "ioc_value": "cyicgwcweuiewkkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547216": [
        {
            "ioc_value": "yqaqimcmmcmomawc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547217": [
        {
            "ioc_value": "uiymsqaceieegico.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547218": [
        {
            "ioc_value": "uimoocucowguowmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547219": [
        {
            "ioc_value": "qaksqgciacicomki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547220": [
        {
            "ioc_value": "wmcgmuqaoqiamwag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547221": [
        {
            "ioc_value": "cyscieucgeaeasoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547222": [
        {
            "ioc_value": "owcwaqyqoyiaisua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547223": [
        {
            "ioc_value": "ggasemmceoiacyem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547224": [
        {
            "ioc_value": "cyouuusoesgscqqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547225": [
        {
            "ioc_value": "wmoicsomomwggiyq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547226": [
        {
            "ioc_value": "auukokyyyieyssms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547227": [
        {
            "ioc_value": "uimosqseogekksmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547228": [
        {
            "ioc_value": "uiuwagiygmcqqamu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547229": [
        {
            "ioc_value": "ikocmscoyugwouse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547230": [
        {
            "ioc_value": "ikisowigswiuuuec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547231": [
        {
            "ioc_value": "gggcwayqukguaykg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547232": [
        {
            "ioc_value": "qaaiyqakguecuyws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547233": [
        {
            "ioc_value": "mscyesagmqmkmyqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547234": [
        {
            "ioc_value": "eckgweqwcqmyamuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:23",
            "last_seen_utc": "2025-09-02 07:16:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547194": [
        {
            "ioc_value": "wmyyoukkeqwsamyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547195": [
        {
            "ioc_value": "yqaagooommmeieey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547196": [
        {
            "ioc_value": "wmwgqmysymykeyio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547197": [
        {
            "ioc_value": "koimuewemmoiacis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547198": [
        {
            "ioc_value": "ggeouuaiiqkkquwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547199": [
        {
            "ioc_value": "ikqsewmkiskaqsik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547200": [
        {
            "ioc_value": "qacgywaaeacgwsui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547201": [
        {
            "ioc_value": "eckicmycacsyweuq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547202": [
        {
            "ioc_value": "qawswuuemewewogy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547203": [
        {
            "ioc_value": "qaayisgisqiwoyyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547204": [
        {
            "ioc_value": "ecuwqkimicseiyiu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547205": [
        {
            "ioc_value": "msgsyceagkigqyyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547206": [
        {
            "ioc_value": "ecquieawuiomewie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547207": [
        {
            "ioc_value": "owcqiuwskasiumie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547208": [
        {
            "ioc_value": "owiuommmacoeeqio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547209": [
        {
            "ioc_value": "qacukyscesougkqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547210": [
        {
            "ioc_value": "ggmoismguayiesgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547211": [
        {
            "ioc_value": "sekaggeoeqgksqam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547212": [
        {
            "ioc_value": "mskcgkcaeywqwsuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547213": [
        {
            "ioc_value": "ikumkccymyqycuqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547214": [
        {
            "ioc_value": "ggskckicsiikyouq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:22",
            "last_seen_utc": "2025-09-02 07:16:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547174": [
        {
            "ioc_value": "uiiuugwkkysmgikk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547175": [
        {
            "ioc_value": "ikyqwikagssekoga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547176": [
        {
            "ioc_value": "yqmmgeusgoomeayu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547177": [
        {
            "ioc_value": "uiaumiosegkkqako.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547178": [
        {
            "ioc_value": "wmqwqoogkmkyeoky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547179": [
        {
            "ioc_value": "ikekaoucieisqyqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547180": [
        {
            "ioc_value": "cycwsocumawoscci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547181": [
        {
            "ioc_value": "qaawagkequeogskq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547182": [
        {
            "ioc_value": "seekiqsowuqoyoci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547183": [
        {
            "ioc_value": "auoqkamiswowgaek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547184": [
        {
            "ioc_value": "auucqueoaywwiuwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547185": [
        {
            "ioc_value": "yqskukkumwwgawsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547186": [
        {
            "ioc_value": "yqcemysosmgkaggw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547187": [
        {
            "ioc_value": "ikeeigugagewmowa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547188": [
        {
            "ioc_value": "uiwuwagckysgwwqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547189": [
        {
            "ioc_value": "ecegaqikmowmygsg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547190": [
        {
            "ioc_value": "owiscagsagiogwek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547191": [
        {
            "ioc_value": "yqeskgauqccioywa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547192": [
        {
            "ioc_value": "cyoiqkqsmmycmwyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547193": [
        {
            "ioc_value": "yqycoaoqkgqciqoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:21",
            "last_seen_utc": "2025-09-02 07:16:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547156": [
        {
            "ioc_value": "kocgqcwsaymmoewk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547157": [
        {
            "ioc_value": "ikkukoywqcoyaagg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547158": [
        {
            "ioc_value": "ggcymcowqaqoescu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547159": [
        {
            "ioc_value": "uicwgookcuscgkms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547160": [
        {
            "ioc_value": "cyseoiuaaiykiwmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547161": [
        {
            "ioc_value": "ggygkksuukqmgiyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547162": [
        {
            "ioc_value": "msucccwwyomiwway.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547163": [
        {
            "ioc_value": "uicesyouiyakameg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547164": [
        {
            "ioc_value": "wmacymqgaiewoauc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547165": [
        {
            "ioc_value": "kocywcqmuusgwggq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547166": [
        {
            "ioc_value": "augumqcygiauwocs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547167": [
        {
            "ioc_value": "qacysgwucaccyqei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547168": [
        {
            "ioc_value": "ggueyewiiqgyeomo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547169": [
        {
            "ioc_value": "kogqkqkuysccekak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547170": [
        {
            "ioc_value": "owqogawmoiqsyskg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547171": [
        {
            "ioc_value": "msasyeumuucoesww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547172": [
        {
            "ioc_value": "cygykqquuacgwmyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547173": [
        {
            "ioc_value": "semmwgqakgwkeege.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:20",
            "last_seen_utc": "2025-09-02 07:16:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547138": [
        {
            "ioc_value": "ikuyeuumoqguqoeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547139": [
        {
            "ioc_value": "sesoawywmyaaqkaw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547140": [
        {
            "ioc_value": "wmkgyomqycqoukww.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547141": [
        {
            "ioc_value": "cyiwyquyywsksmce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547142": [
        {
            "ioc_value": "msugyaiomogmycmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547143": [
        {
            "ioc_value": "ecyeoqcqcgueygos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547144": [
        {
            "ioc_value": "wmoumoagwswgiyew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547145": [
        {
            "ioc_value": "owyoseymyaqgukck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547146": [
        {
            "ioc_value": "ecegkwoicuouggmg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547147": [
        {
            "ioc_value": "ecwcksuouacqqmow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547148": [
        {
            "ioc_value": "secwagkeiuyiomoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547149": [
        {
            "ioc_value": "kowccgucwiciccmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547150": [
        {
            "ioc_value": "cyouayuwgcskqsoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547151": [
        {
            "ioc_value": "seoaciwewoscamow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547152": [
        {
            "ioc_value": "ggigmaeykkawmmmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547153": [
        {
            "ioc_value": "secgsscwkomyqkya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547154": [
        {
            "ioc_value": "owogosaeyiysocqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547155": [
        {
            "ioc_value": "cywacawqqeuwcegq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:19",
            "last_seen_utc": "2025-09-02 07:16:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547120": [
        {
            "ioc_value": "koakwsgkuqemigqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547121": [
        {
            "ioc_value": "cyaawqokgouimsye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547122": [
        {
            "ioc_value": "wmweeawqmgwikmym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547123": [
        {
            "ioc_value": "auqqcymcsmyukmeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547124": [
        {
            "ioc_value": "yqqcqsucyccwkowq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547125": [
        {
            "ioc_value": "auweooaagqoomawe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547126": [
        {
            "ioc_value": "msueomusoygqsewy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547127": [
        {
            "ioc_value": "owayaiwuwyeuycge.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547128": [
        {
            "ioc_value": "seqsoqwcwewumgqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547129": [
        {
            "ioc_value": "qamseowgiyyiayec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547130": [
        {
            "ioc_value": "wmeyomycysswmkyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547131": [
        {
            "ioc_value": "ggqsgismukgcmsyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547132": [
        {
            "ioc_value": "yqmeamqqmoqkqcui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547133": [
        {
            "ioc_value": "wmkmuagcwcegcqqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547134": [
        {
            "ioc_value": "semqsqyaycggmyce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547135": [
        {
            "ioc_value": "owiyismoqwcciyeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547136": [
        {
            "ioc_value": "qaoqemmmauiqgoky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547137": [
        {
            "ioc_value": "ikeoemcwcwgmeyiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:18",
            "last_seen_utc": "2025-09-02 07:16:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547102": [
        {
            "ioc_value": "uickmweoawqmqaim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547103": [
        {
            "ioc_value": "uikaoeusmgccqgim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547104": [
        {
            "ioc_value": "ikicyckyqausiowy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547105": [
        {
            "ioc_value": "ggyemokcqgugwwou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547106": [
        {
            "ioc_value": "qasyoimgouiweqmo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547107": [
        {
            "ioc_value": "ikcgeqgesqusamem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547108": [
        {
            "ioc_value": "yqakqyocsseggwec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547109": [
        {
            "ioc_value": "owcmamosgmskiucm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547110": [
        {
            "ioc_value": "auwkgsyauksimumi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547111": [
        {
            "ioc_value": "wmoswgaiwmwigoqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547112": [
        {
            "ioc_value": "uioqwkiassmocwwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547113": [
        {
            "ioc_value": "qawqasgsoeumcyuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547114": [
        {
            "ioc_value": "secsgsekoccmayms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547115": [
        {
            "ioc_value": "ecuqcquyquksggau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547116": [
        {
            "ioc_value": "cygekeqaoucoycms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547117": [
        {
            "ioc_value": "cykakeoqggkwyqyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547118": [
        {
            "ioc_value": "ikcooouygagqcuss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547119": [
        {
            "ioc_value": "ggawiogocsqgkgqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:17",
            "last_seen_utc": "2025-09-02 07:16:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547083": [
        {
            "ioc_value": "yqweqsemasuyguci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547084": [
        {
            "ioc_value": "ggmyqiqgicmoyycs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547085": [
        {
            "ioc_value": "eciiuyesaiuakseg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547086": [
        {
            "ioc_value": "wmqyecgwiumqcsse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547087": [
        {
            "ioc_value": "wmukkqkgwysumwqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547088": [
        {
            "ioc_value": "koumsuwiqkmykciw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547089": [
        {
            "ioc_value": "wmkucsycgugsiyuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547090": [
        {
            "ioc_value": "owmsgiwcoiocyusu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547091": [
        {
            "ioc_value": "ecmgykqueeycqemq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547092": [
        {
            "ioc_value": "seyiiyaoyiycmyak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547093": [
        {
            "ioc_value": "wmwesakceuwmksye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547094": [
        {
            "ioc_value": "auaeqseeamssgsgq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547095": [
        {
            "ioc_value": "qawcoommaqusyuca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547096": [
        {
            "ioc_value": "qagwsqsqyggmuwcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547097": [
        {
            "ioc_value": "qagqmqccqsisykeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547098": [
        {
            "ioc_value": "msowmikmwecgssow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547099": [
        {
            "ioc_value": "ggamsiwyugsegkqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547100": [
        {
            "ioc_value": "uikuiwuewmwakcoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547101": [
        {
            "ioc_value": "seqmayiqwqkoqsco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:16",
            "last_seen_utc": "2025-09-02 07:16:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547061": [
        {
            "ioc_value": "qaiamqueocmweisu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547062": [
        {
            "ioc_value": "seageyigwymammas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547063": [
        {
            "ioc_value": "aukwgoseewqykmki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547064": [
        {
            "ioc_value": "ecsiasqwqcgkuaoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547065": [
        {
            "ioc_value": "owcyomyeaocycygs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547066": [
        {
            "ioc_value": "ecwowwywmguymwss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547067": [
        {
            "ioc_value": "auugygicuiiwkiwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547068": [
        {
            "ioc_value": "cyqiqiaegqygyuws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547069": [
        {
            "ioc_value": "ggaiuequoaksgwks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547070": [
        {
            "ioc_value": "ecommiaeeqmsscgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547071": [
        {
            "ioc_value": "ggyeiuqoseckkmoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547072": [
        {
            "ioc_value": "wmgsoukmcqsooacs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547073": [
        {
            "ioc_value": "owqsqaqusuuyiqwc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547074": [
        {
            "ioc_value": "uiaiewgqikokokqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547075": [
        {
            "ioc_value": "ecccuukckqaeiyau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547076": [
        {
            "ioc_value": "uimueqaeymyqiaec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547077": [
        {
            "ioc_value": "qakaceaagkmocsyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547078": [
        {
            "ioc_value": "uicygqygaciigkuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547079": [
        {
            "ioc_value": "msaayqucqeucsgko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547080": [
        {
            "ioc_value": "cysuiwayyokwiwio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547081": [
        {
            "ioc_value": "yqeucsgcsawgcqyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547082": [
        {
            "ioc_value": "ikiiwckskygewocs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:15",
            "last_seen_utc": "2025-09-02 07:16:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547041": [
        {
            "ioc_value": "yqgsmueyamgcqqqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547042": [
        {
            "ioc_value": "yqwukgcmagmiwuga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547043": [
        {
            "ioc_value": "qakauukqgaaksuue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547044": [
        {
            "ioc_value": "qaisikimqsmemcsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547045": [
        {
            "ioc_value": "yqocowmkaekkwiqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547046": [
        {
            "ioc_value": "owkwyamamqciouui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547047": [
        {
            "ioc_value": "auceswgcocieqiui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547048": [
        {
            "ioc_value": "secaiwguaaskgeyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547049": [
        {
            "ioc_value": "seqgiuygikoqauye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547050": [
        {
            "ioc_value": "iksmcywgcqwgskmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547051": [
        {
            "ioc_value": "owosmkgyesiamkky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547052": [
        {
            "ioc_value": "ikyuaawekmyiuaoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547053": [
        {
            "ioc_value": "ecsqyqigeqkgicyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547054": [
        {
            "ioc_value": "cykkggwegweoswya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547055": [
        {
            "ioc_value": "ggueuomoqcukeoei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547056": [
        {
            "ioc_value": "cyggqkoygeuggksg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547057": [
        {
            "ioc_value": "auqeekskcywuqoqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547058": [
        {
            "ioc_value": "yqukawuoqaegamag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547059": [
        {
            "ioc_value": "seosiyumyeysiisq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547060": [
        {
            "ioc_value": "ecouwkcsmosooqkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:14",
            "last_seen_utc": "2025-09-02 07:16:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547020": [
        {
            "ioc_value": "uiqcqqgyqocoywya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547021": [
        {
            "ioc_value": "auukgwyowysuowuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547022": [
        {
            "ioc_value": "segesuwyuacaugum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547023": [
        {
            "ioc_value": "yqycawmeugwcemgk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547024": [
        {
            "ioc_value": "msysouiagwiusyke.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547025": [
        {
            "ioc_value": "ggeqwqiseyumuayo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547026": [
        {
            "ioc_value": "msuusmiuykqwmcqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547027": [
        {
            "ioc_value": "ggukeicewaugcgos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547028": [
        {
            "ioc_value": "qawmcgkyygkyaamo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547029": [
        {
            "ioc_value": "uiecmyewyowqeuoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547030": [
        {
            "ioc_value": "koiigaukmemsgcko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547031": [
        {
            "ioc_value": "wmgwsmyciosewmmq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547032": [
        {
            "ioc_value": "uiqisqyuikcsmkam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547033": [
        {
            "ioc_value": "wmkiaeimwsscoegs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547034": [
        {
            "ioc_value": "seuwyiacaacmkkga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547035": [
        {
            "ioc_value": "yqeiomwceciiqsqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547036": [
        {
            "ioc_value": "uikoosyguissumsu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547037": [
        {
            "ioc_value": "cymsgowgaqaymwug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547038": [
        {
            "ioc_value": "yqeokqsuugcmssgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547039": [
        {
            "ioc_value": "uieicqeyagqmeokc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547040": [
        {
            "ioc_value": "mseqwiwkgysokmea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:13",
            "last_seen_utc": "2025-09-02 07:16:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547000": [
        {
            "ioc_value": "msauiuywimcawcso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547001": [
        {
            "ioc_value": "seieuosmaygwcoia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547002": [
        {
            "ioc_value": "kokomyqwmaeygqmy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547003": [
        {
            "ioc_value": "wmwiqymcgaammacm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547004": [
        {
            "ioc_value": "wmewmaicweyiyase.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547005": [
        {
            "ioc_value": "kowaokmwuoacsawg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547006": [
        {
            "ioc_value": "seiqgosauykkuugq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547007": [
        {
            "ioc_value": "eccuwsmcmwkeuwik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547008": [
        {
            "ioc_value": "kowicqokeyugmwmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547009": [
        {
            "ioc_value": "auomwkqeakwmkoee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547010": [
        {
            "ioc_value": "qauimiwmssummsoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547011": [
        {
            "ioc_value": "ikcmcecouqkakgyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547012": [
        {
            "ioc_value": "eceokoqguigskeqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547013": [
        {
            "ioc_value": "auogooaauggcmeow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547014": [
        {
            "ioc_value": "ikqaioeiycaeeueg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547015": [
        {
            "ioc_value": "mscikgucqwgaweku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547016": [
        {
            "ioc_value": "auquoscuuukqoqma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547017": [
        {
            "ioc_value": "uigwmikcawimymgg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547018": [
        {
            "ioc_value": "cyeawoysugiaqyom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1547019": [
        {
            "ioc_value": "qawackgskqewyook.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:12",
            "last_seen_utc": "2025-09-02 07:16:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546981": [
        {
            "ioc_value": "komwskyuqcomecck.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546982": [
        {
            "ioc_value": "eciowskgaaymcwgo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546983": [
        {
            "ioc_value": "wmkmweqsoiouoyss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546984": [
        {
            "ioc_value": "ecgqseqeiokcigeg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546985": [
        {
            "ioc_value": "owqmmoekucisgmwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546986": [
        {
            "ioc_value": "yqeymsisyakkmqqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546987": [
        {
            "ioc_value": "owsiemmkoiismqya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546988": [
        {
            "ioc_value": "kokqcwoqwaeygeoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546989": [
        {
            "ioc_value": "owswkcoeqmoiegcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546990": [
        {
            "ioc_value": "msioiwymcaymuqka.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546991": [
        {
            "ioc_value": "qacockcumkkmiagg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546992": [
        {
            "ioc_value": "uiwmwwoemqqkcykg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546993": [
        {
            "ioc_value": "ikaiqqgkqusuwwws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546994": [
        {
            "ioc_value": "gguaoocqyeoameuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546995": [
        {
            "ioc_value": "ggcqikwwigmoqwia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546996": [
        {
            "ioc_value": "uimuuossgmeaweoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546997": [
        {
            "ioc_value": "wmuiqyakcwimkuac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546998": [
        {
            "ioc_value": "semoiauwagyokyee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546999": [
        {
            "ioc_value": "auoammicgogekiew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:11",
            "last_seen_utc": "2025-09-02 07:16:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546961": [
        {
            "ioc_value": "owiayuooyayogqws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546962": [
        {
            "ioc_value": "ikyccogamuwoymwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546963": [
        {
            "ioc_value": "koasocmmmgokmcey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546964": [
        {
            "ioc_value": "uieisecegsksqyoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546965": [
        {
            "ioc_value": "msawoaoisacweego.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546966": [
        {
            "ioc_value": "aumiwkowmaaoiami.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546967": [
        {
            "ioc_value": "mseagaosyaimgame.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546968": [
        {
            "ioc_value": "ikyiwwqakceeuwuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546969": [
        {
            "ioc_value": "auemcwccamsacmai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:02",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546970": [
        {
            "ioc_value": "kocgywuqqyimumao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:02",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546971": [
        {
            "ioc_value": "segqcyowwymgwoow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:02",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546972": [
        {
            "ioc_value": "qaikmsgkuyuaoqai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546973": [
        {
            "ioc_value": "uiykcqeoeeismuou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546974": [
        {
            "ioc_value": "uiowkmaecaekqusw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546975": [
        {
            "ioc_value": "seoocgmcqyskckuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546976": [
        {
            "ioc_value": "qaeuceawkioqsomu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546977": [
        {
            "ioc_value": "wmuayiiukwimekkq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546978": [
        {
            "ioc_value": "ecswoesookogkmas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546979": [
        {
            "ioc_value": "kosqwsosqiwyqgoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546980": [
        {
            "ioc_value": "msoqiqqymwskkaca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:10",
            "last_seen_utc": "2025-09-02 07:16:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546941": [
        {
            "ioc_value": "kommekugekyyquia.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546942": [
        {
            "ioc_value": "cyaomscumauieeym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546943": [
        {
            "ioc_value": "koykyawgckeykake.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546944": [
        {
            "ioc_value": "ausgqskwwwumqamw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546945": [
        {
            "ioc_value": "auywcgkmauggukya.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546946": [
        {
            "ioc_value": "owwamioagkemuqsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546947": [
        {
            "ioc_value": "ggywgowqiegumqwq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546948": [
        {
            "ioc_value": "msakawaekgqawcqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546949": [
        {
            "ioc_value": "uisucmmuusckgaaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546950": [
        {
            "ioc_value": "koywowqsmuamqkyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546951": [
        {
            "ioc_value": "uiioukuqykquemou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546952": [
        {
            "ioc_value": "uiwwsaaqomokcgsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546953": [
        {
            "ioc_value": "msewwycmewqquwkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546954": [
        {
            "ioc_value": "ggmgkmgcicksiiso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546955": [
        {
            "ioc_value": "seogkaogaywumqeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546956": [
        {
            "ioc_value": "ikgyycmwquceigao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546957": [
        {
            "ioc_value": "msgkymqoyykwckks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546958": [
        {
            "ioc_value": "ikawuaookcioukss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546959": [
        {
            "ioc_value": "qayugcoigwekmqcu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546960": [
        {
            "ioc_value": "ggwiyoacqquoaasq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:09",
            "last_seen_utc": "2025-09-02 07:15:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546920": [
        {
            "ioc_value": "yqcswmawswouecyk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546921": [
        {
            "ioc_value": "uieaosguwwqgkqwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546922": [
        {
            "ioc_value": "yqskkegqcsyqyquc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546923": [
        {
            "ioc_value": "ecqkscmwqmywckoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546924": [
        {
            "ioc_value": "auowymgooaqicqee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546925": [
        {
            "ioc_value": "yqygmgsaoqoagsow.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546926": [
        {
            "ioc_value": "yqyksoeasuscwemw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546927": [
        {
            "ioc_value": "ikcqeomayyoqyaok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546928": [
        {
            "ioc_value": "auuyqkeqcmgwiqog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546929": [
        {
            "ioc_value": "yqqwkaoucqsgiuum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546930": [
        {
            "ioc_value": "ggoucggiwiqoyqac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546931": [
        {
            "ioc_value": "mscwmumgewyycocm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546932": [
        {
            "ioc_value": "auqiyucmsaqeyumq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546933": [
        {
            "ioc_value": "qacaucqkmmcegeuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546934": [
        {
            "ioc_value": "seaoqwgqamekiqso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546935": [
        {
            "ioc_value": "eciogaqwaoaccwqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546936": [
        {
            "ioc_value": "ecikgmyukkqwwsem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546937": [
        {
            "ioc_value": "ggseqwoswkqiuswa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546938": [
        {
            "ioc_value": "koesqakmakggagcc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546939": [
        {
            "ioc_value": "ggqicsmigcoksggc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546940": [
        {
            "ioc_value": "ggwuegysawiqimkm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:08",
            "last_seen_utc": "2025-09-02 07:15:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546899": [
        {
            "ioc_value": "mseiyuqesmymceiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546900": [
        {
            "ioc_value": "wmsqocycagmkekie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546901": [
        {
            "ioc_value": "kowqoguwiswoiqgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546902": [
        {
            "ioc_value": "cyagckskqmauuiac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546903": [
        {
            "ioc_value": "owcoagmykssoqwkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546904": [
        {
            "ioc_value": "owquweigqoaycisu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546905": [
        {
            "ioc_value": "yqqysocimqkosieu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546906": [
        {
            "ioc_value": "ikyukiuosgaouasi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546907": [
        {
            "ioc_value": "ggeqegcooeaqkwem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546908": [
        {
            "ioc_value": "kogosmckqoucmmes.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546909": [
        {
            "ioc_value": "wmewomccogkcyaac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546910": [
        {
            "ioc_value": "cywsmwgiyymswwyg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546911": [
        {
            "ioc_value": "ecyyqmumkgsasaue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546912": [
        {
            "ioc_value": "koyckmwukewgkwwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546913": [
        {
            "ioc_value": "iksekiowycowkeos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546914": [
        {
            "ioc_value": "uioqgyqosygmcciq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546915": [
        {
            "ioc_value": "ggqwcamieoukaeoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546916": [
        {
            "ioc_value": "kowuscwwksacokmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546917": [
        {
            "ioc_value": "mscqswiuwmggkmkk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546918": [
        {
            "ioc_value": "yqgqcowukyqusmkw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546919": [
        {
            "ioc_value": "aukkyegsaacqecgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:07",
            "last_seen_utc": "2025-09-02 07:15:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546877": [
        {
            "ioc_value": "wmksawuyakiuqicc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546878": [
        {
            "ioc_value": "wmaoikouwqyeesag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546879": [
        {
            "ioc_value": "auaeyguaeqiqqugw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546880": [
        {
            "ioc_value": "yqwgmekaykaiesgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546881": [
        {
            "ioc_value": "ikikyewaswwqewaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546882": [
        {
            "ioc_value": "sewqcgguoqkusuau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546883": [
        {
            "ioc_value": "owicycyoouimkwks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546884": [
        {
            "ioc_value": "cyoguquyesmaosgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546885": [
        {
            "ioc_value": "owsswcgemuacsqug.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546886": [
        {
            "ioc_value": "seqsuwgaqiaciosq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546887": [
        {
            "ioc_value": "auimygqqasaquouw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546888": [
        {
            "ioc_value": "ggmiwimyqookasee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546889": [
        {
            "ioc_value": "semiakqaiewcsugw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546890": [
        {
            "ioc_value": "uimcwwskckaiysea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546891": [
        {
            "ioc_value": "yqkmeggiiaqkuoea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546892": [
        {
            "ioc_value": "yqswsyeiqksaegso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546893": [
        {
            "ioc_value": "ikscmsmuyuagmyci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546894": [
        {
            "ioc_value": "ikcscsuceoiqmagm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546895": [
        {
            "ioc_value": "auquceuoacasgwsu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546896": [
        {
            "ioc_value": "msuoeoaqycymogus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546897": [
        {
            "ioc_value": "qakeugwcmiiwosec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546898": [
        {
            "ioc_value": "mseemwqoiwkccegc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:06",
            "last_seen_utc": "2025-09-02 07:15:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546855": [
        {
            "ioc_value": "wmgwoseeaumukqeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546856": [
        {
            "ioc_value": "ggiokaewcccqckgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546857": [
        {
            "ioc_value": "ggasukmasageyyeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546858": [
        {
            "ioc_value": "yqawqisoqskoomeo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546859": [
        {
            "ioc_value": "uieweysaukysksku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546860": [
        {
            "ioc_value": "auouciaaogaswwig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546861": [
        {
            "ioc_value": "seyocmcgwkeguiws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546862": [
        {
            "ioc_value": "seywsceiimmosaao.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546863": [
        {
            "ioc_value": "ikcukgeaqkmkcuku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546864": [
        {
            "ioc_value": "cykogmayuqegukcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546865": [
        {
            "ioc_value": "auemaymqmgygkyay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546866": [
        {
            "ioc_value": "ggaecesamimegqko.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546867": [
        {
            "ioc_value": "ikimaioegaaoeqqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546868": [
        {
            "ioc_value": "seqyiesukysygyim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546869": [
        {
            "ioc_value": "wmwomuyosmymyeou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546870": [
        {
            "ioc_value": "koiiaioocmmecsci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546871": [
        {
            "ioc_value": "uigaueigekmawees.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546872": [
        {
            "ioc_value": "segmgaqgwqemkywo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546873": [
        {
            "ioc_value": "yqgayqwukckgyyeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546874": [
        {
            "ioc_value": "mskaaiukkeygmweu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546875": [
        {
            "ioc_value": "ecogeomcggkumqyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546876": [
        {
            "ioc_value": "yqmqscwcioiiaeok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:05",
            "last_seen_utc": "2025-09-02 07:15:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546836": [
        {
            "ioc_value": "mskwacceycsekaog.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546837": [
        {
            "ioc_value": "uiumcewksakmwswi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546838": [
        {
            "ioc_value": "cyacuowosaaksoac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546839": [
        {
            "ioc_value": "uiswaiymekioasek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546840": [
        {
            "ioc_value": "msyoockwiouokiuo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546841": [
        {
            "ioc_value": "ikykagquyweaaack.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546842": [
        {
            "ioc_value": "auqyemeqeawocsac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546843": [
        {
            "ioc_value": "ecisykaiegcwmgkc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546844": [
        {
            "ioc_value": "ecmqimuumosieeqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546845": [
        {
            "ioc_value": "yqskasuyoougowuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546846": [
        {
            "ioc_value": "auyeuikqmamemgaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546847": [
        {
            "ioc_value": "seugausmgwemumum.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546848": [
        {
            "ioc_value": "ecgeawiyseswuigc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546849": [
        {
            "ioc_value": "uisgwqkauemsseoo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546850": [
        {
            "ioc_value": "eckgigmicqwyascm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546851": [
        {
            "ioc_value": "msmsqiiwwoaiwwce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546852": [
        {
            "ioc_value": "auywyiaeucyiaigm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546853": [
        {
            "ioc_value": "eciqwykmwcqqucss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546854": [
        {
            "ioc_value": "kokycmggkcswkksc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:04",
            "last_seen_utc": "2025-09-02 07:15:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546815": [
        {
            "ioc_value": "seiowkmcacqcgmuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546816": [
        {
            "ioc_value": "owkwwguiikgwyqoe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546817": [
        {
            "ioc_value": "ikecqyaasemakoms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:27",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546818": [
        {
            "ioc_value": "ikomoeqqoqgioceu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546819": [
        {
            "ioc_value": "uimeakwuwqyygago.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546820": [
        {
            "ioc_value": "cyiomywawociquwe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:28",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546821": [
        {
            "ioc_value": "yqcycsgmaauocmuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546822": [
        {
            "ioc_value": "yqyosgcgosayaoci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546823": [
        {
            "ioc_value": "ikimsekeemymkequ.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546824": [
        {
            "ioc_value": "mswuaceemmccoouo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:29",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546825": [
        {
            "ioc_value": "ikmuwuykksyqwueg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546826": [
        {
            "ioc_value": "cyuwkyyiougeaeim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546827": [
        {
            "ioc_value": "cywseuyuakswmsee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:30",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546828": [
        {
            "ioc_value": "qaykycaeuscekuey.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546829": [
        {
            "ioc_value": "ggiieekugsuiucgc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546830": [
        {
            "ioc_value": "ecuiusmquioackgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:31",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546831": [
        {
            "ioc_value": "ggaemimuwqowkqio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546832": [
        {
            "ioc_value": "ikgmkymwgaucymks.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:32",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546833": [
        {
            "ioc_value": "kosgmwomikakekce.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546834": [
        {
            "ioc_value": "ggiqyqkeukguqqgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546835": [
        {
            "ioc_value": "ikescisuaoqsumek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:03",
            "last_seen_utc": "2025-09-02 07:15:33",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546805": [
        {
            "ioc_value": "msswwwkouiwgoqws.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546806": [
        {
            "ioc_value": "wmwaaukyqiyuiksc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546807": [
        {
            "ioc_value": "koquwsykwgwoyywg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546808": [
        {
            "ioc_value": "yqqqssmsceuckwua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546809": [
        {
            "ioc_value": "auoyqsyaasymoiyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546810": [
        {
            "ioc_value": "ikcqwasemekemyoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546811": [
        {
            "ioc_value": "owakcmcaeuysawuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:25",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546812": [
        {
            "ioc_value": "ecsuywwcwkeqeoic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546813": [
        {
            "ioc_value": "wmocsqsayeqakwsi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546814": [
        {
            "ioc_value": "wmgswcmagqosogqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:02",
            "last_seen_utc": "2025-09-02 07:15:26",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546802": [
        {
            "ioc_value": "yqgmkuessouomkmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:01",
            "last_seen_utc": "2025-09-02 07:15:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546803": [
        {
            "ioc_value": "uiuomimyccmyiiym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:01",
            "last_seen_utc": "2025-09-02 07:15:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546804": [
        {
            "ioc_value": "cymoaswmwkioqkmc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:01",
            "last_seen_utc": "2025-09-02 07:15:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546784": [
        {
            "ioc_value": "ecmigwokawqsmsuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546785": [
        {
            "ioc_value": "qawuaoqoscweqyoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546786": [
        {
            "ioc_value": "segikwgecuociaok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546787": [
        {
            "ioc_value": "uicqwcqqquqsgssw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546788": [
        {
            "ioc_value": "koiucqyoeyoqqeqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546789": [
        {
            "ioc_value": "yqmwkgaiagikayui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:20",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546790": [
        {
            "ioc_value": "auqagociykymqqwu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546791": [
        {
            "ioc_value": "owwkiccecycqsyyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546792": [
        {
            "ioc_value": "owgycuoaqagyqaqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:21",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546793": [
        {
            "ioc_value": "uiosmusuociuasgw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546794": [
        {
            "ioc_value": "seaimgocuaseswom.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546795": [
        {
            "ioc_value": "eccwoymeksqsucma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546796": [
        {
            "ioc_value": "owuoqguoaakiyesg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546797": [
        {
            "ioc_value": "kowmsegiikyesmsy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:22",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546798": [
        {
            "ioc_value": "wmouqukogoyyecsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546799": [
        {
            "ioc_value": "owakykgsqoiiiwye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546800": [
        {
            "ioc_value": "auoyoaueusgwemku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546801": [
        {
            "ioc_value": "mseakgkcmqaeiius.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:23:00",
            "last_seen_utc": "2025-09-02 07:15:23",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546766": [
        {
            "ioc_value": "yswiiuwaycsuseec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546767": [
        {
            "ioc_value": "ukcisqqqwsicecgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546768": [
        {
            "ioc_value": "qcmwsymemegioyas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546769": [
        {
            "ioc_value": "muuycekwgguugqas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546770": [
        {
            "ioc_value": "ukscuwcwegeuyuse.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546771": [
        {
            "ioc_value": "womueyugmuoagkwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:16",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546772": [
        {
            "ioc_value": "ysqeuqmyqowgcqgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546773": [
        {
            "ioc_value": "sgayugmuquawiewc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546774": [
        {
            "ioc_value": "awksguwwiueowqms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546775": [
        {
            "ioc_value": "gieammkkkcqecyos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:17",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546776": [
        {
            "ioc_value": "yscosiucguiucsqg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546777": [
        {
            "ioc_value": "qcqqkeogswuaecgu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546778": [
        {
            "ioc_value": "oywakkqkauoquimc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546779": [
        {
            "ioc_value": "eegwiiosqasqwqwy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546780": [
        {
            "ioc_value": "kowqwekcioyaioiw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:18",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546781": [
        {
            "ioc_value": "cysaawueeqeaaaio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546782": [
        {
            "ioc_value": "wmiwcekweyeaugmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546783": [
        {
            "ioc_value": "yqumyeogoyaewqay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:59",
            "last_seen_utc": "2025-09-02 07:15:19",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546746": [
        {
            "ioc_value": "eeosqkouiigwouqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546747": [
        {
            "ioc_value": "qcwqgyqokgqmoaeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546748": [
        {
            "ioc_value": "caeeicqiggwsuouy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546749": [
        {
            "ioc_value": "woyckqgqqgoagegi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546750": [
        {
            "ioc_value": "awwaiugyskuasuee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546751": [
        {
            "ioc_value": "ysecuagimeksayss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546752": [
        {
            "ioc_value": "sgggwecisuuqeiaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546753": [
        {
            "ioc_value": "qcusokiammqmwcwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546754": [
        {
            "ioc_value": "imycwyuiqsooqcak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546755": [
        {
            "ioc_value": "womwgikmeqekmqus.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546756": [
        {
            "ioc_value": "imiecsccyyeqyguo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546757": [
        {
            "ioc_value": "oysgusyeaeiocqak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546758": [
        {
            "ioc_value": "ysaeciuuqmkmewmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:13",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546759": [
        {
            "ioc_value": "muekacwssaeoyguw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546760": [
        {
            "ioc_value": "awgycweokwcqgsak.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546761": [
        {
            "ioc_value": "imsqcumyqqamooqy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546762": [
        {
            "ioc_value": "oyeemomgumceceki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546763": [
        {
            "ioc_value": "gieyqyucscmwowsk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:14",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546764": [
        {
            "ioc_value": "imqmsiqqcygksiem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546765": [
        {
            "ioc_value": "eeeycgyqcokecsgi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:58",
            "last_seen_utc": "2025-09-02 07:15:15",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546729": [
        {
            "ioc_value": "giaawugasyagguwg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546730": [
        {
            "ioc_value": "sgmoamscgwagiyyc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546731": [
        {
            "ioc_value": "awwwskqccmkisuis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546732": [
        {
            "ioc_value": "woumggqcoagscouu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546733": [
        {
            "ioc_value": "qcqmiawqqwiakccu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546734": [
        {
            "ioc_value": "mucsoooqoyoyiesc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:08",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546735": [
        {
            "ioc_value": "ukgoeuoqguwuokmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546736": [
        {
            "ioc_value": "kqmykwuqisykmuoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546737": [
        {
            "ioc_value": "giosyaoeqsuueyiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546738": [
        {
            "ioc_value": "mukwyeguammcigwi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546739": [
        {
            "ioc_value": "imqgwemwksosecuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:09",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546740": [
        {
            "ioc_value": "giykgsssuyiwimew.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546741": [
        {
            "ioc_value": "cacmsgwoeggsiuig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546742": [
        {
            "ioc_value": "ysiuyaikgiawcecu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546743": [
        {
            "ioc_value": "ysyucsogesqaukqi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546744": [
        {
            "ioc_value": "wocscyoaiiqquasu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:10",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546745": [
        {
            "ioc_value": "ysgqokmosagcumee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:57",
            "last_seen_utc": "2025-09-02 07:15:11",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546711": [
        {
            "ioc_value": "ukosockioyewgswo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546712": [
        {
            "ioc_value": "ukiksmaagkkceiig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546713": [
        {
            "ioc_value": "giquocioggkwqaoq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546714": [
        {
            "ioc_value": "kqmosuuaiwiywyua.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546715": [
        {
            "ioc_value": "muaiieqqaskmwegy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546716": [
        {
            "ioc_value": "awmqsywowuiwwmgm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:01",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546717": [
        {
            "ioc_value": "giimccimceouessg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:02",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546718": [
        {
            "ioc_value": "ysqkmgukeqigauye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546719": [
        {
            "ioc_value": "gicwicycgiikuyuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:03",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546720": [
        {
            "ioc_value": "yscyamekiqmqskau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546721": [
        {
            "ioc_value": "gisqagccauqaiiga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:04",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546722": [
        {
            "ioc_value": "yswcqyeyqcmwwkme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546723": [
        {
            "ioc_value": "eeweeimmaykeqywe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546724": [
        {
            "ioc_value": "ysgyewskuacioisa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:05",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546725": [
        {
            "ioc_value": "eeggqwaaewkwuaau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546726": [
        {
            "ioc_value": "giuweqggkguuewku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546727": [
        {
            "ioc_value": "ukakcwauqigoycue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:06",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546728": [
        {
            "ioc_value": "kqekceisookmcqku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:56",
            "last_seen_utc": "2025-09-02 07:15:07",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546693": [
        {
            "ioc_value": "sgimgeisoeseekas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546694": [
        {
            "ioc_value": "awoymcqymwqcsumy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546695": [
        {
            "ioc_value": "giyggckouuyyuoki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546696": [
        {
            "ioc_value": "gicaaewcaacqcyyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546697": [
        {
            "ioc_value": "sguoicquikuuoaem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546698": [
        {
            "ioc_value": "eeesyquiqkokkaim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546699": [
        {
            "ioc_value": "musgmmaueymwamqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546700": [
        {
            "ioc_value": "ysieasgkeikacsei.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546701": [
        {
            "ioc_value": "cassqeomqaeskmem.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546702": [
        {
            "ioc_value": "imgskgqyywacsesi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546703": [
        {
            "ioc_value": "qcemqmkuuaqcqeqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546704": [
        {
            "ioc_value": "ukgeawouasmmayoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546705": [
        {
            "ioc_value": "sgmkcqkwyomuogqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:14:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546706": [
        {
            "ioc_value": "imqmyokaqimeuwcq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:15:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546707": [
        {
            "ioc_value": "uksiegyquakaocqo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:15:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546708": [
        {
            "ioc_value": "ukoywgwqkwguusmw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:15:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546709": [
        {
            "ioc_value": "giomaegcywcoemcs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:15:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546710": [
        {
            "ioc_value": "imcokqesykogqesk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:55",
            "last_seen_utc": "2025-09-02 07:15:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546674": [
        {
            "ioc_value": "sgaswwwaocaqcook.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546675": [
        {
            "ioc_value": "gimcmayskgsmiiyo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546676": [
        {
            "ioc_value": "ukmiwieeakkwyywc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546677": [
        {
            "ioc_value": "kqaqimsewemiyesu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546678": [
        {
            "ioc_value": "muyieiooowqoykqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546679": [
        {
            "ioc_value": "muccwskaiwuckyme.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546680": [
        {
            "ioc_value": "eecgyiqyowyaesuk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:55",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546681": [
        {
            "ioc_value": "oyeieqqogkcuiegq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546682": [
        {
            "ioc_value": "yswacseecmycgesy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546683": [
        {
            "ioc_value": "imacmqkaummwmecg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546684": [
        {
            "ioc_value": "ysuwcowskyqygcis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546685": [
        {
            "ioc_value": "ukukmowemowyqcau.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:56",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546686": [
        {
            "ioc_value": "awsosckykquecmco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546687": [
        {
            "ioc_value": "gicmcywuwuokqqci.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546688": [
        {
            "ioc_value": "wokogwmgggoayqsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546689": [
        {
            "ioc_value": "sgoeaeuoimeyuyca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546690": [
        {
            "ioc_value": "awyqekgcicqymgac.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546691": [
        {
            "ioc_value": "qciuoquceusoggga.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:57",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546692": [
        {
            "ioc_value": "oygoacckcawmmmoi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:54",
            "last_seen_utc": "2025-09-02 07:14:58",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546655": [
        {
            "ioc_value": "oysqqkwycocaymek.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546656": [
        {
            "ioc_value": "caaoogyeeyoeooui.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546657": [
        {
            "ioc_value": "cawykeouksacosym.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546658": [
        {
            "ioc_value": "imumcwooosmewguk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546659": [
        {
            "ioc_value": "gigekiwwigyyaquo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546660": [
        {
            "ioc_value": "qcisouqascmugigo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546661": [
        {
            "ioc_value": "imqwieuakecwaakq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:52",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546662": [
        {
            "ioc_value": "kqqqoaqcwukycwaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546663": [
        {
            "ioc_value": "caoqgcikyoqqycso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546664": [
        {
            "ioc_value": "gieywcuyswmyqsai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546665": [
        {
            "ioc_value": "cagkmiemqiukicki.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546666": [
        {
            "ioc_value": "sgmecokqomcackys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546667": [
        {
            "ioc_value": "oywmkekkkuwoymqs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:53",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546668": [
        {
            "ioc_value": "eeskkceaycsiuyae.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546669": [
        {
            "ioc_value": "woogeucoaikgscso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546670": [
        {
            "ioc_value": "giscwkssuwiyssss.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546671": [
        {
            "ioc_value": "mugswwqkuioeacok.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546672": [
        {
            "ioc_value": "eewseqsyysoakssc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546673": [
        {
            "ioc_value": "ysoquqeuckmaiggs.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:53",
            "last_seen_utc": "2025-09-02 07:14:54",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546637": [
        {
            "ioc_value": "eesegsmoyqyswiso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546638": [
        {
            "ioc_value": "muaousemuweagiys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546639": [
        {
            "ioc_value": "imqeyakykmqcysas.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546640": [
        {
            "ioc_value": "awakcysikkugkyyy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546641": [
        {
            "ioc_value": "ukyigkkaqoiisgam.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546642": [
        {
            "ioc_value": "wowqmeyquycssscy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546643": [
        {
            "ioc_value": "mucuqyksgyywseeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546644": [
        {
            "ioc_value": "awyouqwaeqyuaweu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546645": [
        {
            "ioc_value": "ysmwwycmmgekeggc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546646": [
        {
            "ioc_value": "oykaqgoegegkckma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546647": [
        {
            "ioc_value": "kqqgeoyygciqwmio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546648": [
        {
            "ioc_value": "sgmuummcwmmacwyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:50",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546649": [
        {
            "ioc_value": "gikwoaeauguwamis.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546650": [
        {
            "ioc_value": "sgswqoyqgguiomeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546651": [
        {
            "ioc_value": "ukoogcywiwskqase.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546652": [
        {
            "ioc_value": "oyokkocwwuckiuco.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546653": [
        {
            "ioc_value": "oyakaqycsseuykqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546654": [
        {
            "ioc_value": "oygagmioescwqwie.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:52",
            "last_seen_utc": "2025-09-02 07:14:51",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546619": [
        {
            "ioc_value": "eecyieouiamcewcy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546620": [
        {
            "ioc_value": "kqucqsuyaymauyoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546621": [
        {
            "ioc_value": "muueuugykmugewai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546622": [
        {
            "ioc_value": "eemiyagmgsoiecqm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546623": [
        {
            "ioc_value": "kqimymkogoewskuy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546624": [
        {
            "ioc_value": "sgmawugsiqkciuma.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546625": [
        {
            "ioc_value": "imqsggkiwmmakaio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546626": [
        {
            "ioc_value": "kquwawakyqucsiku.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546627": [
        {
            "ioc_value": "ukiuccscgwoqaekk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546628": [
        {
            "ioc_value": "caqiciwssaayguwk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546629": [
        {
            "ioc_value": "muckiqqcqosikemu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:47",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546630": [
        {
            "ioc_value": "qcqmyyeqwmuwaaqu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546631": [
        {
            "ioc_value": "cacmiyucaukeucic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546632": [
        {
            "ioc_value": "ukukuwgyyqyigueq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546633": [
        {
            "ioc_value": "kqqauykcwyuyowms.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546634": [
        {
            "ioc_value": "ukkuikuueauckcii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546635": [
        {
            "ioc_value": "gimmgqiyciskoseu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:48",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546636": [
        {
            "ioc_value": "awagyiegqqqoyosy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:51",
            "last_seen_utc": "2025-09-02 07:14:49",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546602": [
        {
            "ioc_value": "muociqiuscgueqsc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546603": [
        {
            "ioc_value": "womaayeyeeiagisq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546604": [
        {
            "ioc_value": "ukgmaiyekwswgisw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546605": [
        {
            "ioc_value": "oyuiqagwisgukkio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546606": [
        {
            "ioc_value": "oyigmqqksagagkky.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546607": [
        {
            "ioc_value": "sgwkommsmuaeeuwo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546608": [
        {
            "ioc_value": "awckkqwuwmaegecq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:44",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546609": [
        {
            "ioc_value": "kqaakmoomsewqoea.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546610": [
        {
            "ioc_value": "awawoeimwmgmycwm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546611": [
        {
            "ioc_value": "giguocqmqiqymwgy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546612": [
        {
            "ioc_value": "qcuayysomiyqmose.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546613": [
        {
            "ioc_value": "cagsmoqaskciyaik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546614": [
        {
            "ioc_value": "eeyywuscqocqagai.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546615": [
        {
            "ioc_value": "immkyqyeqgkiiasi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:45",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546616": [
        {
            "ioc_value": "muyuigamiomiumsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546617": [
        {
            "ioc_value": "ukgcqemksmkuawso.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546618": [
        {
            "ioc_value": "awoomgymcmwiyqca.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:50",
            "last_seen_utc": "2025-09-02 07:14:46",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546583": [
        {
            "ioc_value": "eeyakcmyouwcmema.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546584": [
        {
            "ioc_value": "mumauauiqeuiieyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546585": [
        {
            "ioc_value": "casissigigouaqeq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546586": [
        {
            "ioc_value": "oysugcscwmgikgcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546587": [
        {
            "ioc_value": "gicgsgqgukuyseio.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546588": [
        {
            "ioc_value": "qcuoquqcskioescg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:41",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546589": [
        {
            "ioc_value": "imguqssoouwukiii.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546590": [
        {
            "ioc_value": "caccmakookioeyaa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546591": [
        {
            "ioc_value": "oywaogcoiiycqygy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546592": [
        {
            "ioc_value": "kqyukeqqwwgeumsm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546593": [
        {
            "ioc_value": "giwguimyqkqmmeqw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546594": [
        {
            "ioc_value": "woacqcqgcaawkuqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:42",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546595": [
        {
            "ioc_value": "qcwecwsqkckgaigc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546596": [
        {
            "ioc_value": "qcocsgiiwuuosuqq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546597": [
        {
            "ioc_value": "mugawscgakeookkg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546598": [
        {
            "ioc_value": "oyssaeqmwamewaee.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546599": [
        {
            "ioc_value": "muuamguykggqmask.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546600": [
        {
            "ioc_value": "qcggccseayuauywe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546601": [
        {
            "ioc_value": "qcmgykmgmguuiamo.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:49",
            "last_seen_utc": "2025-09-02 07:14:43",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546563": [
        {
            "ioc_value": "caaomoewqmmgqeqc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546564": [
        {
            "ioc_value": "kqoimoyqaguswamk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546565": [
        {
            "ioc_value": "ysakcmqkguukkgyi.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546566": [
        {
            "ioc_value": "oycukcyoiyoeqeeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546567": [
        {
            "ioc_value": "imaokkyaoaamosik.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546568": [
        {
            "ioc_value": "ukmcsusyiieqeiuw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546569": [
        {
            "ioc_value": "uksauaeqwuuiiqay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546570": [
        {
            "ioc_value": "eeusgwoqywscsiag.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546571": [
        {
            "ioc_value": "oyeoeaiuuwygieic.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546572": [
        {
            "ioc_value": "oykuuosemywgissc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546573": [
        {
            "ioc_value": "mugucmwcoiskoskg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546574": [
        {
            "ioc_value": "ysicymuuyseocuou.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546575": [
        {
            "ioc_value": "ysmcceaeccgoemec.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546576": [
        {
            "ioc_value": "woeasmeeqggesicw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546577": [
        {
            "ioc_value": "eeqgkkocykuacgos.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546578": [
        {
            "ioc_value": "oywskesgisaogquc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546579": [
        {
            "ioc_value": "woaeqimqesaqawyw.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546580": [
        {
            "ioc_value": "sgqioucqgauwcgcg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546581": [
        {
            "ioc_value": "eegaymamwiegceoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546582": [
        {
            "ioc_value": "gieqqukuaqaumwys.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:48",
            "last_seen_utc": "2025-09-02 07:14:40",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546541": [
        {
            "ioc_value": "muaiyyeiqumymcig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546542": [
        {
            "ioc_value": "eeggckkocsqwuiqk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546543": [
        {
            "ioc_value": "imisymcqkskesawm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546544": [
        {
            "ioc_value": "muieiumumysiwuig.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546545": [
        {
            "ioc_value": "kqkyqgygcowwqiaq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546546": [
        {
            "ioc_value": "sgkuowicimuoeukm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546547": [
        {
            "ioc_value": "ukcwacqaqukgoguk.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546548": [
        {
            "ioc_value": "imkoumgakasgmieg.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546549": [
        {
            "ioc_value": "sgeauaswquoaiaeu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:35",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546550": [
        {
            "ioc_value": "qcweyayuwsqqigwa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546551": [
        {
            "ioc_value": "sgokaeocgmmwowoa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546552": [
        {
            "ioc_value": "oyasqqikeiscwgmu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546553": [
        {
            "ioc_value": "gigiwuckeocgwiye.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546554": [
        {
            "ioc_value": "imycsewieueessoc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546555": [
        {
            "ioc_value": "ysqiowcygggwywuc.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:36",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546556": [
        {
            "ioc_value": "ukaseqqusimmymqa.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546557": [
        {
            "ioc_value": "oyoqyssskmsqcsiq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546558": [
        {
            "ioc_value": "cawmgqsowyuecwqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546559": [
        {
            "ioc_value": "kqgiiseowsqsacim.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546560": [
        {
            "ioc_value": "wosqsieggiwommiy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546561": [
        {
            "ioc_value": "eesaiougqummqysm.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546562": [
        {
            "ioc_value": "ysgccwyqokkqcgue.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:47",
            "last_seen_utc": "2025-09-02 07:14:37",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546539": [
        {
            "ioc_value": "wommcquqegkcoeoy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:46",
            "last_seen_utc": "2025-09-02 07:14:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546540": [
        {
            "ioc_value": "oycukuoukasekkuu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.metastealer",
            "malware_alias": null,
            "malware_printable": "MetaStealer",
            "first_seen_utc": "2025-06-19 07:22:46",
            "last_seen_utc": "2025-09-02 07:14:34",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/e8185b17156f56d07e51573d63ae3060e1e8341555fe083ab1328609decdcc60/",
            "tags": "MetaStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546536": [
        {
            "ioc_value": "rockyx22.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-19 07:05:38",
            "last_seen_utc": "2025-09-22 14:43:24",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f5a8c8e7ae8328c7fc396423188c153fc6a9cfce132b1a5bb288086110fccfc7/",
            "tags": "QuasarRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546529": [
        {
            "ioc_value": "web.uisgfi.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-19 06:34:40",
            "last_seen_utc": "2025-06-19 06:34:40",
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546528": [
        {
            "ioc_value": "con.acml-sconnect-com.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-19 06:11:01",
            "last_seen_utc": "2025-06-19 06:11:02",
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546525": [
        {
            "ioc_value": "talktuahthehand-51875.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-19 05:59:25",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1546524": [
        {
            "ioc_value": "coolseagull-56786.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-19 05:59:24",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1546519": [
        {
            "ioc_value": "follow-solved.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-19 05:58:13",
            "last_seen_utc": "2025-06-28 22:25:39",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1546517": [
        {
            "ioc_value": "cstest250617.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-19 05:57:32",
            "last_seen_utc": "2025-09-20 07:48:25",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,cobaltstrike",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1546403": [
        {
            "ioc_value": "equidn.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-19 05:44:33",
            "last_seen_utc": "2025-06-26 13:24:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1546404": [
        {
            "ioc_value": "baviip.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-19 05:44:32",
            "last_seen_utc": "2025-06-26 13:24:57",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1546405": [
        {
            "ioc_value": "trqqe.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-19 05:44:32",
            "last_seen_utc": "2025-06-26 13:24:58",
            "confidence_level": 100,
            "reference": null,
            "tags": "c2,Lumma,Lumma Stealer,LummaStealer",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1546386": [
        {
            "ioc_value": "api.gameforlikaks.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-06-19 05:44:30",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.joesandbox.com/analysis/1703043#iocs",
            "tags": null,
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1546387": [
        {
            "ioc_value": "plotoraus.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2025-06-19 05:44:29",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.joesandbox.com/analysis/1703043#iocs",
            "tags": null,
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1546397": [
        {
            "ioc_value": "qnoeis.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-19 05:44:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1546396": [
        {
            "ioc_value": "security.fgleragusards.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-19 05:44:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1546373": [
        {
            "ioc_value": "b1.freshtug.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2025-06-19 05:44:17",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://bazaar.abuse.ch/browse/tag/ACRStealer/",
            "tags": "ACRStealer",
            "anonymous": "0",
            "reporter": "aachum"
        }
    ],
    "1546437": [
        {
            "ioc_value": "namadistribution.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nimplant",
            "malware_alias": null,
            "malware_printable": "Nimplant",
            "first_seen_utc": "2025-06-19 04:00:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/139.84.142.56+namadistribution.com",
            "tags": "AS-VULTR,AS20473,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1546425": [
        {
            "ioc_value": "guce.newservicedotup.de",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-19 00:03:04",
            "last_seen_utc": "2025-06-19 04:01:05",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/207.174.43.10+guce.newservicedotup.de",
            "tags": "AS1002,BYTEFILTER-AS,censys,EvilGinx,panel,Phishing",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546358": [
        {
            "ioc_value": "yj233.e1.luyouxia.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-06-18 18:11:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250618-c2yhasgp8v",
            "tags": "c2,domain,rat,RevengeRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546359": [
        {
            "ioc_value": "yukselofficial.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-06-18 18:11:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250618-c2yhasgp8v",
            "tags": "c2,domain,rat,RevengeRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546356": [
        {
            "ioc_value": "shnf-47787.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-06-18 18:08:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250618-c2yhasgp8v",
            "tags": "c2,domain,RAT,RevengeRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546355": [
        {
            "ioc_value": "cocohack.dtdns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-06-18 18:07:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250618-c2yhasgp8v",
            "tags": "c2,domain,RAT,RevengeRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546354": [
        {
            "ioc_value": "unit-sap.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-18 18:06:33",
            "last_seen_utc": "2025-06-28 22:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250618-ga87yahr41",
            "tags": "AsyncRAT,c2,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546351": [
        {
            "ioc_value": "winter-criminal.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-18 18:00:24",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250618-v2h2qatxhw",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546348": [
        {
            "ioc_value": "arvnd.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.crimson",
            "malware_alias": "SEEDOOR,Scarimson",
            "malware_printable": "Crimson RAT",
            "first_seen_utc": "2025-06-18 16:24:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/PrakkiSathwik/status/1935349973404762509",
            "tags": "APT,APT36,CrimsonRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546339": [
        {
            "ioc_value": "hosts.dynuddns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-18 16:16:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://x.com/skocherhan/status/1935017341735109053",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546335": [
        {
            "ioc_value": "crownmedicals.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spyder_patchwork",
            "malware_alias": null,
            "malware_printable": "Spyder Patchwork",
            "first_seen_utc": "2025-06-18 16:06:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1935323396847583380",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546336": [
        {
            "ioc_value": "popcornstudy.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spyder_patchwork",
            "malware_alias": null,
            "malware_printable": "Spyder Patchwork",
            "first_seen_utc": "2025-06-18 16:06:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1935323396847583380",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546337": [
        {
            "ioc_value": "purpleyh.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spyder_patchwork",
            "malware_alias": null,
            "malware_printable": "Spyder Patchwork",
            "first_seen_utc": "2025-06-18 16:06:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1935323396847583380",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546338": [
        {
            "ioc_value": "redcardboard.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.spyder_patchwork",
            "malware_alias": null,
            "malware_printable": "Spyder Patchwork",
            "first_seen_utc": "2025-06-18 16:06:15",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "https://x.com/500mk500/status/1935323396847583380",
            "tags": "APT,Patchwork",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546299": [
        {
            "ioc_value": "unitedigs.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-06-18 13:12:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/ee3871ce91fa2cc79804f3b8bacd1825a57d6bf84a4c7e98e2d4dae90c403236/",
            "tags": "PhantomStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546297": [
        {
            "ioc_value": "kizitodavina.kozow.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.houdini",
            "malware_alias": "Hworm,Jenxcus,Kognito,Njw0rm,WSHRAT,dinihou,dunihi",
            "malware_printable": "Houdini",
            "first_seen_utc": "2025-06-18 13:09:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/51a0ca305b43bbcf6e738bef66220bf8fb30d11c2b63f501f756e91e98a309d9/",
            "tags": "Houdini,RAT,WSHRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546295": [
        {
            "ioc_value": "mohamed88.work.gd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.houdini",
            "malware_alias": "Hworm,Jenxcus,Kognito,Njw0rm,WSHRAT,dinihou,dunihi",
            "malware_printable": "Houdini",
            "first_seen_utc": "2025-06-18 13:06:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/83f74ad67fd96220155ffcfbeb279aeb1fb562b2f726098527060ac4e9c19788/",
            "tags": "Houdini,RAT,WSHRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546274": [
        {
            "ioc_value": "nupdate0625.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_loader",
            "malware_alias": null,
            "malware_printable": "Unknown Loader",
            "first_seen_utc": "2025-06-18 09:34:13",
            "last_seen_utc": "2025-07-08 15:21:38",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/3a73b2fa5b99bf2c037291bb880bc22a5912b91d244accf48eb28cef8592f908/",
            "tags": "spammed-by-tofsee",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546264": [
        {
            "ioc_value": "cloused-flow.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-06-18 09:32:56",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.esentire.com/blog/dont-get-caught-in-the-headlights-deerstealer-analysis",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1546265": [
        {
            "ioc_value": "debianlist.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-06-18 09:32:56",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.esentire.com/blog/dont-get-caught-in-the-headlights-deerstealer-analysis",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1546266": [
        {
            "ioc_value": "cdnnode-01.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-06-18 09:32:55",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.esentire.com/blog/dont-get-caught-in-the-headlights-deerstealer-analysis",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1546267": [
        {
            "ioc_value": "servicesmesh.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-06-18 09:32:54",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.esentire.com/blog/dont-get-caught-in-the-headlights-deerstealer-analysis",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1546268": [
        {
            "ioc_value": "ncloud-servers.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-06-18 09:32:54",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.esentire.com/blog/dont-get-caught-in-the-headlights-deerstealer-analysis",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1546269": [
        {
            "ioc_value": "brokpolok.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-06-18 09:32:54",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.esentire.com/blog/dont-get-caught-in-the-headlights-deerstealer-analysis",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1546270": [
        {
            "ioc_value": "d-nodes.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-06-18 09:32:53",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.esentire.com/blog/dont-get-caught-in-the-headlights-deerstealer-analysis",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1546271": [
        {
            "ioc_value": "uplink-mirrors.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.hijackloader",
            "malware_alias": "DOILoader,GHOSTPULSE,IDAT Loader,SHADOWLADDER",
            "malware_printable": "HijackLoader",
            "first_seen_utc": "2025-06-18 09:32:53",
            "last_seen_utc": null,
            "confidence_level": 49,
            "reference": "https://www.esentire.com/blog/dont-get-caught-in-the-headlights-deerstealer-analysis",
            "tags": "DeerStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1546235": [
        {
            "ioc_value": "securityhealthsystray.accesscam.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-18 08:02:08",
            "last_seen_utc": "2025-06-28 22:25:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/9265a6e0b26a240f1f8bffddf3b36d0e533919d0c894bd66839a90e351961464/",
            "tags": "AsyncRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546233": [
        {
            "ioc_value": "securityhealthmonitor.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-18 07:58:55",
            "last_seen_utc": "2025-06-28 22:25:39",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/6ecbf71d231e9b9e7459b97c97d94aed467481b5b4f22af288bbaea5945c1af4/",
            "tags": "AsyncRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546230": [
        {
            "ioc_value": "givedem2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-18 07:45:05",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/76109c563e65763646d56f9f2bf49fab8aa24a1d6b1668701a8c30524770088d/",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546229": [
        {
            "ioc_value": "givedem.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-18 07:45:04",
            "last_seen_utc": "2025-06-28 22:26:00",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/76109c563e65763646d56f9f2bf49fab8aa24a1d6b1668701a8c30524770088d/",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546228": [
        {
            "ioc_value": "boyz2346.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-18 07:41:32",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/440a3f9a9981b6b2d6335db45acf2dc3dc78601a7c9137b4f176f3f50d74decf/",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546225": [
        {
            "ioc_value": "updatedrvier.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-18 07:29:46",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c3ba98565b219c4fe9a0bc2a10e6a5624133d92e8eaed9ec0c5e3be7ba2951ee/",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546223": [
        {
            "ioc_value": "actwindowdsdriver.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-18 07:26:42",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/cfdc2ae6a13e3aec697ff5535644d20bad1bae878d39ba2f56af905a8ab039d4/",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546222": [
        {
            "ioc_value": "boss2468.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-18 07:18:45",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/ecb6ae7f7b7ff47e51dd45c251d87f2e6a742e5c5b29c36b37b627701337bb40/",
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546219": [
        {
            "ioc_value": "greatthingsstillhappen.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-18 07:12:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/f5dbafa3a5363368b0f9c88484f5641cb39665475441588a22eb38955ed87700/",
            "tags": "RAT,ResolverRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546218": [
        {
            "ioc_value": "eraqron.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_stealer",
            "malware_alias": null,
            "malware_printable": "Unknown Stealer",
            "first_seen_utc": "2025-06-18 07:04:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/c8bb9407c1443efd0a5637759a5d40fa9acf9ca2a329e2d41eec5ec465c428e1/",
            "tags": "PhantomStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546209": [
        {
            "ioc_value": "9.20.storysaverr.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-18 06:27:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1546204": [
        {
            "ioc_value": "nnnpanel.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-18 06:03:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1546129": [
        {
            "ioc_value": "wepolix.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-18 04:45:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1546128": [
        {
            "ioc_value": "security.fizaregiyard.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-18 04:45:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1546131": [
        {
            "ioc_value": "www.ssatech.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-18 04:45:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/file/963588dae17bebb3065cd76dfafce3959e5c0c97f76ea94a75218d715c3487d7/",
            "tags": "AsyncRAT,C2",
            "anonymous": "0",
            "reporter": "Overkill1984zzz"
        }
    ],
    "1546132": [
        {
            "ioc_value": "www.waillyrx5.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-18 04:45:29",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://www.virustotal.com/gui/file/5cf0a9fcbcedf6bc99b0b774b2e3b3b603973d07d2c3f419e2205f7509c7cb33/",
            "tags": "AsyncRAT,C2",
            "anonymous": "0",
            "reporter": "Overkill1984zzz"
        }
    ],
    "1546197": [
        {
            "ioc_value": "singtelcom.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.doplugs",
            "malware_alias": null,
            "malware_printable": "DOPLUGS",
            "first_seen_utc": "2025-06-18 04:06:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "darkpeony,operation controlplug",
            "anonymous": "0",
            "reporter": "Rony"
        }
    ],
    "1546161": [
        {
            "ioc_value": "ssl.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-18 04:00:43",
            "last_seen_utc": "2025-06-18 04:02:30",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+ssl.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,IST-AS",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1546158": [
        {
            "ioc_value": "mta73.bwcasino.email",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-18 04:00:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/165.22.72.249+mta73.bwcasino.email",
            "tags": "AS14061,C2,censys,DIGITALOCEAN-ASN,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1546159": [
        {
            "ioc_value": "santutxuht.eus",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-18 04:00:36",
            "last_seen_utc": "2025-06-22 04:00:34",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/167.86.110.179+santutxuht.eus",
            "tags": "AS51167,C2,censys,CONTABO,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1546152": [
        {
            "ioc_value": "zoutailian.jlx9.asia",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-18 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/154.219.119.203+zoutailian.jlx9.asia",
            "tags": "AS137899,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1546153": [
        {
            "ioc_value": "ecs-113-44-144-145.compute.hwclouds-dns.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-18 04:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/113.44.144.145+ecs-113-44-144-145.compute.hwclouds-dns.com",
            "tags": "AS55990,C2,censys",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1546143": [
        {
            "ioc_value": "play.accountsgooogle.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-18 00:02:42",
            "last_seen_utc": "2025-06-18 04:00:45",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+play.accountsgooogle.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,Havoc,IST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546141": [
        {
            "ioc_value": "100.56.171.34.bc.googleusercontent.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-18 00:02:41",
            "last_seen_utc": "2025-06-18 04:00:44",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/34.171.56.100+100.56.171.34.bc.googleusercontent.com",
            "tags": "AS396982,C2,censys,GOOGLE-CLOUD-PLATFORM,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546142": [
        {
            "ioc_value": "apis.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-18 00:02:41",
            "last_seen_utc": "2025-06-18 04:00:45",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+apis.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,Havoc,IST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546126": [
        {
            "ioc_value": "michikoak51.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-17 21:38:33",
            "last_seen_utc": "2025-06-28 22:25:58",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/198.55.98.15",
            "tags": "c2,domain,Remcos,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546127": [
        {
            "ioc_value": "michikoa.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-17 21:38:33",
            "last_seen_utc": "2025-06-28 22:25:38",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/198.55.98.15",
            "tags": "c2,domain,Remcos,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546125": [
        {
            "ioc_value": "garden-enable.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-17 21:35:18",
            "last_seen_utc": "2025-06-28 22:25:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250617-xyv8zscl6x",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546124": [
        {
            "ioc_value": "lyrics-ships.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-17 21:34:32",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250617-zcv27s1l17",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546123": [
        {
            "ioc_value": "yellow-humanities.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-17 21:33:45",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250617-zrmdls1nv9",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546105": [
        {
            "ioc_value": "content.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-17 20:02:43",
            "last_seen_utc": "2025-06-18 04:00:44",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+content.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,Havoc,IST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546106": [
        {
            "ioc_value": "myaccount.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-17 20:02:43",
            "last_seen_utc": "2025-06-18 04:00:43",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+myaccount.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,Havoc,IST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546107": [
        {
            "ioc_value": "play.google.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-17 20:02:43",
            "last_seen_utc": "2025-06-18 04:00:44",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+play.google.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,Havoc,IST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546085": [
        {
            "ioc_value": "dgost.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-17 19:49:29",
            "last_seen_utc": "2025-07-01 21:12:02",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/45.141.233.60",
            "tags": "c2,dcrat,domain,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546086": [
        {
            "ioc_value": "dckaws.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-17 19:49:29",
            "last_seen_utc": "2025-07-01 21:12:03",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/45.141.233.60",
            "tags": "c2,dcrat,domain,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546087": [
        {
            "ioc_value": "dcaw.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-17 19:49:29",
            "last_seen_utc": "2025-07-01 21:12:03",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/45.141.233.60",
            "tags": "c2,dcrat,domain,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546088": [
        {
            "ioc_value": "soscop.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-17 19:49:29",
            "last_seen_utc": "2025-06-24 14:41:21",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/45.141.233.60",
            "tags": "c2,dcrat,domain,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546089": [
        {
            "ioc_value": "drgrootp.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-17 19:49:29",
            "last_seen_utc": "2025-06-24 14:41:21",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/45.141.233.60",
            "tags": "c2,dcrat,domain,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546090": [
        {
            "ioc_value": "glost.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-17 19:49:29",
            "last_seen_utc": "2025-06-24 14:41:21",
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/45.141.233.60",
            "tags": "c2,dcrat,domain,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546081": [
        {
            "ioc_value": "envioo20020.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-17 19:47:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/93.115.35.146",
            "tags": "AsyncRAT,c2,domain,RAT,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546082": [
        {
            "ioc_value": "envio25100255.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-17 19:47:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/93.115.35.146",
            "tags": "AsyncRAT,c2,domain,RAT,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546083": [
        {
            "ioc_value": "send9214.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-17 19:47:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/93.115.35.146",
            "tags": "AsyncRAT,c2,domain,RAT,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546084": [
        {
            "ioc_value": "dnse2542.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-17 19:47:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/ip-address/93.115.35.146",
            "tags": "AsyncRAT,c2,domain,RAT,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546080": [
        {
            "ioc_value": "sendiadad.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-17 19:40:10",
            "last_seen_utc": "2025-06-28 22:25:39",
            "confidence_level": 100,
            "reference": "https://tria.ge/250617-j5y2kavk13",
            "tags": "AsyncRAT,c2,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546079": [
        {
            "ioc_value": "bendicionesdios.dynuddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-17 19:39:12",
            "last_seen_utc": "2025-06-28 22:25:38",
            "confidence_level": 100,
            "reference": "https://tria.ge/250617-vmhseasvhv",
            "tags": "AsyncRAT,c2,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546078": [
        {
            "ioc_value": "dgost2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-17 19:38:21",
            "last_seen_utc": "2025-07-01 21:12:02",
            "confidence_level": 100,
            "reference": "https://tria.ge/250617-xv3hwscl4s",
            "tags": "AsyncRAT,c2,domain,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546074": [
        {
            "ioc_value": "exclusionremcoss.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-17 18:52:20",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/exclusionremcoss.duckdns.org",
            "tags": "c2,domain,remcos,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546073": [
        {
            "ioc_value": "respaldo2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-17 18:50:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/respaldo2.duckdns.org",
            "tags": "c2,domain,virustotal,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1546072": [
        {
            "ioc_value": "archives-msgstr.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-17 18:47:27",
            "last_seen_utc": "2025-06-28 22:25:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250617-mgt99abj9w",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545885": [
        {
            "ioc_value": "cpanel.realizr.today",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-17 14:35:29",
            "last_seen_utc": "2025-06-17 15:12:51",
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1545878": [
        {
            "ioc_value": "yff.forupper.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 12:55:38",
            "last_seen_utc": "2025-07-19 11:49:25",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545877": [
        {
            "ioc_value": "asslup.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 12:55:03",
            "last_seen_utc": "2025-07-17 21:48:48",
            "confidence_level": 75,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545857": [
        {
            "ioc_value": "macxapp.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "osx.amos",
            "malware_alias": "Atomic macOS Stealer",
            "malware_printable": "AMOS",
            "first_seen_utc": "2025-06-17 12:11:32",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "solostalking"
        }
    ],
    "1545826": [
        {
            "ioc_value": "9.yubaby.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:30",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545827": [
        {
            "ioc_value": "a6dzlc7fyp7uy.swedencentral.cloudapp.azure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:29",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545828": [
        {
            "ioc_value": "activedirectory-windowsazure.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:29",
            "last_seen_utc": "2025-06-17 10:14:53",
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545830": [
        {
            "ioc_value": "api.lcmeng.fun",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:28",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545829": [
        {
            "ioc_value": "api.burbankskincancercenter.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:27",
            "last_seen_utc": "2025-06-17 10:14:53",
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545831": [
        {
            "ioc_value": "carpoly.ru",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:27",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545832": [
        {
            "ioc_value": "igmp.sc.cmcc.transportesturela.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:26",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545833": [
        {
            "ioc_value": "kf.pinkpp.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:26",
            "last_seen_utc": "2025-06-17 10:14:53",
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545834": [
        {
            "ioc_value": "techsupportconnect.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:26",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545835": [
        {
            "ioc_value": "tv-box-cdn.xiaoyinzhen.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 10:29:25",
            "last_seen_utc": null,
            "confidence_level": 75,
            "reference": "https://intelinsights.substack.com/p/cobalt-on-the-weekends",
            "tags": "cobaltstrike,validin",
            "anonymous": "0",
            "reporter": "orlof_v"
        }
    ],
    "1545803": [
        {
            "ioc_value": "romanovas.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-17 07:09:59",
            "last_seen_utc": "2025-06-28 22:26:12",
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/a1e7b215e1864b59a808e8b63356eca78629563744d6deced84afd55690877c1/",
            "tags": "NjRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545697": [
        {
            "ioc_value": "agent24.space",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-17 06:48:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545695": [
        {
            "ioc_value": "actwindowdsdrivers.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-17 06:42:31",
            "last_seen_utc": "2025-06-28 22:25:59",
            "confidence_level": 100,
            "reference": "https://tria.ge/250617-g5hcpswyfs",
            "tags": "c2,domain,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545694": [
        {
            "ioc_value": "11.130.storysaverr.app",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-17 06:30:41",
            "last_seen_utc": "2025-06-17 15:34:23",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545688": [
        {
            "ioc_value": "JJK1241255325324523.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-17 06:24:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://bazaar.abuse.ch/sample/cf7a24c9f2f9d85cc1ba4a11890087b82e38f39c8d194e808e9e6d82a188d3f0/",
            "tags": "QuasarRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545683": [
        {
            "ioc_value": "redslide13-42748.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-17 06:16:34",
            "last_seen_utc": "2025-06-28 22:26:00",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,remcos",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545682": [
        {
            "ioc_value": "dddf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-17 06:16:19",
            "last_seen_utc": "2025-06-28 22:25:34",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,quasar",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545681": [
        {
            "ioc_value": "hnoo17.no-ip.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-17 06:15:58",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,njrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545680": [
        {
            "ioc_value": "flux.zapto.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-17 06:15:39",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545678": [
        {
            "ioc_value": "almghamrh073.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-17 06:15:02",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545660": [
        {
            "ioc_value": "rfcahelp.us",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-17 05:55:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545659": [
        {
            "ioc_value": "web.gtysx.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-17 05:48:38",
            "last_seen_utc": "2025-06-17 05:48:39",
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545657": [
        {
            "ioc_value": "jrzlive.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-17 05:45:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545658": [
        {
            "ioc_value": "itdcare.help",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown_rat",
            "malware_alias": null,
            "malware_printable": "Unknown RAT",
            "first_seen_utc": "2025-06-17 05:45:11",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ConnectWise,ScreenConnect",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1545408": [
        {
            "ioc_value": "6hms.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-06-17 05:18:40",
            "last_seen_utc": "2025-06-16 17:12:01",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114694154894605201",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1545412": [
        {
            "ioc_value": "sinofreights.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-06-17 05:18:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114694154894605201",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1545417": [
        {
            "ioc_value": "cellinifurniture.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2025-06-17 05:18:35",
            "last_seen_utc": "2025-06-16 21:11:59",
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114694586409119991",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1545590": [
        {
            "ioc_value": "security.fjeareshiedls.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-17 05:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1545591": [
        {
            "ioc_value": "folepfa.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-17 05:18:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1545616": [
        {
            "ioc_value": "host-5-58-172-98.bitternet.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2025-06-17 05:18:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/5.58.172.98+host-5-58-172-98.bitternet.ua",
            "tags": "AS16223,C2,censys,COLUMBUS-PE-TE",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1545609": [
        {
            "ioc_value": "lh3.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-17 00:02:37",
            "last_seen_utc": "2025-06-17 04:01:20",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+lh3.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,Havoc,IST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545610": [
        {
            "ioc_value": "port-storage.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-17 00:02:37",
            "last_seen_utc": "2025-06-17 04:01:21",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/47.236.177.123+port-storage.ddns.net",
            "tags": "ALIBABA-CN-NET,AS45102,C2,censys,Havoc",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545608": [
        {
            "ioc_value": "play.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.havoc",
            "malware_alias": "Havokiz",
            "malware_printable": "Havoc",
            "first_seen_utc": "2025-06-17 00:02:36",
            "last_seen_utc": "2025-06-17 04:01:17",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/185.25.50.107+play.accountsgoogle.loginlivemiscrosoftonline.duckdns.org",
            "tags": "AS61272,C2,censys,Havoc,IST-AS",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545577": [
        {
            "ioc_value": "gasfeesethereum.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-16 20:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545578": [
        {
            "ioc_value": "idriss.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-16 20:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545579": [
        {
            "ioc_value": "memecor.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-16 20:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545580": [
        {
            "ioc_value": "testnetmonad.icu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-16 20:05:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545576": [
        {
            "ioc_value": "jjnfs-61366.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-16 20:04:54",
            "last_seen_utc": "2025-06-28 22:25:49",
            "confidence_level": 100,
            "reference": "https://tria.ge/250616-vqm7asel6z",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545568": [
        {
            "ioc_value": "mail.qaz.tw",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-16 20:01:56",
            "last_seen_utc": "2025-06-30 00:01:06",
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/114.34.241.92+mail.qaz.tw",
            "tags": "AS3462,C2,censys,HINET,PenTera",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545566": [
        {
            "ioc_value": "bavmv.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-16 19:58:26",
            "last_seen_utc": "2025-09-10 08:31:28",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,lumma",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545555": [
        {
            "ioc_value": "www.ui-qskp.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545556": [
        {
            "ioc_value": "www.umanrightshelp.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545557": [
        {
            "ioc_value": "www.umansgg.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545558": [
        {
            "ioc_value": "www.utopia.contact",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545559": [
        {
            "ioc_value": "www.velinhasnoreino.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545560": [
        {
            "ioc_value": "www.vgdns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545561": [
        {
            "ioc_value": "www.wjlmv.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545562": [
        {
            "ioc_value": "www.yperliquid.credit",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545563": [
        {
            "ioc_value": "www.zlnrln.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545564": [
        {
            "ioc_value": "www.zmcx7gpt.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:48",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545537": [
        {
            "ioc_value": "www.omprar-lixadeira.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545538": [
        {
            "ioc_value": "www.ov-hzwu.live",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545539": [
        {
            "ioc_value": "www.ov-payow.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545540": [
        {
            "ioc_value": "www.pro-gu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545541": [
        {
            "ioc_value": "www.pruceandstone.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545542": [
        {
            "ioc_value": "www.psdtxb.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545543": [
        {
            "ioc_value": "www.rearypoetry.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545544": [
        {
            "ioc_value": "www.reluk.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545545": [
        {
            "ioc_value": "www.risttechfled.cloud",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545546": [
        {
            "ioc_value": "www.rugtonow.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545547": [
        {
            "ioc_value": "www.ryptopronetworkcom.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545548": [
        {
            "ioc_value": "www.seav.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545549": [
        {
            "ioc_value": "www.sychological.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545550": [
        {
            "ioc_value": "www.tamilmv.win",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545551": [
        {
            "ioc_value": "www.teyrpower.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545552": [
        {
            "ioc_value": "www.trener.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545553": [
        {
            "ioc_value": "www.tudiolegalebarbato.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545554": [
        {
            "ioc_value": "www.ubaopenpay.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:47",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545519": [
        {
            "ioc_value": "www.endo4d.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545520": [
        {
            "ioc_value": "www.enseicoder.sbs",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545521": [
        {
            "ioc_value": "www.eyboardnexus.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545522": [
        {
            "ioc_value": "www.feve.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545523": [
        {
            "ioc_value": "www.gzd.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545524": [
        {
            "ioc_value": "www.h2ct0.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545525": [
        {
            "ioc_value": "www.hzgtd75d3f9fae-98t5vy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545526": [
        {
            "ioc_value": "www.ilviunmul.pro",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545527": [
        {
            "ioc_value": "www.inlife.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545528": [
        {
            "ioc_value": "www.ireplanr.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545529": [
        {
            "ioc_value": "www.juiox.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545530": [
        {
            "ioc_value": "www.lbase.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545531": [
        {
            "ioc_value": "www.lobalprime.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545532": [
        {
            "ioc_value": "www.lon.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545533": [
        {
            "ioc_value": "www.m29c.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545534": [
        {
            "ioc_value": "www.mfolio.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545535": [
        {
            "ioc_value": "www.nkaraharun1.store",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545536": [
        {
            "ioc_value": "www.ogarclean.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:46",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545502": [
        {
            "ioc_value": "www.55tg.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545503": [
        {
            "ioc_value": "www.73ha.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545504": [
        {
            "ioc_value": "www.76av124cg.buzz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545505": [
        {
            "ioc_value": "www.7vin.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545506": [
        {
            "ioc_value": "www.88825.vip",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545507": [
        {
            "ioc_value": "www.8qp008.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545508": [
        {
            "ioc_value": "www.a866.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545509": [
        {
            "ioc_value": "www.aitresurveyors.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545510": [
        {
            "ioc_value": "www.aragonglobalbrandsteam.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545511": [
        {
            "ioc_value": "www.aseltine.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545512": [
        {
            "ioc_value": "www.ast30.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545513": [
        {
            "ioc_value": "www.bikt.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545514": [
        {
            "ioc_value": "www.bramsdeluxedetailing.services",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545515": [
        {
            "ioc_value": "www.chemarium.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545516": [
        {
            "ioc_value": "www.ebmailexprto.click",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545517": [
        {
            "ioc_value": "www.eepbrainreorienting.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545518": [
        {
            "ioc_value": "www.ender.plus",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:45",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545500": [
        {
            "ioc_value": "www.1545.one",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545501": [
        {
            "ioc_value": "www.46wu.top",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.formbook",
            "malware_alias": "win.xloader",
            "malware_printable": "Formbook",
            "first_seen_utc": "2025-06-16 19:56:44",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,formbook",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545433": [
        {
            "ioc_value": "dcupdate.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-16 19:55:55",
            "last_seen_utc": "2025-06-28 22:25:38",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545434": [
        {
            "ioc_value": "jksban.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2025-06-16 19:55:55",
            "last_seen_utc": "2025-06-28 22:25:39",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,dcrat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545432": [
        {
            "ioc_value": "atom1234.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.darkcomet",
            "malware_alias": "Breut,Fynloski,klovbot",
            "malware_printable": "DarkComet",
            "first_seen_utc": "2025-06-16 19:55:36",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,darkcomet",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545430": [
        {
            "ioc_value": "picemo1569-41439.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-16 19:54:53",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "asyncrat,c2",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545406": [
        {
            "ioc_value": "gowanow189-20805.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-16 17:07:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250616-qr6b2sfm51",
            "tags": "AsyncRAT,c2,domain",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545405": [
        {
            "ioc_value": "income-suggests.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-16 17:02:37",
            "last_seen_utc": "2025-06-28 22:25:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-3baxesskx9",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545404": [
        {
            "ioc_value": "mhzlhtools77-42857.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-16 17:01:58",
            "last_seen_utc": "2025-06-28 22:25:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250616-aagdlasl17",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545402": [
        {
            "ioc_value": "loans-holding.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-16 16:58:55",
            "last_seen_utc": "2025-06-28 22:25:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250616-cz16eawyhs",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545397": [
        {
            "ioc_value": "francia2028.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-16 16:50:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://www.virustotal.com/gui/domain/francia2028.duckdns.org",
            "tags": "AsyncRAT,c2,domain,rat,virustotal",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545396": [
        {
            "ioc_value": "purelogs2025.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-16 16:48:30",
            "last_seen_utc": "2025-06-28 22:25:51",
            "confidence_level": 100,
            "reference": "https://tria.ge/250616-rvnf3scq5x",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545395": [
        {
            "ioc_value": "lifehod833-44653.portmap.host",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-16 16:47:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250616-tdx1asgj9s",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545375": [
        {
            "ioc_value": "lqsword.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-06-16 16:46:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114693676333638749",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1545378": [
        {
            "ioc_value": "startupcheetah.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "win.netsupportmanager_rat",
            "malware_alias": "NetSupport",
            "malware_printable": "NetSupportManager RAT",
            "first_seen_utc": "2025-06-16 16:46:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://infosec.exchange/@monitorsg/114693676333638749",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1545361": [
        {
            "ioc_value": "specification.saferunion.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2025-06-16 13:20:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "fakeupdates,SocGholish",
            "anonymous": "0",
            "reporter": "pancak3lullz"
        }
    ],
    "1545363": [
        {
            "ioc_value": "held-lobby.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-16 13:16:53",
            "last_seen_utc": "2025-06-28 22:25:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250616-qbdbbsxr19",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545332": [
        {
            "ioc_value": "long-importantly.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545333": [
        {
            "ioc_value": "pacific-astronomy.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545334": [
        {
            "ioc_value": "dewaw64518-23532.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545335": [
        {
            "ioc_value": "africa-manufacturing.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545336": [
        {
            "ioc_value": "brostoplookingformyc2-21003.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545337": [
        {
            "ioc_value": "darkarmteam-41484.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545338": [
        {
            "ioc_value": "b-proper.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545339": [
        {
            "ioc_value": "mexico-shopper.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:48",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545318": [
        {
            "ioc_value": "harunet.airdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545319": [
        {
            "ioc_value": "pulsar-tcp.at.remote.it",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545320": [
        {
            "ioc_value": "githubrdp-22467.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545321": [
        {
            "ioc_value": "engineering-ebay.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545322": [
        {
            "ioc_value": "fully-expensive.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545323": [
        {
            "ioc_value": "r.aartzz.pp.ua",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545324": [
        {
            "ioc_value": "gta5rppppp-61894.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545325": [
        {
            "ioc_value": "lines-flags.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545326": [
        {
            "ioc_value": "accommodation-specialist.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545327": [
        {
            "ioc_value": "his-varied.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545328": [
        {
            "ioc_value": "repair-oscar.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545329": [
        {
            "ioc_value": "specter699-31351.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545330": [
        {
            "ioc_value": "enans-33358.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545331": [
        {
            "ioc_value": "dugites-44896.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:47",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545307": [
        {
            "ioc_value": "ilikefemboys1234-38334.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545308": [
        {
            "ioc_value": "jamierose-42682.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545309": [
        {
            "ioc_value": "associated-bk.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545310": [
        {
            "ioc_value": "ckfejrnet.airdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545311": [
        {
            "ioc_value": "rule-covers.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545312": [
        {
            "ioc_value": "imhimlmai-61691.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545313": [
        {
            "ioc_value": "includes-whose.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545314": [
        {
            "ioc_value": "svhost.mine.nu",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545315": [
        {
            "ioc_value": "if-definition.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545316": [
        {
            "ioc_value": "iliketacos12341-30048.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545317": [
        {
            "ioc_value": "big-expressed.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-16 09:35:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": null,
            "tags": "16June2025,iocbottest",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1545268": [
        {
            "ioc_value": "cd-checking.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-16 09:09:00",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,xworm",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545265": [
        {
            "ioc_value": "hackergtx-23464.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.revenge_rat",
            "malware_alias": "Revetrat",
            "malware_printable": "Revenge RAT",
            "first_seen_utc": "2025-06-16 09:07:20",
            "last_seen_utc": "2025-06-28 22:25:47",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,revengerat",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545261": [
        {
            "ioc_value": "qwzarterlol.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2025-06-16 09:06:43",
            "last_seen_utc": "2025-06-28 22:26:16",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,nanocore",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545259": [
        {
            "ioc_value": "izumisv1.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-16 09:06:28",
            "last_seen_utc": null,
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545260": [
        {
            "ioc_value": "mdnditly.gotdns.ch",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "elf.mirai",
            "malware_alias": "Katana",
            "malware_printable": "Mirai",
            "first_seen_utc": "2025-06-16 09:06:28",
            "last_seen_utc": "2025-06-28 22:26:30",
            "confidence_level": 50,
            "reference": "",
            "tags": "c2,mirai",
            "anonymous": "0",
            "reporter": "juroots"
        }
    ],
    "1545209": [
        {
            "ioc_value": "19.171.learnblockchain101.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2025-06-16 06:49:20",
            "last_seen_utc": "2025-06-30 15:10:22",
            "confidence_level": 100,
            "reference": "",
            "tags": "Vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1545166": [
        {
            "ioc_value": "security.cleodgiflaoer.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-16 06:19:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1545167": [
        {
            "ioc_value": "emeoxm.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-16 06:19:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "",
            "tags": "ClickFix,CoreSecThree",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1545191": [
        {
            "ioc_value": "ec2-63-33-82-34.eu-west-1.compute.amazonaws.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-16 06:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/63.33.82.34+ec2-63-33-82-34.eu-west-1.compute.amazonaws.com",
            "tags": "AMAZON-02,AS16509,C2,censys,Mythic",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1545201": [
        {
            "ioc_value": "down.ponjs.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2025-06-16 06:19:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://search.censys.io/hosts/8.218.222.240+down.ponjs.com",
            "tags": "AS45102,censys,EvilGoPhish,Phishing",
            "anonymous": "0",
            "reporter": "dyingbreeds_"
        }
    ],
    "1545163": [
        {
            "ioc_value": "stores-replace.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-15 21:12:54",
            "last_seen_utc": "2025-06-16 09:35:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250614-kv4dzagp3w",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545162": [
        {
            "ioc_value": "alexkasa-53195.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-15 21:11:51",
            "last_seen_utc": "2025-06-16 09:35:46",
            "confidence_level": 100,
            "reference": "https://tria.ge/250614-p99azshn3v",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545161": [
        {
            "ioc_value": "gazaru-21459.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-15 21:10:37",
            "last_seen_utc": "2025-06-16 09:35:47",
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-njjf7stmt5",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545159": [
        {
            "ioc_value": "anonam39-41248.portmap.io",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-15 21:07:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-xpbg8agq3s",
            "tags": "c2,domain,Quasar,RAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545157": [
        {
            "ioc_value": "xikhudog2.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2025-06-15 21:04:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-zhg3jaspv9",
            "tags": "c2,domain,Quasar,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545146": [
        {
            "ioc_value": "fernandolopez105040.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-15 19:10:47",
            "last_seen_utc": "2025-06-28 22:25:58",
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-l6wzpsspv9",
            "tags": "c2,domain,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545143": [
        {
            "ioc_value": "tibiaserver.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2025-06-15 19:01:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-pxjjsstqw6",
            "tags": "c2,domain,NjRAT",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545142": [
        {
            "ioc_value": "odogwuvisual123.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-15 19:00:07",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-pxjjsstqw6",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545141": [
        {
            "ioc_value": "teamfavour222.ddns.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2025-06-15 19:00:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-pxjjsstqw6",
            "tags": "c2,domain,rat,remcos",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545140": [
        {
            "ioc_value": "otherwise-puzzle.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2025-06-15 18:59:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-pxjjsstqw6",
            "tags": "AsyncRAT,c2,domain,rat",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545138": [
        {
            "ioc_value": "council-its.gl.at.ply.gg",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2025-06-15 18:57:02",
            "last_seen_utc": "2025-06-28 22:25:48",
            "confidence_level": 100,
            "reference": "https://tria.ge/250615-p2agpadk2w",
            "tags": "c2,domain,xworm",
            "anonymous": "0",
            "reporter": "DonPasci"
        }
    ],
    "1545124": [
        {
            "ioc_value": "greqjfu.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-15 14:40:43",
            "last_seen_utc": "2025-07-14 08:00:50",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1545125": [
        {
            "ioc_value": "firddy.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-15 14:40:43",
            "last_seen_utc": "2025-06-26 13:24:55",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1545121": [
        {
            "ioc_value": "uncombsguq.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-15 14:40:42",
            "last_seen_utc": "2025-07-06 15:10:18",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1545122": [
        {
            "ioc_value": "sushst.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-15 14:40:42",
            "last_seen_utc": "2025-06-21 13:27:27",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1545123": [
        {
            "ioc_value": "shaeb.xyz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2025-06-15 14:40:42",
            "last_seen_utc": "2025-06-26 13:24:56",
            "confidence_level": 75,
            "reference": "",
            "tags": "Domain,Lumma,Lumma Stealer,Stealer",
            "anonymous": "0",
            "reporter": "RacWatchin8872"
        }
    ],
    "1545120": [
        {
            "ioc_value": "gisqe.xyz",
            "ioc_type": "domain",
            "